@ai-workbench/remote-agent 0.8.18 → 0.8.19

package/README.md

@@ -1,10 +1,10 @@
-**`@ai-workbench/remote-agent@0.8.18` 发布形态包。继承0.8.17主机来源执行与L具体Need透传；本版修复Codex员工执行通道时序（需受保护aw.3）、去除逐RPC重复SSH，失败先交还官方界面并显示“正在确认主机清理”。通过官方插件 → 添加插件安装；固定包由编排发布，X不publish。工程/包证明与leo产品验收分别记录，未运行的门保持NOT_RUN。**
+**`@ai-workbench/remote-agent@0.8.19` 发布形态包。包含X2主机目录上下文与审批位置修正；本版以aw.4对齐原生本机MCP过滤、保留远端关闭首因并汇总成功连接核对。继承0.8.18的执行时序、去重复SSH和失败先交还。通过官方插件 → 添加插件安装；固定包由编排发布，X不publish。工程/包证明与leo产品验收分别记录，未运行的门保持NOT_RUN。**
 
 # 远程ACP插件
 
 一个插件提供 **Claude（远程主机）** 和 **Codex（远程主机）**，通过员工主机上的官方CLI运行。Codex保留单次模式；Claude固定会话模式。只用官方模型列表、插件管理和配置入口，不提供自制面板、问答或登录按钮。登录和原生工作区绑定唯一归连接插件L。
 
-当前版本0.8.18，由X按编排裁定在X2的0.8.17上交付aw.3/去重复SSH/失败先交还；0.8.17的主机来源执行和L具体Need透传完整保留；包名采用`@ai-workbench/remote-agent`以涵盖两个品牌；本轮按编排放行准备发布形态包，供 leo 真机自验；X 不执行实际发布，由编排统一发布。开发fixture逐字节保留L0.7.20固定包，公开类型与SSH导出从该包消费。运行时仍要求L的`getContractInfo()`同时返回API0.7.0、implemented、native-local-v1；旧L包、draft.3或只有版本号的不完整实现会明确报缺项。依赖范围为`~0.7.20`，L由官方插件管理单独安装，不打进X。组件验证不代表真实开通、模型或leo E通过；HanaMesh另验。
+当前版本0.8.19，在0.8.18/aw.3基础上修复本机MCP过滤、关闭首因和连接核对降噪，需aw.4；包含X2主机目录上下文与审批位置修正；0.8.17的主机来源执行和L具体Need透传完整保留；包名采用`@ai-workbench/remote-agent`以涵盖两个品牌；本轮按编排放行准备发布形态包，供 leo 真机自验；X 不执行实际发布，由编排统一发布。开发fixture逐字节保留L0.7.20固定包，公开类型与SSH导出从该包消费。运行时仍要求L的`getContractInfo()`同时返回API0.7.0、implemented、native-local-v1；旧L包、draft.3或只有版本号的不完整实现会明确报缺项。依赖范围为`~0.7.20`，L由官方插件管理单独安装，不打进X。组件验证不代表真实开通、模型或leo E通过；HanaMesh另验。
 
 已包含L0.7.18消费增量：来源确认、输入接纳、登录、本机接纳、输入准备、模型目录及运行时解析的早期失败，用正式`preflightDiagnostics:1` / `preflight-check`进入L「连接前技术详情（含登录与工作区确认）」。阶段、真实来源/状态和错误代码可展开；未知来源为null，旧login-check的完整安全原因保留。记录不选择来源、不接纳输入、不自动重发；无原生会话的菜单查询仍在模型设置报告。当前工程和设置组件验证不等于leo GUI验收。
 
@@ -12,7 +12,7 @@
 
 ## 员工路径
 
-从官方插件管理安装，照常使用默认工作区/会话/模型入口。L沿唯一“远程主机连接”设置节记录文件来源；L0.7.20新选主机位置由两品牌按已核验的规范目录执行，旧legacy主机绑定仍沿原规则；本地来源接入N0.4.4/S0.4.11员工端点。旧映射可在本轮官方一次确认中选择改用本机文件夹；拒绝、取消或输入/来源变化时不切换、不执行。也可在L设置逐工作区确认沿用原主机关联。缺正式host解析能力时明确说明所缺组件、保留原话，本轮不派发。本地六类工具经Claude公开toolAliases路由到员工电脑：cwd是员工选定目录，Git使用本机仓库，不回退主机同名目录。本地真实员工输入先取得官方当前轮次CAS预期，再调用L0.7.17 acceptLocalWorkspaceUserTurn；核回包后才打开D19和本轮主机目录/执行。每轮localAcceptanceId冻结进原详情sink，迟到结果不借新轮ID；LOCAL_USER_TURN_CHANGED立即停止本轮，不重接纳或退legacy。已用固定真包完成本地D19组件联测；编排已回证0.8.14 Claude/Opus5/Default在leo本地目录首轮写文件成功；该回证不覆盖本0.8.18或Codex，产品验收以各版本leo实际结果为准。本地文件不自动上传，X不猜目录、不选首项。首次说明使用官方普通回复；先经官方会话提交、持久化并读回核对，才向L确认。持久记录不等于员工已看见，GUI另验；日志丢失后的未知claim由L保留，不宣称端到端恰好一次。
+从官方插件管理安装，照常使用默认工作区/会话/模型入口。L沿唯一“远程主机连接”设置节记录文件来源；L0.7.20新选主机位置由两品牌按已核验的规范目录执行，旧legacy主机绑定仍沿原规则；本地来源接入N0.4.4/S0.4.11员工端点。旧映射可在本轮官方一次确认中选择改用本机文件夹；拒绝、取消或输入/来源变化时不切换、不执行。也可在L设置逐工作区确认沿用原主机关联。缺正式host解析能力时明确说明所缺组件、保留原话，本轮不派发。本地六类工具经Claude公开toolAliases路由到员工电脑：cwd是员工选定目录，Git使用本机仓库，不回退主机同名目录。本地真实员工输入先取得官方当前轮次CAS预期，再调用L0.7.17 acceptLocalWorkspaceUserTurn；核回包后才打开D19和本轮主机目录/执行。每轮localAcceptanceId冻结进原详情sink，迟到结果不借新轮ID；LOCAL_USER_TURN_CHANGED立即停止本轮，不重接纳或退legacy。已用固定真包完成本地D19组件联测；编排已回证0.8.14 Claude/Opus5/Default在leo本地目录首轮写文件成功；该回证不覆盖本0.8.19或Codex，产品验收以各版本leo实际结果为准。本地文件不自动上传，X不猜目录、不选首项。首次说明使用官方普通回复；先经官方会话提交、持久化并读回核对，才向L确认。持久记录不等于员工已看见，GUI另验；日志丢失后的未知claim由L保留，不宣称端到端恰好一次。
 
 新主机位置允许当前SSH员工账号可访问的已选绝对目录、文件系统根目录、非Git或只读目录；不改写原projectRoot、不创建Git、不转本机同名文件夹。read/execute必须可核实，write=false不额外一刀切拒绝，实际写入服从主机系统权限。运行前必核来源UUID、连接代次、目录及链接入口dev/ino和权限；revision与内容增删导致的mtime/ctime变化不单独失效。此核对属于正确性条件，不可关闭。最后inspect到主机spawn之间仍有OS时序边界，不表示原子目录句柄租约。
 
@@ -38,7 +38,7 @@ Codex单次模式首版仅文本，不转接中途审批；图片或系统/开
 
 ## 管理员配置
 
-在官方 **设置 → 内置插件 → 远程助手参数** 查看和修改本插件全部七项参数。页面走官方ConfigForms与settings.plugins.tab，不新增连接设置节、不改DSH核心。每项列明默认值、范围、生效和调整后果；固定never及正确性约束明确列为不可关闭。当前profile不可写、服务未就绪或远程Web不支持持久写入时禁写并说明原因。保存携带编辑起点revision，冲突保留草稿、不自动重试；恢复继承值发unset，不写死默认。原生模型Edit卡未增加表单；“打开配置文件”仍可用，但不作为参数可见性的替代。
+在官方 **设置 → 内置插件 → 远程助手参数** 查看和修改本插件全部八项参数。页面走官方ConfigForms与settings.plugins.tab，不新增连接设置节、不改DSH核心。每项列明默认值、范围、生效和调整后果；固定never及正确性约束明确列为不可关闭。当前profile不可写、服务未就绪或远程Web不支持持久写入时禁写并说明原因。保存携带编辑起点revision，冲突保留草稿、不自动重试；恢复继承值发unset，不写死默认。原生模型Edit卡未增加表单；“打开配置文件”仍可用，但不作为参数可见性的替代。
 
 | 设置 | 默认 | 范围与用途 |
 |---|---|---|
@@ -49,10 +49,11 @@ Codex单次模式首版仅文本，不转接中途审批；图片或系统/开
 | oneShotSandbox | workspace-write | Codex单次可选read-only/workspace-write/danger-full-access |
 | oneShotApproval | never | 当前单次通道无中途交互审批；不代表自动批准 |
 | employeeShellKillGraceMs | 1000 | 0至2147483647的整数；取消后外层SSH清理宽限毫秒。取消结果仍未知，不将宽限作为员工端退出证明 |
+| employeeHttpMcpPolicy | reject | reject / ignore；新连接生效，默认拒绝原生会采用的本机HTTP MCP；ignore仅剔除会话投影后继续。不改员工配置；stdio按原生规则忽略并可见说明名称 |
 
 原六项默认保留；D20新增employeeShellKillGraceMs供管理员调节自己的SSH清理。非法值拒绝，删除覆盖遵循官方配置继承。SSH可执行程序从当前PATH发现，不写死某一系统路径。原始错误码保留在官方失败代码/技术详情，原始stderr、凭据和URL不展开。
 
-仅新增中文文案和验证；保留已有英文名称及既有locale机制。提供方名称不附状态后缀，由原注册replace更新，不自造刷新或客户端品牌分支。
+提供方的中文文案保留已有英文名称及既有locale机制。提供方名称不附状态后缀，由原注册replace更新，不自造刷新或客户端品牌分支。
 
 ## 安装产物
 
@@ -60,9 +61,13 @@ Codex单次模式首版仅文本，不转接中途审批；图片或系统/开
 
 ## 验证范围
 
-当前准备结果与限制记入源码仓`docs/evidence/2026-10-21-X-npm-prep/`（不进npm包）。先前真实emp-a协议诊断及固定三件套GUI是不同轮次，不能代替本次新包安装门。L完整绑定/登录、真实模型、物理断网、HanaMesh及leo E以实际已执行证据为准。主机命令安装来自S，X不修改S仓/安装脚本或登录状态。
+早期npm准备结果与限制记入源码仓`docs/evidence/2026-10-21-X-npm-prep/`（不进npm包）。0.8.19组合工程结果见`docs/evidence/2026-10-24-X-aw4-0819/RESULT.md`。先前真实emp-a协议诊断及固定三件套GUI是不同轮次，不能代替本次新包安装门。L完整绑定/登录、真实模型、物理断网、HanaMesh及leo E以实际已执行证据为准。主机命令安装来自S，X不修改S仓/安装脚本或登录状态。
 
 
+## 历史实现记录（0.8.1–0.8.16）
+
+以下按版本保留当轮的设置数量、依赖、首红与验收状态；“本轮/当前”均指对应历史轮次。0.8.19当前配置以开头、管理员八项表及末节为准；这些历史工程记录不替代本版产品验收。
+
 D19（0.8.1）：相邻正文增量合成连续文本块，工作区首次说明合入真实回复，按官方持久记录核对后才回报“已记入可核对回复”。这不代表界面已经显示。
 
 技术详情由 L 0.7.11 的唯一“远程主机连接”设置节展示，正文只放模型文本。命令目录保留完整描述；未知事件和工具输入输出保留字段、JSON类型及处理结果，未获准原文明确脱敏，数字用量可核对。没有 `remoteConversationDetails:1` 时明确提示“技术详情暂不可用”，本轮不发送模型请求。X 在官方当前 profile 的 `ai-workbench-remote-agent/diagnostics/` 保存私有诊断日志（目录700、文件600、落盘同步）；写入/归属/顺序/容量失败中止本轮，不自动重发、换代重投、过期或淘汰。结果未知时只读核对原事件完整回执，未找到仍保持未知。X本轮无新增设置/阈值；L的单事件容量和分页设置在L设置节可见。
@@ -74,13 +79,13 @@ L安全规范的officialReason原串完整保留；旧/不支持格式明确记O
 
 0.8.3 会话恢复：正常关闭客户端保留原broker；重开仅在私有clean检查点、完整ACP消息边界、原broker UUID及官方最新持久回复一致时接续。否则记录原因、独占并确认结束旧会话后新建，正文说明一次；旧审批不代答，按官方当前步骤保留本批全部输入，不重发历史未确认输入。S0.4.10 的实际冻结controlMaxBytes用于分块，心跳/等待严格消费主机公开策略与remainingLeaseMs；没有新增X超时或重试设置。编排00:05决定：0.4.10以前的x/a仅为测试会话，X不接入、不代答也不结束它们，直接新建r会话并说明；旧进程由编排安装S0.4.10时一次性整理。重开续接只对S0.4.10新broker承诺。
 
