@ai-workbench/remote-agent 0.8.18 → 0.8.21

package/dist/employee-info.d.ts

@@ -0,0 +1,15 @@
+/** Optional protocol information only. Malformed metadata cannot stop a turn. */
+export interface EmployeeExecutionInfo {
+    version: 1;
+    httpMcpPolicy: 'reject' | 'ignore';
+    ignoredStdio: string[];
+    ignoredHttp: string[];
+    ignoredNativeHttp: string[];
+    ignoredStdioUnshown: number;
+    ignoredHttpUnshown: number;
+    ignoredNativeHttpUnshown: number;
+}
+export declare function employeeExecutionInfo(value: unknown): EmployeeExecutionInfo | undefined;
+export declare function employeeMcpSummary(info: EmployeeExecutionInfo): string;
+/** Employee-facing execution fact; protocol terms and stdio names remain in details. */
+export declare function employeeHttpNotice(info: EmployeeExecutionInfo, sanitizeLabel: (name: string) => string, showUnshown: boolean): string;

package/dist/employee-info.js

@@ -0,0 +1,38 @@
+const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const safeName = (value) => typeof value === 'string' && value.length > 0 && !/[\p{C}\r\n]/u.test(value);
+export function employeeExecutionInfo(value) {
+    if (!object(value) || value.version !== 1 || (value.httpMcpPolicy !== 'reject' && value.httpMcpPolicy !== 'ignore'))
+        return;
+    const lists = {};
+    for (const key of ['ignoredStdio', 'ignoredHttp', 'ignoredNativeHttp']) {
+        const entries = value[key];
+        if (!Array.isArray(entries))
+            return;
+        lists[key] = entries.filter(safeName);
+        const unshown = value[key + 'Unshown'];
+        lists[key + 'Unshown'] = (Number.isSafeInteger(unshown) && Number(unshown) >= 0 ? Number(unshown) : 0) + entries.filter(entry => !safeName(entry)).length;
+    }
+    return { version: 1, httpMcpPolicy: value.httpMcpPolicy, ...lists };
+}
+// Code-span delimiter exceeds every backtick run, so names cannot inject Markdown/HTML.
+const quoted = (names) => names.map(name => { let longest = 0; for (const run of name.matchAll(/`+/g))
+    longest = Math.max(longest, run[0].length); const delimiter = '`'.repeat(longest + 1); return delimiter + ' ' + name + ' ' + delimiter; }).join('、');
+export function employeeMcpSummary(info) {
+    const parts = [];
+    for (const [key, label] of [['ignoredStdio', '已忽略本机 stdio MCP'], ['ignoredHttp', info.httpMcpPolicy === 'ignore' ? '已按设置忽略本机 HTTP MCP' : '本机 HTTP MCP 未获支持，当前设置为拒绝'], ['ignoredNativeHttp', '已按原生能力忽略本机 HTTP MCP']]) {
+        const names = info[key], unshown = info[key + 'Unshown'];
+        if (names.length || unshown)
+            parts.push(label + ': ' + [...(names.length ? [quoted(names)] : []), ...(unshown ? [`${unshown} 个名称含不可显示内容`] : [])].join('；'));
+    }
+    return parts.join('。');
+}
+/** Employee-facing execution fact; protocol terms and stdio names remain in details. */
+export function employeeHttpNotice(info, sanitizeLabel, showUnshown) {
+    const rawNames = [...new Set([...(info.httpMcpPolicy === 'ignore' ? info.ignoredHttp : []), ...info.ignoredNativeHttp])];
+    const names = rawNames.filter(name => sanitizeLabel(name) === name && !name.includes('[已脱敏：'));
+    const unshown = showUnshown && (rawNames.length - names.length + (info.httpMcpPolicy === 'ignore' ? info.ignoredHttpUnshown : 0) + info.ignoredNativeHttpUnshown) > 0;
+    if (!names.length)
+        return unshown ? '你电脑上的一项本地扩展本次不可用，详情见技术详情。' : '';
+    const named = names.map(name => '『' + quoted([name]) + '』').join('、');
+    return '你电脑上的' + named + '扩展本次不可用。' + (unshown ? '另有本地扩展本次不可用，详情见技术详情。' : '');
+}

