docs: 同步当前功能、权限与开发指引

CONTRIBUTING.md

@@ -12,8 +12,8 @@
 
 | 工具 | 推荐版本 | 来源与用途 |
 | :--- | :--- | :--- |
-| **Go** | 1.26+ | 核心控制平面、CLI、TUI、HTTP API 与 SQLite 状态机 |
-| **Node.js** | 24+ | 前端管理界面（`web/` 目录下的 React 18 + Vite） |
+| **Go** | 遵循 [go.mod](go.mod)，当前 1.26.10 | 核心控制平面、CLI、TUI、HTTP API 与 SQLite 状态机 |
+| **Node.js** | 24+ | 前端管理界面（`web/` 目录下的 React 19 + Vite） |
 | **Git** | 2.41+ | 源码版本管理 |
 | **Rust** *(可选)* | 1.97.1+ | 仅在修改或验证 `analyzers/` 目录下的 WASI 代码分析器时需要 |
 
@@ -175,7 +175,7 @@ cd ..
    - **React 前端** 负责用户交互呈现与视觉效果，不私自推导或伪造未经后端确认的状态。
 3. **纯 CSS 现代性能标准**：
    - 界面视觉效果优先使用现代纯 CSS 属性（如 `backdrop-filter`、多层 `box-shadow` 内阴影、`linear-gradient`）。
-   - 避免引入高开销的 SVG 位移滤镜（如 `feTurbulence`）或全屏 WebGL Canvas，确保在展示大量代码和日志输出时保持 120fps 丝滑滚动。
+   - 涉及滚动和视觉效果的改动应在实际页面验证；性能结论应记录测量环境与结果。
 4. **统一规范的产品命名**：
    - 所有面向用户的标题、文案、关于页面与文档中，产品官方名称一律统一为 **`Universal-Code`**。
 
@@ -190,7 +190,7 @@ cd ..
    git checkout -b feat/support-deepseek-r1
    ```
 2. 保持 Commit 粒度清晰，提交信息简明扼要。
-3. 在本地完整运行并通过 `npm test` 和 `go test`。
+3. 运行覆盖本次改动的相关测试和必需检查，在 PR 中记录验证范围与结果。
 4. 在 GitHub 上发起 Pull Request，简要说明：
    - **改动背景**：解决了什么问题或增加了什么特性。
    - **关键设计**：采用了什么样的架构思路。

README.en.md

@@ -16,7 +16,7 @@
     <img alt="Platform" src="https://img.shields.io/badge/Platform-Windows%20%7C%20macOS-blueviolet?style=flat-square">
     <img alt="Go" src="https://img.shields.io/badge/Go-1.26+-00ADD8?style=flat-square&logo=go&logoColor=white">
     <img alt="Node" src="https://img.shields.io/badge/Node.js-24+-339933?style=flat-square&logo=node.js&logoColor=white">
-    <img alt="React" src="https://img.shields.io/badge/React-18-61DAFB?style=flat-square&logo=react&logoColor=black">
+    <img alt="React" src="https://img.shields.io/badge/React-19-61DAFB?style=flat-square&logo=react&logoColor=black">
     <a href="CONTRIBUTING.md"><img alt="PRs Welcome" src="https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat-square"></a>
   </p>
   <p>
@@ -31,10 +31,10 @@
 ## Highlights
 
 - **Built for Local Repositories**: Read, inspect, and edit local codebases with built-in line-by-line diff inspection and auditable checkpoints (Rewind).
-- **Transparent Permission Control**: Choose between read-only analysis, approval-gated runs, and automated Full Access. High-risk actions (file deletion, unlisted commands) always require manual confirmation.
+- **Transparent Permission Control**: Ask / Auto / Full authorization allows, requests approval for, or denies operations according to current permissions, verified effects, and safety policy. Full requires explicit activation in the current process.
 - **Ready for Any Model**: Native support for OpenAI, Anthropic Claude, DeepSeek, Kimi, local Ollama models, and custom OpenAI-compatible endpoints with on-the-fly model switching. Also supports quick browser-based ChatGPT account sign-in.
 - **Traceable Web Research**: Prioritizes provider-hosted native search, fetches GitHub Issues/PRs, Hacker News, and RSS/Atom feeds, and keeps source snapshots and citations.
-- **Modern Liquid Glass Aesthetic**: Crafted with pure CSS optical refraction (macOS / VisionOS acrylic style), supporting Dark, Light, and Mist frosted themes at a responsive 120fps.
+- **Switchable Interface Themes**: Dark, Light, and Mist themes use CSS blur, translucent backgrounds, gradients, and edge shadows for a glass-like appearance.
 
