[sunrioa]

Summary

Refs #6716. Depends on #6724 and #6728.

The discovery backend can already run scheduled investigations and retain shared records, but users need a desktop entry point to approve and manage discovery, inspect the original investigation, and reply to a finding with an explicit reference.

This PR connects those capabilities to the Bot desktop interface.

• Add a proactive-discovery panel for creating and approving plans, editing the investigation direction and interval, pausing/resuming, and checking once. Show the selected workspace and model, execution status, errors, and last/next check times.
• Preserve existing schedule settings when editing a plan, including cadence, time zone, fire limits, expiry and misfire handling. Approval captures the displayed target and model.
• Mark discovery publications in Bot Chat and link them to the original worker Session and Turn.
• Allow users to select text in a Bot reply and quote it in the composer. Preserve the source message and Turn identity through draft persistence, sending, retry and restart.
• Render quoted excerpts in sent messages and pending/retried sends. History pages return bounded previews; original text and provenance remain unchanged.
• Resolve discovery feedback from its quoted publication. Reject a supplied discovery record that conflicts with the quoted source.
• Update the client journal, generated SDK contracts and composer consumers. Existing journals and frozen sends without quote data remain readable.

This is the desktop-control and quoted-feedback slice of #6716, built on the scheduling and shared-record work in the preceding PRs.

Verification

The branch has been synchronized with #6728 and rust-preview through e8bc5aa2f. Local checks below apply to that updated implementation on macOS.

Check	Result
Native Agent and client regression	50 passed, 0 failed
Workbench unit and component tests	25 passed, 0 failed
JavaScript/tooling tests	196 passed, 0 failed
Generated schemas, SDK/product and desktop TypeScript checks	Passed
Formatting, ASF headers, dependency-license and whitespace checks	Passed

Coverage includes discovery status and original-worker links, durable notification receipts, quote-linked feedback after restart, rejecting mismatched discovery records, quoted drafts and frozen-send upgrades, and bounded quote previews. Existing tests were adapted to the durable Agent interfaces without restoring the removed legacy harnesses.

The remaining sent-message quote preview has been implemented. This update does not change retry policy or investigation permissions.

The release packaging and real-provider checks below were completed before this upstream synchronization, on the earlier implementation. They have not been repeated on the updated head.

Live-provider checks used Command Code → DeepSeek V4.1 Flash with isolated synthetic data:

Scenario	Observed result
Scheduled investigation with a new actionable finding	One linked notification
Recheck without new information	No repeated notification
Quote a finding and report it resolved	Feedback linked to the original discovery
Investigate again in a fresh Session	Feedback retrieved; no repeated notification
Introduce an independent finding	New notification delivered
Read actual sample files, then correct their contents	Files reread; corrected findings not repeated
Terminate the Host during a real model request	Original investigation settled as failed without replay; the next investigation completed normally

All investigating workers used read-only permissions. Test plans were paused after verification.

The live checks also exposed model-quality limitations: one investigation incorrectly treated an additional, permitted language file as a mismatch, and the Bot initially described background file access inaccurately. Corrective feedback was retained and respected in subsequent investigations. These checks validate the integration, not general discovery accuracy.

Windows/Linux desktop validation and full repository CI were not run locally. The macOS package was a local smoke-test artifact, not a signed or source-bound publication candidate.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex assisted with implementation, regression tests, local verification and drafting this description.

Checklist

• Tests cover the change and fail without it
• Format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

简体中文

概述

关联 #6716，依赖 #6724 和 #6728。

主动发现后端已经能够执行定时调查并保留共享记录，但用户还需要桌面入口来批准和管理发现计划、查看原始调查，以及明确引用某条发现进行反馈。

本 PR 将这些能力接入 Bot 桌面界面。

• 增加主动发现面板，支持创建和批准计划、编辑调查方向与间隔、暂停／恢复，以及检查一次。显示所选工作区和模型、执行状态、错误及上次／下次检查时间。
• 编辑计划时保留原有调度设置，包括执行节奏、时区、触发次数限制、到期时间和错过执行时的处理方式。批准操作固定界面展示的目标与模型。
• 在 Bot 对话中标记主动发现消息，并关联原始 worker Session 和 Turn。
• 支持选中 Bot 回复中的文字并引用到输入框。在草稿保存、发送、重试和重启过程中保留来源消息及 Turn 身份。
• 在已发送消息和待发送／重试消息中展示引用。历史分页返回有长度限制的预览，原始正文与来源保持不变。
• 根据被引用的通知定位原始发现；显式指定的发现记录与引用来源冲突时拒绝关联。
• 更新客户端日志、生成的 SDK 契约及输入框调用方。旧版数据库和不包含引用字段的已冻结发送内容仍可读取。

这是 #6716 中桌面控制与引用反馈部分的实现，建立在前两个 PR 的调度和共享记录能力之上。

验证

分支已同步 #6728，并纳入截至 e8bc5aa2f 的 rust-preview。以下本地检查对应同步后的 macOS 实现。

检查	结果
原生 Agent 与客户端回归	50 项通过，0 项失败
Workbench 单元与组件测试	25 项通过，0 项失败
JavaScript／工具链测试	196 项通过，0 项失败
生成的 Schema、SDK／产品及桌面 TypeScript 检查	通过
格式、ASF 文件头、依赖许可证及空白检查	通过

覆盖调查状态与原 worker 链接、通知回执持久化、重启后的引用反馈关联、错误记录关联拒绝、引用草稿与旧冻结发送内容的升级，以及引用预览的长度边界。原有有效测试已适配新的持久化 Agent 接口，没有恢复上游删除的旧测试框架。

此前剩余的已发送消息引用预览已实现。本次不改变重试策略或调查权限。

下述 release 打包和真实模型联调在本次同步上游之前的实现上完成，尚未在更新后的提交上重复执行。

真实模型联调使用 Command Code → DeepSeek V4.1 Flash，材料均为隔离的合成数据：

场景	实际结果
定时调查发现新的可行动问题	发出一条关联原调查的通知
没有新信息时再次检查	未重复通知
引用发现并反馈已经解决	反馈关联到原始发现
使用新的 Session 再次调查	读取反馈，未重复通知
加入独立的新问题	正常发送新通知
读取实际样例文件，再修改文件内容	重新读取文件，未重复报告已修正的问题
真实模型请求期间终止 Host	原调查明确结算为失败，没有重复执行；下一轮正常完成

调查 worker 均使用只读权限，测试结束后已暂停计划。

真实联调也暴露出模型判断的局限：一次调查把允许存在的额外语言文件误判为差异，Bot 最初也未准确说明后台调查的文件读取能力。纠正反馈得到保存，并在后续调查中生效。这些检查验证的是集成链路，不能作为普遍发现准确率的证明。

本地未执行 Windows／Linux 桌面验证或完整仓库 CI。macOS 包仅用于本地安装冒烟，不是已签名或绑定源码归档的正式发布候选产物。

AI 使用说明

OpenAI Codex 协助完成实现、回归测试、本地验证及本说明起草。

检查清单

• 测试覆盖本次改动，缺少相应实现时无法通过
• 格式、类型检查和受影响套件在本地通过

本 PR 存在行为变化，已在概述中说明。

[liugddx]

Automated code review by Codex. I found two correctness issues and called them out inline. The focused workbench checks could not run because this environment is missing /opt/homebrew/opt/simdjson/lib/libsimdjson.33.dylib; Rust checks were unavailable because cargo is not installed.