package/dist/employee-mcp.js

@@ -88,7 +88,7 @@ export async function openEmployeeMcp(options) {
     if (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 1)
         throw new NeedError('SETTINGS_REQUIRED', '本机工具消息容量无效。', 'acpMaxMessageBytes');
     await access('/usr/bin/nc', constants.X_OK);
-    const tools = createEmployeeTools({ closeDiagnostics: options.closeDiagnostics, cwd: options.lease.target.local.directory.path, shell: options.lease.target.endpoint.endpointShell, uid: options.lease.target.endpoint.remoteUid, maxBytes: options.maxBytes, killGraceMs: options.killGraceMs, detail: observe, runShell: options.runShell, validate: signal => options.lease.validate(signal).then(() => { }) });
+    const tools = createEmployeeTools({ closeDiagnostics: options.closeDiagnostics, cwd: options.lease.target.local.directory.path, shell: options.lease.target.endpoint.endpointShell, uid: options.lease.target.endpoint.remoteUid, maxBytes: options.maxBytes, killGraceMs: options.killGraceMs, detail: observe, runShell: options.runShell, validate: signal => options.lease.validateDirectory(signal).then(() => { }) });
     const root = await mkdtemp('/private/tmp/aw-x87-'), socketPath = root + '/mcp';
     try {
         const info = await lstat(root);

