@ai-workbench/remote-agent 0.8.1 → 0.8.2

package/README.md

@@ -1,4 +1,4 @@
-在 DSH「插件 → 添加插件」填 `@ai-workbench/remote-agent@0.8.1`（由编排发布后可用），或运行 `dsh plugin --profile desktop add @ai-workbench/remote-agent@0.8.1`。
+在 DSH「插件 → 添加插件」填 `@ai-workbench/remote-agent@0.8.2`（由编排发布后可用），或运行 `dsh plugin --profile desktop add @ai-workbench/remote-agent@0.8.2`。
 
 # 远程ACP插件
 
@@ -56,4 +56,9 @@ Codex单次模式首版仅文本，不转接中途审批；图片或系统/开
 
 D19（0.8.1）：相邻正文增量合成连续文本块，工作区首次说明合入真实回复，按官方持久记录核对后才回报“已记入可核对回复”。这不代表界面已经显示。
 
-技术详情由 L 0.7.9 的唯一“远程主机连接”设置节展示，正文只放模型文本。命令目录保留完整描述；未知事件和工具输入输出保留字段、JSON类型及处理结果，未获准原文明确脱敏，数字用量可核对。没有 `remoteConversationDetails:1` 时明确提示“技术详情暂不可用”，本轮不发送模型请求。X 在官方当前 profile 的 `ai-workbench-remote-agent/diagnostics/` 保存私有诊断日志（目录700、文件600、落盘同步）；写入/归属/顺序/容量失败中止本轮，不自动重发、换代重投、过期或淘汰。结果未知时只读核对原事件完整回执，未找到仍保持未知。X本轮无新增设置/阈值；L的单事件容量和分页设置在L设置节可见。
+技术详情由 L 0.7.11 的唯一“远程主机连接”设置节展示，正文只放模型文本。命令目录保留完整描述；未知事件和工具输入输出保留字段、JSON类型及处理结果，未获准原文明确脱敏，数字用量可核对。没有 `remoteConversationDetails:1` 时明确提示“技术详情暂不可用”，本轮不发送模型请求。X 在官方当前 profile 的 `ai-workbench-remote-agent/diagnostics/` 保存私有诊断日志（目录700、文件600、落盘同步）；写入/归属/顺序/容量失败中止本轮，不自动重发、换代重投、过期或淘汰。结果未知时只读核对原事件完整回执，未找到仍保持未知。X本轮无新增设置/阈值；L的单事件容量和分页设置在L设置节可见。
+
+
+0.8.2 登录检查：需要 L `~0.7.11`，失败来源及固定分支保留到 L“登录前技术详情”（`loginDiagnostics:1`），员工正文保持原文。按 L 明确的本品牌 queued/checking/authorizing 状态订阅等待；不以全局checking猜测在途，不新增刷新、轮询、超时或重试。每轮ensureReady仍是合同规定的显式检查，L的新可信结果可以替代旧检查，较早返回不得覆盖它。
+
+L安全规范的officialReason原串完整保留；旧/不支持格式明确记OFFICIAL_REASON_UNSUPPORTED与字节数/SHA，秘密原文不保存。L0.7.11的LOGIN_INSTANCE_MISMATCH记录通过observedLoginInstanceId与原始login.instanceId保存实际观测ID，事件及connection仍绑定当前可信ID/代次；L技术详情和X私有日志均保留真实双ID，不归一、不清空快照。复合未知官方原因以固定summary完整保存OFFICIAL_REASON_UNSUPPORTED及bytes/SHA，不交原文。X私有原快照先同步落盘，再追加L；ACK未知只读核实原事件，跨代不重写/重发。此版本的工程验证不替代leo员工路径复验，真实故障根因尚未证实。

package/dist/auth-reason.d.ts

@@ -0,0 +1 @@
+export declare function validOfficialReason(value: unknown): value is string;

package/dist/auth-reason.js

@@ -0,0 +1,27 @@
+/** L 0.7.10 officialReason v1 consumer validation; preserve canonical bytes only. */
+const markers = ['AW_REMOTE_COMMAND_KILL_FAILED', 'AUTH_STATUS_JSON_INVALID:SyntaxError', 'Permission denied', 'Host key verification failed', 'Connection refused', 'Connection closed', 'command not found', 'No such file or directory'];
+const names = ['Error', 'TypeError', 'SyntaxError', 'RangeError', 'AbortError', 'DOMException', 'UnknownError'];
+const codes = ['ENOENT', 'EPERM', 'ESRCH', 'EACCES', 'EINVAL', 'EPIPE', 'ECONNRESET', 'ECONNREFUSED', 'ETIMEDOUT', 'ABORT_ERR', 'UNKNOWN'];
+const stages = ['ssh-status', 'ssh-result', 'remote-frame', 'auth-status', 'connect-check-login', 'integration-pre-login', 'process-spawn', 'process-stdin', 'process-output', 'process-runner'];
+const reasons = ['CANCELLED', 'SSH_EXIT_NONZERO', 'SSH_STDERR_NONEMPTY', 'FRAME_TRUNCATED', 'FRAME_JSON_INVALID', 'FRAME_OBJECT_INVALID', 'FRAME_VERSION_INVALID', 'FRAME_NONCE_INVALID', 'FRAME_AFTER_END', 'FRAME_KEYS_INVALID', 'FRAME_START_MISSING', 'FRAME_BASE64_INVALID', 'REMOTE_COMMAND_SIGNAL', 'FRAME_END_EXIT_INVALID', 'FRAME_SEQUENCE_OR_VALUE_INVALID', 'FRAME_END_MISSING', 'STATUS_ARGUMENT_INVALID', 'STATUS_EXECUTION_FAILED', 'STATUS_JSON_INVALID', 'STATUS_OBJECT_INVALID', 'STATUS_KEYS_INVALID', 'STATUS_VERSION_INVALID', 'STATUS_PROVIDER_INVALID', 'STATUS_EXIT_MISMATCH', 'STATUS_LOGGED_IN_INVALID', 'STATUS_STDERR_NONEMPTY', 'STATUS_EXIT_INVALID', 'STATUS_EXCEPTION', 'STATUS_SUPERSEDED', 'SSH_PORT_MISSING', 'STDIN_FAILED', 'SPAWN_FAILED', 'OUTPUT_LIMIT_EXCEEDED', 'PROCESS_SIGNAL'];
+const object = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const integer = (v) => Number.isSafeInteger(v) && Number(v) >= 0;
+const member = (list, v) => typeof v === 'string' && list.includes(v);
+function summary(v) {
+    return object(v) && Object.keys(v).every(k => ['bytes', 'sha256', 'markers', 'cleanupErrors'].includes(k)) && integer(v.bytes) && typeof v.sha256 === 'string' && /^[a-f0-9]{64}$/.test(v.sha256) && Array.isArray(v.markers) && v.markers.every(m => member(markers, m)) && (v.cleanupErrors === undefined || Array.isArray(v.cleanupErrors) && v.cleanupErrors.every(e => object(e) && Object.keys(e).sort().join(',') === 'errorCode,errorName' && member(['Error', 'TypeError', 'RangeError', 'UnknownError'], e.errorName) && member(['EPERM', 'EACCES', 'EINVAL', 'UNKNOWN'], e.errorCode)));
+}
+export function validOfficialReason(value) {
+    if (typeof value !== 'string')
+        return false;
+    let v;
+    try {
+        v = JSON.parse(value);
+    }
+    catch {
+        return false;
+    }
+    if (!object(v) || JSON.stringify(v) !== value || v.version !== 1 || !member(stages, v.stage) || !member(reasons, v.reason))
+        return false;
+    const fields = { version: x => x === 1, stage: x => member(stages, x), reason: x => member(reasons, x), errorName: x => member(names, x), errorCode: x => member(codes, x), exitCode: x => x === null || typeof x === 'number' && Number.isFinite(x) && Number.isInteger(x), signal: x => member(['SIGTERM', 'SIGKILL', 'SIGABRT', 'SIGHUP', 'SIGINT', 'SIGSEGV', 'OTHER'], x), index: integer, unexpectedCount: integer, maxOutputBytes: x => integer(x) && Number(x) > 0, observedBytes: integer, stderr: summary, output: summary, missing: x => Array.isArray(x) && x.every(k => member(['nonce', 'protocolVersion', 'type', 'data', 'exitCode', 'signal', 'loggedIn', 'provider'], k)), loggedInType: x => member(['null', 'undefined', 'object', 'boolean', 'number', 'string', 'function', 'symbol', 'bigint'], x), exitCodeType: x => member(['undefined', 'object', 'boolean', 'number', 'string', 'function', 'symbol', 'bigint'], x) };
+    return Object.entries(v).every(([key, item]) => Object.hasOwn(fields, key) && fields[key](item));
+}

