@ai-workbench/connect 0.7.9 → 0.7.11

package/lib/login-diagnostics.d.ts

@@ -0,0 +1,26 @@
+import type { RemoteConversationDetail } from './api.ts';
+import { type ConversationDetailOptions } from './conversation-details.ts';
+export declare function validLoginDiagnostic(detail: RemoteConversationDetail): boolean;
+export declare function createLoginDiagnostics(options: Omit<ConversationDetailOptions, 'storageName' | 'validate' | 'knownKinds'>): {
+    appendLoginDiagnostic: (detail: RemoteConversationDetail) => Promise<import("./api.ts").Result<{
+        eventId: string;
+        recorded: true;
+    }>>;
+    getLoginDiagnosticReceipt: (query: {
+        eventId: string;
+        sessionId: string;
+        provider: import("./api.ts").Provider;
+    }) => Promise<import("./api.ts").Result<{
+        eventId: string;
+        recorded: false;
+    } | {
+        eventId: string;
+        recorded: true;
+        detail: RemoteConversationDetail;
+    }>>;
+    listLoginDiagnostics: (query: import("./api.ts").RemoteDetailQuery) => Promise<import("./api.ts").Result<import("./api.ts").RemoteDetailPage>>;
+    getLoginDiagnosticState: () => import("./api.ts").RemoteConversationDetailState;
+    onLoginDiagnosticState: (listener: (state: import("./api.ts").RemoteConversationDetailState) => void) => () => void;
+    observeConnection: (state: import("./api.ts").ConnectionState) => void;
+    dispose: () => Promise<void>;
+};

package/lib/login-diagnostics.js

@@ -0,0 +1,42 @@
+import { createConversationDetails, validRemoteConversationDetail } from "./conversation-details.js";
+import { validAuthDiagnosticReason } from "./auth-diagnostics.js";
+const object = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+const keys = (value, required, optional = []) => required.every(key => Object.hasOwn(value, key)) && Object.keys(value).every(key => required.includes(key) || optional.includes(key));
+const providers = (value) => Array.isArray(value) && value.every(provider => provider === 'claude' || provider === 'codex') && new Set(value).size === value.length;
+// Only structured status facts belong here. Ordinary user-turn payloads retain D19's scope.
+export function validLoginDiagnostic(detail) {
+    if (!validRemoteConversationDetail(detail) || detail.kind !== 'login-check')
+        return false;
+    const p = detail.payload;
+    if (!object(p) || !keys(p, ['reason', 'connection', 'login'], ['observedLoginInstanceId', 'officialReason', 'officialReasonRejected']))
+        return false;
+    const c = p.connection, l = p.login;
+    if (typeof p.reason !== 'string' || !/^[A-Z][A-Z0-9_]*$/.test(p.reason) || !object(c) || !object(l))
+        return false;
+    if (!keys(c, ['phase', 'instanceId', 'epoch']) || !['connecting', 'connected', 'unavailable', 'disposed'].includes(c.phase) || c.instanceId !== detail.instanceId || c.epoch !== detail.epoch)
+        return false;
+    if (!keys(l, ['phase', 'instanceId', 'logins', 'queuedProviders', 'checkingProviders']) || !['checking', 'blocked', 'login-required', 'authorizing', 'idle', 'disposed'].includes(l.phase) || !object(l.logins))
+        return false;
+    // The observed ID is diagnostic evidence only. Event/connection scope remains current.
+    if (Object.hasOwn(p, 'observedLoginInstanceId')) {
+        const observed = p.observedLoginInstanceId;
+        if (p.reason !== 'LOGIN_INSTANCE_MISMATCH' || typeof observed !== 'string' || !observed.length || /[\x00-\x1f\x7f]/.test(observed) || observed === detail.instanceId || l.instanceId !== observed)
+            return false;
+    }
+    else if (l.instanceId !== detail.instanceId)
+        return false;
+    if (!keys(l.logins, [], ['claude', 'codex']) || !Object.values(l.logins).every(value => typeof value === 'boolean' || value === 'absent') || !providers(l.queuedProviders) || !providers(l.checkingProviders))
+        return false;
+    if (p.officialReasonRejected !== undefined) {
+        const rejected = p.officialReasonRejected;
+        if (p.reason !== 'OFFICIAL_REASON_UNSUPPORTED' || p.officialReason !== undefined || !object(rejected) || !keys(rejected, ['bytes', 'sha256']) || !Number.isSafeInteger(rejected.bytes) || Number(rejected.bytes) < 0 || typeof rejected.sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(rejected.sha256))
+            return false;
+    }
+    if (p.reason === 'OFFICIAL_REASON_UNSUPPORTED' && p.officialReasonRejected === undefined)