package/dist/employee-provider.js

@@ -210,7 +210,7 @@ export function createEmployeeProvider(get, options, agent) {
             const scopedIo = { run: (command, signal) => io.run(command, signal), attach: async (command) => {
                     const observe = closeDiagnostics.capture();
                     const child = await io.attach(command);
-                    child.once('close', (code, signal) => { observe({ layer: 'relay', initiator: 'ssh.process.close', reason: 'EMPLOYEE_EXEC_UNKNOWN', action: 'exit', exitCode: code, signal }); if (candidate && !candidate.ended)
+                    child.once('close', (code, signal) => { observe({ layer: 'relay', initiator: 'ssh.process.close', reason: 'EMPLOYEE_EXEC_UNKNOWN', action: 'exit', exitCode: code, signal }); if (candidate && !candidate.ended && !candidate.execution.remoteClose)
                         void candidate.dispose(fail('EMPLOYEE_EXEC_UNKNOWN'), { layer: 'runtime', initiator: 'provider.child-close', reason: 'EMPLOYEE_EXEC_UNKNOWN', action: 'dispose' }).catch(() => { }); });
                     return child;
                 } };
@@ -255,7 +255,8 @@ export function createEmployeeProvider(get, options, agent) {
             }
             const disposers = [];
             const execution = new EmployeeExecution({ closeDiagnostics, bindingId: admitted.bindingId, acpMaxMessageBytes: request.acpMaxMessageBytes, validate, transport: signal => createEmployeeSshTransport(ssh, signal) });
-            const runtime = { ...host, closeDiagnostics, cwd: admitted.cwd, details, connection: { ...connection }, binding: { bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, revision: state.revision }, saveCheckpoint: undefined, recoveredSession: undefined, employeeExecutionMeta: { version: 1, bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, cwd: admitted.cwd, acpMaxMessageBytes: request.acpMaxMessageBytes }, employeePresentation: CODEX_EMPLOYEE_SCOPE_NOTICE };
+            const runtime = { ...host, closeDiagnostics, cwd: admitted.cwd, details, connection: { ...connection }, binding: { bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, revision: state.revision }, saveCheckpoint: undefined, recoveredSession: undefined, employeeExecutionMeta: { version: 1, bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, cwd: admitted.cwd, acpMaxMessageBytes: request.acpMaxMessageBytes, httpMcpPolicy: request.employeeHttpMcpPolicy ?? 'ignore' }, employeePresentation: CODEX_EMPLOYEE_SCOPE_NOTICE };
+            runtime.employeeRemoteCloseReason = () => execution.remoteClose?.reason;
             entry = { scope, runtime, current: input, details, execution, network, ended: false, dispose: (reason, cause = { layer: 'runtime', initiator: 'provider.dispose', reason: reason?.code ?? 'EMPLOYEE_EXEC_CLOSED', action: 'dispose' }) => {
                     closeDiagnostics.record({ ...cause, changes: cause.changes ?? [{ field: 'provider.ended', before: entry.ended, after: true }] });
                     if (entry.closing)
@@ -310,13 +311,13 @@ export function createEmployeeProvider(get, options, agent) {
             runtime.employeeExecution = async (params, signal) => {
                 try {
                     const result = await execution.handle(params, signal);
-                    if (result.closed)
+                    if (result.closed && !execution.remoteClose)
                         void entry.dispose(undefined, { layer: 'runtime', initiator: 'provider.rpc-closed-result', reason: 'EMPLOYEE_EXEC_CLOSED', operation: typeof params === 'object' && params && 'operation' in params && typeof params.operation === 'string' ? params.operation : 'unknown', action: 'dispose' }).catch(cleanup => closeDiagnostics.record({ layer: 'runtime', initiator: 'provider.rpc-cleanup', reason: closeCode(cleanup, 'REMOTE_CLEANUP_UNCONFIRMED'), action: 'failure' }));
                     return { ...result };
                 }
                 catch (error) {
                     // EmployeeExecution reserves ABORTED for an unconsumed read wait. Lost responses are UNKNOWN.
-                    if (!(params && typeof params === 'object' && 'operation' in params && params.operation === 'read' && errorCode(error) === 'ABORTED'))
+                    if (!execution.remoteClose && !(params && typeof params === 'object' && 'operation' in params && params.operation === 'read' && errorCode(error) === 'ABORTED'))
                         void entry.dispose(asNeed(error), { layer: 'runtime', initiator: 'provider.rpc-failure', reason: closeCode(error), action: 'dispose' }).catch(cleanup => closeDiagnostics.record({ layer: 'runtime', initiator: 'provider.rpc-cleanup', reason: closeCode(cleanup, 'REMOTE_CLEANUP_UNCONFIRMED'), action: 'failure' }));
                     throw withFirstFailureEvidence(error, closeDiagnostics.first?.reason, errorCode(error));
                 }

package/dist/employee-reasons.d.ts

@@ -0,0 +1,4 @@
+/** Approved protocol codes only; remote exception text is never a reason. */
+export declare const employeeAdapterCodes: Set<string>;
+export declare const employeeOpenCauseCodes: Set<string>;
+export declare function trustedEmployeeReason(value: unknown): string | undefined;