package/dist/connect-contract.d.ts

@@ -1,3 +1,4 @@
+import type { ConnectNeed } from '@ai-workbench/connect/api';
 import type { ConnectTarget } from './provider.ts';
 import type { ContractInfo, Provider, WorkspaceUse, WorkspaceNoticeReceipt as LWorkspaceNoticeReceipt } from '@ai-workbench/connect/api';
 /** 正式L0.7公开类型；消费子集不表示已安装或已通过真实产品门。 */
@@ -16,7 +17,7 @@ export type ConnectResult<T> = {
         code: string;
         message: string;
         requires: string;
-    };
+    } & Pick<ConnectNeed, 'officialReason'>;
 };
 export interface NativeWorkspaceApi {
     getContractInfo(): ContractInfo;

package/dist/index.d.ts

@@ -5,6 +5,7 @@ import { type AcpHooks } from './acp.ts';
 import { type RuntimeProvider } from './provider.ts';
 import { type AgentDefinition } from './agents.ts';
 import { type ImageReader } from './input.ts';
+import type { LoginDiagnostic } from './login-diagnostic.ts';
 export declare const name = "ai-workbench-remote-agent";
 export declare const settingsNamespace = "ai-workbench-codex";
 export declare const inject: string[];
@@ -47,17 +48,22 @@ type LiveConfig = {
 };
 /** DSH volatile settings are handles; adapters freeze their values once per invocation. */
 export declare function readConfig(config: LiveConfig): PluginConfig;
+export type LoginFailureReporter = (sessionId: string | undefined, code: string, diagnostic: LoginDiagnostic) => Promise<{
+    eventId: string;
+    recorded: true;
+}>;
 export declare class CodexRemoteAdapter extends LlmAdapter {
     private resolveRuntime;
     private approve?;
     private readonly providerName;
     private readonly agent;
     private readonly readImage?;
+    private readonly reportLoginFailure?;
     private config;
     private sessions;
     private turns;
     private lifetime;
-    constructor(config: PluginConfig | (() => PluginConfig), resolveRuntime: RuntimeProvider, approve?: InvocationApproval | undefined, providerName?: () => string, agent?: AgentDefinition, readImage?: ImageReader | undefined);
+    constructor(config: PluginConfig | (() => PluginConfig), resolveRuntime: RuntimeProvider, approve?: InvocationApproval | undefined, providerName?: () => string, agent?: AgentDefinition, readImage?: ImageReader | undefined, reportLoginFailure?: LoginFailureReporter | undefined);
     providerInfo(provider: string): {
         id: string;
         name: string;
@@ -84,7 +90,7 @@ export declare class CodexRemoteAdapter extends LlmAdapter {
 /** One official registration owns both routes, preserving opaque replay ownership. */
 export declare class RemoteAgentsAdapter extends LlmAdapter {
     private adapters;
-    constructor(config: () => PluginConfig, makeRuntime: (agent: AgentDefinition) => RuntimeProvider, approve: InvocationApproval, nameFor: (agent: AgentDefinition) => string, readImage?: ImageReader);
+    constructor(config: () => PluginConfig, makeRuntime: (agent: AgentDefinition) => RuntimeProvider, approve: InvocationApproval, nameFor: (agent: AgentDefinition) => string, readImage?: ImageReader, reportLoginFailure?: LoginFailureReporter);
     private adapter;
     providerInfo(provider: string): {
         id: string;