+        return false;
+    return p.officialReason === undefined || validAuthDiagnosticReason(p.officialReason);
+}
+export function createLoginDiagnostics(options) {
+    const details = createConversationDetails({ ...options, get maxEventBytes() { return options.maxEventBytes; }, get pageSize() { return options.pageSize; }, context: () => options.context(), scope: (sessionId, provider) => options.scope(sessionId, provider), storageName: 'login-diagnostics', knownKinds: ['login-check'], validate: validLoginDiagnostic });
+    return { appendLoginDiagnostic: details.appendRemoteConversationDetail, getLoginDiagnosticReceipt: details.getRemoteConversationDetailReceipt, listLoginDiagnostics: details.listRemoteConversationDetails, getLoginDiagnosticState: details.getRemoteConversationDetailState, onLoginDiagnosticState: details.onRemoteConversationDetailState, observeConnection: details.observeConnection, dispose: details.dispose };
+}

package/lib/processes.js

@@ -2,6 +2,7 @@ import { spawn } from 'node:child_process';
 import { StringDecoder } from 'node:string_decoder';
 import { extractLoginUrl } from "./login.js";
 import { fail, ok } from "./needs.js";
+import { AuthDiagnosticError, exceptionSummary, outputSummary } from "./auth-diagnostics.js";
 function limit(n) { if (!Number.isSafeInteger(n) || n < 1)
     throw new Error('OUTPUT_SETTING_REQUIRED'); }
 function start(command, args, signal) {
@@ -18,15 +19,15 @@ export function createRunner(maxBytes) {
     limit(maxBytes);
     return { run: async (command, args, signal, input) => {
             const child = start(command, args, signal);
-            let stdout = '', stderr = '', size = 0, failed = false;
-            child.stdin.on('error', () => { failed = true; child.kill('SIGTERM'); });
+            let stdout = '', stderr = '', size = 0, failure;
+            child.stdin.on('error', error => { failure ??= { stage: 'process-stdin', reason: 'STDIN_FAILED', ...exceptionSummary(error) }; child.kill('SIGTERM'); });
             child.stdin.end(input);
             const finished = new Promise((resolve, reject) => {
-                child.once('error', () => { failed = true; });
+                child.once('error', error => { failure = { stage: 'process-spawn', reason: 'SPAWN_FAILED', ...exceptionSummary(error) }; });
                 for (const [stream, channel] of [[child.stdout, 'out'], [child.stderr, 'err']]) {
                     const decoder = new StringDecoder('utf8');
                     stream.on('data', (chunk) => { size += chunk.length; if (size > maxBytes) {
-                        failed = true;
+                        failure ??= { stage: 'process-output', reason: 'OUTPUT_LIMIT_EXCEEDED', maxOutputBytes: maxBytes, observedBytes: size };
                         child.kill('SIGTERM');
                         return;
                     } if (channel === 'out')
@@ -34,7 +35,7 @@ export function createRunner(maxBytes) {
                     else
                         stderr += decoder.write(chunk); });
                 }
-                child.once('close', code => failed || signal.aborted ? reject(new Error('COMMAND_FAILED')) : resolve({ exitCode: code, stdout, stderr }));
+                child.once('close', (code, processSignal) => failure || signal.aborted || processSignal !== null ? reject(new AuthDiagnosticError(failure ?? { stage: 'process-runner', reason: signal.aborted ? 'CANCELLED' : 'PROCESS_SIGNAL', exitCode: code, signal: ['SIGTERM', 'SIGKILL', 'SIGABRT', 'SIGHUP', 'SIGINT', 'SIGSEGV'].includes(processSignal ?? '') ? processSignal : 'OTHER', stderr: outputSummary(stderr) }, 'COMMAND_FAILED')) : resolve({ exitCode: code, stdout, stderr }));
             });
             const abort = () => child.kill('SIGTERM');
             signal.addEventListener('abort', abort, { once: true });

package/lib/profile-runtime.js

@@ -6,6 +6,7 @@ import { createNativeImportPicker } from "./native-import-picker.js";
 import { createHash } from 'node:crypto';
 import { readPrivate } from "./private-files.js";
 import { createConversationDetails } from "./conversation-details.js";
+import { createLoginDiagnostics } from "./login-diagnostics.js";
 import { CONVERSATION_DETAIL_DEFAULTS, L_DEFAULTS } from "./defaults.js";
 import { createProfileActivation } from "./profile-activation.js";
 // Composition only: consume official services; never provide replacements or alter default entries.
