sync the project from upstream in 0516

.github/workflows/ci.yml

@@ -86,7 +86,8 @@ jobs:
 
       - uses: swatinem/rust-cache@v2
         with:
-          shared-key: "ci-check-${{ runner.os }}"
+          shared-key: "ci-check-v2-${{ runner.os }}-no-cargo-bin-v1"
+          cache-bin: false
 
       - name: Check compilation
         run: cargo check --workspace --exclude bitfun-cli

.github/workflows/desktop-package.yml

@@ -81,6 +81,11 @@ jobs:
     needs: prepare
     env:
       NODE_OPTIONS: --max-old-space-size=6144
+      BITFUN_ENABLE_UPDATER_ARTIFACTS: ${{ needs.prepare.outputs.upload_to_release }}
+      TAURI_UPDATER_ENDPOINT: https://github.com/GCWing/BitFun/releases/latest/download/latest.json
+      TAURI_UPDATER_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
+      TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+      TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
 
     strategy:
       fail-fast: false
@@ -105,7 +110,16 @@ jobs:
           - os: windows-latest
             name: windows-x64
             target: x86_64-pc-windows-msvc
-            build_command: pnpm run installer:build
+            build_command: |
+              $ErrorActionPreference = 'Stop'
+              pnpm run desktop:build:nsis --target x86_64-pc-windows-msvc --verbose
+              if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+              $desktopExe = "target/x86_64-pc-windows-msvc/release/bitfun-desktop.exe"
+              if (-not (Test-Path $desktopExe)) {
+                throw "Desktop executable was not found after NSIS build: $desktopExe"
+              }
+              pnpm run installer:build:only
+              if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
     steps:
       - name: Checkout
@@ -118,6 +132,29 @@ jobs:
         shell: pwsh
         run: ./scripts/ci/setup-openssl-windows.ps1
 
+      - name: Install NSIS (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          choco install nsis -y --no-progress
+          $nsisRoot = "${env:ProgramFiles(x86)}\NSIS"
+          $nsisBin = "${env:ProgramFiles(x86)}\NSIS\Bin"
+          if (Test-Path $nsisRoot) {
+            Add-Content $env:GITHUB_PATH $nsisRoot
+          }
+          if (Test-Path $nsisBin) {
+            Add-Content $env:GITHUB_PATH $nsisBin
+          }
+
+      - name: Verify NSIS (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          where.exe makensis
+          makensis /VERSION
+
       - name: Install Linux system dependencies (Tauri bundler)
         if: runner.os == 'Linux'
         shell: bash
@@ -170,7 +207,8 @@ jobs:
       - name: Cache Rust build
         uses: swatinem/rust-cache@v2
         with:
-          shared-key: "package-${{ matrix.platform.name }}"
+          shared-key: "package-v2-${{ matrix.platform.name }}"
+          cache-bin: false
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -198,8 +236,13 @@ jobs:
     needs: [prepare, package]
     if: needs.prepare.outputs.upload_to_release == 'true'
     runs-on: ubuntu-latest
+    env:
+      REQUIRED_UPDATER_PLATFORMS: windows-x86_64,darwin-x86_64,darwin-aarch64,linux-x86_64,linux-aarch64
 
     steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
       - name: Download bundled artifacts
         uses: actions/download-artifact@v4
         with:
@@ -212,14 +255,51 @@ jobs:
           echo "Release assets:"
           find release-assets -type f | sort
 