package/dist/employee-reasons.js

@@ -0,0 +1,61 @@
+/** Approved protocol codes only; remote exception text is never a reason. */
+export const employeeAdapterCodes = new Set([
+    "AW_EMPLOYEE_ADDITIONAL_DIRECTORIES_UNSUPPORTED",
+    "AW_EMPLOYEE_SLASH_COMMAND_UNSUPPORTED",
+    "AW_EMPLOYEE_HOST_FILE_REPORT_UNSUPPORTED",
+    "AW_EMPLOYEE_CONFIG_DISCOVERY_OVERRIDE_UNSUPPORTED",
+    "AW_EMPLOYEE_CONFIG_ADMISSION_INVALID",
+    "AW_EMPLOYEE_CONFIG_ADMISSION_FAILED",
+    "AW_EMPLOYEE_HOST_PROJECT_CONFIG_UNSUPPORTED",
+    "AW_EMPLOYEE_EXECUTOR_MCP_UNSUPPORTED",
+    "AW_EMPLOYEE_EXECUTOR_CONFIG_PROTOCOL_INVALID",
+    "AW_EMPLOYEE_EXECUTOR_CONFIG_READ_FAILED",
+    "AW_EMPLOYEE_AGENT_CONFIG_UNAVAILABLE",
+    "AW_EMPLOYEE_BINDING_INVALID",
+    "AW_EMPLOYEE_BINDING_MISMATCH",
+    "AW_EMPLOYEE_CAPABILITY_REQUIRED",
+    "AW_EMPLOYEE_CLOSE_FAILED",
+    "AW_EMPLOYEE_CLOSE_RESPONSE_INVALID",
+    "AW_EMPLOYEE_COLD_RESUME_UNSUPPORTED",
+    "AW_EMPLOYEE_CWD_MISMATCH",
+    "AW_EMPLOYEE_ENVIRONMENT_REGISTRATION_FAILED",
+    "AW_EMPLOYEE_ENVIRONMENT_REQUIRED",
+    "AW_EMPLOYEE_EXECUTION_CLOSED",
+    "AW_EMPLOYEE_EXECUTION_ID_REQUIRED",
+    "AW_EMPLOYEE_HOST_AUXILIARY_CONFIG_UNSUPPORTED",
+    "AW_EMPLOYEE_HOST_AUXILIARY_UNSUPPORTED",
+    "AW_EMPLOYEE_HOST_FALLBACK_FORBIDDEN",
+    "AW_EMPLOYEE_MCP_UNSUPPORTED",
+    "AW_EMPLOYEE_MESSAGE_INVALID",
+    "AW_EMPLOYEE_MESSAGE_TOO_LARGE",
+    "AW_EMPLOYEE_OPEN_RESPONSE_INVALID",
+    "AW_EMPLOYEE_READ_MESSAGE_INVALID",
+    "AW_EMPLOYEE_READ_RESPONSE_INVALID",
+    "AW_EMPLOYEE_RELAY_ADDRESS_INVALID",
+    "AW_EMPLOYEE_RELAY_FAILED",
+    "AW_EMPLOYEE_REQUEST_INVALID",
+    "AW_EMPLOYEE_SESSION_UNKNOWN",
+    "AW_EMPLOYEE_WIRE_FAILED",
+    "AW_EMPLOYEE_WRITE_RESPONSE_INVALID"
+]);
+export const employeeOpenCauseCodes = new Set([
+    "AW_EMPLOYEE_BINARY_UNAVAILABLE",
+    "AW_EMPLOYEE_BINARY_HASH_FAILED",
+    "AW_EMPLOYEE_BINARY_HASH_MISMATCH",
+    "AW_EMPLOYEE_BINARY_VERSION_FAILED",
+    "AW_EMPLOYEE_BINARY_VERSION_MISMATCH",
+    "EMPLOYEE_CONTEXT_CHANGED",
+    "EMPLOYEE_ENDPOINT_INVALID",
+    "EMPLOYEE_BINARY_REQUIRED",
+    "EMPLOYEE_EXECUTION_UNSUPPORTED",
+    "EMPLOYEE_EXEC_PROTOCOL_INVALID",
+    "EMPLOYEE_EXEC_IDENTITY_MISMATCH",
+    "EMPLOYEE_EXEC_CLOSED",
+    "EMPLOYEE_EXEC_UNKNOWN",
+    "EMPLOYEE_EXEC_ALREADY_OPEN",
+    "EMPLOYEE_EXEC_READ_BUSY",
+    "ACP_MESSAGE_TOO_LARGE",
+    "ABORTED",
+    "SETTINGS_REQUIRED"
+]);
+export function trustedEmployeeReason(value) { return typeof value === 'string' && (employeeAdapterCodes.has(value) || employeeOpenCauseCodes.has(value)) ? value : undefined; }