@@ -29,27 +30,29 @@ export function attachProfileRuntime(ctx, api, ports, config, network) {
     ctx.provide('aiWorkbenchWorkspaceDiagnostics', { getLatest: () => lastWorkspaceError });
     ctx.inject(['workspaceRegistry', 'sessions', 'sessionPersistence'], native => {
         const registry = native.get('workspaceRegistry');
+        const readHeader = async (id) => {
+            const live = native.get('sessions');
+            const session = live?.get(id);
+            if (session)
+                return session.header;
+            const persistence = native.get('sessionPersistence');
+            if (!persistence)
+                throw new NeedError(need('DEPENDENCY_REQUIRED'));
+            return (await persistence.list()).find(s => s.header.id === id)?.header;
+        };
         const bindings = createWorkspaceBindings({ profileDir: profile.dir, metadataMaxBytes: config.enrollmentMetadataMaxBytes ?? L_DEFAULTS.enrollmentMetadataMaxBytes, api, registry,
-            readHeader: async (id) => {
-                const live = native.get('sessions');
-                const session = live?.get(id);
-                if (session)
-                    return session.header;
-                const persistence = native.get('sessionPersistence');
-                if (!persistence)
-                    throw new NeedError(need('DEPENDENCY_REQUIRED'));
-                return (await persistence.list()).find(s => s.header.id === id)?.header;
-            }, nextRevision: () => ++workspaceRevision, onState: state => ctx.emit('ai-workbench/workspace-binding-state', state), diagnostic: error => { lastWorkspaceError = error; ctx.emit('ai-workbench/workspace-diagnostic', error); } });
+            readHeader, nextRevision: () => ++workspaceRevision, onState: state => ctx.emit('ai-workbench/workspace-binding-state', state), diagnostic: error => { lastWorkspaceError = error; ctx.emit('ai-workbench/workspace-diagnostic', error); } });
         const settings = ctx.get('aiWorkbenchConversationDetailSettings');
+        const context = async () => { const current = api.getModelCatalogTarget('codex'); if (!current.ok)
+            return current; const t = current.value.target; try {
+            const trust = await readPrivate(t.knownHostsFile, config.enrollmentMetadataMaxBytes ?? L_DEFAULTS.enrollmentMetadataMaxBytes);
+            return { ok: true, value: { identity: createHash('sha256').update(JSON.stringify([t.host, t.username, t.port, trust])).digest('hex') } };
+        }
+        catch {
+            return fail('REMOTE_DETAIL_SCOPE_INVALID');
+        } };
         const details = createConversationDetails({ profileDir: profile.dir, get maxEventBytes() { return settings ? settings.values()?.maxEventBytes ?? 0 : config.conversationDetails?.maxEventBytes ?? CONVERSATION_DETAIL_DEFAULTS.maxEventBytes; }, get pageSize() { return settings ? settings.values()?.pageSize ?? 0 : config.conversationDetails?.pageSize ?? CONVERSATION_DETAIL_DEFAULTS.pageSize; }, getConnectionState: api.getConnectionState,
-            context: async () => { const current = api.getModelCatalogTarget('codex'); if (!current.ok)
-                return current; const t = current.value.target; try {
-                const trust = await readPrivate(t.knownHostsFile, config.enrollmentMetadataMaxBytes ?? L_DEFAULTS.enrollmentMetadataMaxBytes);
-                return { ok: true, value: { identity: createHash('sha256').update(JSON.stringify([t.host, t.username, t.port, trust])).digest('hex') } };
-            }
-            catch {
-                return fail('REMOTE_DETAIL_SCOPE_INVALID');
-            } },
+            context,
             scope: async (sessionId, provider) => { const current = api.getModelCatalogTarget(provider); if (!current.ok)
                 return current; return bindings.verifyRemoteConversationScope(sessionId, provider, current.value.target); },
             onState: state => ctx.emit('ai-workbench/remote-conversation-detail-state', state) });
@@ -58,11 +61,22 @@ export function attachProfileRuntime(ctx, api, ports, config, network) {
         api.getRemoteConversationDetailState = details.getRemoteConversationDetailState;
         api.onRemoteConversationDetailState = details.onRemoteConversationDetailState;
         api.listRemoteConversationDetails = details.listRemoteConversationDetails;
-        const previousContractInfo = api.getContractInfo, detailContractInfo = () => ({ ...previousContractInfo(), remoteConversationDetails: 1 });
+        const loginDiagnostics = createLoginDiagnostics({ profileDir: profile.dir, get maxEventBytes() { return settings ? settings.values()?.maxEventBytes ?? 0 : config.conversationDetails?.maxEventBytes ?? CONVERSATION_DETAIL_DEFAULTS.maxEventBytes; }, get pageSize() { return settings ? settings.values()?.pageSize ?? 0 : config.conversationDetails?.pageSize ?? CONVERSATION_DETAIL_DEFAULTS.pageSize; }, getConnectionState: api.getConnectionState, context,
+            scope: async (sessionId, provider) => { const current = api.getModelCatalogTarget(provider); if (!current.ok)
+                return current; const header = await readHeader(sessionId); if (!header || header.id !== sessionId)
+                return fail('REMOTE_DETAIL_SCOPE_INVALID'); return context(); },
+            onState: state => ctx.emit('ai-workbench/login-diagnostic-state', state) });
+        api.appendLoginDiagnostic = loginDiagnostics.appendLoginDiagnostic;
+        api.getLoginDiagnosticReceipt = loginDiagnostics.getLoginDiagnosticReceipt;
+        api.listLoginDiagnostics = loginDiagnostics.listLoginDiagnostics;
+        api.getLoginDiagnosticState = loginDiagnostics.getLoginDiagnosticState;
+        api.onLoginDiagnosticState = loginDiagnostics.onLoginDiagnosticState;
+        const previousContractInfo = api.getContractInfo, detailContractInfo = () => ({ ...previousContractInfo(), remoteConversationDetails: 1, loginDiagnostics: 1 });