+      - name: Collect updater assets
+        run: |
+          node scripts/collect-tauri-updater-assets.mjs \
+            --assets-dir release-assets \
+            --version "${{ needs.prepare.outputs.version }}" \
+            --out-dir release-updater-assets \
+            --required-platforms "${REQUIRED_UPDATER_PLATFORMS}"
+
+      - name: Generate updater manifest
+        run: |
+          node scripts/generate-tauri-latest-json.mjs \
+            --assets-dir release-updater-assets \
+            --version "${{ needs.prepare.outputs.version }}" \
+            --tag "${{ needs.prepare.outputs.release_tag }}" \
+            --repo "GCWing/BitFun" \
+            --out release-updater-assets/latest.json \
+            --required-platforms "${REQUIRED_UPDATER_PLATFORMS}"
+
+      - name: Verify updater manifest
+        run: |
+          node scripts/verify-tauri-latest-json.mjs \
+            --manifest release-updater-assets/latest.json \
+            --version "${{ needs.prepare.outputs.version }}" \
+            --required-platforms "${REQUIRED_UPDATER_PLATFORMS}"
+
       - name: Upload to release
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ needs.prepare.outputs.release_tag }}
           files: |
+            release-updater-assets/*
             release-assets/**/*.AppImage
             release-assets/**/*.deb
             release-assets/**/*.dmg
             release-assets/**/*.rpm
             release-assets/**/*bitfun-installer.exe
           fail_on_unmatched_files: true
+
+      - name: Verify published updater manifest
+        run: |
+          curl -fsSL --retry 5 --retry-delay 3 \
+            "https://github.com/GCWing/BitFun/releases/download/${{ needs.prepare.outputs.release_tag }}/latest.json" \
+            -o latest.published.json
+          node scripts/verify-tauri-latest-json.mjs \
+            --manifest latest.published.json \
+            --version "${{ needs.prepare.outputs.version }}" \
+            --required-platforms "${REQUIRED_UPDATER_PLATFORMS}" \
+            --check-urls true

.github/workflows/nightly.yml

@@ -153,7 +153,8 @@ jobs:
       - name: Cache Rust build
         uses: swatinem/rust-cache@v2
         with:
-          shared-key: "nightly-${{ matrix.platform.name }}"
+          shared-key: "nightly-v2-${{ matrix.platform.name }}"
+          cache-bin: false
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile

.gitignore

@@ -44,6 +44,9 @@ apps/desktop/gen/
 src/apps/desktop/gen/
 src-tauri/gen/
 
+# Updater signing private key (never commit; pubkey is in tauri.conf.json)
+src/apps/desktop/.tauri/*.key
+
 # Editor directories and files
 .vscode/*
 !.vscode/extensions.json

AGENTS-CN.md

@@ -17,6 +17,9 @@ BitFun 是一个由 Rust workspace 与共享 React 前端组成的项目。
 | 模块 | 路径 | Agent 文档 |
 |---|---|---|
 | Core（产品逻辑） | `src/crates/core` | [AGENTS.md](src/crates/core/AGENTS.md) |
+| 已拆出的 core 支撑 crate | `src/crates/{core-types,agent-stream,runtime-ports,terminal,tool-runtime}` | （使用 core 指南） |
+| Core owner crate | `src/crates/{services-core,services-integrations,agent-tools,tool-packs}` | （使用 core 指南 + 拆解护栏） |
+| 产品领域 crate | `src/crates/product-domains` | [AGENTS.md](src/crates/product-domains/AGENTS.md) |
 | Transport 适配层 | `src/crates/transport` | （使用 core 指南） |
 | API layer | `src/crates/api-layer` | （使用 core 指南） |
 | AI adapters | `src/crates/ai-adapters` | [AGENTS.md](src/crates/ai-adapters/AGENTS.md) |
@@ -94,8 +97,38 @@ await api.invoke('your_command', { request: { ... } });
 - 桌面端专属集成应放在 `src/apps/desktop`，再通过 transport / API layer 回流到共享逻辑。
 - 在共享 core 中避免使用 `tauri::AppHandle` 等宿主 API；优先使用 `bitfun_events::EventEmitter` 等共享抽象。
 
+### 远程兼容
+
+- 新增功能时，从一开始就要考虑远程工作区和远程控制同步适配。只支持本地的行为很容易让远程场景功能缺失。
+- 如果某个功能无法合理支持远程工作区，必须做能力屏蔽，或展示明确的不支持提示，不能让它以通用错误的形式失败。
+
+### Agent loop 行为
+
+- 不要把硬编码限制或模式判断作为处理 agent loop 循环问题的第一反应，例如仅按字符串或次数阻止重复工具调用。
+- 过多硬编码会把 agent loop 变成脆弱的 workflow。应先定位根因：工具行为、模型交互、会话上下文封装、prompt/tool schema 设计，或状态同步问题。
+
 ## 架构
 