package/dist/index.js

@@ -55,17 +55,19 @@ export class CodexRemoteAdapter extends LlmAdapter {
     providerName;
     agent;
     readImage;
+    reportLoginFailure;
     config;
     sessions = new Map();
     turns = new Map();
     lifetime = new AbortController();
-    constructor(config, resolveRuntime, approve, providerName = () => PROVIDER_NAMES.en, agent = CODEX_AGENT, readImage) {
+    constructor(config, resolveRuntime, approve, providerName = () => PROVIDER_NAMES.en, agent = CODEX_AGENT, readImage, reportLoginFailure) {
         super();
         this.resolveRuntime = resolveRuntime;
         this.approve = approve;
         this.providerName = providerName;
         this.agent = agent;
         this.readImage = readImage;
+        this.reportLoginFailure = reportLoginFailure;
         this.config = typeof config === 'function' ? config : () => config;
     }
     providerInfo(provider) { return { id: provider, name: this.providerName() }; }
@@ -95,7 +97,17 @@ export class CodexRemoteAdapter extends LlmAdapter {
             if (error instanceof NeedError) {
                 const rpc = /RPC 错误码 (-?\d+)/u.exec(error.requires)?.[1];
                 const message = employeeFailure(error.code) + (rpc ? `（技术详情：RPC 错误码 ${rpc}）` : '');
-                throw new LlmError(message, error.code, { cause: new Error(`诊断代码：${error.code}；${error.requires}`) });
+                let diagnostic = error.technical ? JSON.stringify(error.technical) : '';
+                if (error.technical && this.reportLoginFailure) {
+                    try {
+                        const receipt = await this.reportLoginFailure(options.sessionId, error.code, error.technical);
+                        diagnostic += '；诊断 eventId=' + receipt.eventId;
+                    }
+                    catch (failure) {
+                        diagnostic += '；诊断保存失败：' + (failure instanceof NeedError ? failure.code : 'DIAGNOSTIC_WRITE_FAILED');
+                    }
+                }
+                throw new LlmError(message, error.code, { cause: new Error(`诊断代码：${error.code}；${error.requires}` + (diagnostic ? '；' + diagnostic : '')) });
             }
             throw error;
         }
@@ -281,8 +293,8 @@ export class CodexRemoteAdapter extends LlmAdapter {
 /** One official registration owns both routes, preserving opaque replay ownership. */
 export class RemoteAgentsAdapter extends LlmAdapter {
     adapters = new Map();
-    constructor(config, makeRuntime, approve, nameFor, readImage) { super(); for (const agent of AGENTS)
-        this.adapters.set(agent.id, new CodexRemoteAdapter(config, makeRuntime(agent), approve, () => nameFor(agent), agent, readImage)); }
+    constructor(config, makeRuntime, approve, nameFor, readImage, reportLoginFailure) { super(); for (const agent of AGENTS)
+        this.adapters.set(agent.id, new CodexRemoteAdapter(config, makeRuntime(agent), approve, () => nameFor(agent), agent, readImage, reportLoginFailure)); }
     adapter(provider) { const adapter = this.adapters.get(provider); if (!adapter)
         throw new LlmError('远程模型未注册', 'PROVIDER_NOT_FOUND'); return adapter; }
     providerInfo(provider) { return this.adapter(provider).providerInfo(provider); }
@@ -304,16 +316,19 @@ export function apply(ctx, live) {
     };
     const openByAgent = new Map(AGENTS.map(agent => [agent.id, brokerFactory(get, undefined, config)]));
     const detailManagers = new Map();
+    const managerForProfile = () => {
+        const profile = ctx.get('profileContext');
+        if (typeof profile?.dir !== 'string')
+            throw new NeedError('TECHNICAL_DETAILS_UNAVAILABLE', '技术详情暂不可用：缺少官方profile目录。', '官方profileContext.dir');
+        let manager = detailManagers.get(profile.dir);
+        if (!manager) {
+            manager = createRemoteDetails({ profileDir: profile.dir, getApi: get });
+            detailManagers.set(profile.dir, manager);
+        }
+        return manager;
+    };
     const adapter = new RemoteAgentsAdapter(config, agent => connectProvider(get, { agent, notice: createWorkspaceNoticeConsumer(ctx, agent), details: async (request, api, connection, target) => {
-            const profile = ctx.get('profileContext');
-            if (typeof profile?.dir !== 'string')
-                throw new NeedError('TECHNICAL_DETAILS_UNAVAILABLE', '技术详情暂不可用：缺少官方profile目录。', '官方profileContext.dir');
-            let manager = detailManagers.get(profile.dir);
-            if (!manager) {
-                manager = createRemoteDetails({ profileDir: profile.dir, getApi: get });
-                detailManagers.set(profile.dir, manager);
-            }
-            return manager.open({ sessionId: request.sessionId, provider: agent.loginProvider, identity: `${target.username}@${target.host}:${target.port}`, connection });
+            return managerForProfile().open({ sessionId: request.sessionId, provider: agent.loginProvider, identity: `${target.username}@${target.host}:${target.port}`, connection });
         }, open: async (...args) => {
             const runtime = await openByAgent.get(agent.id)(...args);
             runtime.detailContext = () => {
@@ -336,7 +351,25 @@ export function apply(ctx, live) {
                 return { turn, step };
             };
             return runtime;
-        } }), dshApproval(ctx), agent => agent.name[language], readImage);
+        } }), dshApproval(ctx), agent => agent.name[language], readImage, (sessionId, code, diagnostic) => {
+        const events = sessionId ? ctx.get('agents')?.get(SessionId(sessionId))?.session.snapshotEvents() : undefined;
+        let turn = null, step = null;
+        for (const event of events ?? []) {
+            if (event.type === 'turn/start') {
+                turn = event.data.turn;
+                step = null;
+            }
+            else if (event.type === 'turn/end') {
+                turn = null;
+                step = null;
+            }
+            else if (event.type === 'step/start' && event.data.turn === turn)
+                step = event.data.step;
+            else if (event.type === 'step/end')
+                step = null;
+        }
+        return managerForProfile().recordLoginFailure({ sessionId, code, diagnostic, context: { turn, step } });
+    });
     const ids = AGENTS.map(agent => agent.id);
     const entries = () => AGENTS.map(agent => ({ provider: agent.id, displayName: agent.name[language], settingsNs: settingsNamespace, settingsPath: [] }));
     const directory = ctx.llm.registerConfigurableProviders(entries());

package/dist/login-diagnostic.d.ts

@@ -0,0 +1,38 @@
+import type { ConnectionState, LoginPromptState } from '@ai-workbench/connect/api';
+export type LoginReason = 'LOGIN_INSTANCE_MISMATCH' | 'LOGIN_PHASE_BLOCKED' | 'LOGIN_PHASE_DISPOSED' | 'LOGIN_CHECKING' | 'LOGIN_AUTHORIZING' | 'LOGIN_PROVIDER_NEED' | 'LOGIN_VALUE_INVALID' | 'LOGIN_REQUIRED' | 'L_ENSURE_READY_FAILED' | 'LOGIN_QUEUED';
+/** Allowlisted protocol facts only: never messages, requires, host details or status command output. */
+export interface LoginDiagnostic {
+    version: 1;
+    source: 'verified-login' | 'readiness' | 'ensure-ready';
+    reason: LoginReason;
+    provider: 'claude' | 'codex';
+    officialReason?: string;
+    officialReasonRejected?: {
+        bytes: number;
+        sha256: string;
+    };
+    connection: {
+        instanceId: string;
+        phase: string;
+        epoch: number;
+    };
+    login: {
+        instanceId: string;
+        phase: string;
+        revision: number;
+        provider: 'claude' | 'codex' | null;
+        logins: {
+            claude: boolean | 'absent' | 'invalid';
+            codex: boolean | 'absent' | 'invalid';
+        };
+        queuedProviders: ('claude' | 'codex')[];
+        checkingProviders: ('claude' | 'codex')[];
+        providerNeeds: {
+            claude: string | null;
+            codex: string | null;
+        };
+        code: string | null;
+    };
+}
+export declare function loginDiagnostic(source: LoginDiagnostic['source'], reason: LoginReason, provider: 'claude' | 'codex', connection: ConnectionState, state: LoginPromptState, officialReason?: string): LoginDiagnostic;
+export declare function loginReason(state: LoginPromptState, connection: ConnectionState, provider: 'claude' | 'codex'): LoginReason | undefined;