-D22阶段耗时进入技术详情；D23文件审批用中文动作，原工具名和会话ID进入技术详情。恢复记录沿官方profile的ai-workbench-remote-agent/recovery，目录700/文件600/fsync，无过期或淘汰。产品设置仍为上列六项，无新增默认/阈值。含真实S进程的工程测试按文件串行运行，避免多个持久化/编译测试同时争用磁盘；测试观察期限和所有断言不变，工程证据不等于leo验收。
+D22阶段耗时进入技术详情；D23文件审批用中文动作，原工具名和会话ID进入技术详情。恢复记录沿官方profile的ai-workbench-remote-agent/recovery，目录700/文件600/fsync，无过期或淘汰。当时产品设置为六项，无新增默认/阈值。含真实S进程的工程测试按文件串行运行，避免多个持久化/编译测试同时争用磁盘；测试观察期限和所有断言不变，工程证据不等于leo验收。
 
 D21（0.8.5）：两个品牌的官方模型菜单从 L 的 `modelCatalogTarget:1` / `getModelCatalogTarget` 取得当前可信员工目标，再只读调用 S 的 `aw-model-catalog --provider codex|claude`。目录按 host-user 作用域展示完整模型与逐模型推理等级，保留远端标识原值；失败显示“无法获取模型列表：原因”，不登录、不创建项目、不返回替代模型。L 必须宣告该正式能力，S 必须安装保护入口；这两项未就绪时不能据组件测试声称菜单可用。
 
 每轮先核对目录代次和所选模型，再经 ACP 逐项配置模型及推理等级，收到完整配置确认后才发送输入。Claude 别名每轮须有精确的模型配置成功回执，并由同一员工主机、同一连接代际的目录唯一映射到具体型号。具体型号注明来自主机目录，会话未单独回报；旧恢复记录不作本轮证据。目录缺项、映射不唯一、回执不符或身份/代际变化时不发送输入。所选值、远端确认值及型号来源仅在恢复标识与技术详情保留，插件不向真实回复追加技术参数，确认配置不等于验证推理效果。连接/身份/目录变化清除旧确认；远端清理待定或结果未知时阻止派发，不自动清理重试或另开替代会话。Codex 单次模式当前不能确认此选择，会在发送前明确拒绝。新增设置 0；本轮工程证据、真实只读链路与产品未验项见 `docs/evidence/2026-10-22-X2-D21/`。
 
-0.8.5统一包原依赖L `~0.7.13`；0.8.16原对齐L `~0.7.19`；当前0.8.18对齐L `~0.7.20`。D8模型目录双事件长期监听保留；同epoch的recovery提示/失败消息变化不触发执行状态失效，真实实例/epoch/phase/可信目标/登录变化仍失效。完整D9两品牌正文/状态/就绪门呈现按编排00:50允许的范围记下一版，本版不宣称已消费完成；L的connectionMessages.administratorAfterMs仍只由L管理，X新增设置0。
+0.8.5统一包原依赖L `~0.7.13`；0.8.16原对齐L `~0.7.19`；当前0.8.19对齐L `~0.7.20`。D8模型目录双事件长期监听保留；同epoch的recovery提示/失败消息变化不触发执行状态失效，真实实例/epoch/phase/可信目标/登录变化仍失效。完整D9两品牌正文/状态/就绪门呈现按编排00:50允许的范围记下一版，本版不宣称已消费完成；L的connectionMessages.administratorAfterMs仍只由L管理；X本版新增employeeHttpMcpPolicy见末节。
 
 D18（0.8.6）：Codex 需要主机自有 adapter `2.2.2-aw.1` 的明确新建会话上下文政策，官方 CLI 仍为未改的0.160.1。系统/开发者要求仅在新建时生效；恢复时与初建摘要相同则正常恢复且省略新建专用字段，不声称恢复接口会更新指令。要求不同或清空时，在同一真实回复说明“会话要求已变化，已新建 Codex 会话继续处理，原会话仍保留。”，并新建远端承接公开对话，保留旧标识和查询记录；旧/非法初建摘要明确拒绝，不能猜测。
 
@@ -94,7 +99,7 @@ Read/Write/Edit/Glob/Grep由员工DSH同UID后端执行；Bash经L严格SSH到S
 
 本机执行在每个DSH会话首次用一句“文件和命令在你的电脑上执行”说明；既有0.8.14说明也计为已显示。完整限制每轮记录在技术详情，遇到不支持的操作再明确提示：子代理和harness内部直接工具调用尚未证明可在员工端执行，可能仍在主机；已识别的原生未改道工具/Agent审批拒绝。PDF等二进制读取及后台命令明确不支持，不静默主机代跑。六类组件/MCP/配置转交证明不等于真实Claude原生alias执行或真实员工链路通过。实际Git依赖员工环境中已有Git，缺失会返回实际命令失败，不在主机替代，也不自动安装。
 
-本地目前仅支持macOS（arm64/x64）；Grep固定携带微软@vscode/ripgrep-universal1.18.0的两架构原字节并核SHA，无员工PATH搜索或安装下载。主机需S0.4.11，N可选peer~0.4.4（缺失明确报能力缺项），L当前~0.7.18，本地接纳与D19工程路径已接，真实员工端门仍开放。无DSH/CLI修改、额外设置节或npm发布。
+本地目前仅支持macOS（arm64/x64）；Grep固定携带微软@vscode/ripgrep-universal1.18.0的两架构原字节并核SHA，无员工PATH搜索或安装下载。主机需S0.4.11，N可选peer~0.4.4（缺失明确报能力缺项），L当时~0.7.18，本地接纳与D19工程路径已接，真实员工端门仍开放。无DSH/CLI修改、额外设置节或npm发布。
 
 ## 合并保留的 Codex D20 路线
 
@@ -131,8 +136,17 @@ D20（0.8.8开发记录）：本地来源的Codex原生文件与命令通过固
 
 0.8.16 不新增 Config、默认值、阈值、超时或重试。首因可见、旧代不重投、实际选择与绑定一致属于不可关闭的正确性不变量。目录完成结果不用于后续请求缓存；活跃租约仅保留更新观测的选择有效性证据，释放即撤登记。断连/错代仍保留原详情信封及未确认状态，仅按旧合同读 receipt 核验。`unconfirmed-<eventId>.json` 私有记录追加是否尝试及失败阶段/固定码，不能当作 L 的 ACK；员工可见原因沿官方错误消息，无新增面板。
 
-### 本机执行的核验位置（不可关闭）
+## 本机执行的核验位置（继承0.8.18，不可关闭）
 
 L接纳每轮真实输入时核对实际目录和N端点/代次。X只在该代执行通道open时向S核对一次target，并继续验证员工执行器固定SHA和官方版本；原生注册发生在open完成之后。之后broker输入及每个native RPC只核对既有内存连接、工作区绑定和接纳事实，撤销来自已订阅的L连接/位置、N网络事件和执行SSH关闭。N实例/代次改变会重新接纳并建立新通道，旧流不会跨代迁移。
 
-这属于执行位置与已接纳输入的一致性不变量，没有关闭设置。失败先交还官方会话并显示“正在确认主机清理”，详情落盘及条件kill/list随后在原清理promise进行；同一会话仍由原cleanupFailure/未知送达门阻止不安全重发。没有新增超时、重试、模型限制或中止检查。技术详情事件EMPLOYEE_EXECUTION_VALIDATION_POLICY列出同一核验位置。
+这属于执行位置与已接纳输入的一致性不变量，没有关闭设置。已取得owned keyed live的会话失败先交还官方会话并显示“正在确认主机清理”，详情落盘及条件kill/list随后在原清理promise进行；preflight、resolve、未取得live、无key/单次模式及detach/shutdown保持原await语义；同一会话仍由原cleanupFailure/未知送达门阻止不安全重发。没有新增超时、重试、模型限制或中止检查。技术详情事件EMPLOYEE_EXECUTION_VALIDATION_POLICY列出同一核验位置。
+
+
+## 0.8.19 / aw.4 本机 MCP 与失败原因
+
+按 Codex 0.160.1 原生层合并和 HTTP/header 能力过滤处理员工 MCP。stdio（例如 node_repl）不拒绝，显示“已忽略本机 stdio MCP: 名称”；不转发其 command、args、env 值，不修改员工文件。真正的 HTTP 条目使用具名设置 employeeHttpMcpPolicy：默认 reject 保留 AW_EMPLOYEE_EXECUTOR_MCP_UNSUPPORTED；ignore 只在会话投影剔除后继续。管理员可在现有远程助手参数页及官方配置文件入口编辑，范围、默认值、生效与后果均可见。此项在新连接冻结，修改不增加中止当前轮或旧会话的条件。stdio 的过滤来自固定原生协议，不是可调阈值。
+
+aw.4 仅在客户端声明 closeReason:1 后发送白名单 close.reason；旧端形状保持兼容。新版 X 接到明确远端 close 后释放员工 carrier，保留在途主机 session/new 回应，再由原本收尾释放 broker；非预期 EOF 仍按既有路径关闭。技术详情分别显示运行原因、首次观察和远端固定关闭原因；它们不因详情保存或清理失败而被替代。成功 connection-confirm 按阶段汇总次数和耗时，失败仍即时记录；实际确认操作不减少，无新增超时、重试、慢阈值或中止检查。
+
+03:44 现场的 stdio 首因仍属强推断，主机当时原码没有落盘；离线回放不能补造现场证据。aw.4 由编排审后交 S 安装，客户端固定包不由 X 发布；真实 leo Sol/Luna“你好”及写文件验收单独记录，不能用离线或包门代替。

package/dist/acp.d.ts

@@ -18,6 +18,7 @@ export interface AcpHooks {
     onNeed?: (need: Need) => void;
     onDetail?: (detail: Readonly<SanitizedObservation>) => void;
     broker?: BrokerTransport;
+    onEmployeeInfo?: (summary: string) => void;
     employeeExecution?: (params: unknown, signal?: AbortSignal) => Promise<Record<string, unknown>>;
 }
 export interface EmployeeExecutionMeta {
@@ -26,6 +27,7 @@ export interface EmployeeExecutionMeta {
     workspaceId: string;
     cwd: string;
     acpMaxMessageBytes: number;
+    httpMcpPolicy?: 'reject' | 'ignore';
 }
 export interface AcpStartContext {
     systemPrompt?: string;
@@ -76,6 +78,7 @@ export declare class AcpSession {
     private stage;
     get diagnostics(): readonly Readonly<SanitizedObservation>[];
     private detail;
+    private employeeInfo;
     private need;
     private checkReporting;
     constructor(transport: acp.Stream | acp.AgentApp | stable.AgentApp, hooks: AcpHooks);

