@ai-workbench/connect 0.0.0-stage → 0.7.5

package/lib/connect.js

@@ -0,0 +1,246 @@
+import { randomUUID } from 'node:crypto';
+import { dependency, fail, ok, need } from "./needs.js";
+import { isProjectName } from "./projects.js";
+import { createStartup } from "./startup.js";
+import { parseLoginStatus } from "./auth-status.js";
+export function validEnrollment(e) {
+    return typeof e === 'object' && e !== null && typeof e.host === 'string' && /^[a-zA-Z0-9][a-zA-Z0-9.-]*$/.test(e.host)
+        && typeof e.username === 'string' && /^emp-[a-z0-9][a-z0-9-]*$/.test(e.username)
+        && Number.isInteger(e.port) && e.port > 0 && e.port <= 65535
+        && e.session?.protocolVersion === 1 && [e.session.command, e.session.root, e.session.settingsPath].every(v => typeof v === 'string' && v.startsWith('/') && !/[\x00-\x1f\x7f]/.test(v))
+        && typeof e.knownHostsFile === 'string' && e.knownHostsFile.startsWith('/') && !/[\x00-\x1f\x7f]/.test(e.knownHostsFile)
+        && typeof e.projectRoot === 'string' && e.projectRoot.length > 0 && !/[\x00-\x1f\x7f]/.test(e.projectRoot);
+}
+export function createConnect(ports, emit, options = {}) {
+    let state = { phase: 'idle' }, generation = 0, disposed = false;
+    let flight;
+    const instanceId = randomUUID();
+    let connection = { instanceId, phase: 'unavailable', epoch: 0 };
+    const connectionListeners = new Set();
+    let startup;
+    const setConnection = (phase, need) => {
+        const next = { instanceId, phase, epoch: generation, ...(need ? { need } : {}) };
+        if (JSON.stringify(next) === JSON.stringify(connection))
+            return;
+        connection = structuredClone(next);
+        startup?.connectionChanged(next);
+        options.onConnectionState?.(structuredClone(next));
+        for (const listener of connectionListeners)
+            listener(structuredClone(next));
+    };
+    let controller = new AbortController();
+    const loginFlights = new Map();
+    const pending = new Set();
+    let disposal;
+    const track = (promise) => { pending.add(promise); void promise.then(() => pending.delete(promise), () => pending.delete(promise)); return promise; };
+    const publish = (s) => { state = structuredClone(s); emit(structuredClone(state)); };
+    const invalid = (g) => disposed ? fail('DISPOSED') : g !== generation ? fail('CONNECTION_LOST') : undefined;
+    const block = (r) => { if (!r.ok && !disposed) {
+        publish({ phase: 'blocked', need: r.error });
+        if (connection.phase !== 'connected')
+            setConnection('unavailable', r.error);
+    } return r; };
+    const transportBlock = (r) => { if (!r.ok && !disposed && connection.phase === 'connected') {
+        generation++;
+        controller.abort();
+        controller = new AbortController();
+        flight = undefined;
+        loginFlights.clear();
+    } const value = block(r); if (!r.ok && !disposed)
+        setConnection('unavailable', r.error); return value; };
+    const connect = () => {
+        if (disposed)
+            return Promise.resolve(fail('DISPOSED'));
+        if (state.target)
+            return Promise.resolve(ok(structuredClone(state.target)));
+        if (flight)
+            return flight;
+        const g = generation, signal = controller.signal;
+        if (connection.phase !== 'connected')
+            setConnection('connecting');
+        const run = async () => {
+            if (!ports.enrollment)
+                return transportBlock(dependency('S host-layout/enroll.json 适配器'));
+            if (!ports.network)
+                return transportBlock(dependency('N net-helper 生命周期/状态适配器'));
+            if (!ports.ssh)
+                return transportBlock(dependency('系统 SSH 适配器'));
+            try {
+                publish({ phase: 'enrolling' });
+                const e = await ports.enrollment.read(signal);
+                let stale = invalid(g);
+                if (stale)
+                    return stale;
+                if (!e.ok)
+                    return transportBlock(e);
+                if (!validEnrollment(e.value))
+                    return transportBlock(fail('ENROLLMENT_INVALID'));
+                publish({ phase: 'network' });
+                const n = await ports.network.connect(e.value, signal);
+                stale = invalid(g);
+                if (stale)
+                    return stale;
+                if (!n.ok)
+                    return transportBlock(n);
+                if (typeof n.value.proxyCommand !== 'string' || n.value.proxyCommand.length === 0 || /[\r\n\x00]/.test(n.value.proxyCommand))
+                    return transportBlock(dependency('有效的 N ProxyCommand'));
+                const { host, username, port, projectRoot, knownHostsFile, session, hostContext } = e.value;
+                const target = { host, username, port, projectRoot, knownHostsFile, session, ...(hostContext ? { hostContext } : {}), proxyCommand: n.value.proxyCommand };
+                publish({ phase: 'ssh' });
+                const verified = await ports.ssh.verify(target, signal);
+                stale = invalid(g);
+                if (stale)
+                    return stale;
+                if (!verified.ok)
+                    return transportBlock(verified);
+                publish({ phase: 'connected', target });
+                setConnection('connected');
+                return ok(structuredClone(target));
+            }
+            catch {
+                return invalid(g) ?? transportBlock(dependency('提供方调用失败，根因未查明；请检查 S/N/SSH 适配器'));
+            }
+        };
+        const promise = track(run());
+        flight = promise;
+        const clear = () => { if (flight === promise)
+            flight = undefined; };
+        void promise.then(clear, clear);
+        return promise;
+    };
+    const checkLogin = async (provider) => {
+        if (provider !== 'claude' && provider !== 'codex')
+            return fail('AUTH_STATUS_INVALID');
+        const g = generation;
+        const connected = await connect();
+        const staleConnection = invalid(g);
+        if (staleConnection)
+            return staleConnection;
+        if (!connected.ok)
+            return connected;
+        publish({ phase: 'checking-login', target: connected.value, provider });
+        try {
+            const raw = await ports.ssh.status(connected.value, provider, controller.signal);
+            const stale = invalid(g);
+            if (stale)
+                return stale;