package/dist/login-diagnostic.js

@@ -0,0 +1,29 @@
+import { validOfficialReason } from "./auth-reason.js";
+import { createHash } from 'node:crypto';
+const code = (value) => typeof value === 'string' && /^[A-Z][A-Z0-9_]*$/u.test(value) ? value : null;
+export function loginDiagnostic(source, reason, provider, connection, state, officialReason) {
+    const value = (brand) => typeof state.logins?.[brand] === 'boolean' ? state.logins[brand] : state.logins?.[brand] === undefined ? 'absent' : 'invalid';
+    const rawReason = officialReason ?? state.providerNeeds?.[provider]?.officialReason;
+    const safeReason = typeof rawReason !== 'string' ? {} : validOfficialReason(rawReason) ? { officialReason: rawReason } : { officialReasonRejected: { bytes: Buffer.byteLength(rawReason, 'utf8'), sha256: createHash('sha256').update(rawReason).digest('hex') } };
+    return { version: 1, source, reason, provider, ...safeReason, connection: { instanceId: connection.instanceId, phase: connection.phase, epoch: connection.epoch }, login: { instanceId: state.instanceId, phase: state.phase, revision: state.revision, provider: state.provider ?? null, logins: { claude: value('claude'), codex: value('codex') }, queuedProviders: state.queuedProviders ?? [], checkingProviders: Array.isArray(state.checkingProviders) ? state.checkingProviders.filter(p => p === 'claude' || p === 'codex') : [], providerNeeds: { claude: code(state.providerNeeds?.claude?.code), codex: code(state.providerNeeds?.codex?.code) }, code: code(state.technicalDetails?.code) } };
+}
+export function loginReason(state, connection, provider) {
+    if (state.instanceId !== connection.instanceId)
+        return 'LOGIN_INSTANCE_MISMATCH';
+    if (state.phase === 'blocked')
+        return 'LOGIN_PHASE_BLOCKED';
+    if (state.phase === 'disposed')
+        return 'LOGIN_PHASE_DISPOSED';
+    if (state.queuedProviders?.includes(provider))
+        return 'LOGIN_QUEUED';
+    if (state.checkingProviders.includes(provider))
+        return 'LOGIN_CHECKING';
+    if (state.phase === 'authorizing' && state.provider === provider)
+        return 'LOGIN_AUTHORIZING';
+    if (state.providerNeeds[provider])
+        return 'LOGIN_PROVIDER_NEED';
+    if (typeof state.logins?.[provider] !== 'boolean')
+        return 'LOGIN_VALUE_INVALID';
+    if (!state.logins[provider])
+        return 'LOGIN_REQUIRED';
+}

package/dist/provider.d.ts

@@ -1,6 +1,6 @@
 import type { AgentApp } from '@agentclientprotocol/sdk';
 import type { AgentApp as ExtendedAgentApp } from '@agentclientprotocol/sdk/unstable';
-import type { ConnectState, ConnectApi as LConnectApi, ConnectionState, LoginPromptState } from '@ai-workbench/connect/api';
+import type { ConnectState, ConnectNeed, ConnectApi as LConnectApi, ConnectionState, LoginPromptState } from '@ai-workbench/connect/api';
 export type { ConnectionState, LoginPromptState } from '@ai-workbench/connect/api';
 import type { OneShotRuntime } from './job.ts';
 import type { BrokerTransport, BrokerSettings } from './broker.ts';
@@ -85,10 +85,10 @@ type Result<T> = {
         code: string;
         message: string;
         requires: string;
-    };
+    } & Pick<ConnectNeed, 'officialReason'>;
 };
 /** 消费正式connect-api 0.7公开子集；X不响应L登录票据、不直接调用登录。 */
-export interface ConnectApi extends Pick<LConnectApi, 'getConnectionState' | 'getLoginPromptState' | 'requestLoginPrompt' | 'refreshLoginPrompts'>, Partial<NativeWorkspaceApi>, Partial<Pick<LConnectApi, 'appendRemoteConversationDetail' | 'getRemoteConversationDetailReceipt' | 'listRemoteConversationDetails'>> {
+export interface ConnectApi extends Pick<LConnectApi, 'getConnectionState' | 'getLoginPromptState' | 'requestLoginPrompt' | 'refreshLoginPrompts'>, Partial<NativeWorkspaceApi>, Partial<Pick<LConnectApi, 'onConnectionState' | 'onLoginPromptState' | 'appendRemoteConversationDetail' | 'getRemoteConversationDetailReceipt' | 'listRemoteConversationDetails'>> {
     getState?(): ConnectState;
     getSshTarget(): Promise<Result<ConnectTarget>>;
     checkLogin(provider: LoginProvider): Promise<Result<{