 ---
 
@@ -52,7 +52,7 @@ Packages retain their historical filenames; the product name shown in the applic
 
 ### Option 2: Build from Source
 
-Install **Go as pinned in [go.mod](go.mod), currently 1.26.9**, and **Node.js 24** (CI uses 24.16.0), then clone the repository:
+Install **Go as pinned in [go.mod](go.mod), currently 1.26.10**, and **Node.js 24** (CI uses 24.16.0), then clone the repository:
 
 ```bash
 git clone https://github.com/CWNU-Open-Source-Community/Universal-Code.git
@@ -110,6 +110,7 @@ Switch between **System, Light, Dark, and Mist** under **Settings → Appearance
 | :--- | :--- | :--- |
 | **User Guide** | [Usage Guide](docs/usage.md) | Client walkthrough, CLI commands, and typical workflows |
 | **Web Research** | [Search & Citations](docs/web-evidence.md) | Search setup, snapshot storage, URL provenance, and diagnostics |
+| **Chat Resources** | [Links, Files & Clipboard](docs/chat-resource-interactions.md) | Link previews, resource context menus, and file/image copy and paste |
 | **Code Auditing** | [Workspace Checkpoints](docs/workspace-checkpoints.md) | Line-by-line diff review, snapshots, and safe Rewind |
 | **Extensions** | [Extensions & MCP](docs/extensions.md) | Integrating Model Context Protocol (MCP) and custom skills |
 | **Code Intelligence** | [LSP Support](docs/code-intelligence.md) | Symbol jump, type inference, and repository index |

README.md

@@ -16,7 +16,7 @@
     <img alt="Platform" src="https://img.shields.io/badge/Platform-Windows%20%7C%20macOS-blueviolet?style=flat-square">
     <img alt="Go" src="https://img.shields.io/badge/Go-1.26+-00ADD8?style=flat-square&logo=go&logoColor=white">
     <img alt="Node" src="https://img.shields.io/badge/Node.js-24+-339933?style=flat-square&logo=node.js&logoColor=white">
-    <img alt="React" src="https://img.shields.io/badge/React-18-61DAFB?style=flat-square&logo=react&logoColor=black">
+    <img alt="React" src="https://img.shields.io/badge/React-19-61DAFB?style=flat-square&logo=react&logoColor=black">
     <a href="CONTRIBUTING.md"><img alt="PRs Welcome" src="https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat-square"></a>
   </p>
   <p>
@@ -31,10 +31,10 @@
 ## 核心特性
 
 - **深度聚焦本地项目**：直接阅读、分析与修改本地代码库，内置 Diff 逐行审阅与可信撤销（Rewind / Checkpoints）能力。
-- **透明可控的安全策略**：支持只读分析、交互审批（Approval Mode）与全自动（Full Access）权限分级，高危操作（文件删除、非白名单命令）严格阻断并要求人工确认。
+- **透明可控的安全策略**：采用 Ask / Auto / Full 分级授权；操作按当前权限、实际影响和安全策略自动执行、请求审批或拒绝，Full 须在当前进程显式激活。
 - **主流模型即开即用**：原生接入 OpenAI、Anthropic Claude、DeepSeek、Kimi、Ollama 本地模型与任何兼容 OpenAI 的第三方 API，支持单会话内即时热切，并支持通过系统浏览器快速完成 ChatGPT 账户授权登录。
 - **真实来源的网络检索**：优先调用供应商原生搜索，支持直接抓取 GitHub PR/Issue、Hacker News 与 RSS/Atom 资讯，自动附带快照存证与引用出处。
-- **现代苹果液态玻璃美学**：采用纯 CSS 物理折射模型（macOS / VisionOS 亚克力液态玻璃风格），提供深色、浅色与雾透磨砂质感，兼具 120fps 极速渲染。
+- **可切换的界面主题**：提供深色、浅色与雾透主题，使用 CSS 模糊、半透明背景、渐变和边缘阴影呈现玻璃质感。
 
 ---
 
@@ -52,7 +52,7 @@
 
 ### 方式二：从源码构建运行
 
-安装 **Go（版本遵循 [go.mod](go.mod)，当前为 1.26.9）** 与 **Node.js 24**（CI 使用 24.16.0），然后克隆仓库：
+安装 **Go（版本遵循 [go.mod](go.mod)，当前为 1.26.10）** 与 **Node.js 24**（CI 使用 24.16.0），然后克隆仓库：
 
 ```bash
 git clone https://github.com/CWNU-Open-Source-Community/Universal-Code.git

docs/architecture.md

@@ -157,7 +157,7 @@ The production React bundle is built by Vite but hosted only when Go receives an
 
 ## Core Domain
 
-`Run` is a domain aggregate, not a programming language, operating-system process, or replacement for Go/TypeScript/Rust. Go creates and owns Run lifecycle state; TypeScript may display and control it through Go APIs. Rust never owns a Run. The current analyzer fixture has no Run field or product bridge; a future Go adapter may bind a validated analyzer operation to a Run outside the Rust wire contract.
+`Run` is a domain aggregate, not a programming language, operating-system process, or replacement for Go/TypeScript/Rust. Go creates and owns Run lifecycle state; TypeScript may display and control it through Go APIs. Rust never owns a Run. Go application services bind the fixed embedded digest analyzer to a Run and commit its execution evidence. The Rust wire contract remains free of Run identity and authority. See the [Analyzer README](../analyzers/README.md) for the current execution boundary.
 