package/dist/acp.js

@@ -1,3 +1,5 @@
+import { employeeExecutionInfo, employeeMcpSummary } from "./employee-info.js";
+import { employeeAdapterCodes, employeeOpenCauseCodes } from "./employee-reasons.js";
 import { CloseDiagnostics, withFailureEvidence } from "./close-diagnostics.js";
 import * as acp from '@agentclientprotocol/sdk/unstable';
 import { NeedError } from "./remote.js";
@@ -133,6 +135,15 @@ export class AcpSession {
                 this.close({ layer: 'acp', initiator: 'acp.reporting-failure', reason: 'CONVERSATION_DETAILS_FAILED', action: 'close' });
         }
     }
+    employeeInfo(value) {
+        const info = employeeExecutionInfo(value);
+        if (!info)
+            return;
+        const summary = employeeMcpSummary(info);
+        this.detail({ kind: 'session', severity: 'info', code: 'EMPLOYEE_MCP_INFORMATION', summary: summary || '本机MCP策略已应用：' + info.httpMcpPolicy, payload: info });
+        if (summary)
+            this.hooks.onEmployeeInfo?.(summary);
+    }
     need(need, hooks = this.hooks) {
         this.detail({ kind: 'need', severity: 'action-required', code: need.code, summary: need.message, payload: { requires: need.requires } }, hooks);
         hooks.onNeed?.(need);
@@ -255,7 +266,11 @@ export class AcpSession {
             if (!this.employeeNegotiated || !this.employeeMeta || !this.hooks.employeeExecution)
                 throw new acp.RequestError(-32601, 'EMPLOYEE_EXECUTION_UNSUPPORTED');
             try {
-                return await this.hooks.employeeExecution(params, signal);
+                const result = await this.hooks.employeeExecution(params, signal);
+                const request = record(params);
+                if (request?.operation === 'close' && result.closed === true)
+                    this.employeeInfo(request.info);
+                return result;
             }
             catch (error) {
                 if (error instanceof NeedError) {
@@ -390,8 +405,8 @@ export class AcpSession {
         signal?.addEventListener('abort', abort, { once: true });
         try {
             const hello = await this.stage('acp-initialize', () => this.connection.agent.request(acp.methods.agent.initialize, {
-                protocolVersion: acp.PROTOCOL_VERSION, clientInfo: { name: '@ai-workbench/remote-agent', version: '0.8.18' },
-                clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, terminal: false, session: { notices: {} }, ...(this.employeeMeta ? { _meta: { awEmployeeExecution: { version: 1 } } } : {}) },
+                protocolVersion: acp.PROTOCOL_VERSION, clientInfo: { name: '@ai-workbench/remote-agent', version: '0.8.19' },
+                clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, terminal: false, session: { notices: {} }, ...(this.employeeMeta ? { _meta: { awEmployeeExecution: { version: 1, closeReason: 1 } } } : {}) },
             }, { cancellationSignal: signal }));
             this.hooks.broker?.acknowledge(acp.methods.agent.initialize);
             if (hello.protocolVersion !== acp.PROTOCOL_VERSION)
@@ -403,7 +418,7 @@ export class AcpSession {
                 if (!this.hooks.employeeExecution || !policy || Object.keys(policy).length !== 5 || policy.version !== 1 || policy.nativeCliVersion !== '0.160.1' || policy.native !== true || policy.perRpcGate !== true || policy.noHostFallback !== true)
                     throw new NeedError('EMPLOYEE_EXECUTION_UNSUPPORTED', '当前主机尚不支持在你的电脑执行Codex原生工具，本轮没有执行。', 'Codex员工端原生执行适配器与明确能力声明');
                 this.employeeNegotiated = true;
-                this.detail({ kind: 'session', severity: 'info', code: 'EMPLOYEE_EXECUTION_SELECTED', summary: '文件和命令在员工电脑的选定目录执行，Git使用本机仓库；模型、登录和全局助手要求仍在主机。本机MCP、hooks、plugins、冷恢复、快捷命令和主机文件报告尚不支持。外层ACP冷恢复已拒绝；原生子代理回收/缺少存活父会话时的恢复仅做源码检查，未实测。', payload: { bindingId: this.employeeMeta.bindingId, workspaceId: this.employeeMeta.workspaceId, cwd: this.employeeMeta.cwd, nativeCliVersion: '0.160.1', noHostFallback: true, agentConfigSource: 'host CODEX_HOME', unsupportedLocalFeatures: ['mcp', 'hooks', 'plugins', 'cold-resume', 'slash-commands', 'host-file-reports'] } });
+                this.detail({ kind: 'session', severity: 'info', code: 'EMPLOYEE_EXECUTION_SELECTED', summary: '文件和命令在员工电脑的选定目录执行，Git使用本机仓库；模型、登录和全局助手要求仍在主机。本机stdio MCP按原生规则忽略；HTTP MCP按管理员设置拒绝或忽略。本机hooks、plugins、冷恢复、快捷命令和主机文件报告尚不支持。外层ACP冷恢复已拒绝；原生子代理回收/缺少存活父会话时的恢复仅做源码检查，未实测。', payload: { bindingId: this.employeeMeta.bindingId, workspaceId: this.employeeMeta.workspaceId, cwd: this.employeeMeta.cwd, nativeCliVersion: '0.160.1', noHostFallback: true, agentConfigSource: 'host CODEX_HOME', unsupportedLocalFeatures: ['http-mcp-execution', 'hooks', 'plugins', 'cold-resume', 'slash-commands', 'host-file-reports'] } });
             }
             const systemPrompt = context?.systemPrompt;
             this.codexNewSessionOnly = !!context?.codexNewSessionOnly;
@@ -433,6 +448,8 @@ export class AcpSession {
             else {
                 const result = await this.stage('acp-session-new', () => this.connection.agent.request(acp.methods.agent.session.new, params, { cancellationSignal: signal }));
                 this.sessionId = result.sessionId;
+                if (this.employeeMeta)
+                    this.employeeInfo(result._meta?.awEmployeeExecutionInfo);
                 this.lifecycleConfiguration(result, configRevision);
                 this.method = acp.methods.agent.session.new;
             }
@@ -482,6 +499,8 @@ export class AcpSession {
             if (!result.sessionId || result.sessionId === oldId)
                 throw new NeedError('SESSION_STATE_INVALID', '新会话没有返回独立的远端标识，原会话状态需确认', '独立的新远端会话标识');
             this.sessionId = result.sessionId;
+            if (this.employeeMeta)
+                this.employeeInfo(result._meta?.awEmployeeExecutionInfo);
             this.lifecycleConfiguration(result, revision);
             this.hooks.broker?.acknowledge(acp.methods.agent.session.new);
             this.checkReporting();
@@ -629,8 +648,6 @@ export function acpNeed(error) {
         return new NeedError('ACP_FAILED', '远端 ACP 请求失败，根因未查明；未切换到新会话', `有效的远端 ACP 连接；RPC 错误码 ${error.code}`);
     return new NeedError('ACP_FAILED', '远端 ACP 请求失败或连接中断，根因未查明；未切换到新会话', '有效的远端 ACP 连接');
 }
-const employeeOpenCauseCodes = new Set(['AW_EMPLOYEE_BINARY_UNAVAILABLE', 'AW_EMPLOYEE_BINARY_HASH_FAILED', 'AW_EMPLOYEE_BINARY_HASH_MISMATCH', 'AW_EMPLOYEE_BINARY_VERSION_FAILED', 'AW_EMPLOYEE_BINARY_VERSION_MISMATCH', 'EMPLOYEE_CONTEXT_CHANGED', 'EMPLOYEE_ENDPOINT_INVALID', 'EMPLOYEE_BINARY_REQUIRED', 'EMPLOYEE_EXECUTION_UNSUPPORTED', 'EMPLOYEE_EXEC_PROTOCOL_INVALID', 'EMPLOYEE_EXEC_IDENTITY_MISMATCH', 'EMPLOYEE_EXEC_CLOSED', 'EMPLOYEE_EXEC_UNKNOWN', 'EMPLOYEE_EXEC_ALREADY_OPEN', 'EMPLOYEE_EXEC_READ_BUSY', 'ACP_MESSAGE_TOO_LARGE', 'ABORTED', 'SETTINGS_REQUIRED']);
 function record(value) { return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined; }
 const knownUpdates = new Set(['user_message_chunk', 'agent_message_chunk', 'agent_thought_chunk', 'tool_call', 'tool_call_update', 'plan', 'plan_update', 'plan_removed', 'available_commands_update', 'current_mode_update', 'config_option_update', 'session_info_update', 'usage_update', 'notice', 'compaction_update', 'compaction_summary_chunk', 'subagent_update', 'session_message', 'session_message_chunk']);
 function safeLabel(value) { return value.replaceAll(/[\r\n\x00-\x1f\x7f]/g, ' '); }
-const employeeAdapterCodes = new Set(["AW_EMPLOYEE_ADDITIONAL_DIRECTORIES_UNSUPPORTED", "AW_EMPLOYEE_SLASH_COMMAND_UNSUPPORTED", "AW_EMPLOYEE_HOST_FILE_REPORT_UNSUPPORTED", "AW_EMPLOYEE_CONFIG_DISCOVERY_OVERRIDE_UNSUPPORTED", "AW_EMPLOYEE_CONFIG_ADMISSION_INVALID", "AW_EMPLOYEE_CONFIG_ADMISSION_FAILED", "AW_EMPLOYEE_HOST_PROJECT_CONFIG_UNSUPPORTED", "AW_EMPLOYEE_EXECUTOR_MCP_UNSUPPORTED", "AW_EMPLOYEE_EXECUTOR_CONFIG_PROTOCOL_INVALID", "AW_EMPLOYEE_EXECUTOR_CONFIG_READ_FAILED", "AW_EMPLOYEE_AGENT_CONFIG_UNAVAILABLE", "AW_EMPLOYEE_BINDING_INVALID", "AW_EMPLOYEE_BINDING_MISMATCH", "AW_EMPLOYEE_CAPABILITY_REQUIRED", "AW_EMPLOYEE_CLOSE_FAILED", "AW_EMPLOYEE_CLOSE_RESPONSE_INVALID", "AW_EMPLOYEE_COLD_RESUME_UNSUPPORTED", "AW_EMPLOYEE_CWD_MISMATCH", "AW_EMPLOYEE_ENVIRONMENT_REGISTRATION_FAILED", "AW_EMPLOYEE_ENVIRONMENT_REQUIRED", "AW_EMPLOYEE_EXECUTION_CLOSED", "AW_EMPLOYEE_EXECUTION_ID_REQUIRED", "AW_EMPLOYEE_HOST_AUXILIARY_CONFIG_UNSUPPORTED", "AW_EMPLOYEE_HOST_AUXILIARY_UNSUPPORTED", "AW_EMPLOYEE_HOST_FALLBACK_FORBIDDEN", "AW_EMPLOYEE_MCP_UNSUPPORTED", "AW_EMPLOYEE_MESSAGE_INVALID", "AW_EMPLOYEE_MESSAGE_TOO_LARGE", "AW_EMPLOYEE_OPEN_RESPONSE_INVALID", "AW_EMPLOYEE_READ_MESSAGE_INVALID", "AW_EMPLOYEE_READ_RESPONSE_INVALID", "AW_EMPLOYEE_RELAY_ADDRESS_INVALID", "AW_EMPLOYEE_RELAY_FAILED", "AW_EMPLOYEE_REQUEST_INVALID", "AW_EMPLOYEE_SESSION_UNKNOWN", "AW_EMPLOYEE_WIRE_FAILED", "AW_EMPLOYEE_WRITE_RESPONSE_INVALID"]);

package/dist/approval-label.d.ts

@@ -1,6 +1,7 @@
 import type { RequestPermissionRequest } from '@agentclientprotocol/sdk/unstable';
+import type { HostWorkspacePresentation } from './input.ts';
 /** ACP diff.oldText=null means a new file. Write alone may overwrite a file. */
-export declare function approvalLabel(request: RequestPermissionRequest, location?: 'host' | 'local'): {
+export declare function approvalLabel(request: RequestPermissionRequest, location?: 'host' | 'local', hostWorkspace?: HostWorkspacePresentation): {
     toolName: string;
     reason: string;
 } | undefined;

package/dist/approval-label.js

@@ -5,7 +5,7 @@ function display(value) {
     return safe && !safe.includes('[已脱敏：') ? safe : undefined;
 }
 /** ACP diff.oldText=null means a new file. Write alone may overwrite a file. */
-export function approvalLabel(request, location = 'host') {
+export function approvalLabel(request, location = 'host', hostWorkspace) {
     const tool = request.toolCall;
     const diffs = tool.content?.filter(item => item.type === 'diff') ?? [];
     const originalName = tool.name ?? tool._meta?.claudeCode?.toolName ?? /^(Write|Edit|MultiEdit) /.exec(tool.title ?? '')?.[1];
@@ -53,5 +53,13 @@ export function approvalLabel(request, location = 'host') {
         return;
     if (!safePaths.length && !description)
         return;
+    if (location === 'host' && hostWorkspace && (tool.kind === 'execute' || name === 'Bash' || name === 'exec_command')) {
+        const cwd = display(hostWorkspace.cwd);
+        if (!cwd)
+            return;
+        // ACP locations are accessed paths, not a cwd declaration. Preserve them as
+        // reported targets, alongside the independently resolved session directory.
+        return { toolName: action, reason: action + '（会话主机目录：' + cwd + '）' + (safePaths.length ? '；工具报告目标：' + safePaths.join('、') : '') + (description ? '：' + description : '') };
+    }
     return { toolName: action, reason: action + (safePaths.length ? ' ' + safePaths.join('、') : '') + (description ? '：' + description : '') };
 }