+### Core 拆解护栏
+
+任何 `bitfun-core` 拆解、feature 边界、依赖边界或 Rust 构建提速重构，
+都必须先阅读
+[`docs/architecture/core-decomposition.md`](docs/architecture/core-decomposition.md)。
+该文档定义产品行为不变量、crate 归属目标、禁止依赖方向、feature 安全规则和里程碑验证门禁。
+
+### Tool 归属护栏
+
+- `src/crates/agent-tools` 拥有轻量 tool contract，以及 generic registry / dynamic-provider container。
+- `src/crates/core/src/agentic/tools` 当前负责产品工具组装、`dyn Tool` 适配、snapshot decoration、tool exposure / manifest resolution，以及按需工具说明发现（`GetToolSpec`）。
+- `ToolUseContext` 与具体工具实现继续留在 core，直到有已评审的 port/provider 设计和等价测试。
+- Tool 迁移必须保持 expanded/collapsed exposure、prompt 可见 manifest、`ToolUseContext.unlocked_collapsed_tools`，以及 desktop/MCP/ACP tool catalog 行为等价。
+
+### DeepReview 护栏
+
+Deep Review / 代码审核团队横跨 core runtime 与 Web UI。target resolution 与
+manifest construction 保持在前端；policy validation、queue/retry state 和
+report enrichment 保持在 shared core。
+
 ### 后端链路
 
 大多数功能建议按这个顺序追踪：
@@ -133,7 +166,7 @@ SessionManager → Session → DialogTurn → ModelRound
 | `core`、`transport`、`api-layer` 或共享服务中的 Rust 逻辑 | `cargo check --workspace && cargo test --workspace` |
 | 桌面端集成、Tauri API、browser/computer-use 或桌面专属行为 | `cargo check -p bitfun-desktop && cargo test -p bitfun-desktop` |
 | 被桌面端 smoke/functional 流覆盖的行为 | `cargo build -p bitfun-desktop` 后运行最接近的 E2E spec，或 `pnpm run e2e:test:l0` |
-| `src/crates/ai-adapters` | 运行上面相关 Rust 检查，**并且**运行 `src/crates/core/tests` 中的 stream integration tests |
+| `src/crates/ai-adapters` | 运行上面相关 Rust 检查，**并且**运行 `cargo test -p bitfun-agent-stream` 验证 stream contract |
 | 安装器应用 | `pnpm run installer:build` |
 
 ## 先看哪里
@@ -142,6 +175,7 @@ SessionManager → Session → DialogTurn → ModelRound
 |---|---|
 | Agent mode | `src/crates/core/src/agentic/agents/`、`src/crates/core/src/agentic/agents/prompts/`、`src/web-ui/src/locales/*/scenes/agents.json` |
 | Deep Review / 代码审核团队 | `src/crates/core/src/agentic/deep_review_policy.rs`、`src/crates/core/src/agentic/agents/deep_review_agent.rs`、`src/crates/core/src/agentic/tools/implementations/{task_tool.rs,code_review_tool.rs}`、`src/web-ui/src/shared/services/reviewTeamService.ts`、`src/web-ui/src/flow_chat/services/DeepReviewService.ts`、`src/web-ui/src/app/scenes/agents/components/ReviewTeamPage.tsx` |
+| 会话用量报告（`/usage`） | `src/crates/core/src/service/session_usage/`、`src/web-ui/src/flow_chat/components/usage/`、`src/web-ui/src/locales/*/flow-chat.json` |
 | Tool | `src/crates/core/src/agentic/tools/implementations/`、`src/crates/core/src/agentic/tools/registry.rs` |
 | MCP / LSP / remote | `src/crates/core/src/service/mcp/`、`src/crates/core/src/service/lsp/`、`src/crates/core/src/service/remote_connect/`、`src/crates/core/src/service/remote_ssh/` |
 | 桌面端 API | `src/apps/desktop/src/api/`、`src/crates/api-layer/src/`、`src/crates/transport/src/adapters/tauri.rs` |