+            const status = raw.ok ? parseLoginStatus(provider, raw.value) : raw;
+            if (!status.ok)
+                return ['network', 'ssh', 'enrollment'].includes(status.error.layer) ? transportBlock(status) : block(status);
+            publish(status.value.loggedIn ? { phase: 'ready', target: connected.value, provider } : { phase: 'connected', target: connected.value, provider });
+            return status;
+        }
+        catch {
+            return invalid(g) ?? block(fail('AUTH_STATUS_INVALID'));
+        }
+    };
+    const login = (provider) => {
+        if (provider !== 'claude' && provider !== 'codex')
+            return Promise.resolve(fail('LOGIN_FAILED'));
+        if (disposed)
+            return Promise.resolve(fail('DISPOSED'));
+        const prior = loginFlights.get(provider);
+        if (prior)
+            return prior;
+        const run = async () => {
+            const g = generation;
+            const connected = await connect();
+            const staleConnection = invalid(g);
+            if (staleConnection)
+                return staleConnection;
+            if (!connected.ok)
+                return connected;
+            if (!ports.login)
+                return block(dependency('Electron 登录助手及已确认设置'));
+            publish({ phase: 'login', target: connected.value, provider });
+            try {
+                const r = await ports.login.run(connected.value, provider, controller.signal);
+                const stale = invalid(g);
+                if (stale)
+                    return stale;
+                if (!r.ok)
+                    return ['network', 'ssh', 'enrollment'].includes(r.error.layer) ? transportBlock(r) : block(r);
+                const checked = await checkLogin(provider);
+                return checked.ok && !checked.value.loggedIn ? block(fail('LOGIN_FAILED')) : checked;
+            }
+            catch {
+                return invalid(g) ?? block(fail('LOGIN_FAILED'));
+            }
+        };
+        const promise = track(run());
+        loginFlights.set(provider, promise);
+        const clear = () => { if (loginFlights.get(provider) === promise)
+            loginFlights.delete(provider); };
+        void promise.then(clear, clear);
+        return promise;
+    };
+    const projectOperation = (operation, name) => track((async () => {
+        if (disposed)
+            return fail('DISPOSED');
+        if (operation === 'create' && !isProjectName(name))
+            return fail('PROJECT_NAME_INVALID');
+        const g = generation, connected = await connect();
+        const stale = invalid(g);
+        if (stale)
+            return stale;
+        if (!connected.ok)
+            return connected;
+        if (!ports.projects)
+            return dependency('L 主机项目接口适配器');
+        try {
+            const r = operation === 'list' ? await ports.projects.list(connected.value, controller.signal) : await ports.projects.create(connected.value, name, controller.signal);
+            return invalid(g) ?? r;
+        }
+        catch {
+            return invalid(g) ?? fail(operation === 'list' ? 'PROJECT_LIST_FAILED' : 'PROJECT_CREATE_FAILED');
+        }
+    })());
+    const unsubscribe = ports.network?.onState(event => {
+        if (disposed)
+            return;
+        if (event.kind === 'lost') {
+            generation++;
+            controller.abort();
+            controller = new AbortController();
+            flight = undefined;
+            loginFlights.clear();
+            block(fail('CONNECTION_LOST'));
+            setConnection('unavailable', need('CONNECTION_LOST'));
+        }
+        else {
+            void connect();
+        }
+    });
+    const operations = { getState: () => structuredClone(state), connect, checkLogin: provider => track(checkLogin(provider)), login };
+    startup = createStartup(operations, options.providers ?? ['codex', 'claude'], options.onPromptState, options.onPromptResult, instanceId);
+    return {
+        ...operations,
+        getContractInfo: () => ({ apiVersion: '0.7.0', status: 'implemented', workspaceBinding: 'native-local-v1' }),
+        getEnrollmentState: () => ({ instanceId, revision: 0, phase: 'blocked', need: need('DEPENDENCY_REQUIRED') }), onEnrollmentState: () => () => { },
+        importEnrollment: async () => dependency('官方profileContext与原生目录选择服务'),
+        getWorkspaceBindingState: () => ({ instanceId, revision: 0, items: [] }), onWorkspaceBindingState: () => () => { }, acknowledgeWorkspaceNotice: async () => dependency('官方工作区说明回执'), resolveSessionProject: async () => dependency('官方会话存储与L可信工作区关联'),
+        listProjects: () => projectOperation('list'), createProject: name => projectOperation('create', name), getSshTarget: connect,
+        getConnectionState: () => structuredClone(connection), onConnectionState: listener => { connectionListeners.add(listener); return () => { connectionListeners.delete(listener); }; },
+        getLoginPromptState: startup.getState, onLoginPromptState: startup.subscribe,
+        requestLoginPrompt: startup.request, respondLoginPrompt: startup.respond,
+        refreshLoginPrompts: async () => { await startup.check(); const s = startup.getState(); return s.phase === 'disposed' ? fail('DISPOSED') : s.phase === 'blocked' ? fail(s.technicalDetails.code ?? 'AUTH_STATUS_INVALID') : ok(s); },
+        login: async (provider) => { const request = await startup.request(provider, 'automatic'); if (!request.ok)
+            return request; return request.value.logins[provider] === true ? ok({ provider, loggedIn: true }) : fail('LOGIN_REQUIRED'); },
+        ensureReady: provider => track((async () => {
+            const g = generation;
+            const r = await checkLogin(provider);
+            const stale = invalid(g);
+            if (stale)
+                return stale;
+            if (!r.ok)
+                return r;
+            if (!r.value.loggedIn) {
+                const request = await startup.request(provider, 'automatic');
+                return invalid(g) ?? (!request.ok ? request : fail('LOGIN_REQUIRED'));
+            }
+            return connect();
+        })()),
+        dispose: () => { if (disposal)
+            return disposal; startup.stop(); disposed = true; generation++; controller.abort(); unsubscribe?.(); publish({ phase: 'disposed' }); setConnection('disposed'); connectionListeners.clear(); disposal = Promise.allSettled([...pending]).then(() => startup.dispose()); return disposal; },
+    };
+}