package/dist/client.js

@@ -1,7 +1,7 @@
 /* Official locale and provider-registration updates only; no custom UI or refresh. */
 window.__ModuleLoader__.load({id:'@ai-workbench/remote-agent',factory(require){
-  const messages={"en":{"administratorNote":"Settings → Built-in plugins → 远程助手参数. Seven named settings with defaults, scope and effects.","providerName":"Codex (Remote Host)"},"zh":{"administratorNote":"管理员：设置 → 内置插件 → 远程助手参数。七项设置含默认值、范围、生效和后果说明。","providerName":"Codex（远程主机）"}};
-  const settingsFields=[{"key":"mode","name":"Codex 运行方式","kind":"select","options":[{"value":"session","name":"会话模式"},{"value":"one-shot","name":"单次模式（当前版本不可运行）"}],"range":"session / one-shot","scope":"仅 Codex；Claude 始终使用会话模式。","when":"当前轮不变；更改后原会话下一轮会拒绝继续，需新建会话。","consequence":"会话模式保留连续对话；当前单次模式会明确拒绝运行，不会发给模型。不提供关闭会话身份核对的选项。","defaultValue":"session"},{"key":"acpMaxMessageBytes","name":"完整消息与工具输出容量（字节）","kind":"number","min":1,"max":9007199254740991,"range":"1～9007199254740991 的整数；0不能关闭上限","scope":"两位远程助手的完整会话消息；也用于模型目录、本机 MCP、员工执行 RPC 和工具输出容量。","when":"当轮快照不变；下一次独立目录查询读取新值；已有会话需新建后使用。","consequence":"调大可接收更大消息、占用更多内存；调小更早拒绝超限。超限明确停止，不截断、不自动重试；不能用0取消完整消息保护。","defaultValue":4194304},{"key":"brokerMaxFrameBytes","name":"主机会话回传单段容量（字节）","kind":"number","min":1,"max":9007199254740991,"range":"1～9007199254740991 的整数；0不能关闭上限","scope":"本插件接收主机会话单段输出的容量；不会替主机修改它自己的输出策略。","when":"当轮快照不变；更改后已有会话需新建。","consequence":"调大允许更大回传段、占用更多内存；调小可能拒绝主机合法输出。超限停止，不截断；不能关闭协议帧核验。","defaultValue":2097152},{"key":"brokerControlMaxBytes","name":"主机会话管理回复容量（字节）","kind":"number","min":1,"max":9007199254740991,"range":"1～9007199254740991 的整数；0不能关闭上限","scope":"主机会话管理命令的标准输出、标准错误各自容量；也用于本机执行桥的管理回复。","when":"当轮快照不变；更改后已有会话需新建。","consequence":"调大允许更长管理回复、占用更多内存；调小可能无法核实状态。超限明确停止，不能把不完整回复当成功；0不表示无限。","defaultValue":1048576},{"key":"oneShotSandbox","name":"Codex 单次任务权限模式","kind":"select","options":[{"value":"read-only","name":"只读"},{"value":"workspace-write","name":"工作区内可写"},{"value":"danger-full-access","name":"完全访问（高权限）"}],"range":"read-only / workspace-write / danger-full-access","scope":"仅 Codex 单次通道；不改变会话模式、本机工具或员工账号的系统权限。","when":"仅单次任务启动时适用；当前版本单次任务被拒绝，因此目前不生效。","consequence":"只读不允许单次任务写入；工作区内可写允许该目录写入；完全访问放宽单次沙箱。此项不是员工目录的权限开关，也不会解锁当前不可用的单次模式。","defaultValue":"workspace-write"},{"key":"oneShotApproval","name":"Codex 单次任务审批方式","kind":"fixed","readOnly":true,"range":"固定 never；不能切换","scope":"仅 Codex 单次通道；不改变会话模式的员工审批。","when":"仅单次启动参数；当前单次模式不可运行。","consequence":"单次通道没有中途交互审批能力，所以必须固定为无中途交互；不表示自动批准或允许所有操作。不能切换为自动回答旧审批。","defaultValue":"never"},{"key":"employeeShellKillGraceMs","name":"本机命令外层连接清理宽限（毫秒）","kind":"number","min":0,"max":2147483647,"range":"0～2147483647 的整数","scope":"仅 Claude 本机 Bash 取消后，本插件自己的外层 SSH 进程清理；不控制员工命令或 Codex 执行器。","when":"当轮快照不变；更改后已有会话需新建。","consequence":"大于0时先请求外层连接退出，再等待所设毫秒后强制清理；0表示不留宽限、立即强制清理外层连接，不是关闭取消。没有员工端退出确认时结果仍未知，不能据此自动重放或声称命令已停止。","defaultValue":1000}];
+  const messages={"en":{"administratorNote":"Settings → Built-in plugins → 远程助手参数. Eight named settings with defaults, scope and effects.","providerName":"Codex (Remote Host)"},"zh":{"administratorNote":"管理员：设置 → 内置插件 → 远程助手参数。八项设置含默认值、范围、生效和后果说明。","providerName":"Codex（远程主机）"}};
+  const settingsFields=[{"key":"mode","name":"Codex 运行方式","kind":"select","options":[{"value":"session","name":"会话模式"},{"value":"one-shot","name":"单次模式（当前版本不可运行）"}],"range":"session / one-shot","scope":"仅 Codex；Claude 始终使用会话模式。","when":"当前轮不变；更改后原会话下一轮会拒绝继续，需新建会话。","consequence":"会话模式保留连续对话；当前单次模式会明确拒绝运行，不会发给模型。不提供关闭会话身份核对的选项。","defaultValue":"session"},{"key":"acpMaxMessageBytes","name":"完整消息与工具输出容量（字节）","kind":"number","min":1,"max":9007199254740991,"range":"1～9007199254740991 的整数；0不能关闭上限","scope":"两位远程助手的完整会话消息；也用于模型目录、本机 MCP、员工执行 RPC 和工具输出容量。","when":"当轮快照不变；下一次独立目录查询读取新值；已有会话需新建后使用。","consequence":"调大可接收更大消息、占用更多内存；调小更早拒绝超限。超限明确停止，不截断、不自动重试；不能用0取消完整消息保护。","defaultValue":4194304},{"key":"brokerMaxFrameBytes","name":"主机会话回传单段容量（字节）","kind":"number","min":1,"max":9007199254740991,"range":"1～9007199254740991 的整数；0不能关闭上限","scope":"本插件接收主机会话单段输出的容量；不会替主机修改它自己的输出策略。","when":"当轮快照不变；更改后已有会话需新建。","consequence":"调大允许更大回传段、占用更多内存；调小可能拒绝主机合法输出。超限停止，不截断；不能关闭协议帧核验。","defaultValue":2097152},{"key":"brokerControlMaxBytes","name":"主机会话管理回复容量（字节）","kind":"number","min":1,"max":9007199254740991,"range":"1～9007199254740991 的整数；0不能关闭上限","scope":"主机会话管理命令的标准输出、标准错误各自容量；也用于本机执行桥的管理回复。","when":"当轮快照不变；更改后已有会话需新建。","consequence":"调大允许更长管理回复、占用更多内存；调小可能无法核实状态。超限明确停止，不能把不完整回复当成功；0不表示无限。","defaultValue":1048576},{"key":"oneShotSandbox","name":"Codex 单次任务权限模式","kind":"select","options":[{"value":"read-only","name":"只读"},{"value":"workspace-write","name":"工作区内可写"},{"value":"danger-full-access","name":"完全访问（高权限）"}],"range":"read-only / workspace-write / danger-full-access","scope":"仅 Codex 单次通道；不改变会话模式、本机工具或员工账号的系统权限。","when":"仅单次任务启动时适用；当前版本单次任务被拒绝，因此目前不生效。","consequence":"只读不允许单次任务写入；工作区内可写允许该目录写入；完全访问放宽单次沙箱。此项不是员工目录的权限开关，也不会解锁当前不可用的单次模式。","defaultValue":"workspace-write"},{"key":"oneShotApproval","name":"Codex 单次任务审批方式","kind":"fixed","readOnly":true,"range":"固定 never；不能切换","scope":"仅 Codex 单次通道；不改变会话模式的员工审批。","when":"仅单次启动参数；当前单次模式不可运行。","consequence":"单次通道没有中途交互审批能力，所以必须固定为无中途交互；不表示自动批准或允许所有操作。不能切换为自动回答旧审批。","defaultValue":"never"},{"key":"employeeShellKillGraceMs","name":"本机命令外层连接清理宽限（毫秒）","kind":"number","min":0,"max":2147483647,"range":"0～2147483647 的整数","scope":"仅 Claude 本机 Bash 取消后，本插件自己的外层 SSH 进程清理；不控制员工命令或 Codex 执行器。","when":"当轮快照不变；更改后已有会话需新建。","consequence":"大于0时先请求外层连接退出，再等待所设毫秒后强制清理；0表示不留宽限、立即强制清理外层连接，不是关闭取消。没有员工端退出确认时结果仍未知，不能据此自动重放或声称命令已停止。","defaultValue":1000},{"key":"employeeHttpMcpPolicy","name":"本机 HTTP MCP 策略","kind":"select","options":[{"value":"reject","name":"拒绝（默认）"},{"value":"ignore","name":"忽略后继续"}],"range":"reject / ignore","scope":"仅 Codex 员工本机执行器实际会采用的 HTTP MCP；stdio 始终依原生过滤忽略并说明名称。","when":"新连接建立时读取并冻结；修改不停止当轮或已有会话，需新建会话使用新值。","consequence":"默认 reject 会以明确代码拒绝这些 HTTP 条目；ignore 仅剔除会话投影后继续，不改员工配置、不启动 MCP、不新增网络路径。两种模式都显示实际忽略的安全名称。","defaultValue":"reject"}];
   /* Public settings.plugins.tab + shared ConfigForms. No private client services. */
 function mountRuntimeSettings(ctx,React,fields){
  const h=React.createElement;

package/dist/close-diagnostics.d.ts

@@ -12,7 +12,7 @@ export interface CloseCause {
     operation?: string;
     exitCode?: number | null;
     signal?: string | null;
-    remoteReason?: 'unavailable';
+    remoteReason?: string;
     changedFields?: readonly string[];
     changes?: readonly CloseChange[];
 }

package/dist/conversation-details.js

@@ -1,3 +1,5 @@
+import { employeeExecutionInfo } from "./employee-info.js";
+import { trustedEmployeeReason } from "./employee-reasons.js";
 import { randomUUID } from 'node:crypto';
 import { STAGES } from "./stage-timing.js";
 const redactionMarkers = new WeakSet();
@@ -260,11 +262,13 @@ function timingStructure(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return opaqueStructure(value);
     return Object.fromEntries(Object.entries(value).map(([key, child]) => {
+        if (key === 'count' && typeof child === 'number' && Number.isSafeInteger(child) && child >= 1)
+            return [key, child];
         if (key === 'phase' && typeof child === 'string' && Object.hasOwn(STAGES, child))
             return [key, child];
         if (key === 'clock' && child === 'client-monotonic' || key === 'outcome' && (child === 'ok' || child === 'failed'))
             return [key, child];
-        if (['durationMs', 'elapsedMs'].includes(key) && typeof child === 'number' && Number.isFinite(child) && child >= 0)
+        if (['durationMs', 'elapsedMs', 'totalDurationMs', 'minDurationMs', 'maxDurationMs'].includes(key) && typeof child === 'number' && Number.isFinite(child) && child >= 0)
             return [key, child];
         return [key, opaqueStructure(child)];
     }));
@@ -361,7 +365,7 @@ function closeStructure(value) {
             return [key, child];
         if (key === 'reason' && typeof child === 'string' && /^[A-Z][A-Z0-9_]*$/.test(child))
             return [key, child];
-        if (key === 'remoteReason' && child === 'unavailable' || key === 'first' && typeof child === 'boolean')
+        if (key === 'remoteReason' && (child === 'unavailable' || trustedEmployeeReason(child) !== undefined) || key === 'first' && typeof child === 'boolean')
             return [key, child];
         if (['closeSequence', 'elapsedMs'].includes(key) && typeof child === 'number' && Number.isFinite(child) && child >= 0)
             return [key, child];
@@ -400,11 +404,12 @@ export function sanitizeObservation(observation, protectModelMaterial = false) {
                         : observation.kind === 'session' && ['REMOTE_CLOSE_FIRST', 'REMOTE_CLOSE_NEXT'].includes(observation.code) ? closeStructure(payload)
                             : observation.kind === 'commands' ? catalogStructure(payload)
                                 : observation.kind === 'usage' ? usageStructure(payload)
-                                    : observation.kind === 'session' && observation.code === 'REMOTE_STAGE_TIMING' ? timingStructure(payload)
-                                        : observation.kind === 'session' && ['CLAUDE_EMPLOYEE_OPERATION', 'CLAUDE_EMPLOYEE_PROCESS', 'CLAUDE_EMPLOYEE_REVOKED', 'CLAUDE_EMPLOYEE_SCOPE'].includes(observation.code) ? employeeStructure(payload)
-                                            : observation.kind === 'need' ? payload
-                                                : observation.kind === 'tool' || ['SDK_ITEM', 'SDK_TOOL', 'ACP_SESSION_UPDATE', 'ACP_IDLE_UPDATE'].includes(observation.code) ? toolStructure(payload)
-                                                    : opaqueStructure(payload),
+                                    : observation.kind === 'session' && observation.code === 'EMPLOYEE_MCP_INFORMATION' ? (employeeExecutionInfo(observation.payload) ?? { information: 'unconfirmed' })
+                                        : observation.kind === 'session' && observation.code === 'REMOTE_STAGE_TIMING' ? timingStructure(payload)
+                                            : observation.kind === 'session' && ['CLAUDE_EMPLOYEE_OPERATION', 'CLAUDE_EMPLOYEE_PROCESS', 'CLAUDE_EMPLOYEE_REVOKED', 'CLAUDE_EMPLOYEE_SCOPE'].includes(observation.code) ? employeeStructure(payload)
+                                                : observation.kind === 'need' ? payload
+                                                    : observation.kind === 'tool' || ['SDK_ITEM', 'SDK_TOOL', 'ACP_SESSION_UPDATE', 'ACP_IDLE_UPDATE'].includes(observation.code) ? toolStructure(payload)
+                                                        : opaqueStructure(payload),
     });
 }
 function validatedScope(scope) {