package/dist/failure-evidence.d.ts

@@ -6,6 +6,8 @@ export declare function closeErrorCodes(error: unknown, fallback?: string): stri
 export declare function closeFailure(code: string, message: string, requires: string, codes: readonly string[]): NeedError;
 /** Saving succeeded: retain the original trusted error type, code and presentation. */
 export declare function withFirstFailureEvidence<T>(primary: T, firstReason: unknown, primaryCode: string): T;
+/** A negotiated close reason is independent evidence, never a replacement error or new gate. */
+export declare function withRemoteFailureEvidence<T>(primary: T, remoteReason: unknown, primaryCode: string): T;
 /** A known turn failure is final even while its original resource is still closing. */
 export declare function withPendingCleanupEvidence<T>(primary: T, firstReason: unknown, primaryCode: string): T;
 /** Preserve causal roles without copying arbitrary exception text into employee output. */

package/dist/failure-evidence.js

@@ -1,4 +1,5 @@
 import { NeedError } from "./remote.js";
+import { trustedEmployeeReason } from "./employee-reasons.js";
 /** Only typed codes, never exception messages, causes, stderr or RPC data. */
 export function closeCode(error, fallback = 'CLOSE_REASON_UNKNOWN') {
     return error instanceof NeedError && /^[A-Z][A-Z0-9_]*$/.test(error.code) ? error.code : fallback;
@@ -58,7 +59,16 @@ function retainedEvidence(error) {
 export function withFirstFailureEvidence(primary, firstReason, primaryCode) {
     if (primary && typeof primary === 'object' && safeCode(firstReason) && safeCode(primaryCode)) {
         const previous = retainedEvidence(primary);
-        evidence.set(primary, Object.freeze({ first: previous?.first ?? firstReason, original: previous?.original ?? Object.freeze([primaryCode]), diagnostic: previous?.diagnostic ?? Object.freeze([]), cleanup: previous?.cleanup ?? Object.freeze([]) }));
+        evidence.set(primary, Object.freeze({ ...previous, first: previous?.first ?? firstReason, original: previous?.original ?? Object.freeze([primaryCode]), diagnostic: previous?.diagnostic ?? Object.freeze([]), cleanup: previous?.cleanup ?? Object.freeze([]) }));
+    }
+    return primary;
+}
+/** A negotiated close reason is independent evidence, never a replacement error or new gate. */
+export function withRemoteFailureEvidence(primary, remoteReason, primaryCode) {
+    const remote = trustedEmployeeReason(remoteReason);
+    if (primary && typeof primary === 'object' && remote) {
+        const previous = retainedEvidence(primary);
+        evidence.set(primary, Object.freeze({ ...previous, remote: previous?.remote ?? remote, original: previous?.original ?? Object.freeze([safeCode(primaryCode) ? primaryCode : 'TURN_FAILED']), diagnostic: previous?.diagnostic ?? Object.freeze([]), cleanup: previous?.cleanup ?? Object.freeze([]) }));
     }
     return primary;
 }
@@ -75,7 +85,8 @@ export function withFailureEvidence(primary, secondary, kind, firstReason, prima
     const previous = retainedEvidence(primary), first = previous?.first ?? (safeCode(firstReason) ? firstReason : undefined);