         api.getContractInfo = detailContractInfo;
         native.effect(() => { details.observeConnection(api.getConnectionState()); return api.onConnectionState(details.observeConnection); });
+        native.effect(() => { loginDiagnostics.observeConnection(api.getConnectionState()); return api.onConnectionState(loginDiagnostics.observeConnection); });
         native.effect(() => () => { if (api.getContractInfo === detailContractInfo)
-            api.getContractInfo = previousContractInfo; return details.dispose(); });
+            api.getContractInfo = previousContractInfo; return Promise.all([details.dispose(), loginDiagnostics.dispose()]); });
         native.effect(() => api.onConnectionState(bindings.observeConnection));
         api.getWorkspaceBindingState = bindings.getWorkspaceBindingState;
         api.onWorkspaceBindingState = bindings.onWorkspaceBindingState;

package/lib/ssh.js

@@ -1,6 +1,7 @@
 import { readFile } from 'node:fs/promises';
 import { randomUUID } from 'node:crypto';
 import { fail, ok } from "./needs.js";
+import { AuthDiagnosticError, authFailure, outputSummary } from "./auth-diagnostics.js";
 export function shellQuote(s) {
     if (/[\x00-\x1f\x7f%]/.test(s))
         throw new Error('INVALID_PROXY_PATH');
@@ -18,28 +19,46 @@ export async function runRemote(runner, t, command, signal, input) {
     const nonce = randomUUID(), source = await readFile(new URL('../helper/remote-command.cjs', import.meta.url), 'utf8');
     const remote = 'node -e ' + "'" + source.replaceAll("'", "'\\''") + "'";
     const raw = await runner.run('ssh', [...sshArgs(t), remote], signal, JSON.stringify({ protocolVersion: 1, nonce, command, ...input === undefined ? {} : { input } }));
-    if (signal.aborted || raw.exitCode !== 0 || raw.stderr !== '')
-        throw Error('REMOTE_RESULT_INVALID');
+    const bad = (stage, reason, details = {}) => { throw new AuthDiagnosticError({ stage, reason, ...details }); };
+    if (signal.aborted)
+        bad('ssh-result', 'CANCELLED');
+    if (raw.exitCode !== 0 || raw.stderr !== '')
+        bad('ssh-result', raw.exitCode !== 0 ? 'SSH_EXIT_NONZERO' : 'SSH_STDERR_NONEMPTY', { exitCode: raw.exitCode, stderr: outputSummary(raw.stderr) });
     const lines = raw.stdout.split('\n');
     if (lines.pop() !== '')
-        throw Error('REMOTE_RESULT_INVALID');
+        bad('remote-frame', 'FRAME_TRUNCATED');
     let started = false, ended = false, exitCode = null;
     const out = [], err = [];
-    for (const line of lines) {
-        const v = JSON.parse(line);
-        if (!v || typeof v !== 'object' || v.protocolVersion !== 1 || v.nonce !== nonce || ended)
-            throw Error('REMOTE_RESULT_INVALID');
+    for (const [index, line] of lines.entries()) {
+        let v;
+        try {
+            v = JSON.parse(line);
+        }
+        catch {
+            bad('remote-frame', 'FRAME_JSON_INVALID', { index, errorName: 'SyntaxError', output: outputSummary(line) });
+        }
+        if (!v || typeof v !== 'object' || Array.isArray(v))
+            bad('remote-frame', 'FRAME_OBJECT_INVALID', { index });
+        if (v.protocolVersion !== 1)
+            bad('remote-frame', 'FRAME_VERSION_INVALID', { index });
+        if (v.nonce !== nonce)
+            bad('remote-frame', 'FRAME_NONCE_INVALID', { index });
+        if (ended)
+            bad('remote-frame', 'FRAME_AFTER_END', { index });
         const keys = Object.keys(v).sort().join(',');
         if (v.type === 'start' && !started && keys === 'nonce,protocolVersion,type') {
             started = true;
             continue;
         }
+        const expected = v.type === 'start' ? 'nonce,protocolVersion,type' : v.type === 'end' ? 'exitCode,nonce,protocolVersion,signal,type' : v.type === 'stdout' || v.type === 'stderr' ? 'data,nonce,protocolVersion,type' : undefined;
+        if (expected && keys !== expected)
+            bad('remote-frame', 'FRAME_KEYS_INVALID', { index, missing: expected.split(',').filter(key => !Object.hasOwn(v, key)), unexpectedCount: Object.keys(v).filter(key => !expected.split(',').includes(key)).length });
         if (!started)
-            throw Error('REMOTE_RESULT_INVALID');
+            bad('remote-frame', 'FRAME_START_MISSING', { index });
         if ((v.type === 'stdout' || v.type === 'stderr') && keys === 'data,nonce,protocolVersion,type' && typeof v.data === 'string') {
             const bytes = Buffer.from(v.data, 'base64');
             if (bytes.toString('base64') !== v.data)
-                throw Error('REMOTE_RESULT_INVALID');
+                bad('remote-frame', 'FRAME_BASE64_INVALID', { index });
             (v.type === 'stdout' ? out : err).push(bytes);
             continue;
         }
@@ -48,10 +67,14 @@ export async function runRemote(runner, t, command, signal, input) {
             exitCode = v.exitCode;
             continue;
         }
-        throw Error('REMOTE_RESULT_INVALID');
+        if (v.type === 'end' && v.signal !== null)
+            bad('remote-frame', 'REMOTE_COMMAND_SIGNAL', { index, signal: ['SIGTERM', 'SIGKILL', 'SIGABRT', 'SIGHUP', 'SIGINT', 'SIGSEGV'].includes(v.signal) ? v.signal : 'OTHER' });
+        if (v.type === 'end')
+            bad('remote-frame', 'FRAME_END_EXIT_INVALID', { index, exitCodeType: typeof v.exitCode, ...(typeof v.exitCode === 'number' && Number.isFinite(v.exitCode) && Number.isInteger(v.exitCode) ? { exitCode: v.exitCode } : {}) });
+        bad('remote-frame', 'FRAME_SEQUENCE_OR_VALUE_INVALID', { index });
     }
     if (!ended || exitCode === null)
-        throw Error('REMOTE_RESULT_INVALID');
+        bad('remote-frame', 'FRAME_END_MISSING');
     return { exitCode, stdout: Buffer.concat(out).toString('utf8'), stderr: Buffer.concat(err).toString('utf8') };
 }
 export function createSsh(runner, maxOutputBytes) {