package/dist/employee-exec.d.ts

@@ -34,6 +34,11 @@ export declare class EmployeeExecution {
     private ended;
     private error?;
     private pendingRead;
+    private remoteClosure?;
+    /** Set only after the existing binding and execution ID checks accept a close. */
+    get remoteClose(): Readonly<{
+        reason?: string;
+    }> | undefined;
     private writeTail;
     private queuedWriteBytes;
     private closing;

package/dist/employee-exec.js

@@ -1,3 +1,4 @@
+import { trustedEmployeeReason } from "./employee-reasons.js";
 import { closeCode } from "./close-diagnostics.js";
 import { randomUUID } from 'node:crypto';
 import { NeedError } from "./remote.js";
@@ -49,6 +50,9 @@ export class EmployeeExecution {
     ended = false;
     error;
     pendingRead = false;
+    remoteClosure;
+    /** Set only after the existing binding and execution ID checks accept a close. */
+    get remoteClose() { return this.remoteClosure; }
     writeTail = Promise.resolve();
     queuedWriteBytes = 0;
     closing = Promise.resolve();
@@ -60,7 +64,9 @@ export class EmployeeExecution {
         this.options = options;
     }
     parse(params) {
-        if (!object(params) || Object.keys(params).some(key => !['version', 'bindingId', 'operation', 'executionId', 'message'].includes(key)) || params.version !== 1 || typeof params.bindingId !== 'string' || !['open', 'write', 'read', 'close'].includes(params.operation))
+        if (!object(params) || Object.keys(params).some(key => !['version', 'bindingId', 'operation', 'executionId', 'message', 'reason', 'info'].includes(key)) || params.version !== 1 || typeof params.bindingId !== 'string' || !['open', 'write', 'read', 'close'].includes(params.operation))
+            throw need('EMPLOYEE_EXEC_PROTOCOL_INVALID');
+        if (params.operation !== 'close' && (Object.hasOwn(params, 'reason') || Object.hasOwn(params, 'info')))
             throw need('EMPLOYEE_EXEC_PROTOCOL_INVALID');
         if (params.bindingId !== this.options.bindingId)
             throw need('EMPLOYEE_EXEC_IDENTITY_MISMATCH');
@@ -117,7 +123,11 @@ export class EmployeeExecution {
     async handleRequest(request, signal, observe) {
         cancelled(signal);
         if (request.operation === 'close') {
-            this.stop(undefined, { layer: 'executor', initiator: 'remote.employee-exec.close', reason: 'REMOTE_REASON_UNAVAILABLE', remoteReason: 'unavailable', operation: 'close', action: 'close' }, observe);
+            const reason = trustedEmployeeReason(request.reason);
+            this.remoteClosure ??= Object.freeze({});
+            if (reason && !this.remoteClosure.reason)
+                this.remoteClosure = Object.freeze({ reason });
+            this.stop(undefined, { layer: 'executor', initiator: 'remote.employee-exec.close', reason: reason ?? 'REMOTE_REASON_UNAVAILABLE', remoteReason: reason ?? 'unavailable', operation: 'close', action: 'close' }, observe);
             await this.cleanup();
             return { version: 1, closed: true, result: 'UNKNOWN' };
         }

package/dist/employee-info.d.ts

@@ -0,0 +1,13 @@
+/** Optional protocol information only. Malformed metadata cannot stop a turn. */
+export interface EmployeeExecutionInfo {
+    version: 1;
+    httpMcpPolicy: 'reject' | 'ignore';
+    ignoredStdio: string[];
+    ignoredHttp: string[];
+    ignoredNativeHttp: string[];
+    ignoredStdioUnshown: number;
+    ignoredHttpUnshown: number;
+    ignoredNativeHttpUnshown: number;
+}
+export declare function employeeExecutionInfo(value: unknown): EmployeeExecutionInfo | undefined;
+export declare function employeeMcpSummary(info: EmployeeExecutionInfo): string;

package/dist/employee-info.js

@@ -0,0 +1,28 @@
+const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const safeName = (value) => typeof value === 'string' && value.length > 0 && !/[\p{C}\r\n]/u.test(value);
+export function employeeExecutionInfo(value) {
+    if (!object(value) || value.version !== 1 || (value.httpMcpPolicy !== 'reject' && value.httpMcpPolicy !== 'ignore'))
+        return;
+    const lists = {};
+    for (const key of ['ignoredStdio', 'ignoredHttp', 'ignoredNativeHttp']) {
+        const entries = value[key];
+        if (!Array.isArray(entries))
+            return;
+        lists[key] = entries.filter(safeName);
+        const unshown = value[key + 'Unshown'];
+        lists[key + 'Unshown'] = (Number.isSafeInteger(unshown) && Number(unshown) >= 0 ? Number(unshown) : 0) + entries.filter(entry => !safeName(entry)).length;
+    }
+    return { version: 1, httpMcpPolicy: value.httpMcpPolicy, ...lists };
+}
+// Code-span delimiter exceeds every backtick run, so names cannot inject Markdown/HTML.
+const quoted = (names) => names.map(name => { let longest = 0; for (const run of name.matchAll(/`+/g))
+    longest = Math.max(longest, run[0].length); const delimiter = '`'.repeat(longest + 1); return delimiter + ' ' + name + ' ' + delimiter; }).join('、');
+export function employeeMcpSummary(info) {
+    const parts = [];
+    for (const [key, label] of [['ignoredStdio', '已忽略本机 stdio MCP'], ['ignoredHttp', info.httpMcpPolicy === 'ignore' ? '已按设置忽略本机 HTTP MCP' : '本机 HTTP MCP 未获支持，当前设置为拒绝'], ['ignoredNativeHttp', '已按原生能力忽略本机 HTTP MCP']]) {
+        const names = info[key], unshown = info[key + 'Unshown'];
+        if (names.length || unshown)
+            parts.push(label + ': ' + [...(names.length ? [quoted(names)] : []), ...(unshown ? [`${unshown} 个名称含不可显示内容`] : [])].join('；'));
+    }
+    return parts.join('。');
+}

package/dist/employee-provider.js

@@ -210,7 +210,7 @@ export function createEmployeeProvider(get, options, agent) {
             const scopedIo = { run: (command, signal) => io.run(command, signal), attach: async (command) => {
                     const observe = closeDiagnostics.capture();
                     const child = await io.attach(command);
-                    child.once('close', (code, signal) => { observe({ layer: 'relay', initiator: 'ssh.process.close', reason: 'EMPLOYEE_EXEC_UNKNOWN', action: 'exit', exitCode: code, signal }); if (candidate && !candidate.ended)
+                    child.once('close', (code, signal) => { observe({ layer: 'relay', initiator: 'ssh.process.close', reason: 'EMPLOYEE_EXEC_UNKNOWN', action: 'exit', exitCode: code, signal }); if (candidate && !candidate.ended && !candidate.execution.remoteClose)
                         void candidate.dispose(fail('EMPLOYEE_EXEC_UNKNOWN'), { layer: 'runtime', initiator: 'provider.child-close', reason: 'EMPLOYEE_EXEC_UNKNOWN', action: 'dispose' }).catch(() => { }); });
                     return child;
                 } };
@@ -255,7 +255,8 @@ export function createEmployeeProvider(get, options, agent) {
             }
             const disposers = [];
             const execution = new EmployeeExecution({ closeDiagnostics, bindingId: admitted.bindingId, acpMaxMessageBytes: request.acpMaxMessageBytes, validate, transport: signal => createEmployeeSshTransport(ssh, signal) });
-            const runtime = { ...host, closeDiagnostics, cwd: admitted.cwd, details, connection: { ...connection }, binding: { bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, revision: state.revision }, saveCheckpoint: undefined, recoveredSession: undefined, employeeExecutionMeta: { version: 1, bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, cwd: admitted.cwd, acpMaxMessageBytes: request.acpMaxMessageBytes }, employeePresentation: CODEX_EMPLOYEE_SCOPE_NOTICE };
+            const runtime = { ...host, closeDiagnostics, cwd: admitted.cwd, details, connection: { ...connection }, binding: { bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, revision: state.revision }, saveCheckpoint: undefined, recoveredSession: undefined, employeeExecutionMeta: { version: 1, bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, cwd: admitted.cwd, acpMaxMessageBytes: request.acpMaxMessageBytes, httpMcpPolicy: request.employeeHttpMcpPolicy ?? 'reject' }, employeePresentation: CODEX_EMPLOYEE_SCOPE_NOTICE };
+            runtime.employeeRemoteCloseReason = () => execution.remoteClose?.reason;
             entry = { scope, runtime, current: input, details, execution, network, ended: false, dispose: (reason, cause = { layer: 'runtime', initiator: 'provider.dispose', reason: reason?.code ?? 'EMPLOYEE_EXEC_CLOSED', action: 'dispose' }) => {
                     closeDiagnostics.record({ ...cause, changes: cause.changes ?? [{ field: 'provider.ended', before: entry.ended, after: true }] });
                     if (entry.closing)
@@ -310,13 +311,13 @@ export function createEmployeeProvider(get, options, agent) {
             runtime.employeeExecution = async (params, signal) => {
                 try {
                     const result = await execution.handle(params, signal);
-                    if (result.closed)
+                    if (result.closed && !execution.remoteClose)
                         void entry.dispose(undefined, { layer: 'runtime', initiator: 'provider.rpc-closed-result', reason: 'EMPLOYEE_EXEC_CLOSED', operation: typeof params === 'object' && params && 'operation' in params && typeof params.operation === 'string' ? params.operation : 'unknown', action: 'dispose' }).catch(cleanup => closeDiagnostics.record({ layer: 'runtime', initiator: 'provider.rpc-cleanup', reason: closeCode(cleanup, 'REMOTE_CLEANUP_UNCONFIRMED'), action: 'failure' }));
                     return { ...result };
                 }
                 catch (error) {
                     // EmployeeExecution reserves ABORTED for an unconsumed read wait. Lost responses are UNKNOWN.
-                    if (!(params && typeof params === 'object' && 'operation' in params && params.operation === 'read' && errorCode(error) === 'ABORTED'))
+                    if (!execution.remoteClose && !(params && typeof params === 'object' && 'operation' in params && params.operation === 'read' && errorCode(error) === 'ABORTED'))
                         void entry.dispose(asNeed(error), { layer: 'runtime', initiator: 'provider.rpc-failure', reason: closeCode(error), action: 'dispose' }).catch(cleanup => closeDiagnostics.record({ layer: 'runtime', initiator: 'provider.rpc-cleanup', reason: closeCode(cleanup, 'REMOTE_CLEANUP_UNCONFIRMED'), action: 'failure' }));
                     throw withFirstFailureEvidence(error, closeDiagnostics.first?.reason, errorCode(error));
                 }

package/dist/employee-reasons.d.ts

@@ -0,0 +1,4 @@
+/** Approved protocol codes only; remote exception text is never a reason. */
+export declare const employeeAdapterCodes: Set<string>;
+export declare const employeeOpenCauseCodes: Set<string>;
+export declare function trustedEmployeeReason(value: unknown): string | undefined;