     const original = previous?.original ?? (safeCode(primaryCode) ? [primaryCode] : closeErrorCodes(primary, 'TURN_FAILED'));
     const secondaryFacts = secondary.map(retainedEvidence), added = [...new Set(secondary.flatMap((error, index) => secondaryFacts[index] ? secondaryFacts[index].original.filter(code => !original.includes(code)) : closeErrorCodes(error, kind === 'diagnostic' ? 'DIAGNOSTIC_WRITE_FAILED' : 'REMOTE_CLEANUP_UNCONFIRMED')))];
-    const facts = Object.freeze({ ...(first ? { first } : {}), original: Object.freeze(original), diagnostic: Object.freeze([...new Set([...(previous?.diagnostic ?? []), ...secondaryFacts.flatMap(f => f?.diagnostic ?? []), ...(kind === 'diagnostic' ? added : [])])]), cleanup: Object.freeze([...new Set([...(previous?.cleanup ?? []), ...secondaryFacts.flatMap(f => f?.cleanup ?? []), ...(kind === 'cleanup' ? added : [])])]) });
+    const remote = previous?.remote ?? secondaryFacts.find(f => f?.remote)?.remote;
+    const facts = Object.freeze({ ...(first ? { first } : {}), ...(remote ? { remote } : {}), original: Object.freeze(original), diagnostic: Object.freeze([...new Set([...(previous?.diagnostic ?? []), ...secondaryFacts.flatMap(f => f?.diagnostic ?? []), ...(kind === 'diagnostic' ? added : [])])]), cleanup: Object.freeze([...new Set([...(previous?.cleanup ?? []), ...secondaryFacts.flatMap(f => f?.cleanup ?? []), ...(kind === 'cleanup' ? added : [])])]) });
     const code = kind === 'cleanup' ? 'REMOTE_CLEANUP_UNCONFIRMED' : !secondary.length ? primary instanceof NeedError ? primary.code : safeCode(primaryCode) ? primaryCode : 'TURN_FAILED' : primary instanceof NeedError && facts.diagnostic.length > 0 && facts.diagnostic.every(code => code === primary.code) && !facts.cleanup.length && !previous ? primary.code : 'CONVERSATION_DETAILS_FAILED';
     const failure = Object.assign(new NeedError(code, '本轮已停止；运行原因与诊断或清理结果分别保留。', '核对原始原因及未确认的保存/清理结果'), { cause: new AggregateError([primary, ...(safeCode(primaryCode) && !(primary instanceof NeedError) ? [new NeedError(primaryCode, '运行错误代码', '可信调用点提供的固定代码')] : []), ...secondary, ...(first ? [new NeedError(first, '首次观察关闭代码', '不是已证明根因')] : [])], 'TURN_FAILURE_EVIDENCE') });
     evidence.set(failure, facts);
@@ -87,5 +98,5 @@ export function failureEvidenceSummary(error) {
     const facts = retainedEvidence(error);
     if (!facts)
         return '';
-    return '技术详情：' + [...(facts.first ? ['首次观察关闭 ' + facts.first] : []), '运行原因 ' + facts.original.join('、'), ...(facts.diagnostic.length ? ['详情保存未确认 ' + facts.diagnostic.join('、')] : []), ...(facts.cleanup.length ? ['清理未确认 ' + facts.cleanup.join('、')] : facts.cleanupPending ? ['正在确认主机清理，原资源清理结果尚待确认'] : [])].join('；');
+    return '技术详情：' + [...(facts.first ? ['首次观察关闭 ' + facts.first] : []), '运行原因 ' + facts.original.join('、'), ...(facts.remote ? ['远端关闭原因 ' + facts.remote] : []), ...(facts.diagnostic.length ? ['详情保存未确认 ' + facts.diagnostic.join('、')] : []), ...(facts.cleanup.length ? ['清理未确认 ' + facts.cleanup.join('、')] : facts.cleanupPending ? ['正在确认主机清理，原资源清理结果尚待确认'] : [])].join('；');
 }