package/lib/cordis.d.ts

@@ -0,0 +1,15 @@
+import type { ConnectApi, ConnectState, ConnectionState, LoginPromptState, LoginPromptResult, EnrollmentState, WorkspaceBindingState } from './api.ts';
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        aiWorkbenchConnect: ConnectApi;
+    }
+    interface Events {
+        'ai-workbench/enrollment-state': (state: EnrollmentState) => void;
+        'ai-workbench/workspace-binding-state': (state: WorkspaceBindingState) => void;
+        'ai-workbench/workspace-diagnostic': (error: unknown) => void;
+        'ai-workbench/connect-state': (state: ConnectState) => void;
+        'ai-workbench/connection-state': (state: ConnectionState) => void;
+        'ai-workbench/login-prompt-state': (state: LoginPromptState) => void;
+        'ai-workbench/login-prompt-result': (result: LoginPromptResult) => void;
+    }
+}

package/lib/cordis.js

@@ -0,0 +1 @@
+export {};

package/lib/defaults.d.ts

@@ -0,0 +1,29 @@
+export declare const L_DEFAULTS: Readonly<{
+    enrollmentMetadataMaxBytes: 1048576;
+    commandOutputMaxBytes: 1048576;
+    remoteKillGraceMs: 1000;
+    componentDownloadMaxRedirects: 3;
+    maxDownloadBytes: 200000000;
+    maxExtractedBytes: 600000000;
+    loginOutputMaxBytes: 1048576;
+    ipcMaxBytes: 1048576;
+}>;
+export declare const ELECTRON_PIN: Readonly<{
+    source: "https://github.com/electron/electron/releases/download/v44.0.0/electron-v44.0.0-darwin-arm64.zip";
+    sha256: "076d79742986e1b100b69ebecc691cb07368045e54c9087cef631b8622b76a80";
+    executable: "Electron.app/Contents/MacOS/Electron";
+}>;
+export declare const NETWORK_DEFAULTS: Readonly<{
+    proxyListen: "127.0.0.1:0";
+    logUpload: false;
+    statusRefreshIntervalSeconds: 2;
+    dialTimeoutSeconds: 20;
+    headerTimeoutSeconds: 10;
+    enrollmentObservationSeconds: 30;
+    httpMaxHeaderBytes: 1048576;
+    httpMaxResponseHeaderBytes: 1048576;
+    startupObservationSeconds: 35;
+    shutdownObservationSeconds: 10;
+    controlResponseMaxBytes: 65536;
+    downloadMaxRedirects: 3;
+}>;

