@ai-workbench/remote-agent 0.8.17 → 0.8.18

package/README.md

@@ -1,10 +1,10 @@
-**`@ai-workbench/remote-agent@0.8.17` 发布形态包。Claude、Codex 接入 L0.7.20 已选择的主机文件夹；成功核验来源和目录后才打开技术详情与派发，每次派发前重新核验。L 的具体原因和下一步动作直接给员工。包含0.8.16首次关闭、运行、诊断保存和清理结果留痕；历史原始撤销字段与61秒慢查询根因仍未查明。本版 leo 主机位置/真实员工链路尚未复验。通过官方插件 → 添加插件安装；固定包由编排发布，X2 不 publish。**
+**`@ai-workbench/remote-agent@0.8.18` 发布形态包。继承0.8.17主机来源执行与L具体Need透传；本版修复Codex员工执行通道时序（需受保护aw.3）、去除逐RPC重复SSH，失败先交还官方界面并显示“正在确认主机清理”。通过官方插件 → 添加插件安装；固定包由编排发布，X不publish。工程/包证明与leo产品验收分别记录，未运行的门保持NOT_RUN。**
 
 # 远程ACP插件
 
 一个插件提供 **Claude（远程主机）** 和 **Codex（远程主机）**，通过员工主机上的官方CLI运行。Codex保留单次模式；Claude固定会话模式。只用官方模型列表、插件管理和配置入口，不提供自制面板、问答或登录按钮。登录和原生工作区绑定唯一归连接插件L。
 
-当前版本0.8.17，由X2按编排裁定基于0.8.16交付主机来源执行和L具体Need透传；包名采用`@ai-workbench/remote-agent`以涵盖两个品牌；本轮按编排放行准备发布形态包，供 leo 真机自验；X 不执行实际发布，由编排统一发布。开发fixture逐字节保留L0.7.20固定包，公开类型与SSH导出从该包消费。运行时仍要求L的`getContractInfo()`同时返回API0.7.0、implemented、native-local-v1；旧L包、draft.3或只有版本号的不完整实现会明确报缺项。依赖范围为`~0.7.20`，L由官方插件管理单独安装，不打进X。组件验证不代表真实开通、模型或leo E通过；HanaMesh另验。
+当前版本0.8.18，由X按编排裁定在X2的0.8.17上交付aw.3/去重复SSH/失败先交还；0.8.17的主机来源执行和L具体Need透传完整保留；包名采用`@ai-workbench/remote-agent`以涵盖两个品牌；本轮按编排放行准备发布形态包，供 leo 真机自验；X 不执行实际发布，由编排统一发布。开发fixture逐字节保留L0.7.20固定包，公开类型与SSH导出从该包消费。运行时仍要求L的`getContractInfo()`同时返回API0.7.0、implemented、native-local-v1；旧L包、draft.3或只有版本号的不完整实现会明确报缺项。依赖范围为`~0.7.20`，L由官方插件管理单独安装，不打进X。组件验证不代表真实开通、模型或leo E通过；HanaMesh另验。
 
 已包含L0.7.18消费增量：来源确认、输入接纳、登录、本机接纳、输入准备、模型目录及运行时解析的早期失败，用正式`preflightDiagnostics:1` / `preflight-check`进入L「连接前技术详情（含登录与工作区确认）」。阶段、真实来源/状态和错误代码可展开；未知来源为null，旧login-check的完整安全原因保留。记录不选择来源、不接纳输入、不自动重发；无原生会话的菜单查询仍在模型设置报告。当前工程和设置组件验证不等于leo GUI验收。
 