package/dist/host-workspace.js

@@ -96,8 +96,12 @@ export async function hostWorkspaceGuard(get, api, connection, target, request,
                     return value;
                 }
                 catch (error) {
-                    if (!request.signal?.aborted)
+                    if (!request.signal?.aborted) {
+                        const cause = revoked.signal.reason;
                         revoke(error);
+                        if (cause instanceof NeedError)
+                            throw cause;
+                    }
                     throw error;
                 }
             }

package/dist/index.d.ts

@@ -5,7 +5,7 @@ import { LlmAdapter, type GenerateOptions, type StreamChunk } from '@deepseek-ai
 import { type AcpHooks } from './acp.ts';
 import { type RuntimeProvider } from './provider.ts';
 import { type AgentDefinition } from './agents.ts';
-import { type ImageReader } from './input.ts';
+import { type ImageReader, type HostWorkspacePresentation } from './input.ts';
 import type { LoginDiagnostic } from './login-diagnostic.ts';
 import { type ModelDirectory, type HostModel } from './model-catalog.ts';
 import { type PreflightDiagnostics } from './preflight-diagnostic.ts';
@@ -21,8 +21,10 @@ export declare const DEFAULT_CONFIG: Readonly<{
     readonly oneShotSandbox: "workspace-write";
     readonly oneShotApproval: "never";
     readonly employeeShellKillGraceMs: 1000;
+    readonly employeeHttpMcpPolicy: "ignore";
 }>;
 export declare const Config: Schema<Schemastery.ObjectS<NoInfer<{
+    employeeHttpMcpPolicy: Schema<"reject" | "ignore", "reject" | "ignore", "volatile-defined">;
     mode: Schema<"session" | "one-shot", "session" | "one-shot", "volatile-defined">;
     acpMaxMessageBytes: Schema<number, number, "volatile-defined">;
     brokerMaxFrameBytes: Schema<number, number, "volatile-defined">;
@@ -31,6 +33,7 @@ export declare const Config: Schema<Schemastery.ObjectS<NoInfer<{
     oneShotApproval: Schema<"never", "never", "volatile-defined">;
     employeeShellKillGraceMs: Schema<number, number, "volatile-defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
+    employeeHttpMcpPolicy: Schema<"reject" | "ignore", "reject" | "ignore", "volatile-defined">;
     mode: Schema<"session" | "one-shot", "session" | "one-shot", "volatile-defined">;
     acpMaxMessageBytes: Schema<number, number, "volatile-defined">;
     brokerMaxFrameBytes: Schema<number, number, "volatile-defined">;
@@ -47,6 +50,7 @@ export interface PluginConfig {
     oneShotSandbox?: 'read-only' | 'workspace-write' | 'danger-full-access';
     oneShotApproval?: 'never';
     employeeShellKillGraceMs?: number;
+    employeeHttpMcpPolicy?: 'reject' | 'ignore';
 }
 type LiveConfig = {
     [K in keyof PluginConfig]: PluginConfig[K] | {
@@ -150,6 +154,6 @@ export declare class RemoteAgentsAdapter extends LlmAdapter {
     dispose(): Promise<void>;
 }
 export declare function apply(ctx: Context, live: LiveConfig): void;
-type InvocationApproval = (request: Parameters<NonNullable<AcpHooks['approve']>>[0], signal: AbortSignal | undefined, options: GenerateOptions, context?: string) => ReturnType<NonNullable<AcpHooks['approve']>>;
+type InvocationApproval = (request: Parameters<NonNullable<AcpHooks['approve']>>[0], signal: AbortSignal | undefined, options: GenerateOptions, context?: string, hostWorkspace?: HostWorkspacePresentation) => ReturnType<NonNullable<AcpHooks['approve']>>;
 export declare function dshApproval(ctx: Context): InvocationApproval;
 export {};

