feat(workbuddy): WorkBuddy 功能优化

CLAUDE.md

@@ -119,6 +119,13 @@ Rules:
 
 Do not reintroduce UMeng, Bugly, Aliyun SLS, or any other commercial/mobile tracking SDKs without explicit user approval.
 
+### WorkBuddy plugin official service (approved exception)
+
+- `workbuddy-plugin/` connects by default to the official CoreMate account and model service `https://cm2backend.dmyh.tech`, defined in `workbuddy-plugin/src/service-config.ts` and bundled into every build by `scripts/finalize.mjs`
+- This is a deliberate maintainer decision: it uses that service's existing `/api/user-auth/*` (SMS sign-in, auto-registration) and `/api/agent-config/runtime/*` routes, which the public `server/` does not provide
+- Do not remove the default or treat it as a leaked private endpoint; `OPENGUI_ACCOUNT_SERVICE_URL` overrides it for self-hosting or development
+- Keep the data-flow disclosure in the plugin READMEs accurate when this integration changes
+
 ### Executor mode
 
 The public release is GUI/vision-first. The server-side A11y tree reasoning path from older versions is gone. The Android client still uses accessibility services to perform actions, but do not casually resurrect old `executor_a11y` / A11y-tree routing ideas from private code.

workbuddy-plugin/NOTICE.md

@@ -2,8 +2,10 @@
 
 The Android command validation, execution queue, device discovery, owned-forward inventory, safe ZIP extraction, scrcpy clipboard transport, session API, and associated baseline tests were ported from the public OpenGUI repository at commit `674e35893219f47b03508ba58b84a13e57f31c57` (DSH release v0.1.13).
 
-These are independent copies under the accompanying OpenGUI license. This package does not import, build, install, upgrade, reconfigure, or share state with the DSH or Codex plugins. Changes here do not patch those production packages. The native DSH UI, browser agent, host commands, model routing, and Codex installer/daemon are not included. The WorkBuddy broker, MCP adapter, device-wall access checks, packaging, and lifecycle fixes are maintained here separately.
+These are independent copies under the accompanying OpenGUI license. This package does not import, build, install, upgrade, reconfigure, or share state with the DSH or Codex plugins. Changes here do not patch those production packages. The DSH host, browser agent, host commands, model routing, and Codex installer/daemon are not included. The WorkBuddy broker, MCP adapter, device-wall access checks, packaging, and lifecycle fixes are maintained here separately.
 
 Android Platform Tools binaries and their upstream notices are in `assets/platform-tools/`. `MANIFEST.md` records their fixed version and SHA-256 hashes. The scrcpy 4.1 archives are downloaded only on first Unicode input from the official Genymobile GitHub release, checked against fixed byte counts and SHA-256 hashes, and cached privately. No DSH/Codex cache is inspected or migrated. scrcpy is licensed under Apache-2.0; its upstream license and notices remain in the downloaded archive.
 
-The MCP SDK, sharp, Ajv, tar, and yauzl are installed as version-pinned npm dependencies, with a committed lockfile for development and CI. This is GitHub tarball distribution, not an npm publication.
+The MCP SDK, sharp, Ajv, tar, yauzl, PDFKit and fontkit are installed as version-pinned npm dependencies, with a committed lockfile for development and CI. PDFKit and fontkit are MIT licensed. Unmodified Noto Sans SC and Noto Emoji fonts are bundled under SIL Open Font License 1.1; pinned public sources, hashes and licenses are recorded in third-party/noto-sans-sc and third-party/noto-emoji. PDF export uses these local fonts and subsets them into the document. It never reads system fonts or downloads font resources. This is GitHub tarball distribution, not an npm publication.
+
+The macOS iOS simulator adapter downloads the official AXe 1.8.0 universal distribution on first simulator selection and checks its fixed SHA-256. AXe is MIT-licensed; its license and IDB third-party notices are retained in `third-party/axe/`. This adapter uses screenshot-based targets and HID coordinate input; it does not expose accessibility trees to the model. Physical iOS devices are excluded.

workbuddy-plugin/connector/connector-meta.json

@@ -2,13 +2,19 @@
   "name": "OpenGUI",
   "name_zh": "OpenGUI 手机助手",
   "name_en": "OpenGUI Android Assistant",
-  "description": "Control locally connected Android phones and monitor a private device wall from WorkBuddy.",
-  "description_zh": "通过 WorkBuddy 操作本机连接的 Android 手机，并在只读设备墙中查看最多四台手机的画面。",
-  "description_en": "Control locally connected Android phones from WorkBuddy and monitor up to four phones in a read-only device wall.",
+  "description": "Let WorkBuddy operate a locally connected Android phone or emulator for GUI testing and reviewed comment operations, with a live workbench for the screen, task plan and run trace.",
+  "description_zh": "在 WorkBuddy 中让 AI 操作本机连接的 Android 手机或模拟器，完成自动化测试与经人工审核的评论运营；右侧工作台实时显示手机画面、任务清单和执行记录。",
+  "description_en": "Let WorkBuddy operate a locally connected Android phone or emulator for GUI testing and reviewed comment operations, with a live workbench for the screen, task plan and run trace.",
   "source": "opengui",
   "type": "mcp",
   "version": "0.3.1",
   "minWorkbuddyVersion": "5.5.3",
-  "examples_zh": ["看看手机上的 Android 版本", "在设备墙里查看这两台手机的画面"],
-  "examples_en": ["Check the Android version on my phone", "Show these two phones in the device wall"]
+  "examples_zh": [
+    "帮我测试这个 App 的登录页输入校验，做到提交前就停",
+    "帮我回复这篇笔记下的评论，每条先让我审核再发送"
+  ],
+  "examples_en": [
+    "Test the login form validation of this app and stop before submitting",
+    "Reply to comments under this post, letting me review each draft before sending"
+  ]
 }