package/dist/provider.js

@@ -1,3 +1,4 @@
+import { loginDiagnostic, loginReason } from "./login-diagnostic.js";
 import { NeedError } from "./remote.js";
 import { CONNECTION_REQUIRED, TEST_HOST_NOTICE } from "./presentation.js";
 import { CODEX_AGENT } from "./agents.js";
@@ -8,6 +9,8 @@ export function requireLoginCoordinator(api) {
 export function requireLoginState(state) {
     const object = (v) => !!v && typeof v === 'object' && !Array.isArray(v) && (Object.getPrototypeOf(v) === Object.prototype || Object.getPrototypeOf(v) === null);
     const need = (v) => object(v) && typeof v.code === 'string' && v.code.length > 0 && ['enrollment', 'network', 'ssh', 'auth', 'integration', 'settings', 'projects'].includes(v.layer) && typeof v.message === 'string' && typeof v.requires === 'string' && ['employee', 'administrator', 'ai-administrator', 'plugin'].includes(v.actor) && object(v.action) && typeof v.action.id === 'string' && typeof v.action.label === 'string' && typeof v.action.available === 'boolean';
+    if (state.queuedProviders !== undefined && (!Array.isArray(state.queuedProviders) || state.queuedProviders.some(p => p !== 'codex' && p !== 'claude') || new Set(state.queuedProviders).size !== state.queuedProviders.length || state.queuedProviders.some(p => state.checkingProviders?.includes(p))))
+        throw new NeedError('CONNECT_API_MISMATCH', '我需要真实的品牌排队与进行中状态', 'L >=0.7.10');
     if (!Array.isArray(state.checkingProviders) || state.checkingProviders.some(p => p !== 'codex' && p !== 'claude') || !object(state.providerNeeds) || Object.entries(state.providerNeeds).some(([p, v]) => !['codex', 'claude'].includes(p) || !need(v)))
         throw new NeedError('CONNECT_API_MISMATCH', '我需要按助手区分的真实登录状态', 'L >=0.6.1');
 }
@@ -32,15 +35,77 @@ function verifiedLogin(api, brand, expected) {
     if (!connection.instanceId || !Number.isSafeInteger(connection.epoch) || connection.epoch < 0 || connection.phase !== 'connected' || expected && (connection.instanceId !== expected.instanceId || connection.epoch !== expected.epoch))
         throw new NeedError('CONNECTION_LOST', 'connection binding changed', 'current employee connection');
     requireLoginState(login);
-    if (login.instanceId !== connection.instanceId || login.checkingProviders.includes(brand) || login.providerNeeds[brand] || login.phase === 'blocked' || login.phase === 'disposed' || login.phase === 'authorizing' && login.provider === brand || typeof login.logins?.[brand] !== 'boolean')
-        throw new NeedError('AUTH_STATUS_INVALID', '无法确认当前品牌的登录状态', 'L核验的本品牌登录状态');
-    if (!login.logins[brand])
-        throw new NeedError('LOGIN_REQUIRED', '需要登录，请到设置 → 远程主机连接 点登录', '本人登录');
+    const reason = loginReason(login, connection, brand);
+    if (reason)
+        throw Object.assign(new NeedError(reason === 'LOGIN_REQUIRED' ? 'LOGIN_REQUIRED' : 'AUTH_STATUS_INVALID', reason === 'LOGIN_REQUIRED' ? '需要登录，请到设置 → 远程主机连接 点登录' : '无法确认当前品牌的登录状态', 'L核验的本品牌登录状态'), { technical: loginDiagnostic('verified-login', reason, brand, connection, login), ...(typeof login.providerNeeds[brand]?.officialReason === 'string' ? { officialReason: login.providerNeeds[brand].officialReason } : {}) });
     return { ...connection };
 }
+/** Wait only for L's explicit in-progress evidence. No timer, polling, refresh or authorization. */
+async function waitForLogin(api, brand, expected, get, signal) {
+    const check = () => {
+        signal?.throwIfAborted();
+        if (get() !== api)
+            throw new NeedError('CONNECTION_LOST', '远程主机连接组件已更换', '当前员工连接');
+        const connection = api.getConnectionState(), state = api.getLoginPromptState();
+        requireLoginState(state);
+        if (connection.phase !== 'connected' || connection.instanceId !== expected.instanceId || connection.epoch !== expected.epoch)
+            return verifiedLogin(api, brand, expected);
+        const pending = state.instanceId === connection.instanceId && state.phase !== 'blocked' && state.phase !== 'disposed' && (state.queuedProviders?.includes(brand) || state.checkingProviders.includes(brand) || state.phase === 'authorizing' && state.provider === brand);
+        return pending ? undefined : verifiedLogin(api, brand, expected);
+    };
+    const ready = check();
+    if (ready)
+        return ready;
+    if (typeof api.onLoginPromptState !== 'function' || typeof api.onConnectionState !== 'function')
+        throw new NeedError('CONNECT_API_MISMATCH', '我需要登录检查状态订阅能力', 'L onLoginPromptState / onConnectionState');
+    return new Promise((resolve, reject) => {
+        let ended = false;
+        const disposers = [];
+        const clear = () => { ended = true; signal?.removeEventListener('abort', abort); for (const off of disposers)
+            off(); };
+        const changed = () => { if (ended)
+            return; try {
+            const value = check();
+            if (value) {
+                clear();
+                resolve(value);
+            }
+        }
+        catch (error) {
+            clear();
+            reject(error);
+        } };
+        const abort = () => { if (ended)
+            return; clear(); reject(new NeedError('ABORTED', 'consumer wait cancelled', 'employee action')); };
+        const register = (off) => { if (ended)
+            off();
+        else
+            disposers.push(off); };
+        signal?.addEventListener('abort', abort, { once: true });
+        try {
+            if (signal?.aborted)
+                abort();
+            if (!ended)
+                register(api.onLoginPromptState(changed));
+            if (!ended)
+                register(api.onConnectionState(changed));
+            changed();
+        }
+        catch (error) {
+            clear();
+            reject(error);
+        }
+    });
+}
+async function ensureReady(api, brand, signal) {
+    const result = await awaitL(() => api.ensureReady(brand), signal);
+    if (!result.ok)
+        throw Object.assign(new NeedError(result.error.code, result.error.message, result.error.requires), { technical: loginDiagnostic('ensure-ready', 'L_ENSURE_READY_FAILED', brand, api.getConnectionState(), api.getLoginPromptState(), result.error.officialReason), ...(typeof result.error.officialReason === 'string' ? { officialReason: result.error.officialReason } : {}) });
+    return result.value;
+}
 export function unwrap(result) {
     if (!result.ok)
-        throw new NeedError(result.error.code, result.error.message, result.error.requires);
+        throw Object.assign(new NeedError(result.error.code, result.error.message, result.error.requires), typeof result.error.officialReason === 'string' ? { officialReason: result.error.officialReason } : {});
     return result.value;
 }
 export function validateTarget(t) {
@@ -76,12 +141,12 @@ export async function offerLogin(connect, request, currentApi, agent = CODEX_AGE
     requireNativeWorkspace(connect);
     request.signal?.throwIfAborted();
     const before = connect.getConnectionState();
-    const target = unwrap(await awaitL(() => connect.ensureReady(agent.loginProvider), request.signal));
+    const target = await ensureReady(connect, agent.loginProvider, request.signal);
     validateTarget(target);
     request.signal?.throwIfAborted();
     if (currentApi && currentApi() !== connect)
         throw new NeedError('CONNECTION_LOST', '远程主机连接组件已更换', '当前员工连接');
-    verifiedLogin(connect, agent.loginProvider, before);
+    await waitForLogin(connect, agent.loginProvider, before, currentApi ?? (() => connect), request.signal);
 }
 export function sameTarget(a, b) {
     return identity(a) === identity(b) && a.projectRoot === b.projectRoot && a.knownHostsFile === b.knownHostsFile && a.proxyCommand === b.proxyCommand && a.session.command === b.session.command && a.session.root === b.session.root && a.session.settingsPath === b.session.settingsPath;
@@ -99,12 +164,12 @@ export function connectProvider(get, options = {}) {
         if (request.mode === 'one-shot' && !agent.oneShot)
             throw new NeedError('MODE_UNSUPPORTED', '此远程模型仅支持会话模式', '使用会话模式');
         const before = api.getConnectionState();
-        const target = unwrap(await awaitL(() => api.ensureReady(agent.loginProvider), request.signal));
+        const target = await ensureReady(api, agent.loginProvider, request.signal);
         validateTarget(target);
         request.signal?.throwIfAborted();
         if (get() !== api)
             throw new NeedError('CONNECTION_LOST', '远程主机连接组件已更换', '当前员工连接');
-        const connection = verifiedLogin(api, agent.loginProvider, before);
+        const connection = await waitForLogin(api, agent.loginProvider, before, get, request.signal);
         if (request.identity && request.identity !== identity(target))
             throw new NeedError('SESSION_CONTEXT_MISMATCH', '员工主机与原会话不一致，请新建会话', '原员工主机');
         admissions.set(request, { api, target, connection });
@@ -115,15 +180,14 @@ export function connectProvider(get, options = {}) {
         const admitted = admissions.get(request);
         admissions.delete(request);
         const { api, target, connection } = admitted;
-        const stable = () => { request.signal?.throwIfAborted(); if (get() !== api)
-            throw new NeedError('CONNECTION_LOST', '远程主机连接组件已更换', '当前员工连接'); verifiedLogin(api, agent.loginProvider, connection); };
-        stable();
+        const stable = () => waitForLogin(api, agent.loginProvider, connection, get, request.signal);
+        await stable();
         if (!request.sessionId)
             throw new NeedError('PROJECT_BINDING_REQUIRED', '我需要当前会话和已选择的工作区，请使用原生工作区入口', 'DSH会话与原生工作区');
         await options.notice?.reconcile(request, api);
-        stable();
+        await stable();
         const resolved = unwrap(await awaitL(() => api.resolveSessionProject(request.sessionId, { provider: agent.loginProvider, purpose: 'user-turn' }), request.signal));
-        stable();
+        await stable();
         if (!resolved || resolved.instanceId !== connection.instanceId || resolved.epoch !== connection.epoch)
             throw new NeedError('CONNECTION_LOST', '工作区解析回复已失效', '当前连接代次');
         validateTarget(resolved.target);
@@ -133,19 +197,19 @@ export function connectProvider(get, options = {}) {
         if (request.cwd && request.cwd !== project.path || request.bindingId && request.bindingId !== resolved.bindingId || request.workspaceId && request.workspaceId !== resolved.workspaceId)
             throw new NeedError('SESSION_CONTEXT_MISMATCH', '原会话的工作区绑定已改变，请新建会话', '原工作区绑定');
         const details = await options.details?.(request, api, connection, target);
-        stable();
+        await stable();
         let workspaceNotice = undefined;
         if (resolved.notice) {
             if (!options.notice)
                 throw new NeedError('DEPENDENCY_REQUIRED', '我需要官方会话持久记录来确认工作区说明', '官方会话与持久化服务');
             workspaceNotice = await options.notice.deliver(resolved.notice, resolved, request, api);
-            stable();
+            await stable();
         }
         if (!options.open)
             throw new NeedError('RUNTIME_REQUIRED', '我需要主机运行适配器', '主机broker适配');
         const runtime = await options.open(resolved.target, project, { ...request, agent });
         try {
-            stable();
+            await stable();
         }
         catch (error) {
             await runtime.dispose?.();

