feat(extensions): add Claude Code and Codex config sources

[limityan]

Summary

• Add runtime-free Claude Code Command, Subagent, and MCP sources plus Codex Subagent and MCP sources behind the existing external-source provider contracts.
• Keep source-native discovery and precedence in sibling adapters while reusing the shared catalog, approval, diagnostics, refresh, conflict, and product-projection owners.
• Add bounded/canonical source reads, fail-closed required-layer handling, redacted public MCP previews, last-valid recovery, and session-safe GUI discovery.
• Route BitFun-native/external command conflicts through one versioned Core control plane for Desktop and CLI, including guarded expansion and surface-local native facts.

Product behavior

• Custom commands keep the familiar plain /name form and show their source only when a choice is needed. No /builtin:, /external:, or ecosystem-prefixed syntax is introduced.
• OpenCode remains the naming baseline: /agent and /mcp are primary management commands; /agents and /mcps remain compatibility aliases. TUI keyboard and mouse selection preserve the exact alias chosen by the user.
• Known native slash commands remain available if external discovery fails. Unknown slash commands are held during discovery and are not silently sent to the model when the external catalog fails to load.
• Source-native precedence is resolved inside each adapter. Cross-provider and BitFun-native conflicts use explicit versioned choices; changed or removed candidates never silently switch implementations.
• GUI expansion only clears the submitted text when the composer is still unchanged, preserving drafts typed while asynchronous expansion is in flight.
• MCP discovery never starts a server. Activation still uses the existing BitFun MCP approval and runtime owners.

Safety and compatibility

• Codex MCP/Subagent discovery fails closed when an unsuppressed required config.toml layer cannot be read or parsed; later project layers cannot bypass the failure. The coordinator retains last-valid state without blocking application startup or chat.
• Public native and external MCP content/behavior revisions use domain-separated HMAC-SHA256 with a host-private persisted key. Native MCP JSON is canonicalized before signing so HashMap iteration order cannot trigger re-approval after a normal restart.
• The key is not serializable through public contracts and is redacted from Debug/log output. First upgrade to this revision format, or loss of the local key, requires one MCP re-confirmation; ordinary restarts reuse the same key.
• External failures remain isolated from native commands and the main application.

Scope boundaries

• No runtime host, Node/Bun runtime selection, external CLI process execution, Agent SDK, executable Hook handler, or second Agent/Tool runtime.
• No new ecosystem-specific shared DTO, numeric cross-ecosystem priority, or GUI/TUI-specific source scanner.
• No external-AI default-toggle change, MCP approval-card redesign, or Agent diagnostic UI change from the parallel settings work.
• Rules/Instructions, References, provider/model configuration, LSP, Formatter, Theme, Keybind, complete plugin inventories, and managed/session/plugin layers remain separately scoped.
• Durable design details stay consolidated in external-ai-work-sources-design.md; no PR-specific Claude/Codex design document is added.

Validation

• Claude Code, Codex, and OpenCode focused MCP adapter tests; Codex required-layer MCP/Subagent regressions
• Product-domain MCP revision contract tests: 2 passed
• Core native MCP HMAC, canonical JSON, and persisted-secret redaction tests: 3 passed
• cargo check -p bitfun-core --tests
• cargo check -p bitfun-cli --tests; prior CLI command regression suite and alias identity test passed
• Web external prompt-command tests: 10 passed; pnpm run type-check:web
• Core boundary check and self-test, repository hygiene, Rust formatting, and git diff --check

Independent review hardening

Independent architecture, logic, and product reviews were repeated against the final worktree. Follow-up fixes cover the public MCP revision oracle, deterministic native revisions, Codex required-layer bypass, GUI draft preservation and failed-catalog routing, exact TUI alias identity, and removal of duplicate HMAC ownership. No remaining introduced blocker was reported.