package/lib/defaults.js

@@ -0,0 +1,4 @@
+// Owner-approved technical settings (2026-10-20, part two). One source for schema and composition.
+export const L_DEFAULTS = Object.freeze({ enrollmentMetadataMaxBytes: 1048576, commandOutputMaxBytes: 1048576, remoteKillGraceMs: 1000, componentDownloadMaxRedirects: 3, maxDownloadBytes: 200000000, maxExtractedBytes: 600000000, loginOutputMaxBytes: 1048576, ipcMaxBytes: 1048576 });
+export const ELECTRON_PIN = Object.freeze({ source: 'https://github.com/electron/electron/releases/download/v44.0.0/electron-v44.0.0-darwin-arm64.zip', sha256: '076d79742986e1b100b69ebecc691cb07368045e54c9087cef631b8622b76a80', executable: 'Electron.app/Contents/MacOS/Electron' });
+export const NETWORK_DEFAULTS = Object.freeze({ proxyListen: '127.0.0.1:0', logUpload: false, statusRefreshIntervalSeconds: 2, dialTimeoutSeconds: 20, headerTimeoutSeconds: 10, enrollmentObservationSeconds: 30, httpMaxHeaderBytes: 1048576, httpMaxResponseHeaderBytes: 1048576, startupObservationSeconds: 35, shutdownObservationSeconds: 10, controlResponseMaxBytes: 65536, downloadMaxRedirects: 3 });

package/lib/electron.d.ts

@@ -0,0 +1,8 @@
+import type { LoginBoot, LoginWindow } from './login.ts';
+export interface ElectronLaunch {
+    executable: string;
+    entry: string;
+    cacheDir: string;
+    ipcMaxBytes: number;
+}
+export declare function launchElectron(settings: ElectronLaunch, boot: LoginBoot, onCode: (code: string) => Promise<void>, signal: AbortSignal): Promise<LoginWindow>;

package/lib/electron.js

@@ -0,0 +1,83 @@
+import { spawn } from 'node:child_process';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { join, isAbsolute } from 'node:path';
+import { StringDecoder } from 'node:string_decoder';
+import { privateDirectory } from "./private-files.js";
+export async function launchElectron(settings, boot, onCode, signal) {
+    if (signal.aborted || !isAbsolute(settings.executable) || !isAbsolute(settings.entry) || !Number.isSafeInteger(settings.ipcMaxBytes) || settings.ipcMaxBytes < 1)
+        throw new Error('HELPER_SETTINGS_REQUIRED');
+    await privateDirectory(settings.cacheDir);
+    if (signal.aborted)
+        throw new Error('HELPER_CANCELLED');
+    const userDataDir = await mkdtemp(join(settings.cacheDir, 'session-'));
+    if (signal.aborted) {
+        await rm(userDataDir, { recursive: true });
+        throw new Error('HELPER_CANCELLED');
+    }
+    const child = spawn(settings.executable, [settings.entry], { shell: false, stdio: ['pipe', 'pipe', 'pipe'], env: { ...process.env, ELECTRON_RUN_AS_NODE: undefined, ELECTRON_ENABLE_LOGGING: undefined } });
+    let resolveReady = () => { }, rejectReady = () => { };
+    const ready = new Promise((yes, no) => { resolveReady = yes; rejectReady = no; });
+    let failed = false, line = '', size = 0;
+    const decoder = new StringDecoder('utf8');
+    const abort = () => { failed = true; child.kill('SIGTERM'); };
+    const close = () => { if (child.exitCode === null && child.signalCode === null && !child.stdin.destroyed) {
+        child.stdin.end(JSON.stringify({ type: 'close' }) + '\n');
+    } return closed; };
+    child.stdout.on('data', (chunk) => {
+        size += chunk.length;
+        if (size > settings.ipcMaxBytes) {
+            abort();
+            return;
+        }
+        line += decoder.write(chunk);
+        const lines = line.split('\n');
+        line = lines.pop();
+        for (const value of lines) {
+            try {
+                const e = JSON.parse(value);
+                if (e.type === 'ready')
+                    resolveReady();
+                else if (e.type === 'claude-code' && boot.provider === 'claude' && typeof e.code === 'string')
+                    void onCode(e.code).catch(abort);
+                else if (e.type === 'closed') { /* process exit owns cleanup acknowledgement */ }
+                else
+                    abort();
+            }
+            catch {
+                abort();
+            }
+        }
+    });
+    // Chromium diagnostics are deliberately not forwarded to logs; failures use fixed public codes.
+    child.stderr.resume();
+    child.stdin.on('error', abort);
+    child.once('error', () => { failed = true; });
+    const closed = new Promise((yes, no) => child.once('close', async (code) => {
+        signal.removeEventListener('abort', abort);
+        rejectReady(new Error('HELPER_CLOSED'));
+        try {
+            await rm(userDataDir, { recursive: true });
+            if (failed || code !== 0)
+                no(new Error('HELPER_FAILED'));
+            else
+                yes();
+        }
+        catch {
+            no(new Error('HELPER_CLEANUP_FAILED'));
+        }
+    }));
+    // The child may fail before the caller receives its handle.
+    void closed.catch(() => { });
+    signal.addEventListener('abort', abort, { once: true });
+    child.stdin.write(JSON.stringify({ ...boot, userDataDir }) + '\n');
+    if (signal.aborted)
+        abort();
+    try {
+        await ready;
+        return { closed, close };
+    }
+    catch {
+        await closed.catch(() => { });
+        throw new Error('HELPER_FAILED');
+    }
+}