@@ -12,7 +12,7 @@
 
 ## 员工路径
 
-从官方插件管理安装，照常使用默认工作区/会话/模型入口。L沿唯一“远程主机连接”设置节记录文件来源；L0.7.20新选主机位置由两品牌按已核验的规范目录执行，旧legacy主机绑定仍沿原规则；本地来源接入N0.4.4/S0.4.11员工端点。旧映射可在本轮官方一次确认中选择改用本机文件夹；拒绝、取消或输入/来源变化时不切换、不执行。也可在L设置逐工作区确认沿用原主机关联。缺正式host解析能力时明确说明所缺组件、保留原话，本轮不派发。本地六类工具经Claude公开toolAliases路由到员工电脑：cwd是员工选定目录，Git使用本机仓库，不回退主机同名目录。本地真实员工输入先取得官方当前轮次CAS预期，再调用L0.7.17 acceptLocalWorkspaceUserTurn；核回包后才打开D19和本轮主机目录/执行。每轮localAcceptanceId冻结进原详情sink，迟到结果不借新轮ID；LOCAL_USER_TURN_CHANGED立即停止本轮，不重接纳或退legacy。已用固定真包完成本地D19组件联测；编排已回证0.8.14 Claude/Opus5/Default在leo本地目录首轮写文件成功；该回证不覆盖本0.8.17或Codex，产品验收以各版本leo实际结果为准。本地文件不自动上传，X不猜目录、不选首项。首次说明使用官方普通回复；先经官方会话提交、持久化并读回核对，才向L确认。持久记录不等于员工已看见，GUI另验；日志丢失后的未知claim由L保留，不宣称端到端恰好一次。
+从官方插件管理安装，照常使用默认工作区/会话/模型入口。L沿唯一“远程主机连接”设置节记录文件来源；L0.7.20新选主机位置由两品牌按已核验的规范目录执行，旧legacy主机绑定仍沿原规则；本地来源接入N0.4.4/S0.4.11员工端点。旧映射可在本轮官方一次确认中选择改用本机文件夹；拒绝、取消或输入/来源变化时不切换、不执行。也可在L设置逐工作区确认沿用原主机关联。缺正式host解析能力时明确说明所缺组件、保留原话，本轮不派发。本地六类工具经Claude公开toolAliases路由到员工电脑：cwd是员工选定目录，Git使用本机仓库，不回退主机同名目录。本地真实员工输入先取得官方当前轮次CAS预期，再调用L0.7.17 acceptLocalWorkspaceUserTurn；核回包后才打开D19和本轮主机目录/执行。每轮localAcceptanceId冻结进原详情sink，迟到结果不借新轮ID；LOCAL_USER_TURN_CHANGED立即停止本轮，不重接纳或退legacy。已用固定真包完成本地D19组件联测；编排已回证0.8.14 Claude/Opus5/Default在leo本地目录首轮写文件成功；该回证不覆盖本0.8.18或Codex，产品验收以各版本leo实际结果为准。本地文件不自动上传，X不猜目录、不选首项。首次说明使用官方普通回复；先经官方会话提交、持久化并读回核对，才向L确认。持久记录不等于员工已看见，GUI另验；日志丢失后的未知claim由L保留，不宣称端到端恰好一次。
 
 新主机位置允许当前SSH员工账号可访问的已选绝对目录、文件系统根目录、非Git或只读目录；不改写原projectRoot、不创建Git、不转本机同名文件夹。read/execute必须可核实，write=false不额外一刀切拒绝，实际写入服从主机系统权限。运行前必核来源UUID、连接代次、目录及链接入口dev/ino和权限；revision与内容增删导致的mtime/ctime变化不单独失效。此核对属于正确性条件，不可关闭。最后inspect到主机spawn之间仍有OS时序边界，不表示原子目录句柄租约。
 
@@ -80,7 +80,7 @@ D21（0.8.5）：两个品牌的官方模型菜单从 L 的 `modelCatalogTarget:
 
 每轮先核对目录代次和所选模型，再经 ACP 逐项配置模型及推理等级，收到完整配置确认后才发送输入。Claude 别名每轮须有精确的模型配置成功回执，并由同一员工主机、同一连接代际的目录唯一映射到具体型号。具体型号注明来自主机目录，会话未单独回报；旧恢复记录不作本轮证据。目录缺项、映射不唯一、回执不符或身份/代际变化时不发送输入。所选值、远端确认值及型号来源仅在恢复标识与技术详情保留，插件不向真实回复追加技术参数，确认配置不等于验证推理效果。连接/身份/目录变化清除旧确认；远端清理待定或结果未知时阻止派发，不自动清理重试或另开替代会话。Codex 单次模式当前不能确认此选择，会在发送前明确拒绝。新增设置 0；本轮工程证据、真实只读链路与产品未验项见 `docs/evidence/2026-10-22-X2-D21/`。
 
-0.8.5统一包原依赖L `~0.7.13`；0.8.16原对齐L `~0.7.19`；当前0.8.17对齐L `~0.7.20`。D8模型目录双事件长期监听保留；同epoch的recovery提示/失败消息变化不触发执行状态失效，真实实例/epoch/phase/可信目标/登录变化仍失效。完整D9两品牌正文/状态/就绪门呈现按编排00:50允许的范围记下一版，本版不宣称已消费完成；L的connectionMessages.administratorAfterMs仍只由L管理，X新增设置0。
+0.8.5统一包原依赖L `~0.7.13`；0.8.16原对齐L `~0.7.19`；当前0.8.18对齐L `~0.7.20`。D8模型目录双事件长期监听保留；同epoch的recovery提示/失败消息变化不触发执行状态失效，真实实例/epoch/phase/可信目标/登录变化仍失效。完整D9两品牌正文/状态/就绪门呈现按编排00:50允许的范围记下一版，本版不宣称已消费完成；L的connectionMessages.administratorAfterMs仍只由L管理，X新增设置0。
 
