feat: Enhance AI Agent and Channel Management

- Updated labels in the AI Agents dashboard for clarity, changing "流程状态" to "Playbook 状态" and "未发布流程" to "未发布 Playbook".
- Introduced AI Agent rollout percentage management in channel editing, allowing users to set and rollback rollout percentages.
- Added new API endpoints for rolling back AI Agent rollout and fetching agent run metrics.
- Implemented new UI components for displaying agent run details, including status, duration, and input/output tokens.
- Enhanced type definitions for AdminChannel and AIAgent to include rollout percentages and runtime modes.
- Updated navigation to include a section for agent runs.
- Added new translations for agent run features in both English and Chinese.

internal/ai/runtime/readtools/graph_executor.go

@@ -0,0 +1,79 @@
+// Package readtools executes deterministic, read-only graph tools through the
+// shared Tool Registry boundary.
+package readtools
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+
+	"agent-desk/internal/ai/runtime/graphs"
+	"agent-desk/internal/ai/runtime/retrievers"
+	aitooling "agent-desk/internal/ai/tooling"
+	"agent-desk/internal/models"
+	"agent-desk/internal/pkg/toolx"
+)
+
+func ExecuteGraphTool(ctx context.Context, conversation models.Conversation, toolCode string, arguments map[string]any, policy aitooling.Policy) (aitooling.Definition, string, error) {
+	toolCode = toolx.NormalizeToolCodeAlias(strings.TrimSpace(toolCode))
+	if toolCode != toolx.GraphTriageServiceRequest.Code && toolCode != toolx.GraphAnalyzeConversation.Code && toolCode != toolx.GraphPrepareTicketDraft.Code {
+		return aitooling.Definition{}, "", fmt.Errorf("tool is not a graph read tool")
+	}
+	definition, err := aitooling.DefaultRegistry.Resolve(toolCode)
+	if err != nil {
+		return aitooling.Definition{}, "", err
+	}
+	if err := aitooling.DefaultPolicyGuard.Authorize(aitooling.Invocation{
+		Definition: definition,
+		Arguments:  arguments,
+		Policy:     policy,
+	}); err != nil {
+		return definition, "", err
+	}
+	if definition.TimeoutMS > 0 {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithTimeout(ctx, time.Duration(definition.TimeoutMS)*time.Millisecond)
+		defer cancel()
+	}
+	data, err := json.Marshal(arguments)
+	if err != nil {
+		return definition, "", err
+	}
+	switch toolCode {
+	case toolx.GraphTriageServiceRequest.Code:
+		result, err := graphs.NewTriageServiceRequestGraph(conversation).Run(ctx, string(data))
+		return definition, result, err
+	case toolx.GraphAnalyzeConversation.Code:
+		result, err := graphs.NewAnalyzeConversationGraph(conversation).Run(ctx, string(data))
+		return definition, result, err
+	default:
+		result, err := graphs.NewPrepareTicketDraftGraph(conversation).Run(ctx, string(data))
+		return definition, result, err
+	}
+}
+
+// RetrieveKnowledge executes the built-in knowledge tool after the same
+// registry policy and timeout checks used by graph tools.
+func RetrieveKnowledge(ctx context.Context, agent models.AIAgent, knowledgeBaseIDs []int64, query string, policy aitooling.Policy) (aitooling.Definition, *retrievers.KnowledgeRetrieveResult, error) {
+	definition, err := aitooling.DefaultRegistry.Resolve(toolx.BuiltinKnowledgeRetrieve.Code)
+	if err != nil {
+		return aitooling.Definition{}, nil, err
+	}
+	arguments := map[string]any{"query": strings.TrimSpace(query), "knowledgeBaseIds": knowledgeBaseIDs}
+	if err := aitooling.DefaultPolicyGuard.Authorize(aitooling.Invocation{
+		Definition: definition,
+		Arguments:  arguments,
+		Policy:     policy,
+	}); err != nil {
+		return definition, nil, err
+	}
+	if definition.TimeoutMS > 0 {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithTimeout(ctx, time.Duration(definition.TimeoutMS)*time.Millisecond)
+		defer cancel()
+	}
+	result, err := retrievers.NewKnowledgeRetriever(agent, knowledgeBaseIDs).RetrieveContext(ctx, strings.TrimSpace(query))
+	return definition, result, err
+}

internal/ai/runtime/readtools/graph_executor_test.go

@@ -0,0 +1,26 @@
+package readtools
+
+import (
+	"context"
+	"testing"
+
+	aitooling "agent-desk/internal/ai/tooling"
+	"agent-desk/internal/models"
+	"agent-desk/internal/pkg/toolx"
+)
+
+func TestExecuteGraphToolRejectsDisallowedToolBeforeGraphExecution(t *testing.T) {
+	definition, _, err := ExecuteGraphTool(context.Background(), models.Conversation{}, toolx.GraphAnalyzeConversation.Code, map[string]any{
+		"observedIssue": "需要分析的问题",
+	}, aitooling.Policy{
+		AllowedToolCodes:  []string{toolx.GraphPrepareTicketDraft.Code},
+		AllowedRiskLevels: []string{aitooling.RiskLevelRead},
+		Confirmed:         true,
+	})
+	if err == nil {
+		t.Fatal("expected policy guard to reject the graph tool")
+	}
+	if definition.Code != toolx.GraphAnalyzeConversation.Code {
+		t.Fatalf("definition code = %q, want %q", definition.Code, toolx.GraphAnalyzeConversation.Code)
+	}
+}