package/lib/enrollment.d.ts

@@ -0,0 +1,3 @@
+import type { Result } from './api.ts';
+import type { Enrollment } from './ports.ts';
+export declare function readEnrollment(packageDir: string, trustDir: string, maxMetadataBytes?: number): Promise<Result<Enrollment>>;

package/lib/enrollment.js

@@ -0,0 +1,78 @@
+import { lstat, open, rename, rm } from 'node:fs/promises';
+import { join, isAbsolute } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { fail, ok } from "./needs.js";
+import { privateDirectory, privateFile, readPrivate } from "./private-files.js";
+export async function readEnrollment(packageDir, trustDir, maxMetadataBytes) {
+    try {
+        if (!isAbsolute(packageDir) || !isAbsolute(trustDir))
+            return fail('ENROLLMENT_INVALID');
+        const dir = await lstat(packageDir);
+        if (!dir.isDirectory() || dir.isSymbolicLink() || dir.uid !== process.getuid() || (dir.mode & 0o077) !== 0)
+            return fail('ENROLLMENT_INVALID');
+        const wire = JSON.parse(await readPrivate(join(packageDir, 'enroll.json'), maxMetadataBytes));
+        if (wire.schemaVersion !== 1 || !/^emp-[a-z0-9][a-z0-9-]*$/.test(wire.employee?.username) || wire.employee.username.length > 32)
+            return fail('ENROLLMENT_INVALID');
+        const user = wire.employee.username, home = '/Users/' + user;
+        const rows = (v) => Array.isArray(v) && v.every(r => r && typeof r.id === 'string' && typeof r.status === 'string' && !/[\x00-\x1f\x7f]/.test(r.id + r.status));
+        if (!['production', 'test'].includes(wire.hostEnforcement) || wire.host?.enforcement !== wire.hostEnforcement || ![0, 1].includes(wire.checkExitCode) || !rows(wire.failedChecks) || !rows(wire.unverifiedChecks))
+            return fail('ENROLLMENT_INVALID');
+        const hasIssues = wire.failedChecks.length + wire.unverifiedChecks.length > 0;
+        if ((wire.checkExitCode === 0 && hasIssues) || (wire.checkExitCode === 1 && !hasIssues) || (wire.hostEnforcement === 'production' && (hasIssues || wire.checkExitCode !== 0)))
+            return fail('ENROLLMENT_INVALID');
+        const hostContext = { enforcement: wire.hostEnforcement, checkExitCode: wire.checkExitCode, failedChecks: wire.failedChecks.map(({ id, status }) => ({ id, status })), unverifiedChecks: wire.unverifiedChecks.map(({ id, status }) => ({ id, status })) };
+        if (wire.employee.home !== home || wire.employee.projectsRoot !== home + '/projects' || wire.employee.tag !== 'tag:aw-' + user || wire.host?.tag !== 'tag:aw-host' || !Number.isInteger(wire.host?.sshPort) || wire.host.sshPort < 1 || wire.host.sshPort > 65535 || !(/^[a-zA-Z0-9][a-zA-Z0-9.-]*$/).test(wire.host?.name))
+            return fail('ENROLLMENT_INVALID');
+        if (wire.session?.protocolVersion !== 1 || typeof wire.session.command !== 'string' || !wire.session.command.startsWith('/') || typeof wire.session.settingsPath !== 'string' || !wire.session.settingsPath.startsWith('/') || wire.session.root !== home + '/.aw/s' || [wire.session.command, wire.session.settingsPath].some((v) => /[\x00-\x1f\x7f]/.test(v)) || wire.authKeyDelivery?.mode !== 'file' || wire.authKeyDelivery.source !== 'administrator-stdin' || typeof wire.authKeyDelivery.path !== 'string' || !(/^[a-zA-Z0-9._-]+$/).test(wire.authKeyDelivery.path) || ['.', '..'].includes(wire.authKeyDelivery.path))
+            return fail('ENROLLMENT_INVALID');
+        // Metadata only. The enrollment secret is opened exclusively by N.
+        let authKeyFile = join(packageDir, wire.authKeyDelivery.path);
+        try {
+            await privateFile(authKeyFile);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                authKeyFile = undefined;
+            else
+                throw error;
+        }
+        const keys = wire.host.knownHosts;
+        if (!Array.isArray(keys) || keys.length === 0)
+            return fail('HOST_TRUST_REQUIRED');
+        if (keys.some((k) => typeof k !== 'string' || /[\r\n\x00]/.test(k) || !(/^(\S+) (ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp\d+|sk-ssh-ed25519@openssh.com) [A-Za-z0-9+/=]+(?: .*)?$/).test(k)))
+            return fail('HOST_TRUST_REQUIRED');
+        const expected = wire.host.sshPort === 22 ? wire.host.name : `[${wire.host.name}]:${wire.host.sshPort}`;
+        if (keys.some((k) => !k.split(' ')[0].split(',').includes(expected)))
+            return fail('HOST_TRUST_REQUIRED');
+        await privateDirectory(trustDir);
+        const destination = join(trustDir, 'known_hosts'), temp = join(trustDir, 'known_hosts-' + randomUUID());
+        // N holds this immutable handoff path; reopening must never replace its inode.
+        let exists = false;
+        try {
+            const cached = await readPrivate(destination, maxMetadataBytes);
+            if (cached !== keys.join('\n') + '\n')
+                return fail('HOST_KEY_MISMATCH');
+            exists = true;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        if (!exists) {
+            const file = await open(temp, 'wx', 0o600);
+            try {
+                await file.writeFile(keys.join('\n') + '\n');
+                await file.close();
+                await rename(temp, destination);
+            }
+            finally {
+                await file.close();
+                await rm(temp, { force: true });
+            }
+        }
+        return ok({ authKeyFile, hostContext, host: wire.host.name, username: user, port: wire.host.sshPort, projectRoot: wire.employee.projectsRoot, knownHostsFile: destination, session: { command: wire.session.command, root: wire.session.root, settingsPath: wire.session.settingsPath, protocolVersion: 1 } });
+    }
+    catch {
+        return fail('ENROLLMENT_INVALID');
+    }
+}