 D18（0.8.6）：Codex 需要主机自有 adapter `2.2.2-aw.1` 的明确新建会话上下文政策，官方 CLI 仍为未改的0.160.1。系统/开发者要求仅在新建时生效；恢复时与初建摘要相同则正常恢复且省略新建专用字段，不声称恢复接口会更新指令。要求不同或清空时，在同一真实回复说明“会话要求已变化，已新建 Codex 会话继续处理，原会话仍保留。”，并新建远端承接公开对话，保留旧标识和查询记录；旧/非法初建摘要明确拒绝，不能猜测。
 
@@ -130,3 +130,9 @@ D20（0.8.8开发记录）：本地来源的Codex原生文件与命令通过固
 0.8.14 不把空菜单、非穷举 picker、可选 UI category/label 或同值配置通知当作额外发送门槛；每轮仍要求可靠模型入口与 fresh exact setter ACK。本轮完成后的配置变化只记录 warning，保留真实回复与 finish，并明确未获单独的实际执行型号回报。同一身份、代际与可信目标的 needCode/诊断变化只记 info；真实身份、代际、目标或能力失效仍撤回。每次关闭/取消保留 caller、字段前后值和首次观测原因（不等于根因）。新增配置、阈值、超时、重试为 0。
 
 0.8.16 不新增 Config、默认值、阈值、超时或重试。首因可见、旧代不重投、实际选择与绑定一致属于不可关闭的正确性不变量。目录完成结果不用于后续请求缓存；活跃租约仅保留更新观测的选择有效性证据，释放即撤登记。断连/错代仍保留原详情信封及未确认状态，仅按旧合同读 receipt 核验。`unconfirmed-<eventId>.json` 私有记录追加是否尝试及失败阶段/固定码，不能当作 L 的 ACK；员工可见原因沿官方错误消息，无新增面板。
+
+### 本机执行的核验位置（不可关闭）
+
+L接纳每轮真实输入时核对实际目录和N端点/代次。X只在该代执行通道open时向S核对一次target，并继续验证员工执行器固定SHA和官方版本；原生注册发生在open完成之后。之后broker输入及每个native RPC只核对既有内存连接、工作区绑定和接纳事实，撤销来自已订阅的L连接/位置、N网络事件和执行SSH关闭。N实例/代次改变会重新接纳并建立新通道，旧流不会跨代迁移。
+
+这属于执行位置与已接纳输入的一致性不变量，没有关闭设置。失败先交还官方会话并显示“正在确认主机清理”，详情落盘及条件kill/list随后在原清理promise进行；同一会话仍由原cleanupFailure/未知送达门阻止不安全重发。没有新增超时、重试、模型限制或中止检查。技术详情事件EMPLOYEE_EXECUTION_VALIDATION_POLICY列出同一核验位置。