AGENTS.md

@@ -17,6 +17,9 @@ Repository rule: **keep product logic platform-agnostic, then expose it through
 | Module | Path | Agent doc |
 |---|---|---|
 | Core (product logic) | `src/crates/core` | [AGENTS.md](src/crates/core/AGENTS.md) |
+| Extracted core support | `src/crates/{core-types,agent-stream,runtime-ports,terminal,tool-runtime}` | (use core guide) |
+| Core owner crates | `src/crates/{services-core,services-integrations,agent-tools,tool-packs}` | (use core guide + decomposition guardrails) |
+| Product domains | `src/crates/product-domains` | [AGENTS.md](src/crates/product-domains/AGENTS.md) |
 | Transport adapters | `src/crates/transport` | (use core guide) |
 | API layer | `src/crates/api-layer` | (use core guide) |
 | AI adapters | `src/crates/ai-adapters` | [AGENTS.md](src/crates/ai-adapters/AGENTS.md) |
@@ -94,8 +97,83 @@ await api.invoke('your_command', { request: { ... } });
 - Desktop-only integrations belong in `src/apps/desktop`, then flow back through transport/API layers.
 - In shared core, avoid host-specific APIs such as `tauri::AppHandle`; use shared abstractions such as `bitfun_events::EventEmitter`.
 
+### Remote compatibility
+
+- When adding features, consider remote workspace and remote control synchronization support from the start. Local-only behavior can silently leave remote scenarios incomplete.
+- If a feature cannot reasonably support remote workspaces, gate it or show a clear unsupported-state message instead of letting it fail with a generic error.
+
+### Agent loop behavior
+
+- Do not add hard-coded limits or pattern checks to the agent loop as a first response to looping behavior, such as blocking repeated tool calls by string or count alone.
+- Excessive hard-coding turns the agent loop into a brittle workflow engine. Investigate the root cause first: tool behavior, model interaction, session context packaging, prompt/tool schema design, or state synchronization issues.
+
 ## Architecture
 
+### Core decomposition guardrails
+
+For any `bitfun-core` decomposition, feature-boundary, dependency-boundary, or
+Rust build-speed refactor, read
+[`docs/architecture/core-decomposition.md`](docs/architecture/core-decomposition.md)
+before editing. The guardrail document defines product-behavior invariants,
+crate ownership targets, forbidden dependency directions, feature safety rules,
+and milestone verification gates.
+
+### Tool ownership guardrails
+
+- `src/crates/agent-tools` owns lightweight tool contracts and the generic
+  registry / dynamic-provider container.
+- `src/crates/core/src/agentic/tools` owns product tool assembly, `dyn Tool`
+  adaptation, snapshot decoration, tool exposure / manifest resolution, and
+  on-demand tool spec discovery (`GetToolSpec`) for now.
+- Keep `ToolUseContext` and concrete tool implementations in core until a
+  reviewed port/provider design and equivalence tests exist.
+- Tool migrations must preserve expanded/collapsed exposure, prompt-visible
+  manifests, `ToolUseContext.unlocked_collapsed_tools`, and desktop/MCP/ACP
+  tool catalog behavior.
+
+### Latest-main runtime anchors
+
+- Agent registry migration must preserve mode-scoped subagent availability,
+  hidden/custom/review grouping, and desktop subagent API semantics.
+- DeepResearch report finalization currently relies on the core citation
+  renumber hook; do not move it without preserving `report.md`,
+  `citations.md`, `display_map.json`, and rejected-citation handling.
+- Workspace/search refactors must preserve remote workspace startup guards,
+  remote flashgrep fallback, and search preview/context mapping.
+- ACP timeout handling and Web operation-diff fallback are product-surface
+  behavior; share facts through contracts, not UI/protocol implementation.
+
+### Services/product owner closure
+
+- Remote-SSH path, session identity, mirror path, and unresolved-session layout
+  helpers belong in `bitfun-services-integrations`; core may inject
+  `PathManager` and hold SSH manager / remote FS / terminal assembly.
+- MiniApp storage shape belongs in `bitfun-product-domains`; core storage
+  keeps filesystem IO, worker runtime, `PathManager`, and port adapters until a
+  reviewed runtime migration exists.
+- Remote-connect port baselines live in `bitfun-runtime-ports` and
+  `bitfun-services-integrations`; tracker state and tracker event reduction
+  belong in `bitfun-services-integrations`. Remote command/response wire DTOs,
+  remote model catalog DTOs, poll-response assembly helpers, and model-catalog
+  poll delta policy also belong there. Pure remote image-context
+  fallback/preference, restore-target, cancel-decision, and remote file-transfer
+  size/chunk/name helpers also belong in `bitfun-services-integrations`, while
+  core still owns the adapter back to `ImageContextData`, dispatcher assembly,
+  session restore execution, file IO/path resolution, terminal pre-warm, and
+  product execution routing. Further remote runtime owner migration must
+  preserve the existing migration snapshots for command/response shape,
+  restore, active-turn polling, cancel decisions, image context
+  fallback/preference, tracker fanout, file transfer, and RemoteRelay/Bot queue
+  policy.
+  `AgentSubmissionPort` still rejects generic attachments until
+  image/multimodal equivalence tests and a runtime migration plan are reviewed.
+
+### DeepReview guardrails
+
+Deep Review / Code Review Team work spans the core runtime and web UI. Keep
+target resolution and manifest construction on the frontend; keep policy
+validation, queue/retry state, and report enrichment in shared core.
+
 ### Backend flow
 