package/lib/index.d.ts

@@ -0,0 +1,40 @@
+import type { Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+export type * from './cordis.ts';
+import type { Ports } from './ports.ts';
+import { type ComponentInventory } from './components.ts';
+import type { NetworkSettings } from './network.ts';
+import type { AssemblySettings } from './profile-activation.ts';
+export { writeNetworkConfig, createNetworkClient } from './network.ts';
+export type * from './api.ts';
+export { createConnect } from './connect.ts';
+export { sshArgs } from './ssh.ts';
+export declare const name = "ai-workbench-connect";
+export declare const inject: string[];
+export interface Config {
+    inventory?: ComponentInventory;
+    enrollmentMetadataMaxBytes?: number;
+    enrollmentPackageDir?: string;
+    trustDir?: string;
+    commandOutputMaxBytes?: number;
+    network?: (NetworkSettings & AssemblySettings);
+    helper?: {
+        componentDownloadMaxRedirects?: number;
+        remoteKillGraceMs?: number;
+        maxRedirects?: number;
+        source?: string;
+        sha256?: string;
+        cacheDir?: string;
+        maxDownloadBytes?: number;
+        maxExtractedBytes?: number;
+        executable?: string;
+        loginOutputMaxBytes?: number;
+        ipcMaxBytes?: number;
+    };
+}
+export declare const Config: z<Config>;
+export declare function register(ctx: Context, ports: Ports, inventory?: ComponentInventory, extend?: (api: import('./api.ts').ConnectApi) => void): void;
+export declare function apply(ctx: Context, config?: Config): void;
+export { createProfileEnrollment } from './profile-enrollment.ts';
+export { createWorkspaceBindings } from './workspace-bindings.ts';
+export { profileSettings } from './profile-settings.ts';