package/dist/acp.js

@@ -1,4 +1,4 @@
-import { CloseDiagnostics } from "./close-diagnostics.js";
+import { CloseDiagnostics, withFailureEvidence } from "./close-diagnostics.js";
 import * as acp from '@agentclientprotocol/sdk/unstable';
 import { NeedError } from "./remote.js";
 import { employeeFailure } from "./presentation.js";
@@ -390,7 +390,7 @@ export class AcpSession {
         signal?.addEventListener('abort', abort, { once: true });
         try {
             const hello = await this.stage('acp-initialize', () => this.connection.agent.request(acp.methods.agent.initialize, {
-                protocolVersion: acp.PROTOCOL_VERSION, clientInfo: { name: '@ai-workbench/remote-agent', version: '0.8.17' },
+                protocolVersion: acp.PROTOCOL_VERSION, clientInfo: { name: '@ai-workbench/remote-agent', version: '0.8.18' },
                 clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, terminal: false, session: { notices: {} }, ...(this.employeeMeta ? { _meta: { awEmployeeExecution: { version: 1 } } } : {}) },
             }, { cancellationSignal: signal }));
             this.hooks.broker?.acknowledge(acp.methods.agent.initialize);
@@ -609,8 +609,18 @@ export function acpNeed(error) {
             if (typeof value !== 'string')
                 continue;
             const code = value.split(':', 1)[0];
-            if (employeeAdapterCodes.has(code))
-                return new NeedError(code, employeeFailure(code), `员工电脑执行适配器明确拒绝：${code}；RPC 错误码 ${error.code}`);
+            if (employeeAdapterCodes.has(code)) {
+                const failure = new NeedError(code, employeeFailure(code), `员工电脑执行适配器明确拒绝：${code}；RPC 错误码 ${error.code}`);
+                if (code === 'AW_EMPLOYEE_ENVIRONMENT_REGISTRATION_FAILED' && value.startsWith(code + ': ')) {
+                    const reason = value.slice(code.length + 2);
+                    if (employeeAdapterCodes.has(reason) || employeeOpenCauseCodes.has(reason)) {
+                        const retained = withFailureEvidence(Object.assign(failure, { cause: new NeedError(reason, '员工执行通道开通失败', '核对固定开通原因') }), [], 'diagnostic');
+                        retained.requires += `；RPC 错误码 ${error.code}`;
+                        return retained;
+                    }
+                }
+                return failure;
+            }
         }
     }
     if (error instanceof acp.RequestError && error.code === -32000)
@@ -619,6 +629,7 @@ export function acpNeed(error) {
         return new NeedError('ACP_FAILED', '远端 ACP 请求失败，根因未查明；未切换到新会话', `有效的远端 ACP 连接；RPC 错误码 ${error.code}`);
     return new NeedError('ACP_FAILED', '远端 ACP 请求失败或连接中断，根因未查明；未切换到新会话', '有效的远端 ACP 连接');
 }
+const employeeOpenCauseCodes = new Set(['AW_EMPLOYEE_BINARY_UNAVAILABLE', 'AW_EMPLOYEE_BINARY_HASH_FAILED', 'AW_EMPLOYEE_BINARY_HASH_MISMATCH', 'AW_EMPLOYEE_BINARY_VERSION_FAILED', 'AW_EMPLOYEE_BINARY_VERSION_MISMATCH', 'EMPLOYEE_CONTEXT_CHANGED', 'EMPLOYEE_ENDPOINT_INVALID', 'EMPLOYEE_BINARY_REQUIRED', 'EMPLOYEE_EXECUTION_UNSUPPORTED', 'EMPLOYEE_EXEC_PROTOCOL_INVALID', 'EMPLOYEE_EXEC_IDENTITY_MISMATCH', 'EMPLOYEE_EXEC_CLOSED', 'EMPLOYEE_EXEC_UNKNOWN', 'EMPLOYEE_EXEC_ALREADY_OPEN', 'EMPLOYEE_EXEC_READ_BUSY', 'ACP_MESSAGE_TOO_LARGE', 'ABORTED', 'SETTINGS_REQUIRED']);
 function record(value) { return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined; }
 const knownUpdates = new Set(['user_message_chunk', 'agent_message_chunk', 'agent_thought_chunk', 'tool_call', 'tool_call_update', 'plan', 'plan_update', 'plan_removed', 'available_commands_update', 'current_mode_update', 'config_option_update', 'session_info_update', 'usage_update', 'notice', 'compaction_update', 'compaction_summary_chunk', 'subagent_update', 'session_message', 'session_message_chunk']);
 function safeLabel(value) { return value.replaceAll(/[\r\n\x00-\x1f\x7f]/g, ' '); }