 Budget, events, sandbox sessions, and reports are Run-scoped rather than embedded into one large object. Their modules remain independent and persist references by `run_id`; `AgentRunner` coordinates their lifecycle.
 
@@ -1041,7 +1041,7 @@ internal/store/             SQLite stores and migrations
 internal/session/           Compatibility conversation service
 internal/tui/               Bubble Tea adapter
 internal/httpapi/           Loopback-only read/control API, OpenAPI contract, and bounded Run-event SSE
-internal/analyzer/          Go-owned analyzer protocol, validation, and future bridge boundary
+internal/analyzer/          Go-owned analyzer protocol, validation, and embedded WASI execution boundary
 ```
 
 Packages split when a concrete implementation establishes different ownership. New tools and integrations reuse these services and add focused behavior tests for their contracts.
@@ -1334,6 +1334,9 @@ records these bounds.
 
 ## Go-Owned Analyzer Protocol And Rust Fixture
 
+The following P10-A/B sections record the initial implementation stages. For the
+current product execution path, see the [Analyzer README](../analyzers/README.md).
+
 P10-A1 establishes `internal/analyzer` as a pure Go protocol owner rather than a process
 launcher. `analyzer_protocol.v1` accepts one canonical inline Base64 payload plus explicit
 limits and four capability declarations that must all be false. Strict decoding rejects

docs/architecture/bounded-project-tests.md

@@ -1,11 +1,18 @@
 # Bounded project tests
 
-`run_tests` is the root Supervisor's project test entry point in Code Plan and
-Deliver. Review is a workflow state, not an execution phase: the domain has
+`run_tests` is the project test entry point in Code Plan and Deliver for the root
+Supervisor and recorded `specialist_runner` workers with matching WorkerAuthority.
+Review is a workflow state, not an execution phase: the domain has
 only `plan` and `deliver` phases.
 
-The request contains `version: "run-tests.v1"`, a relative directory `target`,
-and `timeout_milliseconds` from 1 through 25000. The host resolves the pinned
+The request contains `version: "run-tests.v1"`. `action: "run"` (the default when
+omitted) takes a relative directory `target` and `timeout_milliseconds` from 1
+through 25000. Longer tests use `action: "start"` with a timeout up to 1800000 ms,
+then `action: "wait"` with the original `job_id`, returned `cursor`, `max_bytes`
+(4–32768), and `wait_milliseconds` (1–5000). Wait observes the existing Job without
+a new target or timeout; repeating start is not a polling operation.
+
+The host resolves the pinned
 project test ID or detects a supported project through the existing project
 action registry. It chooses the executable, literal arguments, environment,
 closed stdin, disabled network intent, output bounds and empty credentials.
@@ -21,10 +28,11 @@ fall back to the host. Dependency installation retains its sandbox-only gate.
 The prepared command is pinned in the durable tool authority and regenerated
 before approval and dispatch. The existing command authorizer, Run lease,
 root attempt, gateway tool budget, command budget, timeout, cancellation and
-Job/output receipts remain authoritative. A test runs as one synchronous Job;
-failed or timed-out Jobs are returned as test evidence. A completed call is
-replayed without starting another Job. Specialist calls retain their existing
-bounded validation tools and child budget; `run_tests` grants no child access.
+Job/output receipts remain authoritative. Each run/start creates one Job; wait
+returns bounded output and status for that Job, retaining its original actor and
+authority. Failed or timed-out Jobs are returned as test evidence. A completed
+call is replayed without starting another Job. Worker execution retains its
+recorded assignment, WorkerAuthority, and child budget checks.
 
 General `command_runtime` remains Deliver-only. Plan Job insertion additionally
 requires a pending `run_tests` call with matching actor, command fingerprint,

docs/ci.md

@@ -30,11 +30,11 @@ successful aggregate result. Unclassified build inputs select full checks.
 
 ## Go security baseline
 
-The supported build toolchain is Go **1.26.9**, pinned by `go.mod`. Both central
+The supported build toolchain is Go **1.26.10**, pinned by `go.mod`. Both central
 CI and release builders read that exact version with `go-version-file`.
 This avoids selecting an older patch while the setup-go version catalog lags
 behind a new Go security release. Local desktop builders require the same
-version; set `GOTOOLCHAIN=go1.26.9` when another Go toolchain is installed.
+version; set `GOTOOLCHAIN=go1.26.10` when another Go toolchain is installed.
 The module's minimum version alone cannot exclude vulnerable newer release
 branches, such as Go 1.27.0 and 1.27.1; a larger version is not security evidence.
 The Windows fixed-toolchain fixture must match the exact version selected by

docs/extensions.md

@@ -105,10 +105,11 @@ Supervisor 首次最多展示 32 条已安装 Skill 摘要。更多摘要通过
 组件与内容版本的绑定；停用、撤销或版本改变后，旧选择不能恢复权限。手动选择沿用每任务
 最多 4 项、合计最多 4096 Token 的边界，超出预算会拒绝而不会截断正文。
 
-网页的“Skill 包”入口目前上传版本化 ZIP，新导入内容在扩展页审查与启用；历史 Skill
-登记列表用于兼容旧安装和移除。原生目录可通过上述 `skill import-dir` 导入后，在任务
-设置中手动选择。网页直接导入原生目录、URL/Git 导入和旧 Skill Catalog 发布者信任的
-GUI 入口仍由 #334 跟踪。
+网页支持安装版本化 Skill ZIP，并上传原生 `SKILL.md` 目录；原生目录暂存后，
+在扩展页审查与启用。
+Plugin 来源导入支持 URL/Git，由对应后端 capability 控制；高级设置提供旧 Skill Catalog
+发布者信任管理。历史 Skill 登记列表保留旧安装和移除操作。具体步骤见
+[使用指南](usage.md)。
 
 同一来源的新 revision 使用新的 operation key 导入。如果旧 revision 仍启用，命令会报告 `another plugin version is enabled`；此时新 revision 已保留为 `approved`，旧 revision 继续启用。通过 `plugin list`、`plugin show` 核对两者的来源和 revision，并从各自最新输出取得 ID、`package_fingerprint` 与 `generation`，然后显式切换：
 

docs/macos-release.md

@@ -37,7 +37,7 @@ Extract the Actions transport ZIP, then the product ZIP inside it, and open `Tra
 
 ## 构建与核验
 
-本机源码构建需要 Xcode Command Line Tools、[go.mod](../go.mod) 固定的 Go（当前 1.26.9）、Node.js 24（CI 为 24.16.0）和 CGO。在仓库根目录运行：
+本机源码构建需要 Xcode Command Line Tools、[go.mod](../go.mod) 固定的 Go（当前 1.26.10）、Node.js 24（CI 为 24.16.0）和 CGO。在仓库根目录运行：
 