package/dist/readiness.js

@@ -32,6 +32,7 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
     if (target) Object.defineProperty(target, contextIn.name, descriptor);
     done = true;
 };
+import { loginDiagnostic } from "./login-diagnostic.js";
 import { randomUUID } from 'node:crypto';
 import { Remote, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
 import { unwrap, awaitL, requireLoginCoordinator, requireLoginState } from "./provider.js";
@@ -56,18 +57,19 @@ function snapshot(api, agent = CODEX_AGENT) {
     if (connection.phase !== 'connected')
         return denied(connection.need?.code ?? (connection.phase === 'disposed' ? 'DISPOSED' : 'CONNECTION_LOST'));
     const state = api.getLoginPromptState();
+    const diagnostic = (reason) => ({ label: '登录检查快照', value: JSON.stringify(loginDiagnostic('readiness', reason, brand, connection, state)) });
     if (!connection.instanceId || state.instanceId !== connection.instanceId)
-        return denied('AUTH_STATUS_INVALID');
+        return denied('AUTH_STATUS_INVALID', [diagnostic('LOGIN_INSTANCE_MISMATCH')]);
     requireLoginState(state);
     const technical = details({ hostContext: state.technicalDetails?.hostContext });
     if (state.phase === 'blocked' || state.phase === 'disposed')
-        return denied(state.technicalDetails?.code ?? 'AUTH_STATUS_INVALID', technical);
-    if (state.checkingProviders.includes(brand) || state.phase === 'authorizing' && state.provider === brand)
+        return denied(state.technicalDetails?.code ?? 'AUTH_STATUS_INVALID', [...technical, diagnostic(state.phase === 'disposed' ? 'LOGIN_PHASE_DISPOSED' : 'LOGIN_PHASE_BLOCKED')]);
+    if (state.queuedProviders?.includes(brand) || state.checkingProviders.includes(brand) || state.phase === 'authorizing' && state.provider === brand)
         return { phase: 'checking', loginStatus: 'unknown', title: `正在检查 ${agent.name.zh} 登录状态`, message: '远程主机连接正在检查登录状态。', technical };
     if (state.providerNeeds[brand])
-        return denied(state.providerNeeds[brand].code, technical);
+        return denied(state.providerNeeds[brand].code, [...technical, diagnostic('LOGIN_PROVIDER_NEED')]);
     if (typeof state.logins?.[brand] !== 'boolean')
-        return denied('AUTH_STATUS_INVALID', technical);
+        return denied('AUTH_STATUS_INVALID', [...technical, diagnostic('LOGIN_VALUE_INVALID')]);
     return state.logins[brand] ? { phase: 'ready', loginStatus: 'logged-in', title: `${agent.name.zh}已登录`, message: '本次远程主机连接和主机登录检查已完成。', technical } : { phase: 'login-required', loginStatus: 'not-logged-in', title: `${agent.name.zh} 尚未登录`, message: '需要登录，请到设置 → 远程主机连接 点登录', technical };
 }
 export function createReadiness(get, agent = CODEX_AGENT) {