package/lib/index.js

@@ -0,0 +1,48 @@
+import z from '@deepseek-ai/schemastery';
+import { createConnect } from "./connect.js";
+import { configuredPorts } from "./integration.js";
+import { attachProfileRuntime } from "./profile-runtime.js";
+import { profileSettings } from "./profile-settings.js";
+import { createComponentProgress } from "./component-download.js";
+import { L_DEFAULTS, NETWORK_DEFAULTS } from "./defaults.js";
+import { registerComponents } from "./components.js";
+export { writeNetworkConfig, createNetworkClient } from "./network.js";
+export { createConnect } from "./connect.js";
+export { sshArgs } from "./ssh.js";
+export const name = 'ai-workbench-connect';
+export const inject = ['aiWorkbenchNetwork'];
+const positive = () => z.number().step(1).min(1);
+// Administrator settings are optional in schema so the loaded service can explain missing prerequisites.
+// aiWorkbenchNetwork itself is a required Cordis injection; missing N holds this module from loading.
+// Own technical defaults use the approved settings record; no global DSH policy is changed.
+export const Config = z.object({
+    enrollmentMetadataMaxBytes: positive().max(2147483647).default(L_DEFAULTS.enrollmentMetadataMaxBytes).description('开通元数据与工作区关联文件字节上限；默认1MiB，可由管理员修改；不读取key内容'),
+    inventory: z.object({ network: z.string(), connect: z.string(), claude: z.string(), codex: z.string() }).description('由bundle真实包版本自动生成，只读交付事实，不是策略默认'),
+    enrollmentPackageDir: z.string().description('开通包目录：由安装交付，员工不手填；owner已定稿，交付显式配置'),
+    trustDir: z.string().description('主机信任缓存目录；owner已定稿，交付显式配置'),
+    commandOutputMaxBytes: positive().default(L_DEFAULTS.commandOutputMaxBytes).description('CLI检查输出内存上限（字节）；owner已定1048576，管理员可改'),
+    network: z.object({ executable: z.string(), runtimeDir: z.string(), stateDir: z.string(), configFile: z.string(), helperLogFile: z.string(), nodeName: z.string(), startupObservationSeconds: z.number().min(0.001).max(2147483.647).default(NETWORK_DEFAULTS.startupObservationSeconds), shutdownObservationSeconds: z.number().min(0.001).max(2147483.647).default(NETWORK_DEFAULTS.shutdownObservationSeconds), controlResponseMaxBytes: positive().default(NETWORK_DEFAULTS.controlResponseMaxBytes), downloadMaxRedirects: z.number().step(1).min(0).default(NETWORK_DEFAULTS.downloadMaxRedirects), proxyListen: z.string().default(NETWORK_DEFAULTS.proxyListen), logUpload: z.boolean().default(NETWORK_DEFAULTS.logUpload), statusRefreshIntervalSeconds: z.number().min(0.001).max(2147483.647).default(NETWORK_DEFAULTS.statusRefreshIntervalSeconds), dialTimeoutSeconds: z.number().min(1e-9).default(NETWORK_DEFAULTS.dialTimeoutSeconds), headerTimeoutSeconds: z.number().min(0.001).max(2147483.647).default(NETWORK_DEFAULTS.headerTimeoutSeconds), enrollmentObservationSeconds: z.number().min(1e-9).default(NETWORK_DEFAULTS.enrollmentObservationSeconds), httpMaxHeaderBytes: positive().default(NETWORK_DEFAULTS.httpMaxHeaderBytes), httpMaxResponseHeaderBytes: positive().default(NETWORK_DEFAULTS.httpMaxResponseHeaderBytes), controlMaxBytes: positive() }).description('N v1 交接设置；沿owner已定技术值自动装配，管理员可改；路径由当前用户/profile派生，员工不填'),
+    helper: z.object({
+        componentDownloadMaxRedirects: z.number().step(1).min(0).default(L_DEFAULTS.componentDownloadMaxRedirects).description('组件直接HTTPS下载的重定向次数上限；默认3，0拒绝重定向；管理员可改，不影响OAuth主机出口'),
+        remoteKillGraceMs: z.number().step(1).min(0).max(2147483647).default(L_DEFAULTS.remoteKillGraceMs).description('远端本轮登录进程组结束宽限毫秒；owner已定1000，0立即KILL，管理员可改'),
+        maxRedirects: z.number().step(1).min(0).description('兼容旧配置；0.5默认路径改由N插件downloadMaxRedirects控制，此项不再生效'),
+        source: z.string().description('darwin-arm64默认已定Electron44.0.0官方ZIP；其他平台无默认，管理员可改'), sha256: z.string().description('darwin-arm64默认已定44.0.0下载SHA256；管理员可改，必须校验'),
+        cacheDir: z.string().description('默认从当前profile自动派生ai-workbench-connect/login-component-cache；管理员可改，员工不填路径'), maxDownloadBytes: positive().default(L_DEFAULTS.maxDownloadBytes).description('下载字节上限；owner已定200000000，管理员可改'), maxExtractedBytes: positive().default(L_DEFAULTS.maxExtractedBytes).description('解压字节上限；owner已定600000000，管理员可改'),
+        executable: z.string().description('darwin-arm64默认Electron.app/Contents/MacOS/Electron；其他平台无默认，管理员可改'), loginOutputMaxBytes: positive().default(L_DEFAULTS.loginOutputMaxBytes).description('登录进程输出字节上限；owner已定1048576，管理员可改'), ipcMaxBytes: positive().default(L_DEFAULTS.ipcMaxBytes).description('私有IPC字节上限；owner已定1048576，管理员可改'),
+    }),
+});
+export function register(ctx, ports, inventory, extend) {
+    const api = createConnect(ports, state => ctx.emit('ai-workbench/connect-state', state), { providers: inventory && !inventory.codex ? ['claude'] : ['codex', 'claude'], onConnectionState: state => ctx.emit('ai-workbench/connection-state', state), onPromptState: state => ctx.emit('ai-workbench/login-prompt-state', state), onPromptResult: result => ctx.emit('ai-workbench/login-prompt-result', result) });
+    extend?.(api);
+    ctx.provide('aiWorkbenchConnect', api);
+    ctx.effect(() => { void api.refreshLoginPrompts(); return () => api.dispose(); });
+}
+export function apply(ctx, config = {}) {
+    config = profileSettings(config, ctx.get('profileContext')?.dir);
+    const network = ctx.get('aiWorkbenchNetwork'), component = createComponentProgress(), ports = configuredPorts(config, network, component);
+    register(ctx, ports, config.inventory, api => attachProfileRuntime(ctx, api, ports, config, network));
+    registerComponents(ctx, config.inventory, config.helper?.cacheDir, component);
+}
+export { createProfileEnrollment } from "./profile-enrollment.js";
+export { createWorkspaceBindings } from "./workspace-bindings.js";
+export { profileSettings } from "./profile-settings.js";

