fix(web): local-mode permission UX + stop OpenCode 500 spam

[DullJZ]

Summary

Local mode (agentState.controlledByUser === true) cannot remotely approve permissions or list OpenCode models/effort options (no session RPC handlers). The web UI still presented those controls and polled those endpoints, which looked broken and flooded the hub with 500s.

This PR makes local mode honest in the UI and stops the useless session RPCs.

Commits

1. fix(web): hide remote permission actions in local mode
2. fix(web): skip OpenCode model/effort queries in local mode

Problem

1) Local OpenCode looks remotely approvable

• Local OpenCode mirrors permission.asked into agentState.requests, so the web shows pending permissions.
• Local launcher only registers Abort/Switch RPC; permission is remote-only.
• Users could still click Allow/Deny (and voice could try to approve), but nothing could complete the request in the TUI.

2) Local OpenCode floods hub with 500s

• SessionChat enabled:

  • GET /api/sessions/:id/opencode-models
  • GET /api/sessions/:id/opencode-reasoning-effort-options

  for every active OpenCode session, including local.

• Those handlers exist only in the remote launcher.

• Missing handler → RpcTargetMissingError → HTTP 500.

• React Query retry + 1s discovery polling multiplies the noise.

Changes

Permission UX (local mode)

• Plumb controlledByUser through chat context → tool cards.
• Hide remote approval actions in:
  • PermissionFooter
  • AskUserQuestionFooter
  • RequestUserInputFooter
• Show local guidance instead:
  • EN: "Approve this in the local terminal, or switch to remote mode first."
  • ZH: "请在本地终端中审批，或先切换到远程模式。"
• Voice path:
  • refuse approvePermission / denyPermission when local
  • do not notify voice of local pending permissions

OpenCode query gating (local mode)

• Gate both session queries with && !controlledByUser, matching existing Grok/Codex local gating:
  • useOpencodeModels
  • useOpencodeReasoningEffortOptions

Out of scope

• Enabling remote approval while still in local mode
• Registering permission/model RPC handlers in the local launcher
• Hub hard-reject for missing permission RPC (frontend-only defense)

[github-actions]

Findings
No findings.

Summary
Review mode: initial
Reviewed the full diff for local-mode permission UX and OpenCode model/effort query gating. No correctness, security, data-loss, performance, or maintainability issue met the reporting threshold. Residual risk: I could not execute the new Vitest coverage in this runner because bun is not installed.

Testing
Not run (automation): bun not found on PATH when attempting bun test web/src/components/ToolCard/PermissionFooter.test.tsx web/src/realtime/realtimeClientTools.test.ts.

HAPI Bot