package/dist/employee-reasons.js

@@ -0,0 +1,61 @@
+/** Approved protocol codes only; remote exception text is never a reason. */
+export const employeeAdapterCodes = new Set([
+    "AW_EMPLOYEE_ADDITIONAL_DIRECTORIES_UNSUPPORTED",
+    "AW_EMPLOYEE_SLASH_COMMAND_UNSUPPORTED",
+    "AW_EMPLOYEE_HOST_FILE_REPORT_UNSUPPORTED",
+    "AW_EMPLOYEE_CONFIG_DISCOVERY_OVERRIDE_UNSUPPORTED",
+    "AW_EMPLOYEE_CONFIG_ADMISSION_INVALID",
+    "AW_EMPLOYEE_CONFIG_ADMISSION_FAILED",
+    "AW_EMPLOYEE_HOST_PROJECT_CONFIG_UNSUPPORTED",
+    "AW_EMPLOYEE_EXECUTOR_MCP_UNSUPPORTED",
+    "AW_EMPLOYEE_EXECUTOR_CONFIG_PROTOCOL_INVALID",
+    "AW_EMPLOYEE_EXECUTOR_CONFIG_READ_FAILED",
+    "AW_EMPLOYEE_AGENT_CONFIG_UNAVAILABLE",
+    "AW_EMPLOYEE_BINDING_INVALID",
+    "AW_EMPLOYEE_BINDING_MISMATCH",
+    "AW_EMPLOYEE_CAPABILITY_REQUIRED",
+    "AW_EMPLOYEE_CLOSE_FAILED",
+    "AW_EMPLOYEE_CLOSE_RESPONSE_INVALID",
+    "AW_EMPLOYEE_COLD_RESUME_UNSUPPORTED",
+    "AW_EMPLOYEE_CWD_MISMATCH",
+    "AW_EMPLOYEE_ENVIRONMENT_REGISTRATION_FAILED",
+    "AW_EMPLOYEE_ENVIRONMENT_REQUIRED",
+    "AW_EMPLOYEE_EXECUTION_CLOSED",
+    "AW_EMPLOYEE_EXECUTION_ID_REQUIRED",
+    "AW_EMPLOYEE_HOST_AUXILIARY_CONFIG_UNSUPPORTED",
+    "AW_EMPLOYEE_HOST_AUXILIARY_UNSUPPORTED",
+    "AW_EMPLOYEE_HOST_FALLBACK_FORBIDDEN",
+    "AW_EMPLOYEE_MCP_UNSUPPORTED",
+    "AW_EMPLOYEE_MESSAGE_INVALID",
+    "AW_EMPLOYEE_MESSAGE_TOO_LARGE",
+    "AW_EMPLOYEE_OPEN_RESPONSE_INVALID",
+    "AW_EMPLOYEE_READ_MESSAGE_INVALID",
+    "AW_EMPLOYEE_READ_RESPONSE_INVALID",
+    "AW_EMPLOYEE_RELAY_ADDRESS_INVALID",
+    "AW_EMPLOYEE_RELAY_FAILED",
+    "AW_EMPLOYEE_REQUEST_INVALID",
+    "AW_EMPLOYEE_SESSION_UNKNOWN",
+    "AW_EMPLOYEE_WIRE_FAILED",
+    "AW_EMPLOYEE_WRITE_RESPONSE_INVALID"
+]);
+export const employeeOpenCauseCodes = new Set([
+    "AW_EMPLOYEE_BINARY_UNAVAILABLE",
+    "AW_EMPLOYEE_BINARY_HASH_FAILED",
+    "AW_EMPLOYEE_BINARY_HASH_MISMATCH",
+    "AW_EMPLOYEE_BINARY_VERSION_FAILED",
+    "AW_EMPLOYEE_BINARY_VERSION_MISMATCH",
+    "EMPLOYEE_CONTEXT_CHANGED",
+    "EMPLOYEE_ENDPOINT_INVALID",
+    "EMPLOYEE_BINARY_REQUIRED",
+    "EMPLOYEE_EXECUTION_UNSUPPORTED",
+    "EMPLOYEE_EXEC_PROTOCOL_INVALID",
+    "EMPLOYEE_EXEC_IDENTITY_MISMATCH",
+    "EMPLOYEE_EXEC_CLOSED",
+    "EMPLOYEE_EXEC_UNKNOWN",
+    "EMPLOYEE_EXEC_ALREADY_OPEN",
+    "EMPLOYEE_EXEC_READ_BUSY",
+    "ACP_MESSAGE_TOO_LARGE",
+    "ABORTED",
+    "SETTINGS_REQUIRED"
+]);
+export function trustedEmployeeReason(value) { return typeof value === 'string' && (employeeAdapterCodes.has(value) || employeeOpenCauseCodes.has(value)) ? value : undefined; }

package/dist/failure-evidence.d.ts

@@ -6,6 +6,8 @@ export declare function closeErrorCodes(error: unknown, fallback?: string): stri
 export declare function closeFailure(code: string, message: string, requires: string, codes: readonly string[]): NeedError;
 /** Saving succeeded: retain the original trusted error type, code and presentation. */
 export declare function withFirstFailureEvidence<T>(primary: T, firstReason: unknown, primaryCode: string): T;
+/** A negotiated close reason is independent evidence, never a replacement error or new gate. */
+export declare function withRemoteFailureEvidence<T>(primary: T, remoteReason: unknown, primaryCode: string): T;
 /** A known turn failure is final even while its original resource is still closing. */
 export declare function withPendingCleanupEvidence<T>(primary: T, firstReason: unknown, primaryCode: string): T;
 /** Preserve causal roles without copying arbitrary exception text into employee output. */

package/dist/failure-evidence.js

@@ -1,4 +1,5 @@
 import { NeedError } from "./remote.js";
+import { trustedEmployeeReason } from "./employee-reasons.js";
 /** Only typed codes, never exception messages, causes, stderr or RPC data. */
 export function closeCode(error, fallback = 'CLOSE_REASON_UNKNOWN') {
     return error instanceof NeedError && /^[A-Z][A-Z0-9_]*$/.test(error.code) ? error.code : fallback;
@@ -58,7 +59,16 @@ function retainedEvidence(error) {
 export function withFirstFailureEvidence(primary, firstReason, primaryCode) {
     if (primary && typeof primary === 'object' && safeCode(firstReason) && safeCode(primaryCode)) {
         const previous = retainedEvidence(primary);
-        evidence.set(primary, Object.freeze({ first: previous?.first ?? firstReason, original: previous?.original ?? Object.freeze([primaryCode]), diagnostic: previous?.diagnostic ?? Object.freeze([]), cleanup: previous?.cleanup ?? Object.freeze([]) }));
+        evidence.set(primary, Object.freeze({ ...previous, first: previous?.first ?? firstReason, original: previous?.original ?? Object.freeze([primaryCode]), diagnostic: previous?.diagnostic ?? Object.freeze([]), cleanup: previous?.cleanup ?? Object.freeze([]) }));
+    }
+    return primary;
+}
+/** A negotiated close reason is independent evidence, never a replacement error or new gate. */
+export function withRemoteFailureEvidence(primary, remoteReason, primaryCode) {
+    const remote = trustedEmployeeReason(remoteReason);
+    if (primary && typeof primary === 'object' && remote) {
+        const previous = retainedEvidence(primary);
+        evidence.set(primary, Object.freeze({ ...previous, remote: previous?.remote ?? remote, original: previous?.original ?? Object.freeze([safeCode(primaryCode) ? primaryCode : 'TURN_FAILED']), diagnostic: previous?.diagnostic ?? Object.freeze([]), cleanup: previous?.cleanup ?? Object.freeze([]) }));
     }
     return primary;
 }
@@ -75,7 +85,8 @@ export function withFailureEvidence(primary, secondary, kind, firstReason, prima
     const previous = retainedEvidence(primary), first = previous?.first ?? (safeCode(firstReason) ? firstReason : undefined);
     const original = previous?.original ?? (safeCode(primaryCode) ? [primaryCode] : closeErrorCodes(primary, 'TURN_FAILED'));
     const secondaryFacts = secondary.map(retainedEvidence), added = [...new Set(secondary.flatMap((error, index) => secondaryFacts[index] ? secondaryFacts[index].original.filter(code => !original.includes(code)) : closeErrorCodes(error, kind === 'diagnostic' ? 'DIAGNOSTIC_WRITE_FAILED' : 'REMOTE_CLEANUP_UNCONFIRMED')))];
-    const facts = Object.freeze({ ...(first ? { first } : {}), original: Object.freeze(original), diagnostic: Object.freeze([...new Set([...(previous?.diagnostic ?? []), ...secondaryFacts.flatMap(f => f?.diagnostic ?? []), ...(kind === 'diagnostic' ? added : [])])]), cleanup: Object.freeze([...new Set([...(previous?.cleanup ?? []), ...secondaryFacts.flatMap(f => f?.cleanup ?? []), ...(kind === 'cleanup' ? added : [])])]) });
+    const remote = previous?.remote ?? secondaryFacts.find(f => f?.remote)?.remote;
+    const facts = Object.freeze({ ...(first ? { first } : {}), ...(remote ? { remote } : {}), original: Object.freeze(original), diagnostic: Object.freeze([...new Set([...(previous?.diagnostic ?? []), ...secondaryFacts.flatMap(f => f?.diagnostic ?? []), ...(kind === 'diagnostic' ? added : [])])]), cleanup: Object.freeze([...new Set([...(previous?.cleanup ?? []), ...secondaryFacts.flatMap(f => f?.cleanup ?? []), ...(kind === 'cleanup' ? added : [])])]) });
     const code = kind === 'cleanup' ? 'REMOTE_CLEANUP_UNCONFIRMED' : !secondary.length ? primary instanceof NeedError ? primary.code : safeCode(primaryCode) ? primaryCode : 'TURN_FAILED' : primary instanceof NeedError && facts.diagnostic.length > 0 && facts.diagnostic.every(code => code === primary.code) && !facts.cleanup.length && !previous ? primary.code : 'CONVERSATION_DETAILS_FAILED';
     const failure = Object.assign(new NeedError(code, '本轮已停止；运行原因与诊断或清理结果分别保留。', '核对原始原因及未确认的保存/清理结果'), { cause: new AggregateError([primary, ...(safeCode(primaryCode) && !(primary instanceof NeedError) ? [new NeedError(primaryCode, '运行错误代码', '可信调用点提供的固定代码')] : []), ...secondary, ...(first ? [new NeedError(first, '首次观察关闭代码', '不是已证明根因')] : [])], 'TURN_FAILURE_EVIDENCE') });
     evidence.set(failure, facts);
@@ -87,5 +98,5 @@ export function failureEvidenceSummary(error) {
     const facts = retainedEvidence(error);
     if (!facts)
         return '';
-    return '技术详情：' + [...(facts.first ? ['首次观察关闭 ' + facts.first] : []), '运行原因 ' + facts.original.join('、'), ...(facts.diagnostic.length ? ['详情保存未确认 ' + facts.diagnostic.join('、')] : []), ...(facts.cleanup.length ? ['清理未确认 ' + facts.cleanup.join('、')] : facts.cleanupPending ? ['正在确认主机清理，原资源清理结果尚待确认'] : [])].join('；');
+    return '技术详情：' + [...(facts.first ? ['首次观察关闭 ' + facts.first] : []), '运行原因 ' + facts.original.join('、'), ...(facts.remote ? ['远端关闭原因 ' + facts.remote] : []), ...(facts.diagnostic.length ? ['详情保存未确认 ' + facts.diagnostic.join('、')] : []), ...(facts.cleanup.length ? ['清理未确认 ' + facts.cleanup.join('、')] : facts.cleanupPending ? ['正在确认主机清理，原资源清理结果尚待确认'] : [])].join('；');
 }

package/dist/index.d.ts

@@ -5,7 +5,7 @@ import { LlmAdapter, type GenerateOptions, type StreamChunk } from '@deepseek-ai
 import { type AcpHooks } from './acp.ts';
 import { type RuntimeProvider } from './provider.ts';
 import { type AgentDefinition } from './agents.ts';
-import { type ImageReader } from './input.ts';
+import { type ImageReader, type HostWorkspacePresentation } from './input.ts';
 import type { LoginDiagnostic } from './login-diagnostic.ts';
 import { type ModelDirectory, type HostModel } from './model-catalog.ts';
 import { type PreflightDiagnostics } from './preflight-diagnostic.ts';
@@ -21,8 +21,10 @@ export declare const DEFAULT_CONFIG: Readonly<{
     readonly oneShotSandbox: "workspace-write";
     readonly oneShotApproval: "never";
     readonly employeeShellKillGraceMs: 1000;
+    readonly employeeHttpMcpPolicy: "reject";
 }>;
 export declare const Config: Schema<Schemastery.ObjectS<NoInfer<{
+    employeeHttpMcpPolicy: Schema<"reject" | "ignore", "reject" | "ignore", "volatile-defined">;
     mode: Schema<"session" | "one-shot", "session" | "one-shot", "volatile-defined">;
     acpMaxMessageBytes: Schema<number, number, "volatile-defined">;
     brokerMaxFrameBytes: Schema<number, number, "volatile-defined">;
@@ -31,6 +33,7 @@ export declare const Config: Schema<Schemastery.ObjectS<NoInfer<{
     oneShotApproval: Schema<"never", "never", "volatile-defined">;
     employeeShellKillGraceMs: Schema<number, number, "volatile-defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
+    employeeHttpMcpPolicy: Schema<"reject" | "ignore", "reject" | "ignore", "volatile-defined">;
     mode: Schema<"session" | "one-shot", "session" | "one-shot", "volatile-defined">;
     acpMaxMessageBytes: Schema<number, number, "volatile-defined">;
     brokerMaxFrameBytes: Schema<number, number, "volatile-defined">;
@@ -47,6 +50,7 @@ export interface PluginConfig {
     oneShotSandbox?: 'read-only' | 'workspace-write' | 'danger-full-access';
     oneShotApproval?: 'never';
     employeeShellKillGraceMs?: number;
+    employeeHttpMcpPolicy?: 'reject' | 'ignore';
 }
 type LiveConfig = {
     [K in keyof PluginConfig]: PluginConfig[K] | {
@@ -150,6 +154,6 @@ export declare class RemoteAgentsAdapter extends LlmAdapter {
     dispose(): Promise<void>;
 }
 export declare function apply(ctx: Context, live: LiveConfig): void;
-type InvocationApproval = (request: Parameters<NonNullable<AcpHooks['approve']>>[0], signal: AbortSignal | undefined, options: GenerateOptions, context?: string) => ReturnType<NonNullable<AcpHooks['approve']>>;
+type InvocationApproval = (request: Parameters<NonNullable<AcpHooks['approve']>>[0], signal: AbortSignal | undefined, options: GenerateOptions, context?: string, hostWorkspace?: HostWorkspacePresentation) => ReturnType<NonNullable<AcpHooks['approve']>>;
 export declare function dshApproval(ctx: Context): InvocationApproval;
 export {};

