chore: 前端资源更新与后端权限逻辑重构

1. 前端：更新静态资源哈希版本，替换旧版chunk与diagram文件
2. 后端：重构权限审批逻辑，移除旧的缓存授权机制，改用magic word方式处理权限恢复
3. 测试：更新测试用例中的校验关键词
4. 配置：调整模型温度参数，更新go依赖与本地替换配置
5. 文档：精简产品经理与代码评审助手的角色文档

Author: DotNetAge

REFACTORING.md

@@ -25,7 +25,7 @@ require (
 require (
 	github.com/DotNetAge/gochat v0.2.7
 	github.com/DotNetAge/gograph v0.2.6
-	github.com/DotNetAge/goharness v0.2.5
+	github.com/DotNetAge/goharness v0.2.6
 	github.com/DotNetAge/gorag/v2 v2.0.3
 	github.com/creack/pty v1.1.24
 	go.etcd.io/bbolt v1.4.3
@@ -140,4 +140,4 @@ require (
 
 replace github.com/coder/hnsw => ./third_party/hnsw
 
-replace github.com/DotNetAge/goharness => ../goharness
+// replace github.com/DotNetAge/goharness => ../goharness

go.mod

@@ -15,6 +15,8 @@ github.com/DotNetAge/gochat v0.2.7 h1:W06T9dRx46QlWkFDlpRSGtpdgNb8m9meTPxycRX/xZ
 github.com/DotNetAge/gochat v0.2.7/go.mod h1:w7m36rMZoDwmReJNTLUGHhok6DSqnIidg9wFKwYM1dM=
 github.com/DotNetAge/gograph v0.2.6 h1:LhYERtYTPaWXvbBy9bO/6XGmYTW/OZGXQ+zyfycsexo=
 github.com/DotNetAge/gograph v0.2.6/go.mod h1:Ia2wvbkpdJvFJEZ1vw+IklbhNbWjPli2dnU21jbmy7I=
+github.com/DotNetAge/goharness v0.2.6 h1:WNaMfX8Hk9JZ8LUxyAtC9X/pwWhWHX6guRsSdS0NId8=
+github.com/DotNetAge/goharness v0.2.6/go.mod h1:2+Ze4Att5hP3oRR9/5Rqv506hr38G5qwaWQz6ChOu8c=
 github.com/DotNetAge/gorag/v2 v2.0.3 h1:utCl5dKBoMQPkqUYDS1xS5S46gW4tR/L58thEhYNuzg=
 github.com/DotNetAge/gorag/v2 v2.0.3/go.mod h1:K8YAydeJR41JMY59xrzgMNDKRHVg3cwB2pYwJSwVjbE=
 github.com/DotNetAge/gort v0.1.4 h1:nUZdy3cN3Kif21GWIYkxlIS/iFr62eN5boBmCzmI3xw=

go.sum

@@ -95,10 +95,6 @@ type rootModel struct {
 	rpc          *daemonRPCClient
 	rpcConnected bool
 
-	// localGrantCache stores granted permissions for the current session (non-RPC only).
-	// Used by WithGrantCache to allow non-blocking permission resumption in local mode.
-	localGrantCache map[string]map[string]bool
-
 	// currentSessionID tracks the active session ID used in RPC messages.
 	currentSessionID string
 }
@@ -1024,7 +1020,6 @@ func (m *rootModel) Update(e tea.Msg) (tea.Model, tea.Cmd) {
 
 	case clientmsg.ChoiceSelectedMsg:
 		m.statusBar.CurrentState = i18n.T("client.status.idle")
-		toolName := m.permBar.ToolName
 		m.permBar = permission.PermissionBar{}
 
 		if msg.Index < 0 {
@@ -1033,30 +1028,27 @@ func (m *rootModel) Update(e tea.Msg) (tea.Model, tea.Cmd) {
 		}
 