 Trace most features in this order:
@@ -133,15 +211,16 @@ Session data is stored under `.bitfun/sessions/{session_id}/`.
 | Shared Rust logic in `core`, `transport`, `api-layer`, or services | `cargo check --workspace && cargo test --workspace` |
 | Desktop integration, Tauri APIs, browser/computer-use, or desktop-only behavior | `cargo check -p bitfun-desktop && cargo test -p bitfun-desktop` |
 | Behavior covered by desktop smoke/functional flows | `cargo build -p bitfun-desktop` then the nearest E2E spec or `pnpm run e2e:test:l0` |
-| `src/crates/ai-adapters` | Relevant Rust checks above **and** stream integration tests in `src/crates/core/tests` |
+| `src/crates/ai-adapters` | Relevant Rust checks above **and** `cargo test -p bitfun-agent-stream` for stream contracts |
 | Installer app | `pnpm run installer:build` |
 
 ## Where to look first
 
 | Feature | Key paths |
 |---|---|
 | Agent modes | `src/crates/core/src/agentic/agents/`, `src/crates/core/src/agentic/agents/prompts/`, `src/web-ui/src/locales/*/scenes/agents.json` |
-| Deep Review / Code Review Team | `src/crates/core/src/agentic/deep_review_policy.rs`, `src/crates/core/src/agentic/agents/deep_review_agent.rs`, `src/crates/core/src/agentic/tools/implementations/{task_tool.rs,code_review_tool.rs}`, `src/web-ui/src/shared/services/reviewTeamService.ts`, `src/web-ui/src/flow_chat/services/DeepReviewService.ts`, `src/web-ui/src/app/scenes/agents/components/ReviewTeamPage.tsx` |
+| Deep Review / Code Review Team | `src/crates/core/src/agentic/deep_review/`, `src/crates/core/src/agentic/deep_review_policy.rs`, `src/crates/core/src/agentic/agents/deep_review_agent.rs`, `src/crates/core/src/agentic/tools/implementations/{task_tool.rs,code_review_tool.rs}`, `src/web-ui/src/shared/services/review-team/`, `src/web-ui/src/flow_chat/deep-review/`, `src/web-ui/src/app/scenes/agents/components/ReviewTeamPage.tsx` |
+| Session usage report (`/usage`) | `src/crates/core/src/service/session_usage/`, `src/web-ui/src/flow_chat/components/usage/`, `src/web-ui/src/locales/*/flow-chat.json` |
 | Tools | `src/crates/core/src/agentic/tools/implementations/`, `src/crates/core/src/agentic/tools/registry.rs` |
 | MCP / LSP / remote | `src/crates/core/src/service/mcp/`, `src/crates/core/src/service/lsp/`, `src/crates/core/src/service/remote_connect/`, `src/crates/core/src/service/remote_ssh/` |
 | Desktop APIs | `src/apps/desktop/src/api/`, `src/crates/api-layer/src/`, `src/crates/transport/src/adapters/tauri.rs` |

BitFun-Installer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bitfun-installer",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "private": true,
   "type": "module",
   "description": "BitFun Custom Installer - Modern branded installation experience",