@@ -66,12 +89,12 @@ export function createSsh(runner, maxOutputBytes) {
         status: async (t, p, signal) => {
             try {
                 if (!['codex', 'claude'].includes(p) || !Number.isSafeInteger(maxOutputBytes) || maxOutputBytes < 1)
-                    return fail('AUTH_STATUS_INVALID');
+                    return authFailure('ssh-status', 'STATUS_ARGUMENT_INVALID');
                 const source = await readFile(new URL('../helper/auth-status.cjs', import.meta.url), 'utf8');
                 return ok(await runRemote(runner, t, 'node -e ' + "'" + source.replaceAll("'", "'\\''") + "' -- " + p + ' ' + maxOutputBytes, signal));
             }
-            catch {
-                return fail('AUTH_STATUS_INVALID');
+            catch (error) {
+                return authFailure('ssh-status', 'STATUS_EXECUTION_FAILED', {}, error);
             }
         },
     };

package/lib/startup.d.ts

@@ -1,10 +1,31 @@
-import type { ConnectApi, ConnectionState, LoginPromptState, LoginPromptResult, Provider, NeedCode, Result } from './api.ts';
+import type { ConnectApi, ConnectionState, LoginPromptState, LoginPromptResult, LoginState, Provider, NeedCode, Result } from './api.ts';
 export type StartupState = LoginPromptState;
 export declare function employeeMessage(code?: NeedCode): string;
 type Operations = Pick<ConnectApi, 'connect' | 'checkLogin' | 'login' | 'getState'>;
 export declare function createStartup(api: Operations, providers: Provider[], emit?: (s: LoginPromptState) => void, result?: (r: LoginPromptResult) => void, instanceId?: string): {
     getState: () => LoginPromptState;
     check: () => Promise<void>;
+    beginCheck: (provider: Provider) => {
+        provider: Provider;
+        generation: number;
+        serial: number;
+    };
+    finishCheck: (ticket: ReturnType<(provider: Provider) => {
+        provider: Provider;
+        generation: number;
+        serial: number;
+    }>, status: Result<LoginState>) => boolean;
+    currentTicket: (ticket: ReturnType<(provider: Provider) => {
+        provider: Provider;
+        generation: number;
+        serial: number;
+    }>) => boolean;
+    captureCheck: (provider: Provider) => {
+        provider: Provider;
+        generation: number;
+        serial: number;
+    };
+    inheritCheck(source: Result<LoginState>, derived: Result<LoginState>): void;
     subscribe(listener: (s: LoginPromptState) => void): () => void;
     request(provider: Provider, intent: "automatic" | "user"): Promise<Result<LoginPromptState>>;
     respond: (requestId: string, action: "authorize" | "defer") => Promise<Result<LoginPromptState>>;

package/lib/startup.js

@@ -1,5 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { fail, need, ok } from "./needs.js";
+import { authFailure } from "./auth-diagnostics.js";
 export function employeeMessage(code) {
     if (code === 'ENROLLMENT_RESULT_UNKNOWN' || code === 'ENROLLMENT_REJECTED')
         return need(code).message;
@@ -19,19 +20,76 @@ export function createStartup(api, providers, emit = () => { }, result = () => {
     let disposed = false, revision = 0, serial = 0, generation = 0, checkSerial = 0, connectionPhase = 'unavailable', observedConnected = false;
     let flight, authorization, authorizationId;
     const pending = new Set(), listeners = new Set(), deferred = new Set();
-    let state = { instanceId, revision: 0, phase: 'checking', message: '正在连接远程主机…', logins: {}, checkingProviders: [], providerNeeds: {}, technicalDetails: {} };
+    const providerSerial = new Map();
+    const resultTickets = new WeakMap();
+    let connectionEpoch, connectionInstance;
+    let state = { instanceId, revision: 0, phase: 'checking', message: '正在连接远程主机…', logins: {}, queuedProviders: [...providers], checkingProviders: [], providerNeeds: {}, technicalDetails: {} };
     const publish = (next) => { state = { ...next, instanceId, revision: ++revision }; emit(structuredClone(state)); for (const listener of listeners)
         listener(structuredClone(state)); };
     const track = (p) => { pending.add(p); void p.then(() => pending.delete(p), () => pending.delete(p)); return p; };
-    const close = (outcome, code) => { if (state.requestId && state.provider)
-        result({ requestId: state.requestId, provider: state.provider, outcome, ...(code ? { need: need(code) } : {}) }); };
-    const blocked = (code) => { close('invalidated', code); publish({ phase: 'blocked', message: employeeMessage(code), logins: {}, checkingProviders: [], providerNeeds: {}, technicalDetails: { ...state.technicalDetails, code } }); };
+    const close = (outcome, code) => { if (state.requestId && state.provider) {
+        const terminal = { requestId: state.requestId, provider: state.provider, outcome, ...(code ? { need: need(code) } : {}) };
+        publish({ ...state, requestId: undefined, provider: undefined });
+        result(terminal);
+    } };
+    const blocked = (code) => { const mine = generation; close('invalidated', code); if (disposed || mine !== generation)
+        return; publish({ phase: 'blocked', message: employeeMessage(code), logins: {}, queuedProviders: [], checkingProviders: [], providerNeeds: {}, technicalDetails: { ...state.technicalDetails, code } }); };
     const snapshot = () => state.phase === 'disposed' ? fail('DISPOSED') : state.phase === 'blocked' ? fail(state.technicalDetails.code ?? 'AUTH_STATUS_INVALID') : ok(structuredClone(state));
     const ask = () => {
+        if (disposed || state.phase === 'blocked' || state.phase === 'disposed')
+            return;
+        if (state.checkingProviders.length) {
+            publish({ ...state, ...(!state.requestId ? { phase: 'checking', message: '正在检查登录状态…' } : {}) });
+            return;
+        }
         const provider = state.requestId && state.provider && state.logins[state.provider] === false && !deferred.has(state.provider) ? state.provider : providers.find(p => state.logins[p] === false && !deferred.has(p));