package/dist/employee-provider.js

@@ -8,11 +8,11 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 };
 import { connectNeedError } from "./connect-need.js";
 import { CODEX_EMPLOYEE_SCOPE_NOTICE } from "./employee-presentation.js";
-import { CloseDiagnostics, withFailureEvidence, closeCode, closeErrorCodes } from "./close-diagnostics.js";
+import { CloseDiagnostics, withFailureEvidence, withFirstFailureEvidence, closeCode, closeErrorCodes } from "./close-diagnostics.js";
 import { createHash } from 'node:crypto';
 import { admitEmployeeLocation } from "./employee-location.js";
 import { EmployeeExecution } from "./employee-exec.js";
-import { createEmployeeSshTransport, validateEmployeeSshTarget } from "./employee-ssh.js";
+import { createEmployeeSshTransport } from "./employee-ssh.js";
 import { sshIo } from "./broker.js";
 import { NeedError } from "./remote.js";
 const fail = (code) => new NeedError(code, code === 'EMPLOYEE_OPERATION_UNSUPPORTED' ? '当前本机工作区只支持正在连接的会话；单次运行和断线后的冷恢复暂不支持，请新建会话。' : '本机工作区的执行连接无法继续（' + code + '），本轮没有改用主机执行。', '当前 L 工作区绑定、N/S 员工执行端点与支持本机执行的会话适配器');
@@ -177,17 +177,25 @@ export function createEmployeeProvider(get, options, agent) {
                 await prior.dispose(fail('EMPLOYEE_CONTEXT_CHANGED'), { layer: 'endpoint', initiator: 'provider.scope-change', reason: 'EMPLOYEE_CONTEXT_CHANGED', action: 'dispose' });
             let entry = prior && prior.scope === scope && !prior.ended ? prior : undefined;
             let candidate = entry;
+            // Admission still verifies the real directory and N generation. Per-RPC gates below
+            // reuse the subscribed connection/location/network facts, without another SSH.
+            await admitted.validate(request.signal ?? new AbortController().signal);
+            details?.record({ kind: 'session', severity: 'info', code: 'EMPLOYEE_EXECUTION_VALIDATION_POLICY', summary: '本机执行核验不可关闭：L接纳核对实际目录与N端点；同代执行通道仅在open时核对一次主机target与固定执行器。之后每条消息只核对内存中的连接、工作区绑定和已接纳输入，撤销沿现有连接/位置/N网络事件及执行SSH关闭处理；不重复SSH，不改用主机执行。' });
+            if (entry)
+                entry.current = input;
             const base = async (signal) => {
                 signal.throwIfAborted();
                 if (get() !== api || employee.getNetwork() !== network)
                     throw fail('EMPLOYEE_CONTEXT_CHANGED');
                 if (candidate?.ended)
                     throw candidate.reason ?? fail('EMPLOYEE_EXEC_CLOSED');
-                await (candidate?.current ?? input).stable(signal);
-                await closeDiagnostics.run('endpoint.prepare', () => admitted.validate(signal));
+                const current = candidate?.current ?? input;
+                current.request.localAdmissionCheck?.();
+                await current.stable(signal);
                 if (get() !== api || employee.getNetwork() !== network)
                     throw fail('EMPLOYEE_CONTEXT_CHANGED');
-                await (candidate?.current ?? input).stable(signal);
+                current.request.localAdmissionCheck?.();
+                await current.stable(signal);
                 signal.throwIfAborted();
             };
             let argv = employee.argv;
@@ -208,11 +216,11 @@ export function createEmployeeProvider(get, options, agent) {
                 } };
             const ssh = { closeDiagnostics, target, endpoint: admitted.endpoint, employeeBinary: native.path, binarySha256: native.sha256, acpMaxMessageBytes: request.acpMaxMessageBytes, argv: argv ?? (() => []), validate: base, io: scopedIo };
             const validate = async (signal) => { try {
-                await validateEmployeeSshTarget(ssh, signal);
+                await base(signal);
             }
             catch (error) {
                 if (candidate && errorCode(error) !== 'ABORTED')
-                    await candidate.dispose(asNeed(error), { layer: 'endpoint', initiator: 'provider.validation-failure', reason: closeCode(error), action: 'invalidate' });
+                    void candidate.dispose(asNeed(error), { layer: 'endpoint', initiator: 'provider.validation-failure', reason: closeCode(error), action: 'invalidate' }).catch(cleanup => closeDiagnostics.record({ layer: 'runtime', initiator: 'provider.validation-cleanup', reason: closeCode(cleanup, 'REMOTE_CLEANUP_UNCONFIRMED'), action: 'failure' }));
                 throw error;
             } };
             await validate(request.signal ?? new AbortController().signal);
@@ -303,14 +311,14 @@ export function createEmployeeProvider(get, options, agent) {
                 try {
                     const result = await execution.handle(params, signal);
                     if (result.closed)
-                        await entry.dispose(undefined, { layer: 'runtime', initiator: 'provider.rpc-closed-result', reason: 'EMPLOYEE_EXEC_CLOSED', operation: typeof params === 'object' && params && 'operation' in params && typeof params.operation === 'string' ? params.operation : 'unknown', action: 'dispose' });
+                        void entry.dispose(undefined, { layer: 'runtime', initiator: 'provider.rpc-closed-result', reason: 'EMPLOYEE_EXEC_CLOSED', operation: typeof params === 'object' && params && 'operation' in params && typeof params.operation === 'string' ? params.operation : 'unknown', action: 'dispose' }).catch(cleanup => closeDiagnostics.record({ layer: 'runtime', initiator: 'provider.rpc-cleanup', reason: closeCode(cleanup, 'REMOTE_CLEANUP_UNCONFIRMED'), action: 'failure' }));
                     return { ...result };
                 }
                 catch (error) {
                     // EmployeeExecution reserves ABORTED for an unconsumed read wait. Lost responses are UNKNOWN.
                     if (!(params && typeof params === 'object' && 'operation' in params && params.operation === 'read' && errorCode(error) === 'ABORTED'))
-                        await entry.dispose(asNeed(error), { layer: 'runtime', initiator: 'provider.rpc-failure', reason: closeCode(error), action: 'dispose' });
-                    throw error;
+                        void entry.dispose(asNeed(error), { layer: 'runtime', initiator: 'provider.rpc-failure', reason: closeCode(error), action: 'dispose' }).catch(cleanup => closeDiagnostics.record({ layer: 'runtime', initiator: 'provider.rpc-cleanup', reason: closeCode(cleanup, 'REMOTE_CLEANUP_UNCONFIRMED'), action: 'failure' }));
+                    throw withFirstFailureEvidence(error, closeDiagnostics.first?.reason, errorCode(error));
                 }
             };
             runtime.dispose = cause => entry.dispose(undefined, cause ?? { layer: 'runtime', initiator: 'runtime.dispose', reason: 'RUNTIME_DISPOSE', action: 'dispose' });