package/dist/remote-details.d.ts

@@ -1,8 +1,9 @@
 import { type DetailObservation } from './conversation-details.ts';
+import type { LoginDiagnostic } from './login-diagnostic.ts';
 import type { ConnectApi as LConnectApi, ConnectionState } from '@ai-workbench/connect/api';
 export type { RemoteConversationDetail as RemoteDetail } from '@ai-workbench/connect/api';
 type Connection = Pick<ConnectionState, 'instanceId' | 'epoch' | 'phase'>;
-export type RemoteDetailsApi = Pick<LConnectApi, 'getConnectionState'> & Partial<Pick<LConnectApi, 'getContractInfo' | 'appendRemoteConversationDetail' | 'getRemoteConversationDetailReceipt' | 'listRemoteConversationDetails'>>;
+export type RemoteDetailsApi = Pick<LConnectApi, 'getConnectionState'> & Partial<Pick<LConnectApi, 'getContractInfo' | 'appendRemoteConversationDetail' | 'getRemoteConversationDetailReceipt' | 'listRemoteConversationDetails' | 'appendLoginDiagnostic' | 'getLoginDiagnosticReceipt' | 'listLoginDiagnostics'>>;
 export interface DetailChannel {
     record(observation: DetailObservation): void;
     beginTurn(ids: {
@@ -22,5 +23,17 @@ export declare function createRemoteDetails(options: {
     profileDir: string;
     getApi: () => RemoteDetailsApi | undefined;
 }): {
+    recordLoginFailure(request: {
+        sessionId?: string;
+        code: string;
+        diagnostic: LoginDiagnostic;
+        context?: {
+            turn: string | number | null;
+            step: string | number | null;
+        };
+    }): Promise<{
+        eventId: string;
+        recorded: true;
+    }>;
     open(request: DetailRequest): Promise<DetailChannel>;
 };

package/dist/remote-details.js

@@ -88,9 +88,139 @@ async function readJournal(path) {
 }
 export function createRemoteDetails(options) {
     const root = join(options.profileDir, 'ai-workbench-remote-agent', 'diagnostics');
-    const scopes = new Map();
+    const scopes = new Map(), loginScopes = new Map();
     const initialize = async () => { await privateDirectory(join(options.profileDir, 'ai-workbench-remote-agent')); await privateDirectory(root); };
-    return { async open(request) {
+    return {
+        async recordLoginFailure(request) {
+            await initialize();
+            const eventId = randomUUID(), diagnostic = request.diagnostic;
+            // The original observed IDs and full approved snapshot are durable before any L call.
+            await durableWrite(join(root, eventId + '.json'), { version: 1, eventId, kind: 'login-check', code: request.code, sessionHash: request.sessionId ? hash(request.sessionId) : null, diagnostic, delivery: 'pending' });
+            if (!request.sessionId)
+                throw failure('REMOTE_DETAIL_SCOPE_INVALID');
+            const sessionId = request.sessionId, provider = diagnostic.provider, api = options.getApi(), connection = diagnostic.connection;
+            const stable = () => { const now = api?.getConnectionState(); if (!api || options.getApi() !== api || now?.phase !== 'connected' || now.instanceId !== connection.instanceId || now.epoch !== connection.epoch)
+                throw failure('CONNECTION_LOST'); };
+            stable();
+            if (api.getContractInfo?.().loginDiagnostics !== 1 || !['appendLoginDiagnostic', 'getLoginDiagnosticReceipt', 'listLoginDiagnostics'].every(key => typeof api[key] === 'function'))
+                throw failure('TECHNICAL_DETAILS_UNAVAILABLE', '技术详情暂不可用，请更新远程主机连接组件。');
+            const parent = join(root, 'login');
+            await privateDirectory(parent);
+            const key = hash(sessionId + '\0' + provider), dir = join(parent, key);
+            await privateDirectory(dir);
+            const scope = loginScopes.get(key) ?? { tail: Promise.resolve(), maximum: 0, loaded: false };
+            loginScopes.set(key, scope);
+            const operation = scope.tail.then(async () => {
+                stable();
+                const generation = connection.instanceId + '\0' + connection.epoch;
+                if (!scope.loaded || scope.generation !== generation) {
+                    const names = await readdir(dir);
+                    for (const name of names) {
+                        const match = /^(\d+)-([0-9a-f-]+)\.json$/.exec(name);
+                        if (!match)
+                            continue;
+                        const sequence = Number(match[1]);
+                        if (!Number.isSafeInteger(sequence))
+                            throw failure('REMOTE_DETAIL_STORAGE_FAILED');
+                        scope.maximum = Math.max(scope.maximum, sequence);
+                        const saved = await readJournal(join(dir, name));
+                        if (!object(saved) || !object(saved.detail) || saved.detail.sequence !== sequence || saved.detail.eventId !== match[2] || saved.detail.sessionId !== sessionId || saved.detail.provider !== provider)
+                            throw failure('REMOTE_DETAIL_STORAGE_FAILED');
+                        const settled = 'settled-' + match[2] + '.json';
+                        if (names.includes(settled)) {
+                            const receipt = await readJournal(join(dir, settled));
+                            if (!object(receipt) || receipt.eventId !== match[2] || !['recorded', 'rejected'].includes(receipt.state))
+                                throw failure('REMOTE_DETAIL_STORAGE_FAILED');
+                            continue;
+                        }
+                        stable();
+                        const receipt = unwrap(await api.getLoginDiagnosticReceipt({ eventId: match[2], sessionId, provider }));
+                        stable();
+                        if (receipt.eventId !== match[2] || !receipt.recorded)
+                            throw failure('REMOTE_DETAIL_DELIVERY_UNKNOWN');
+                        if (!isDeepStrictEqual(receipt.detail, saved.detail))
+                            throw failure('REMOTE_DETAIL_RECEIPT_INVALID');
+                        await durableWrite(join(dir, settled), { eventId: match[2], state: 'recorded' });
+                    }
+                    let cursor, previous = -1, count = 0, expected;
+                    const seen = new Set();
+                    do {
+                        stable();
+                        const page = unwrap(await api.listLoginDiagnostics({ sessionId, provider, ...(cursor ? { cursor } : {}) }));
+                        stable();
+                        if (!object(page) || !Array.isArray(page.items) || ![page.total, page.unknownCount, page.actionRequiredCount].every(n => Number.isSafeInteger(n) && n >= 0))
+                            throw failure('REMOTE_DETAIL_RESPONSE_INVALID');
+                        const counts = { total: page.total, unknownCount: page.unknownCount, actionRequiredCount: page.actionRequiredCount };
+                        if (expected && !isDeepStrictEqual(expected, counts))
+                            throw failure('REMOTE_DETAIL_RESPONSE_INVALID');
+                        expected = counts;
+                        for (const entry of page.items) {
+                            if (entry.sessionId !== sessionId || entry.provider !== provider || !Number.isSafeInteger(entry.sequence) || entry.sequence < 0 || entry.sequence <= previous)
+                                throw failure('REMOTE_DETAIL_RESPONSE_INVALID');
+                            previous = entry.sequence;
+                            scope.maximum = Math.max(scope.maximum, entry.sequence);
+                            count++;
+                        }
+                        cursor = page.nextCursor;
+                        if (cursor !== undefined && (typeof cursor !== 'string' || !cursor || seen.has(cursor)))
+                            throw failure('REMOTE_DETAIL_CURSOR_INVALID');
+                        if (cursor)
+                            seen.add(cursor);
+                    } while (cursor);
+                    if (count !== expected?.total)
+                        throw failure('REMOTE_DETAIL_RESPONSE_INVALID');
+                    scope.loaded = true;
+                    scope.generation = generation;
+                }
+                const mismatch = diagnostic.reason === 'LOGIN_INSTANCE_MISMATCH', unsupported = !!diagnostic.officialReasonRejected;
+                const reason = mismatch ? 'LOGIN_INSTANCE_MISMATCH' : unsupported ? 'OFFICIAL_REASON_UNSUPPORTED' : diagnostic.reason;
+                // L 0.7.11: observed evidence never changes the current connection scope.
+                const login = { phase: diagnostic.login.phase, instanceId: diagnostic.login.instanceId, logins: Object.fromEntries(Object.entries(diagnostic.login.logins).filter(([, v]) => typeof v === 'boolean' || v === 'absent')), queuedProviders: diagnostic.login.queuedProviders, checkingProviders: diagnostic.login.checkingProviders };
+                const payload = { reason, connection: { ...connection }, login, ...(mismatch ? { observedLoginInstanceId: diagnostic.login.instanceId } : {}), ...(diagnostic.officialReason ? { officialReason: diagnostic.officialReason } : {}), ...(unsupported && !mismatch ? { officialReasonRejected: diagnostic.officialReasonRejected } : {}) };
+                // The two payload reasons are exclusive in L's contract. Preserve both facts
+                // using the approved fixed summary and full digest, without inventing a field.
+                const rejected = diagnostic.officialReasonRejected;
+                const summary = '登录检查：' + diagnostic.reason + (rejected ? '; OFFICIAL_REASON_UNSUPPORTED; bytes=' + rejected.bytes + '; SHA256=' + rejected.sha256 : '');
+                const context = request.context ?? { turn: null, step: null };
+                if (!identifier(context.turn) || !identifier(context.step))
+                    throw failure('REMOTE_DETAIL_SCOPE_INVALID');
+                const sequence = scope.maximum + 1;
+                if (!Number.isSafeInteger(sequence))
+                    throw failure('REMOTE_DETAIL_SEQUENCE_INVALID');
+                scope.maximum = sequence;
+                const detail = { version: 1, eventId, instanceId: connection.instanceId, epoch: connection.epoch, sessionId, provider, turn: context.turn, step: context.step, sequence, kind: 'login-check', severity: 'action-required', code: request.code, summary, method: diagnostic.source, payload };
+                await durableWrite(join(dir, sequence + '-' + eventId + '.json'), { state: 'pending', detail });
+                stable();
+                let response;
+                try {
+                    response = await api.appendLoginDiagnostic(structuredClone(detail));
+                }
+                catch {
+                    stable();
+                    const receipt = unwrap(await api.getLoginDiagnosticReceipt({ eventId, sessionId, provider }));
+                    stable();
+                    if (receipt.eventId !== eventId)
+                        throw failure('REMOTE_DETAIL_RECEIPT_INVALID');
+                    if (!receipt.recorded)
+                        throw failure('REMOTE_DETAIL_DELIVERY_UNKNOWN');
+                    if (!isDeepStrictEqual(receipt.detail, detail))
+                        throw failure('REMOTE_DETAIL_RECEIPT_INVALID');
+                    await durableWrite(join(dir, 'settled-' + eventId + '.json'), { eventId, state: 'recorded' });
+                    return;
+                }
+                stable();
+                if (response?.ok === false)
+                    await durableWrite(join(dir, 'settled-' + eventId + '.json'), { eventId, state: 'rejected', code: response.error.code });
+                const ack = unwrap(response);
+                if (ack.eventId !== eventId || ack.recorded !== true)
+                    throw failure('REMOTE_DETAIL_RESPONSE_INVALID');
+                await durableWrite(join(dir, 'settled-' + eventId + '.json'), { eventId, state: 'recorded' });
+            });
+            scope.tail = operation.then(() => { }, () => { scope.loaded = false; });
+            await operation;
+            return { eventId, recorded: true };
+        },
+        async open(request) {
             if (!request.sessionId || !request.identity || !request.connection.instanceId || !Number.isSafeInteger(request.connection.epoch) || request.connection.epoch < 0 || !['claude', 'codex'].includes(request.provider))
                 throw failure('REMOTE_DETAIL_SCOPE_INVALID');
             try {
@@ -246,5 +376,6 @@ export function createRemoteDetails(options) {
                 async flush() { await tail; if (firstFailure)
                     throw firstFailure.error; stable(); },
             };
-        } };
+        }
+    };
 }

