feat: expand secure assistant workflows

Harden runtime execution and add local knowledge, Smart Heartbeat, usage visibility, responsive product surfaces, and cross-platform packaging support.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

src/main/tool-approval-broker.ts

@@ -35,6 +35,9 @@ export class ToolApprovalBroker {
     if (signal.aborted) {
       throw signal.reason
     }
+    if (request.policy === 'policy') {
+      throw new Error('当前策略已禁止 Agent 工具执行')
+    }
     const grantKey = this.getGrantKey(
       request.conversationId,
       request.scopeKey
@@ -42,9 +45,6 @@ export class ToolApprovalBroker {
     if (this.sessionGrants.has(grantKey)) {
       return 'session'
     }
-    if (request.policy === 'policy') {
-      throw new Error('当前策略已禁止 Agent 工具执行')
-    }
 
     const approvalId = crypto.randomUUID()
     return new Promise<ApprovalDecision>((resolve) => {
@@ -87,7 +87,7 @@ export class ToolApprovalBroker {
     clearTimeout(approval.timeout)
     this.pending.delete(approvalId)
 
-    if (decision === 'session' || decision === 'permanent') {
+    if (decision === 'session') {
       this.sessionGrants.add(
         this.getGrantKey(approval.conversationId, approval.scopeKey)
       )