feat(provider): consolidate provider and network safeguards

[luoye520ww]

Problem

Provider and network safeguards were split across six contract PRs. The repository had definitions for network approval, provider circuit breaking, request queues, model budgets, custom CA bundles, and capability caching, but they were hard to review as one coherent policy surface.

Root cause

Each policy was introduced independently without a shared validation boundary or a single reviewable provider/network reliability change. The circuit-breaker policy also did not reserve the first half-open probe in its returned state, allowing concurrent callers to race.

Scope

This PR consolidates the provider/network contract layer and the Electron-free skill-service test fix. It defines bounded policies and pure decisions; it does not wire provider queues, budgets, CA loading, or network approval into every runtime call site.

Changes

• Add strict network approval matching for host/port and read/mutation scopes, with localhost requiring explicit allowance.
• Add provider circuit-breaker policy with closed/open/half-open states, retryable failure classification, and single-probe reservation.
• Add provider request queue and model budget contracts with bounded identifiers, capacities, priorities, and spend decisions.
• Add a credential-free provider capability cache keyed by non-secret provider/config/version fingerprints, with TTL and LRU-style bounds.
• Add custom CA bundle validation for absolute paths, control-character rejection, and optional SHA-256 pinning.
• Keep skill-service tests independent of Electron native binary installation.

Safety

• Network approval performs no DNS or socket I/O and defaults to denial outside explicit grants.
• Authentication/client failures do not automatically open the provider circuit.
• Capability cache keys reject embedded URL credentials and strip query/hash values.
• Budget, queue, cache, path, and hash inputs are bounded and reject unknown fields where applicable.
• No secret values are stored in the capability cache or contract payloads.

Typecheck

npm.cmd run typecheck
npm.cmd --prefix kun run typecheck

Both passed.

Tests

npm.cmd exec vitest run src/shared/custom-ca.test.ts src/main/legacy-provider-settings-migration.test.ts src/main/services/skill-service.test.ts
npm.cmd --prefix kun test -- src/contracts/network-approval.test.ts src/services/provider-circuit-breaker.test.ts tests/model-budget.test.ts tests/provider-request-queue.test.ts src/services/provider-capability-cache.test.ts
npm.cmd run lint
npm.cmd run build
git diff --check upstream/develop...HEAD

Results: root 3 test files, 21 passed and 1 existing skipped; Kun 5 test files, 34/34 passed; lint, build, and diff check passed.

Actual validation

• Contracts were exercised with real validation functions and state transitions, including the half-open concurrent-probe regression.
• Electron-dependent migration and skill-service tests were run with the Electron binary temporarily absent; they still passed and the binary was restored.
• Packaged Linux, Windows, and macOS validation is required and will run on this PR.

Review performed

• Functional correctness
• Concurrency and single-probe lifecycle
• Secret/path/network safety
• Cache expiry and bounded resource use
• Backward compatibility of the Electron-free test path
• Cross-platform build compatibility
• Scope and test quality

PR size

Production files: 9
Test files: 5
Production LOC: 615
Total diff: 1,039 lines

Non-goals

• No provider HTTP client or Agent Loop changes.
• No automatic network access or CA file loading.
• No UI for budgets, queues, circuit state, or approval prompts.
• Runtime integrations remain separate follow-up work.

Supersedes

• feat(security): define network approval contract #921
• feat(provider): define circuit breaker policy #922
• feat(network): define custom CA bundle contract #923
• feat(budget): define model budget contract #924
• feat(provider): define request queue contract #927
• feat(provider): add bounded capability cache #937

Part of the broader provider/network reliability work; no issue is auto-closed by this PR.

[XingYu-Zhong]

感谢 Provider/网络可靠性方向的工作。关闭当前聚合 PR 的原因是它把网络审批、自定义 CA、预算、队列、熔断和能力缓存六套合同放在一起，但绝大多数没有接入当前请求调用链；与 develop 也已有冲突和邻近能力重叠。

尤其网络主机匹配本身不足以独立构成 DNS/内网访问安全边界，因此不宜在没有真实调用方和完整威胁模型时固化这一整包 API。

如需要继续，请基于最新 develop 按实际消费者拆分：一次只实现一个已接线、可端到端验证的能力。当前分支会保留。