package/dist/employee-ssh.d.ts

@@ -18,7 +18,7 @@ export interface EmployeeSshOptions {
 }
 /** Fixed bootstrap only; cwd for every native operation remains in its original RPC. */
 export declare function employeeExecServerCommand(binary: string, binarySha256: string): string;
-/** Invoke this in EmployeeExecution.validate before and after each native RPC write. */
+/** Explicit read-only probe; production dispatch verifies S once in transport open. */
 export declare function validateEmployeeSshTarget(options: EmployeeSshOptions, signal?: AbortSignal): Promise<void>;
 /** Outer L-authenticated host SSH, then S-authenticated employee SSH; no host execution fallback. */
 export declare function createEmployeeSshTransport(options: EmployeeSshOptions, signal?: AbortSignal): Promise<EmployeeExecutionTransport>;

package/dist/employee-ssh.js

@@ -99,7 +99,7 @@ async function currentTarget(options, signal) {
     await gate();
     return { io, args, gate };
 }
-/** Invoke this in EmployeeExecution.validate before and after each native RPC write. */
+/** Explicit read-only probe; production dispatch verifies S once in transport open. */
 export async function validateEmployeeSshTarget(options, signal = new AbortController().signal) { await currentTarget(options, signal); }
 /** Outer L-authenticated host SSH, then S-authenticated employee SSH; no host execution fallback. */
 export async function createEmployeeSshTransport(options, signal = new AbortController().signal) {

package/dist/failure-evidence.d.ts

@@ -6,6 +6,8 @@ export declare function closeErrorCodes(error: unknown, fallback?: string): stri
 export declare function closeFailure(code: string, message: string, requires: string, codes: readonly string[]): NeedError;
 /** Saving succeeded: retain the original trusted error type, code and presentation. */
 export declare function withFirstFailureEvidence<T>(primary: T, firstReason: unknown, primaryCode: string): T;
+/** A known turn failure is final even while its original resource is still closing. */
+export declare function withPendingCleanupEvidence<T>(primary: T, firstReason: unknown, primaryCode: string): T;
 /** Preserve causal roles without copying arbitrary exception text into employee output. */
 export declare function withFailureEvidence(primary: unknown, secondary: readonly unknown[], kind: 'diagnostic' | 'cleanup', firstReason?: unknown, primaryCode?: string): NeedError;
 export declare function primaryFailureCode(error: unknown, fallback: string): string;