 ```sh
 CGO_ENABLED=1 bash scripts/build-desktop-darwin.sh -Version v1.0.0-dev

docs/releases/v1.0.0.md

@@ -4,7 +4,12 @@
 
 本版本以主线为基础，整合了 Full Access 权限分级、主流大模型接入、网络搜索取证、工作区检查点快照与苹果液态玻璃视觉系统。产品官方全称已统一为 **Universal-Code**。
 
-## 当前下载与验证状态（2026-09-21）
+> 本页保留首版整合时的范围与验证记录。当前预览包见
+> [v1.0.0-preview.20261020](https://github.com/CWNU-Open-Source-Community/Universal-Code/releases/tag/v1.0.0-preview.20261020)；
+> 安装与启动说明见 [Windows](../windows-release.md) / [macOS](../macos-release.md)。
+> 预览包不等同于正式 `v1.0.0` 发布。
+
+## 首版整合时的下载与验证状态（2026-09-21）
 
 - 首版源码 [PR #203](https://github.com/CWNU-Open-Source-Community/Traverse-Board/pull/203) 已合并；尚未公开 `v1.0.0` GitHub Release。现有 [Releases](https://github.com/CWNU-Open-Source-Community/Traverse-Board/releases) 是历史预览，不能据此判断是否包含最新源码功能。
 - Mac 双架构候选与发布接线 [PR #204](https://github.com/CWNU-Open-Source-Community/Traverse-Board/pull/204) 已合并，下载和启动步骤见 [Mac 说明](../macos-release.md)。Windows 下载与签名/Store 状态见 [Windows 说明](../windows-release.md)。

docs/sandbox-environments.md

@@ -28,8 +28,8 @@
 
 ## 准备项目依赖
 
-开始编码后，在「审阅改动 → 检查与交付 → 准备项目」检测 npm 或 Go
-项目，核对锁文件和命令，选择本次允许下载的包源，再在所选沙箱中
+开始编码后，在「审阅改动 → 检查与交付 → 准备项目」检测受支持的
+项目（当前范围见[准备项目依赖](project-preparation.md)），核对锁文件和命令，选择本次允许下载的包源，再在所选沙箱中
 离线安装。依赖下载与任务的网页搜索分别授权，npm 安装脚本另行选择。
 工具链应提前安装在本机环境、固定镜像或模板中。