         const same = provider && state.provider === provider && state.requestId && state.phase === 'login-required';
         publish({ ...state, phase: provider ? 'login-required' : 'idle', provider, requestId: provider ? (same ? state.requestId : 'login-' + instanceId + '-' + (++serial)) : undefined, message: provider ? '需要登录，请到设置 → 远程主机连接 点登录' : Object.keys(state.providerNeeds).length ? Object.keys(state.providerNeeds).map(p => p === 'claude' ? 'Claude' : 'Codex').join('、') + ' 登录状态无法确认，请联系管理员。' : '远程主机连接检查完成。' });
     };
+    const beginCheck = (provider) => {
+        const serial = (providerSerial.get(provider) ?? 0) + 1;
+        providerSerial.set(provider, serial);
+        publish({ ...state, ...(!authorization && !state.requestId ? { phase: 'checking', message: '正在检查登录状态…' } : {}), queuedProviders: (state.queuedProviders ?? []).filter(p => p !== provider), checkingProviders: [...new Set([...state.checkingProviders, provider])] });
+        return { provider, generation, serial };
+    };
+    const currentTicket = (ticket) => !disposed && ticket.generation === generation && (providerSerial.get(ticket.provider) ?? 0) === ticket.serial;
+    const finishCheck = (ticket, status) => {
+        const provider = ticket.provider;
+        if (!currentTicket(ticket))
+            return false;
+        const logins = { ...state.logins }, providerNeeds = { ...state.providerNeeds };
+        if (status.ok) {
+            logins[provider] = status.value.loggedIn;
+            delete providerNeeds[provider];
+        }
+        else {
+            delete logins[provider];
+            providerNeeds[provider] = structuredClone(status.error);
+        }
+        const clearTicket = !authorization && state.requestId && state.provider === provider && logins[provider] !== false;
+        const terminal = clearTicket ? { requestId: state.requestId, provider, outcome: logins[provider] === true ? 'logged-in' : 'invalidated', ...(providerNeeds[provider] ? { need: structuredClone(providerNeeds[provider]) } : {}) } : undefined;
+        publish({ ...state, ...(clearTicket ? { requestId: undefined, provider: undefined } : {}), logins, providerNeeds, checkingProviders: state.checkingProviders.filter(p => p !== provider) });
+        if (terminal)
+            result(currentTicket(ticket) ? terminal : { ...terminal, outcome: 'invalidated', need: need(disposed ? 'DISPOSED' : 'CONNECTION_LOST') });
+        if (!currentTicket(ticket))
+            return false;
+        if (!flight && !authorization)
+            ask();
+        if (!currentTicket(ticket))
+            return false;
+        resultTickets.set(status, ticket);
+        return true;
+    };
+    const observeCheck = async (provider, operation) => {
+        const ticket = beginCheck(provider);
+        if (!currentTicket(ticket))
+            return { status: fail(disposed ? 'DISPOSED' : 'CONNECTION_LOST'), current: false };
+        const status = await operation();
+        if (currentTicket(ticket))
+            finishCheck(ticket, status);
+        const observed = resultTickets.get(status);
+        return { status, current: !!observed && currentTicket(observed) };
+    };
     const check = () => {
         if (disposed)
             return Promise.resolve();
@@ -43,7 +101,8 @@ export function createStartup(api, providers, emit = () => { }, result = () => {
         const run = async () => {
             try {
                 // Preserve an existing question while gathering fresh evidence, so duplicate requests keep its ticket.
-                publish({ ...state, ...(!state.requestId ? { phase: 'checking', message: '正在检查登录状态…' } : {}), checkingProviders: [] });
+                const planned = new Map(providers.map(p => [p, providerSerial.get(p) ?? 0]));
+                publish({ ...state, ...(!state.requestId ? { phase: 'checking', message: '正在检查登录状态…' } : {}), queuedProviders: providers.filter(p => !state.checkingProviders.includes(p)) });
                 const connected = await api.connect();
                 if (disposed || mine !== generation || checkMine !== checkSerial)
                     return;
@@ -51,35 +110,33 @@ export function createStartup(api, providers, emit = () => { }, result = () => {
                     blocked(connected.error.code);
                     return;
                 }
-                const logins = { ...state.logins }, providerNeeds = { ...state.providerNeeds };
                 for (const provider of providers) {
-                    publish({ ...state, checkingProviders: [provider] });
+                    const pendingProvider = state.checkingProviders.includes(provider);
+                    if (pendingProvider)
+                        await new Promise(resolve => { const done = () => { if (disposed || mine !== generation || !state.checkingProviders.includes(provider)) {
+                            listeners.delete(done);
+                            resolve();
+                        } }; listeners.add(done); done(); });
+                    if (disposed || mine !== generation || checkMine !== checkSerial)
+                        return;
+                    if (pendingProvider || (providerSerial.get(provider) ?? 0) !== planned.get(provider)) {
+                        publish({ ...state, queuedProviders: (state.queuedProviders ?? []).filter(p => p !== provider) });
+                        continue;
+                    }
+                    const ticket = beginCheck(provider);
                     const status = await api.checkLogin(provider);
                     if (disposed || mine !== generation || checkMine !== checkSerial)
                         return;
+                    // createConnect publishes its own newer ticket; standalone coordinators use this one.