package/dist/remote.d.ts

@@ -1,3 +1,4 @@
+import type { LoginDiagnostic } from './login-diagnostic.ts';
 import type { ChildProcessWithoutNullStreams } from 'node:child_process';
 /** Development-only direct SSH. Product transports must consume L's exported sshArgs (v0.2). */
 export interface DevelopmentSshTarget {
@@ -16,6 +17,8 @@ export interface Need {
 export declare class NeedError extends Error {
     code: string;
     requires: string;
+    technical?: LoginDiagnostic;
+    officialReason?: string;
     constructor(code: string, message: string, requires: string);
 }
 export declare function shellQuote(value: string): string;

package/dist/remote.js

@@ -2,6 +2,8 @@ import { spawn } from 'node:child_process';
 export class NeedError extends Error {
     code;
     requires;
+    technical;
+    officialReason;
     constructor(code, message, requires) {
         super(message);
         this.name = 'NeedError';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-workbench/remote-agent",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -36,7 +36,7 @@
     "zod": "4.6.7"
   },
   "devDependencies": {
-    "@ai-workbench/connect": "file:test/fixtures/ai-workbench-connect-0.7.9.tgz",
+    "@ai-workbench/connect": "file:test/fixtures/ai-workbench-connect-0.7.11.tgz",
     "@deepseek-ai/cordis": "4.0.4",
     "@deepseek-ai/cordis-plugin-group": "1.0.4",
     "@deepseek-ai/cordis-plugin-include": "1.0.9",
@@ -56,7 +56,7 @@
     "@deepseek-ai/dsh-attachment": "0.2.0-rc.2"
   },
   "peerDependencies": {
-    "@ai-workbench/connect": "~0.7.9",
+    "@ai-workbench/connect": "~0.7.11",
     "@deepseek-ai/cordis": "4.0.4",
     "@deepseek-ai/dsh-llm": "0.2.0-rc.2",
     "@deepseek-ai/dsh-typert-protocol": "0.2.0-rc.2",