 		if msg.Index == permission.PermissionAllow {
+			// Permission resumption is now driven entirely by the
+			// PermissionAllow / PermissionDeny magic words. The runtime
+			// intercepts the magic word, drains session.PendingPermission,
+			// and runs (Allow) or denies (Deny) the tool.
+			//
+			// The legacy non-blocking "store-then-resend" flow (which relied
+			// on a server-side GrantCache) has been removed. We keep the
+			// resend step so the LLM gets a fresh turn to call the tool
+			// again with the magic word now in flight as a user message —
+			// the runtime will resolve it before re-running the tool.
 			if m.rpcConnected {
-				// RPC path: call execution.resume to store grant in daemon cache,
-				// then resend last user message to re-enter the LLM loop.
-				if m.currentSessionID != "" && toolName != "" {
-					go func() {
-						_, _ = m.rpc.client.Call(context.Background(), "execution.resume", map[string]any{
-							"session_id": m.currentSessionID,
-							"tool_name":  toolName,
-						})
-					}()
-					// Resend last user message silently.
-					if lastMsg := m.getLastUserMessage(); lastMsg != "" {
-						m.rpcSendMessage(lastMsg)
-					}
+				// RPC path: resend the last user message. The user message
+				// should already carry the PermissionAllow magic word
+				// (set by the chat store when the user clicked Approve).
+				if lastMsg := m.getLastUserMessage(); lastMsg != "" {
+					m.rpcSendMessage(lastMsg)
 				}
 			} else {
-				// Local path: store in local grant cache, then resend.
-				if m.localGrantCache == nil {
-					m.localGrantCache = make(map[string]map[string]bool)
-				}
-				if m.localGrantCache[m.currentSessionID] == nil {
-					m.localGrantCache[m.currentSessionID] = make(map[string]bool)
-				}
-				m.localGrantCache[m.currentSessionID][toolName] = true
+				// Local path: resend last user message through the
+				// program. The user message carries the PermissionAllow
+				// magic word that the runtime intercepts.
 				if lastMsg := m.getLastUserMessage(); lastMsg != "" {
 					m.program.Send(clientmsg.UserSendMsg{Text: lastMsg})
 				}
@@ -1290,14 +1282,13 @@ func (m *rootModel) handleSend(e clientmsg.UserSendMsg) (tea.Model, tea.Cmd) {
 				TokensUsed: tokenUsage,
 			})
 		})
-		// Set up local grant cache for non-blocking permission resumption.
-		rt.WithGrantCache(func(sessionID, toolName string) bool {
-			if m.localGrantCache == nil {
-				return false
-			}
-			tools, ok := m.localGrantCache[sessionID]
-			return ok && tools[toolName]
-		})
+		// NOTE: Old WithGrantCache / localGrantCache non-blocking permission
+		// flow has been removed. Permission resumption now flows through
+		// the PermissionAllow / PermissionDeny magic words (see
+		// agents.resolvePermissionMagicWord). The runtime intercepts the
+		// magic word before it reaches the LLM, drains
+		// session.PendingPermission, and runs the tool (Allow) or appends
+		// a "Permission Denied" result (Deny).
 
 		ask.OnAskUserPending(func(d events.AskUserPendingData) {
 			m.pendingAskUserData = &d

internal/client/client.go

@@ -837,11 +837,12 @@ func (a *App) IsModelAvailable(name ...string) bool {
 }
 
 func BuildDelegationGuidance() string {
-	return `## Delegation
-When a task is outside your expertise, choose one path:
+	return `## Execution
+Pick one path:
 
-- **Know who handles it** → call **SubAgent** tool directly (agent_name + task), then **CollectResults**
-- **Don't know who** → load **find-experts** skill first (discovers experts, then delegates via same workflow)`
+- **Within your remit, multiple steps** → decompose with task tools
+- **Outside your remit, single expert** → delegate to the right expert
+- **Cross-domain collaboration** → form a team and delegate to an expert panel`
 }
 
 func (a *App) SwitchSession(sessionID string) (*session.SessionInfo, error) {

internal/core/app.go

@@ -259,8 +259,8 @@ func TestBuildDelegationGuidance(t *testing.T) {
 	if guidance == "" {
 		t.Error("BuildDelegationGuidance should not return empty")
 	}
-	if !contains(guidance, "SubAgent") {
-		t.Error("BuildDelegationGuidance should mention SubAgent")
+	if !contains(guidance, "Execution") {
+		t.Error("BuildDelegationGuidance should mention Execution")
 	}
 }