package/dist/failure-evidence.js

@@ -62,6 +62,14 @@ export function withFirstFailureEvidence(primary, firstReason, primaryCode) {
     }
     return primary;
 }
+/** A known turn failure is final even while its original resource is still closing. */
+export function withPendingCleanupEvidence(primary, firstReason, primaryCode) {
+    if (primary && typeof primary === 'object') {
+        const previous = retainedEvidence(primary), first = previous?.first ?? (safeCode(firstReason) ? firstReason : undefined);
+        evidence.set(primary, Object.freeze({ ...previous, ...(first ? { first } : {}), original: previous?.original ?? Object.freeze([safeCode(primaryCode) ? primaryCode : 'TURN_FAILED']), diagnostic: previous?.diagnostic ?? Object.freeze([]), cleanup: previous?.cleanup ?? Object.freeze([]), cleanupPending: true }));
+    }
+    return primary;
+}
 /** Preserve causal roles without copying arbitrary exception text into employee output. */
 export function withFailureEvidence(primary, secondary, kind, firstReason, primaryCode) {
     const previous = retainedEvidence(primary), first = previous?.first ?? (safeCode(firstReason) ? firstReason : undefined);
@@ -79,5 +87,5 @@ export function failureEvidenceSummary(error) {
     const facts = retainedEvidence(error);
     if (!facts)
         return '';
-    return '技术详情：' + [...(facts.first ? ['首次观察关闭 ' + facts.first] : []), '运行原因 ' + facts.original.join('、'), ...(facts.diagnostic.length ? ['详情保存未确认 ' + facts.diagnostic.join('、')] : []), ...(facts.cleanup.length ? ['清理未确认 ' + facts.cleanup.join('、')] : [])].join('；');
+    return '技术详情：' + [...(facts.first ? ['首次观察关闭 ' + facts.first] : []), '运行原因 ' + facts.original.join('、'), ...(facts.diagnostic.length ? ['详情保存未确认 ' + facts.diagnostic.join('、')] : []), ...(facts.cleanup.length ? ['清理未确认 ' + facts.cleanup.join('、')] : facts.cleanupPending ? ['正在确认主机清理，原资源清理结果尚待确认'] : [])].join('；');
 }

package/dist/index.d.ts

@@ -106,6 +106,8 @@ export declare class CodexRemoteAdapter extends LlmAdapter {
         jitterRatio: number;
     };
     private cleanupRuntime;
+    /** Publish an already known failure without coupling the official stream to cleanup. */
+    private finishFailedTurn;
     disposeSession(sessionId: string): Promise<void>;
     detachSession(sessionId: string): Promise<void>;
     dispose(): Promise<void>;