+                    finishCheck(ticket, status);
                     if (!status.ok) {
                         if (status.error.layer !== 'auth' && !['AUTH_STATUS_INVALID', 'LOGIN_FAILED', 'POLICY_DENIED'].includes(status.error.code)) {
                             blocked(status.error.code);
                             return;
                         }
-                        delete logins[provider];
-                        providerNeeds[provider] = status.error;
-                    }
-                    else {
-                        logins[provider] = status.value.loggedIn;
-                        delete providerNeeds[provider];
                     }
-                    if (state.requestId && state.provider === provider && logins[provider] !== false) {
-                        close(logins[provider] === true ? 'logged-in' : 'invalidated', providerNeeds[provider]?.code);
-                        publish({ ...state, requestId: undefined, provider: undefined, phase: 'checking', message: '正在检查登录状态…' });
-                    }
-                    publish({ ...state, logins: { ...logins }, providerNeeds: { ...providerNeeds }, checkingProviders: state.checkingProviders.filter(p => p !== provider) });
-                }
-                if (state.requestId && state.provider && logins[state.provider] === true) {
-                    close('logged-in');
-                    publish({ ...state, requestId: undefined, provider: undefined, phase: 'checking', message: '正在检查登录状态…' });
                 }
-                publish({ ...state, logins, providerNeeds, checkingProviders: [], technicalDetails: connected.value.hostContext ? { hostContext: structuredClone(connected.value.hostContext) } : {} });
+                publish({ ...state, queuedProviders: [], technicalDetails: connected.value.hostContext ? { hostContext: structuredClone(connected.value.hostContext) } : {} });
                 ask();
             }
             catch {
@@ -96,7 +153,7 @@ export function createStartup(api, providers, emit = () => { }, result = () => {
     const providerFailed = (provider, code, sourceNeed = need(code)) => {
         const logins = { ...state.logins };
         delete logins[provider];
-        publish({ ...state, phase: 'idle', requestId: undefined, provider: undefined, logins, checkingProviders: [], providerNeeds: { ...state.providerNeeds, [provider]: structuredClone(sourceNeed) } });
+        publish({ ...state, phase: 'idle', requestId: undefined, provider: undefined, logins, checkingProviders: state.checkingProviders.filter(p => p !== provider), providerNeeds: { ...state.providerNeeds, [provider]: structuredClone(sourceNeed) } });
         ask();
     };
     const respond = (requestId, action) => {
@@ -108,7 +165,10 @@ export function createStartup(api, providers, emit = () => { }, result = () => {
             return Promise.resolve(fail('LOGIN_PROMPT_INVALID'));
         const provider = state.provider;
         if (action === 'defer') {
+            const mine = generation;
             close('deferred');
+            if (disposed || mine !== generation)
+                return Promise.resolve(fail(disposed ? 'DISPOSED' : 'CONNECTION_LOST'));
             deferred.add(provider);
             publish({ ...state, requestId: undefined, provider: undefined });
             ask();
@@ -119,29 +179,44 @@ export function createStartup(api, providers, emit = () => { }, result = () => {
         const mine = generation;
         checkSerial++;
         authorizationId = requestId;
-        publish({ ...state, phase: 'authorizing', checkingProviders: [provider], message: '请在授权窗口完成本人登录。' });
+        publish({ ...state, phase: 'authorizing', queuedProviders: [], checkingProviders: [...new Set([...state.checkingProviders, provider])], message: '请在授权窗口完成本人登录。' });
+        const superseded = () => { const failure = authFailure('connect-check-login', 'STATUS_SUPERSEDED'); if (state.requestId === requestId)
+            publish({ ...state, phase: 'idle', requestId: undefined, provider: undefined }); result({ requestId, provider, outcome: 'invalidated', need: failure.error }); ask(); return failure; };
         const run = async () => {
             try {
                 await flight;
                 if (disposed || mine !== generation)
                     return fail(disposed ? 'DISPOSED' : 'CONNECTION_LOST');
-                const current = await api.checkLogin(provider);
+                const observation = await observeCheck(provider, () => api.checkLogin(provider));
                 if (disposed || mine !== generation)
                     return fail(disposed ? 'DISPOSED' : 'CONNECTION_LOST');
-                const verified = current.ok && current.value.loggedIn ? current : current.ok ? await api.login(provider) : current;
+                if (!observation.current)
+                    return superseded();
+                const current = observation.status;
+                const login = current.ok && !current.value.loggedIn ? await observeCheck(provider, () => api.login(provider)) : observation;
+                const verified = login.status;
                 if (disposed || mine !== generation)
                     return fail(disposed ? 'DISPOSED' : 'CONNECTION_LOST');
+                const finalTicket = resultTickets.get(verified);
+                if (!login.current || !finalTicket || !currentTicket(finalTicket))
+                    return superseded();
                 if (!verified.ok || !verified.value.loggedIn) {
                     const code = verified.ok ? 'LOGIN_FAILED' : verified.error.code;