package/dist/index.js

@@ -1,6 +1,6 @@
 import { connectNeedMessage } from "./connect-need.js";
 import { CloseDiagnostics, withFailureEvidence, withFirstFailureEvidence, failureEvidenceSummary, closeCode, closeErrorCodes, closeFailure } from "./close-diagnostics.js";
-import { withPendingCleanupEvidence } from "./failure-evidence.js";
+import { withPendingCleanupEvidence, withRemoteFailureEvidence } from "./failure-evidence.js";
 import { runCatalog } from "./catalog-ssh.js";
 import { createCatalogDiagnostics, CatalogDiagnosticsRemote } from "./catalog-diagnostics.js";
 import { SessionId } from '@deepseek-ai/dsh-session';
@@ -17,7 +17,7 @@ import { StreamMapper } from "./mapping.js";
 import { connectProvider } from "./provider.js";
 import { brokerFactory } from "./broker.js";
 import { AGENTS, CODEX_AGENT } from "./agents.js";
-import { prepareInput, prepareContinuation } from "./input.js";
+import { prepareInput, prepareContinuation, projectHostWorkspaceInput } from "./input.js";
 import { createWorkspaceNoticeConsumer, isWorkspaceNoticeMessage } from "./workspace-notice.js";
 import { NeedError } from "./remote.js";
 import { employeeFailure } from "./presentation.js";
@@ -45,8 +45,9 @@ export const settingsNamespace = 'ai-workbench-codex';
 // L can be installed/enabled after X; keeping X mounted lets it explain the prerequisite.
 export const inject = ['llm'];
 /** Owner-approved defaults; administrators may override through the existing settings. */
-export const DEFAULT_CONFIG = Object.freeze({ mode: 'session', acpMaxMessageBytes: 4194304, brokerMaxFrameBytes: 2097152, brokerControlMaxBytes: 1048576, oneShotSandbox: 'workspace-write', oneShotApproval: 'never', employeeShellKillGraceMs: 1000 });
+export const DEFAULT_CONFIG = Object.freeze({ mode: 'session', acpMaxMessageBytes: 4194304, brokerMaxFrameBytes: 2097152, brokerControlMaxBytes: 1048576, oneShotSandbox: 'workspace-write', oneShotApproval: 'never', employeeShellKillGraceMs: 1000, employeeHttpMcpPolicy: 'reject' });
 export const Config = Schema.object({
+    employeeHttpMcpPolicy: Schema.union([Schema.const('reject').i18n({ zh: '拒绝本机 HTTP MCP（默认）', en: '拒绝本机 HTTP MCP（默认）' }), Schema.const('ignore').i18n({ zh: '忽略本机 HTTP MCP 后继续', en: '忽略本机 HTTP MCP 后继续' })]).i18n({ zh: '本机 HTTP MCP 策略；默认拒绝；忽略仅剔除会话投影，不改员工配置。新连接生效，stdio 始终按原生规则忽略并说明名称', en: '本机 HTTP MCP 策略；默认拒绝；忽略仅剔除会话投影，不改员工配置。新连接生效，stdio 始终按原生规则忽略并说明名称' }).default(DEFAULT_CONFIG.employeeHttpMcpPolicy).volatile(),
     mode: Schema.union([Schema.const('session').i18n({ en: 'Session', zh: '会话模式' }), Schema.const('one-shot').i18n({ en: 'One-shot', zh: '单次模式' })]).i18n({ en: 'Run mode; start a new session after switching modes', zh: 'Codex运行模式；Claude固定会话模式；切换后请新建会话' }).default(DEFAULT_CONFIG.mode).volatile(),
     acpMaxMessageBytes: Schema.number().min(1).step(1).i18n({ en: 'Session message limit; default 4 MiB, adjustable by administrators', zh: '会话消息容量；默认4 MiB，管理员可调整' }).default(DEFAULT_CONFIG.acpMaxMessageBytes).volatile(),
     brokerMaxFrameBytes: Schema.number().min(1).step(1).i18n({ en: 'Host output chunk limit; default 2 MiB, adjustable by administrators', zh: '主机回传单段容量；默认2 MiB，管理员可调整' }).default(DEFAULT_CONFIG.brokerMaxFrameBytes).volatile(),
@@ -340,7 +341,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
         let turnFailure;
         let employeeNoticeShown = false;
         const information = [];
-        const recordInformation = () => { if (runtime?.details)
+        const recordInformation = () => { timing.summarize(); if (runtime?.details)
             for (const entry of information.splice(0))
                 runtime.details.record(entry); };
         const config = this.config();
@@ -386,7 +387,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
             const configuration = JSON.stringify([mode, config.acpMaxMessageBytes, config.brokerMaxFrameBytes, config.brokerControlMaxBytes, config.employeeShellKillGraceMs]);
             if (live && live.configuration !== configuration)
                 throw new NeedError('SESSION_CONTEXT_MISMATCH', '会话运行设置已改变，请新建会话', '原会话运行设置');
-            Object.assign(request, { timing, acpMaxMessageBytes: config.acpMaxMessageBytes, resumeSessionId: previous?.sessionId, recoveryCheckpointId: previous?.recoveryCheckpointId, sessionId: options.sessionId, mode, cwd: previous?.cwd, identity: previous?.identity, bindingId: previous?.bindingId, workspaceId: previous?.workspaceId, agent: this.agent, retainProcess: !!key && mode === 'session', signal, brokerSettings: Object.freeze({ brokerMaxFrameBytes: config.brokerMaxFrameBytes, brokerControlMaxBytes: config.brokerControlMaxBytes }) });
+            Object.assign(request, { timing, employeeHttpMcpPolicy: config.employeeHttpMcpPolicy ?? DEFAULT_CONFIG.employeeHttpMcpPolicy, acpMaxMessageBytes: config.acpMaxMessageBytes, resumeSessionId: previous?.sessionId, recoveryCheckpointId: previous?.recoveryCheckpointId, sessionId: options.sessionId, mode, cwd: previous?.cwd, identity: previous?.identity, bindingId: previous?.bindingId, workspaceId: previous?.workspaceId, agent: this.agent, retainProcess: !!key && mode === 'session', signal, brokerSettings: Object.freeze({ brokerMaxFrameBytes: config.brokerMaxFrameBytes, brokerControlMaxBytes: config.brokerControlMaxBytes }) });
             if (requireFreshSession) {
                 request.requireFreshSession = true;
                 request.resumeSessionId = undefined;
@@ -487,12 +488,17 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 if (contextChanged)
                     input = await timing.run('input-prepare', () => prepareContinuation(options, input, this.readImage));
             }
+            input = projectHostWorkspaceInput(input, runtime.hostWorkspace);
+            if (runtime.hostWorkspace && mode === 'session' && Buffer.byteLength(JSON.stringify({ prompt: input.prompt, systemPrompt: input.systemPrompt }), 'utf8') > config.acpMaxMessageBytes)
+                throw new NeedError('ACP_MESSAGE_TOO_LARGE', '本轮输入超过已设置的会话消息容量，未截断或发送', '管理员调整acpMaxMessageBytes');
             const details = runtime.details;
             if (!details)
                 throw new NeedError('TECHNICAL_DETAILS_UNAVAILABLE', '技术详情暂不可用，请更新远程主机连接组件。', 'L技术详情持久接收能力');
             recordInformation();
             timing.bind(detail => details.record(detail));
             request.recordEarlyFailure = undefined;
+            if (runtime.hostWorkspace)
+                details.record({ kind: 'session', severity: 'info', code: 'HOST_WORKSPACE_CONTEXT', summary: '本轮模型工作区上下文及审批会话目录使用已确认的主机目录。', payload: { source: 'host', cwd: runtime.hostWorkspace.cwd } });
             const mapper = new StreamMapper(mode === 'session' && !contextChanged ? (runtime.restartNotice ? undefined : live ? live.usageSnapshot : previous ? (previous.usageSnapshot ?? null) : undefined) : undefined, observation => details.record(observation));
             activeMapper = mapper;
             let id;
@@ -530,7 +536,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 let done = false;
                 let failure;
                 const push = (chunks) => { queue.push(...chunks); wake?.(); wake = undefined; };
-                const hooks = { closeDiagnostics: runtime.closeDiagnostics, broker: runtime.broker, employeeExecution: runtime.employeeExecution, timing, approve: async (permission, approvalSignal) => {
+                const hooks = { onEmployeeInfo: summary => push(mapper.text(summary + '\n\n')), closeDiagnostics: runtime.closeDiagnostics, broker: runtime.broker, employeeExecution: runtime.employeeExecution, timing, approve: async (permission, approvalSignal) => {
                         const execution = runtime.execution;
                         const toolName = permission.toolCall.name ?? permission.toolCall._meta?.claudeCode?.toolName;
                         if (execution) {
@@ -541,7 +547,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
                             }
                             await execution.validate(approvalSignal);
                         }
-                        const answer = await this.approve?.(permission, approvalSignal, options, execution && toolName?.startsWith('mcp__employee__') ? 'employee-local' : undefined) ?? 'unavailable';
+                        const answer = await this.approve?.(permission, approvalSignal, options, execution && toolName?.startsWith('mcp__employee__') ? 'employee-local' : undefined, runtime.hostWorkspace) ?? 'unavailable';
                         if (execution && answer === 'allowed-once')
                             await execution.validate(approvalSignal);
                         return answer;
@@ -704,6 +710,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
             runtime?.closeDiagnostics?.record({ layer: 'adapter', initiator: 'adapter.turn-failure', reason: closeCode(error, signal.aborted ? 'ABORTED' : 'TURN_FAILED'), action: 'failure' });
             recordInformation();
             failureCode = error instanceof NeedError || error instanceof ModelConfigurationError ? error.code : error instanceof LlmError ? error.code : 'TURN_PREPARATION_FAILED';
+            withRemoteFailureEvidence(error, runtime?.employeeRemoteCloseReason?.(), failureCode);
             if (live && session && session.promptDispatchCount > promptBaseline)
                 live.failure = { cause: error };
             const reporting = [];
@@ -969,12 +976,12 @@ export function apply(ctx, live) {
     ctx.effect(() => () => { modelDirectory.dispose(); return adapter.dispose(); });
 }
 export function dshApproval(ctx) {
-    return async (request, signal, options, context) => {
+    return async (request, signal, options, context, hostWorkspace) => {
         const agent = options.sessionId ? ctx.get('agents')?.get(options.sessionId) : undefined;
         const approval = ctx.get('approval');
         if (!agent || !approval)
             return 'unavailable';
-        const label = approvalLabel(request, context === 'employee-local' ? 'local' : 'host');
+        const label = approvalLabel(request, context === 'employee-local' ? 'local' : 'host', hostWorkspace);
         if (!label)
             return 'unavailable';
         return approval.request({ agent, ...label, signal });

package/dist/input.d.ts

@@ -12,6 +12,13 @@ export interface HistoryTransfer {
     omittedReasoningBlocks: number;
     reasoningOmissionReason: 'dsh-internal-reasoning';
 }
+export interface HostWorkspacePresentation {
+    readonly cwd: string;
+}
+type RuntimeSection = {
+    name: string;
+    text: string;
+};
 export interface PreparedInput {
     prompt: AcpContentBlock[];
     users: {
@@ -20,8 +27,12 @@ export interface PreparedInput {
     }[];
     systemPrompt?: string;
     historyTransfer?: HistoryTransfer;
+    runtimeSnapshots?: ReadonlyMap<AcpContentBlock, readonly RuntimeSection[]>;
 }
+/** Invocation-only model context; never modifies the native session/history. */
+export declare function projectHostWorkspaceInput(input: PreparedInput, host?: HostWorkspacePresentation): PreparedInput;
 /** Role-labelled public history only; never serialize source/replay/tool internals. */
 export declare function prepareContinuation(options: GenerateOptions, input: PreparedInput, readImage?: ImageReader): Promise<PreparedInput>;
 /** The attachment service supplies verified bytes; client paths never cross SSH. */
 export declare function prepareInput(options: GenerateOptions, readImage?: ImageReader): Promise<PreparedInput>;
+export {};