package/dist/index.js

@@ -1,5 +1,6 @@
 import { connectNeedMessage } from "./connect-need.js";
 import { CloseDiagnostics, withFailureEvidence, withFirstFailureEvidence, failureEvidenceSummary, closeCode, closeErrorCodes, closeFailure } from "./close-diagnostics.js";
+import { withPendingCleanupEvidence } from "./failure-evidence.js";
 import { runCatalog } from "./catalog-ssh.js";
 import { createCatalogDiagnostics, CatalogDiagnosticsRemote } from "./catalog-diagnostics.js";
 import { SessionId } from '@deepseek-ai/dsh-session';
@@ -205,6 +206,35 @@ export class CodexRemoteAdapter extends LlmAdapter {
         this.cleanups.set(runtime, cleanup);
         return cleanup;
     }
+    /** Publish an already known failure without coupling the official stream to cleanup. */
+    finishFailedTurn(key, live, primary, code, firstReason) {
+        withPendingCleanupEvidence(primary, firstReason, code);
+        const runtime = live.runtime;
+        const disposal = this.cleanupRuntime(runtime).then(() => {
+            if (this.sessions.get(key) !== live || live.disposal !== disposal)
+                return;
+            live.disposal = undefined;
+            if (!live.failure) {
+                if (typeof runtime.dispose === 'function') {
+                    this.sessions.delete(key);
+                    this.preparationFailures.set(key, code);
+                }
+                else
+                    live.cleanupFailure = new NeedError('REMOTE_CLEANUP_UNCONFIRMED', '缺少原实例结束证明，不能重开或重发', '原实例的条件结束与list消失证明');
+            }
+        }, error => {
+            if (this.sessions.get(key) === live && live.disposal === disposal)
+                live.cleanupFailure = withFailureEvidence(primary, [error], 'cleanup', firstReason, code);
+            throw error;
+        });
+        live.disposal = disposal;
+        const report = (reason) => {
+            runtime.closeDiagnostics?.record({ layer: 'adapter', initiator: 'adapter.failed-turn-cleanup', reason, action: 'dispose' });
+            // State settles before reporting. A delayed D19 write is not another release gate.
+            void Promise.resolve().then(() => runtime.details?.flush()).catch(error => runtime.closeDiagnostics?.record({ layer: 'adapter', initiator: 'adapter.failed-turn-cleanup-report', reason: closeCode(error, 'CLOSE_FLUSH_FAILED'), action: 'failure' }));
+        };
+        void disposal.then(() => report(typeof runtime.dispose === 'function' ? 'RUNTIME_CLEANUP_CONFIRMED' : 'REMOTE_CLEANUP_UNCONFIRMED'), () => report('REMOTE_CLEANUP_UNCONFIRMED'));
+    }
     async disposeSession(sessionId) {
         this.sessions.get(sessionId)?.runtime.closeDiagnostics?.record({ layer: 'adapter', initiator: 'adapter.dispose-session', reason: 'SESSION_DISPOSED', action: 'abort' });
         this.turns.get(sessionId)?.abort();
@@ -677,22 +707,32 @@ export class CodexRemoteAdapter extends LlmAdapter {
             if (live && session && session.promptDispatchCount > promptBaseline)
                 live.failure = { cause: error };
             const reporting = [];
-            if (request?.recordEarlyFailure) {
-                const record = request.recordEarlyFailure;
-                request.recordEarlyFailure = undefined;
+            const reportFailure = async () => {
+                if (request?.recordEarlyFailure) {
+                    const record = request.recordEarlyFailure;
+                    request.recordEarlyFailure = undefined;
+                    try {
+                        await record(Object.assign(new NeedError(failureCode ?? 'TURN_PREPARATION_FAILED', '本轮在执行前失败。', '白名单阶段与错误代码'), { cause: error }), earlyStage);
+                    }
+                    catch (failure) {
+                        reporting.push(failure);
+                    }
+                }
                 try {
-                    await record(Object.assign(new NeedError(failureCode ?? 'TURN_PREPARATION_FAILED', '本轮在执行前失败。', '白名单阶段与错误代码'), { cause: error }), earlyStage);
+                    await runtime?.details?.flush();
                 }
                 catch (failure) {
                     reporting.push(failure);
                 }
+            };
+            if (runtime && key && live && live.runtime === runtime && this.sessions.get(key) === live) {
+                const captured = runtime;
+                void reportFailure().then(() => { for (const failure of reporting)
+                    for (const code of closeErrorCodes(failure, 'DIAGNOSTIC_WRITE_FAILED'))
+                        captured.closeDiagnostics?.record({ layer: 'adapter', initiator: 'adapter.failed-turn-details', reason: code, action: 'failure' }); }, failure => captured.closeDiagnostics?.record({ layer: 'adapter', initiator: 'adapter.failed-turn-details', reason: closeCode(failure, 'DIAGNOSTIC_WRITE_FAILED'), action: 'failure' }));
             }
-            try {
-                await runtime?.details?.flush();
-            }
-            catch (failure) {
-                reporting.push(failure);
-            }
+            else
+                await reportFailure();
             if (activeMapper)
                 yield* activeMapper.flush();
             const firstReason = request?.closeDiagnostics?.first?.reason ?? runtime?.closeDiagnostics?.first?.reason;
@@ -716,15 +756,19 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 else if (!succeeded || !key || mode !== 'session') {
                     session?.close({ layer: 'adapter', initiator: 'adapter.turn-finally', reason: succeeded ? 'TURN_FINISHED' : 'TURN_FAILED', action: 'close' });
                     if (runtime) {
-                        await this.cleanupRuntime(runtime);
-                        if (key && live && !live.failure && this.sessions.get(key) === live) {
-                            if (typeof runtime.dispose === 'function') {
-                                this.sessions.delete(key);
-                                if (!succeeded)
-                                    this.preparationFailures.set(key, failureCode ?? 'TURN_PREPARATION_FAILED');
+                        if (!succeeded && turnFailure && key && live && live.runtime === runtime && this.sessions.get(key) === live)
+                            this.finishFailedTurn(key, live, turnFailure, failureCode ?? 'TURN_PREPARATION_FAILED', request?.closeDiagnostics?.first?.reason ?? runtime.closeDiagnostics?.first?.reason);
+                        else {
+                            await this.cleanupRuntime(runtime);
+                            if (key && live && !live.failure && this.sessions.get(key) === live) {
+                                if (typeof runtime.dispose === 'function') {
+                                    this.sessions.delete(key);
+                                    if (!succeeded)
+                                        this.preparationFailures.set(key, failureCode ?? 'TURN_PREPARATION_FAILED');
+                                }
+                                else
+                                    live.cleanupFailure = new NeedError('REMOTE_CLEANUP_UNCONFIRMED', '缺少原实例结束证明，不能重开或重发', '原实例的条件结束与list消失证明');
                             }
-                            else
-                                live.cleanupFailure = new NeedError('REMOTE_CLEANUP_UNCONFIRMED', '缺少原实例结束证明，不能重开或重发', '原实例的条件结束与list消失证明');
                         }
                     }
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-workbench/remote-agent",
-  "version": "0.8.17",
+  "version": "0.8.18",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",