-                    result({ requestId, provider, outcome: 'failed', need: need(code) });
                     providerFailed(provider, code, verified.ok ? need(code) : verified.error);
-                    return verified.ok ? fail(code) : verified;
+                    result({ requestId, provider, outcome: 'failed', need: verified.ok ? need(code) : verified.error });
+                    return disposed || mine !== generation ? fail(disposed ? 'DISPOSED' : 'CONNECTION_LOST') : verified.ok ? fail(code) : verified;
                 }
-                result({ requestId, provider, outcome: 'logged-in' });
                 deferred.delete(provider);
                 const providerNeeds = { ...state.providerNeeds };
                 delete providerNeeds[provider];
-                publish({ ...state, requestId: undefined, provider: undefined, logins: { ...state.logins, [provider]: true }, providerNeeds, checkingProviders: [], phase: 'idle' });
+                publish({ ...state, requestId: undefined, provider: undefined, logins: { ...state.logins, [provider]: true }, providerNeeds, checkingProviders: state.checkingProviders.filter(p => p !== provider), phase: 'idle' });
+                if (disposed || mine !== generation) {
+                    result({ requestId, provider, outcome: 'invalidated', need: need(disposed ? 'DISPOSED' : 'CONNECTION_LOST') });
+                    return fail(disposed ? 'DISPOSED' : 'CONNECTION_LOST');
+                }
+                result({ requestId, provider, outcome: 'logged-in' });
+                if (disposed || mine !== generation)
+                    return fail(disposed ? 'DISPOSED' : 'CONNECTION_LOST');
                 ask();
                 return snapshot();
             }
@@ -161,7 +236,9 @@ export function createStartup(api, providers, emit = () => { }, result = () => {
         } });
         return promise;
     };
-    return { getState: () => structuredClone(state), check,
+    return { getState: () => structuredClone(state), check, beginCheck, finishCheck, currentTicket, captureCheck: (provider) => ({ provider, generation, serial: providerSerial.get(provider) ?? 0 }),
+        inheritCheck(source, derived) { const ticket = resultTickets.get(source); if (ticket && currentTicket(ticket))
+            resultTickets.set(derived, ticket); },
         subscribe(listener) { listeners.add(listener); return () => { listeners.delete(listener); }; },
         async request(provider, intent) {
             if (!providers.includes(provider) || !['automatic', 'user'].includes(intent))
@@ -176,6 +253,8 @@ export function createStartup(api, providers, emit = () => { }, result = () => {
                 return fail(disposed ? 'DISPOSED' : 'CONNECTION_LOST');
             if (intent === 'user' && !authorization && state.logins[provider] === false && !state.providerNeeds[provider] && !state.checkingProviders.includes(provider) && state.phase !== 'blocked' && state.phase !== 'disposed' && state.provider !== provider) {
                 close('invalidated', 'LOGIN_PROMPT_INVALID');
+                if (disposed || mine !== generation)
+                    return fail(disposed ? 'DISPOSED' : 'CONNECTION_LOST');
                 publish({ ...state, phase: 'login-required', provider, requestId: 'login-' + instanceId + '-' + (++serial), message: '需要登录，请到设置 → 远程主机连接 点登录' });
             }
             return state.providerNeeds[provider] ? { ok: false, error: structuredClone(state.providerNeeds[provider]) } : snapshot();
@@ -190,6 +269,18 @@ export function createStartup(api, providers, emit = () => { }, result = () => {
                 return;
             const prior = connectionPhase;
             connectionPhase = next.phase;
+            const changed = connectionEpoch !== undefined && (connectionEpoch !== next.epoch || connectionInstance !== next.instanceId);
+            connectionEpoch = next.epoch;
+            connectionInstance = next.instanceId;
+            if (changed) {
+                generation++;
+                flight = undefined;
+                const mine = generation;
+                close('invalidated', 'CONNECTION_LOST');
+                if (disposed || mine !== generation)
+                    return;
+                publish({ phase: 'checking', message: '正在连接远程主机…', logins: {}, queuedProviders: [], checkingProviders: [], providerNeeds: {}, technicalDetails: {} });
+            }
             if (next.phase === 'unavailable' || next.phase === 'disposed') {
                 generation++;
                 flight = undefined;
@@ -206,6 +297,6 @@ export function createStartup(api, providers, emit = () => { }, result = () => {
             }
         },
         stop() { if (disposed)
-            return; disposed = true; generation++; close('invalidated', 'DISPOSED'); publish({ phase: 'disposed', message: '远程主机连接已关闭。', logins: {}, checkingProviders: [], providerNeeds: {}, technicalDetails: { code: 'DISPOSED' } }); listeners.clear(); },
+            return; disposed = true; generation++; close('invalidated', 'DISPOSED'); publish({ phase: 'disposed', message: '远程主机连接已关闭。', logins: {}, queuedProviders: [], checkingProviders: [], providerNeeds: {}, technicalDetails: { code: 'DISPOSED' } }); listeners.clear(); },
         async dispose() { this.stop(); await Promise.allSettled([...pending]); }, };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-workbench/connect",
-  "version": "0.7.9",
+  "version": "0.7.11",
   "type": "module",
   "engines": {
     "node": ">=24.13.1"