package/dist/input.js

@@ -1,5 +1,37 @@
 import { NeedError } from "./remote.js";
 import { isWorkspaceNoticeMessage, withoutWorkspaceNotice } from "./workspace-notice.js";
+function runtimeSections(message) {
+    const source = message.source;
+    if (message.role !== 'user' || source?.kind !== 'runtime-context' || source.form !== 'snapshot' || !Array.isArray(source.sections) || message.content.length !== 1 || message.content[0].type !== 'text')
+        return;
+    if (!source.sections.every(s => s && typeof s.name === 'string' && typeof s.text === 'string'))
+        return;
+    const sections = source.sections, body = sections.map(s => s.text).join('\n\n');
+    // Only official, structurally attributed snapshot text is projected. Employee
+    // text and opaque contributions are never searched for or rewritten as paths.
+    if (body && message.content[0].text.endsWith('\n\n' + body))
+        return sections;
+}
+/** Invocation-only model context; never modifies the native session/history. */
+export function projectHostWorkspaceInput(input, host) {
+    if (!host)
+        return input;
+    const context = `当前会话使用远程主机上的工作区：${JSON.stringify(host.cwd)}。文件和命令在该主机目录执行，受主机账号的操作系统权限约束；本机 DSH 文件沙箱的工作区路径不适用于这些远程操作。`;
+    const mapped = new Map();
+    for (const [block, sections] of input.runtimeSnapshots ?? []) {
+        if (block.type !== 'text' || !sections.some(s => s.name === 'sandbox:policy'))
+            continue;
+        const body = sections.map(s => s.text).join('\n\n');
+        mapped.set(block, { ...block, text: block.text.slice(0, -body.length) + sections.map(s => s.name === 'sandbox:policy' ? context : s.text).join('\n\n') });
+    }
+    const project = (blocks) => blocks.map(block => mapped.get(block) ?? block);
+    const prompt = project(input.prompt);
+    // Confirm this invocation after all current and historical text. A projected
+    // historical snapshot must not suppress host facts for an opaque current one;
+    // warm steps also need no new native snapshot to retain their host location.
+    prompt.push({ type: 'text', text: context });
+    return { ...input, prompt, users: input.users.map(user => ({ ...user, prompt: project(user.prompt) })) };
+}
 async function publicBlock(block, options, readImage, history = false) {
     options.signal?.throwIfAborted();
     if (block.type === 'text')
@@ -26,6 +58,7 @@ export async function prepareContinuation(options, input, readImage) {
             throw new NeedError('HISTORY_CONTENT_UNSUPPORTED', `此前含有无法可靠承接的历史角色：${message.role}；本轮未新建或发送`, '完整公开的用户及助手历史；工具记录的公开内容映射');
     const after = messages.findLastIndex(message => message.role === 'assistant');
     const prompt = [];
+    const runtimeSnapshots = new Map(input.runtimeSnapshots);
     const historyTransfer = { scope: 'visible-user-assistant-text-and-images', textBlocks: 0, imageBlocks: 0, offloadedImagePlaceholders: 0, omittedReasoningBlocks: 0, reasoningOmissionReason: 'dsh-internal-reasoning' };
     for (const message of messages.slice(0, after + 1)) {
         if (message.role === 'system' || message.role === 'developer')
@@ -33,13 +66,17 @@ export async function prepareContinuation(options, input, readImage) {
         if (message.role !== 'user' && message.role !== 'assistant')
             throw new NeedError('HISTORY_CONTENT_UNSUPPORTED', `此前含有无法可靠承接的历史角色：${message.role}；本轮未新建或发送`, '完整公开的用户及助手历史；工具记录的公开内容映射');
         prompt.push({ type: 'text', text: `此前可见对话（历史角色：${message.role}；仅为历史记录）：\n` });
+        const sections = runtimeSections(message);
         for (const block of message.content) {
             // DSH explicitly distinguishes internal thinking from visible user text.
             if (block.type === 'reasoning') {
                 historyTransfer.omittedReasoningBlocks++;
                 continue;
             }
-            prompt.push(await publicBlock(block, options, readImage, true));
+            const prepared = await publicBlock(block, options, readImage, true);
+            prompt.push(prepared);
+            if (sections)
+                runtimeSnapshots.set(prepared, sections);
             if (block.type === 'text')
                 historyTransfer.textBlocks++;
             else if (block.type === 'image') {
@@ -52,7 +89,7 @@ export async function prepareContinuation(options, input, readImage) {
         prompt.push({ type: 'text', text: `\n（历史角色：${message.role} 的记录结束）\n` });
     }
     prompt.push({ type: 'text', text: '此前可见对话结束。以下为当前用户输入：\n' }, ...input.prompt);
-    return { ...input, prompt, historyTransfer };
+    return { ...input, prompt, historyTransfer, runtimeSnapshots };
 }
 /** The attachment service supplies verified bytes; client paths never cross SSH. */
 export async function prepareInput(options, readImage) {
@@ -78,13 +115,19 @@ export async function prepareInput(options, readImage) {
         throw new NeedError('INPUT_REQUIRED', '我需要本轮用户输入', '用户输入');
     const prompt = [];
     const preparedUsers = [];
+    const runtimeSnapshots = new Map();
     for (const message of users) {
         const before = prompt.length;
-        for (const block of message.content)
-            prompt.push(await publicBlock(block, options, readImage));
+        const sections = runtimeSections(message);
+        for (const block of message.content) {
+            const prepared = await publicBlock(block, options, readImage);
+            prompt.push(prepared);
+            if (sections)
+                runtimeSnapshots.set(prepared, sections);
+        }
         preparedUsers.push({ id: message.id, prompt: prompt.slice(before) });
     }
     if (!prompt.length)
         throw new NeedError('INPUT_REQUIRED', '我需要本轮用户输入', '用户输入');
-    return { prompt, users: preparedUsers, ...(context.length ? { systemPrompt: context.join('\n\n') } : {}) };
+    return { prompt, users: preparedUsers, runtimeSnapshots, ...(context.length ? { systemPrompt: context.join('\n\n') } : {}) };
 }

package/dist/presentation.js

@@ -81,7 +81,7 @@ export function employeeFailure(code, brand = 'codex') {
     if (code === 'AW_EMPLOYEE_HOST_PROJECT_CONFIG_UNSUPPORTED')
         return '主机上存在与本机工作区路径重合的项目配置，当前版本无法安全应用，本轮没有执行，请联系管理员。';
     if (code === 'AW_EMPLOYEE_EXECUTOR_MCP_UNSUPPORTED')
-        return '本机工作区配置了附加MCP工具，当前版本尚不支持这类工具，本轮没有继续执行。';
+        return '本机 HTTP MCP 当前配置策略为拒绝，本轮没有继续执行；管理员可在远程助手参数中调整本机 HTTP MCP 策略，新建会话后生效。';
     if (['AW_EMPLOYEE_CONFIG_ADMISSION_INVALID', 'AW_EMPLOYEE_CONFIG_ADMISSION_FAILED', 'AW_EMPLOYEE_EXECUTOR_CONFIG_PROTOCOL_INVALID', 'AW_EMPLOYEE_EXECUTOR_CONFIG_READ_FAILED'].includes(code))
         return '无法核验这次本机工作区的助手配置，本轮没有继续执行，请联系管理员查看技术详情。';
     if (code === 'AW_EMPLOYEE_MCP_UNSUPPORTED')

package/dist/provider.d.ts

@@ -16,6 +16,7 @@ import type { EmployeeProviderOptions } from './employee-provider.ts';
 import { type WorkspaceSourceOptions, type SourceAdmissionStage } from './workspace-source.ts';
 import type { LocalUserTurnAcceptance } from '@ai-workbench/connect/api';
 import type { EmployeeRouting } from './employee-relay.ts';
+import type { HostWorkspacePresentation } from './input.ts';
 export interface EmployeeExecution {
     hostCwd: string;
     routing: EmployeeRouting;
@@ -29,6 +30,7 @@ export interface EmployeeExecution {
 export interface Runtime {
     identity: string;
     cwd: string;
+    hostWorkspace?: Readonly<HostWorkspacePresentation>;
     contextSignal?: AbortSignal;
     execution?: EmployeeExecution;
     acpTransport?: {
@@ -63,9 +65,11 @@ export interface Runtime {
         workspaceId: string;
         cwd: string;
         acpMaxMessageBytes: number;
+        httpMcpPolicy?: 'reject' | 'ignore';
     };
     employeeExecution?: (params: unknown, signal?: AbortSignal) => Promise<Record<string, unknown>>;
     employeePresentation?: string;
+    employeeRemoteCloseReason?: () => string | undefined;
     closeDiagnostics?: CloseDiagnostics;
 }
 export interface RuntimeRequest extends Invocation {
@@ -83,6 +87,7 @@ export interface RuntimeRequest extends Invocation {
     detailChannel?: DetailChannel;
     validateContext?: (ignoreCancellation?: boolean) => Promise<void>;
     verifyRecovery?: () => Promise<boolean>;
+    employeeHttpMcpPolicy?: 'reject' | 'ignore';
     acpMaxMessageBytes?: number;
     employeeScope?: string;
     contextSha256?: string;

package/dist/provider.js

@@ -342,6 +342,7 @@ export function connectProvider(get, options = {}) {
                 }
                 if (host)
                     retainHostScope(runtime, host);
+                runtime.hostWorkspace = host && 'directory' in resolved ? Object.freeze({ cwd: resolved.directory.path }) : undefined;
                 // The transport can outlive a turn; presentation belongs only to this invocation.
                 runtime.workspaceNotice = workspaceNotice || undefined;
                 runtime.details = details ?? runtime.details;

package/dist/stage-timing.d.ts

@@ -22,6 +22,10 @@ export declare class StageTiming {
     private readonly started;
     private pending;
     private sink?;
+    private confirmations;
+    private emit;
+    /** Presentation aggregation only: no duration threshold and no new execution gate. */
+    summarize(): void;
     bind(sink: (detail: DetailObservation) => void): void;
     run<T>(phase: Stage, operation: () => Promise<T>): Promise<T>;
 }

package/dist/stage-timing.js

@@ -11,6 +11,19 @@ export class StageTiming {
     started = performance.now();
     pending = [];
     sink;
+    confirmations = { count: 0, total: 0, min: Infinity, max: 0, elapsed: 0 };
+    emit(detail) { if (this.sink)
+        this.sink(detail);
+    else
+        this.pending.push(detail); }
+    /** Presentation aggregation only: no duration threshold and no new execution gate. */
+    summarize() {
+        const current = this.confirmations;
+        if (!current.count)
+            return;
+        this.confirmations = { count: 0, total: 0, min: Infinity, max: 0, elapsed: 0 };
+        this.emit({ kind: 'session', severity: 'info', code: 'REMOTE_STAGE_TIMING', summary: STAGES['connection-confirm'] + '：' + current.count + '次，共' + current.total.toFixed(1) + '毫秒，最大' + current.max.toFixed(1) + '毫秒', payload: { phase: 'connection-confirm', count: current.count, totalDurationMs: current.total, minDurationMs: current.min, maxDurationMs: current.max, elapsedMs: current.elapsed, outcome: 'ok', clock: 'client-monotonic' } });
+    }
     bind(sink) {
         this.sink = sink;
         const pending = this.pending;
@@ -29,11 +42,20 @@ export class StageTiming {
         finally {
             const ended = performance.now();
             const durationMs = ended - started, elapsedMs = ended - this.started;
-            const detail = { kind: 'session', severity: outcome === 'ok' ? 'info' : 'warning', code: 'REMOTE_STAGE_TIMING', summary: STAGES[phase] + '：' + durationMs.toFixed(1) + '毫秒', payload: { phase, durationMs, elapsedMs, outcome, clock: 'client-monotonic' } };
-            if (this.sink)
-                this.sink(detail);
-            else
-                this.pending.push(detail);
+            if (phase === 'connection-confirm' && outcome === 'ok') {
+                const current = this.confirmations;
+                current.count++;
+                current.total += durationMs;
+                current.min = Math.min(current.min, durationMs);
+                current.max = Math.max(current.max, durationMs);
+                current.elapsed = elapsedMs;
+            }
+            else {
+                if (phase !== 'connection-confirm')
+                    this.summarize();
+                const detail = { kind: 'session', severity: outcome === 'ok' ? 'info' : 'warning', code: 'REMOTE_STAGE_TIMING', summary: STAGES[phase] + '：' + durationMs.toFixed(1) + '毫秒', payload: { phase, durationMs, elapsedMs, outcome, clock: 'client-monotonic' } };
+                this.emit(detail);
+            }
         }
     }
 }

package/locale/en.json

@@ -1,10 +1,10 @@
 {
   "meta": {
     "title": "Codex (Remote Host)",
-    "description": "Run Codex sessions through a remote host. Administrators: use Settings → Open configuration file to edit the existing plugin entry. See README for the six fields and approved defaults."
+    "description": "Run Codex sessions through a remote host. Administrators: use Settings → Open configuration file to edit the existing plugin entry. See README for the eight fields and approved defaults."
   },
   "configuration": {
-    "administratorNote": "Settings → Built-in plugins → 远程助手参数. Seven named settings with defaults, scope and effects.",
+    "administratorNote": "Settings → Built-in plugins → 远程助手参数. Eight named settings with defaults, scope and effects.",
     "providerName": "Codex (Remote Host)"
   }
 }

package/locale/zh.json

@@ -4,7 +4,7 @@
     "description": "通过远程主机运行Claude与Codex。首版不支持总是允许和歧义审批选项、已有Claude会话中立即生效的系统上下文变更；完整说明见README。参数从设置 → 内置插件 → 远程助手参数编辑。"
   },
   "configuration": {
-    "administratorNote": "管理员：设置 → 内置插件 → 远程助手参数。七项设置含默认值、范围、生效和后果说明。",
+    "administratorNote": "管理员：设置 → 内置插件 → 远程助手参数。八项设置含默认值、范围、生效和后果说明。",
     "providerName": "Codex（远程主机）"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-workbench/remote-agent",
-  "version": "0.8.18",
+  "version": "0.8.19",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",