package/lib/integration.d.ts

@@ -0,0 +1,5 @@
+import type { Config } from './index.ts';
+import type { Ports } from './ports.ts';
+import { type NetworkProvider } from './provider.ts';
+import { type ComponentProgressStore } from './component-download.ts';
+export declare function configuredPorts(config: Config, provider?: NetworkProvider, component?: ComponentProgressStore): Ports;

package/lib/integration.js

@@ -0,0 +1,47 @@
+import { fileURLToPath } from 'node:url';
+import { readEnrollment } from "./enrollment.js";
+import { adaptNetwork } from "./provider.js";
+import { createRunner, createRemoteLogin } from "./processes.js";
+import { createSsh, sshArgs } from "./ssh.js";
+import { createProjects } from "./projects.js";
+import { remoteLoginCommand } from "./remote-login.js";
+import { runLogin } from "./login.js";
+import { ensureHelper } from "./cache.js";
+import { launchElectron } from "./electron.js";
+import { need, fail } from "./needs.js";
+import { createComponentProgress, downloadComponent } from "./component-download.js";
+export function configuredPorts(config, provider, component = createComponentProgress()) {
+    const ports = {};
+    const network = provider ? adaptNetwork(provider) : undefined;
+    if (config.enrollmentPackageDir && config.trustDir)
+        ports.enrollment = { read: () => readEnrollment(config.enrollmentPackageDir, config.trustDir) };
+    else if (provider)
+        ports.enrollment = { read: async () => fail('SETTINGS_REQUIRED') };
+    if (config.commandOutputMaxBytes !== undefined) {
+        const runner = createRunner(config.commandOutputMaxBytes);
+        ports.ssh = createSsh(runner, config.commandOutputMaxBytes);
+        ports.projects = createProjects(runner);
+    }
+    else if (provider)
+        ports.ssh = { verify: async () => fail('SETTINGS_REQUIRED'), status: async () => fail('SETTINGS_REQUIRED') };
+    if (network) {
+        ports.network = network;
+        ports.login = { run: async (target, provider, signal) => {
+                const h = config.helper;
+                if (!h || !Number.isSafeInteger(h.remoteKillGraceMs) || h.remoteKillGraceMs < 0 || h.remoteKillGraceMs > 2147483647 || ![h.source, h.sha256, h.cacheDir, h.executable].every(x => typeof x === 'string' && x) || !Number.isSafeInteger(h.componentDownloadMaxRedirects) || h.componentDownloadMaxRedirects < 0 || ![h.maxDownloadBytes, h.maxExtractedBytes, h.loginOutputMaxBytes, h.ipcMaxBytes].every(x => Number.isSafeInteger(x) && x > 0))
+                    return { ok: false, error: need('SETTINGS_REQUIRED') };
+                const attempt = component.begin();
+                const result = await ensureHelper(h, { download: source => downloadComponent(source, signal, h.componentDownloadMaxRedirects), signal, onProgress: attempt.update });
+                if (!result.ok)
+                    return result;
+                if (signal.aborted)
+                    return fail('LOGIN_FAILED');
+                return runLogin(target, provider, {
+                    start: (t, p, s) => createRemoteLogin('ssh', [...sshArgs(t), remoteLoginCommand(p, h.remoteKillGraceMs)], p, h.loginOutputMaxBytes, s, 'remote-control'),
+                    acquireProxy: (_t, s) => network.acquireProxy(s),
+                    open: (boot, onCode, s) => launchElectron({ executable: result.value, entry: fileURLToPath(new URL('../helper/main.cjs', import.meta.url)), cacheDir: h.cacheDir, ipcMaxBytes: h.ipcMaxBytes }, boot, onCode, s),
+                }, signal);
+            } };
+    }
+    return ports;
+}