package/dist/index.js

@@ -1,6 +1,6 @@
 import { connectNeedMessage } from "./connect-need.js";
 import { CloseDiagnostics, withFailureEvidence, withFirstFailureEvidence, failureEvidenceSummary, closeCode, closeErrorCodes, closeFailure } from "./close-diagnostics.js";
-import { withPendingCleanupEvidence } from "./failure-evidence.js";
+import { withPendingCleanupEvidence, withRemoteFailureEvidence } from "./failure-evidence.js";
 import { runCatalog } from "./catalog-ssh.js";
 import { createCatalogDiagnostics, CatalogDiagnosticsRemote } from "./catalog-diagnostics.js";
 import { SessionId } from '@deepseek-ai/dsh-session';
@@ -17,7 +17,7 @@ import { StreamMapper } from "./mapping.js";
 import { connectProvider } from "./provider.js";
 import { brokerFactory } from "./broker.js";
 import { AGENTS, CODEX_AGENT } from "./agents.js";
-import { prepareInput, prepareContinuation } from "./input.js";
+import { prepareInput, prepareContinuation, projectHostWorkspaceInput } from "./input.js";
 import { createWorkspaceNoticeConsumer, isWorkspaceNoticeMessage } from "./workspace-notice.js";
 import { NeedError } from "./remote.js";
 import { employeeFailure } from "./presentation.js";
@@ -45,8 +45,9 @@ export const settingsNamespace = 'ai-workbench-codex';
 // L can be installed/enabled after X; keeping X mounted lets it explain the prerequisite.
 export const inject = ['llm'];
 /** Owner-approved defaults; administrators may override through the existing settings. */
-export const DEFAULT_CONFIG = Object.freeze({ mode: 'session', acpMaxMessageBytes: 4194304, brokerMaxFrameBytes: 2097152, brokerControlMaxBytes: 1048576, oneShotSandbox: 'workspace-write', oneShotApproval: 'never', employeeShellKillGraceMs: 1000 });
+export const DEFAULT_CONFIG = Object.freeze({ mode: 'session', acpMaxMessageBytes: 4194304, brokerMaxFrameBytes: 2097152, brokerControlMaxBytes: 1048576, oneShotSandbox: 'workspace-write', oneShotApproval: 'never', employeeShellKillGraceMs: 1000, employeeHttpMcpPolicy: 'ignore' });
 export const Config = Schema.object({
+    employeeHttpMcpPolicy: Schema.union([Schema.const('reject').i18n({ zh: '拒绝本机 HTTP MCP', en: '拒绝本机 HTTP MCP' }), Schema.const('ignore').i18n({ zh: '忽略本机 HTTP MCP 后继续（默认）', en: '忽略本机 HTTP MCP 后继续（默认）' })]).i18n({ zh: '本机 HTTP MCP 策略；默认忽略；忽略仅剔除会话投影，不改员工配置。新连接生效，stdio 始终按原生规则忽略，名称仅在技术详情说明；HTTP 忽略在正文按扩展名称提示', en: '本机 HTTP MCP 策略；默认忽略；忽略仅剔除会话投影，不改员工配置。新连接生效，stdio 始终按原生规则忽略，名称仅在技术详情说明；HTTP 忽略在正文按扩展名称提示' }).default(DEFAULT_CONFIG.employeeHttpMcpPolicy).volatile(),
     mode: Schema.union([Schema.const('session').i18n({ en: 'Session', zh: '会话模式' }), Schema.const('one-shot').i18n({ en: 'One-shot', zh: '单次模式' })]).i18n({ en: 'Run mode; start a new session after switching modes', zh: 'Codex运行模式；Claude固定会话模式；切换后请新建会话' }).default(DEFAULT_CONFIG.mode).volatile(),
     acpMaxMessageBytes: Schema.number().min(1).step(1).i18n({ en: 'Session message limit; default 4 MiB, adjustable by administrators', zh: '会话消息容量；默认4 MiB，管理员可调整' }).default(DEFAULT_CONFIG.acpMaxMessageBytes).volatile(),
     brokerMaxFrameBytes: Schema.number().min(1).step(1).i18n({ en: 'Host output chunk limit; default 2 MiB, adjustable by administrators', zh: '主机回传单段容量；默认2 MiB，管理员可调整' }).default(DEFAULT_CONFIG.brokerMaxFrameBytes).volatile(),
@@ -340,7 +341,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
         let turnFailure;
         let employeeNoticeShown = false;
         const information = [];
-        const recordInformation = () => { if (runtime?.details)
+        const recordInformation = () => { timing.summarize(); if (runtime?.details)
             for (const entry of information.splice(0))
                 runtime.details.record(entry); };
         const config = this.config();
@@ -386,7 +387,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
             const configuration = JSON.stringify([mode, config.acpMaxMessageBytes, config.brokerMaxFrameBytes, config.brokerControlMaxBytes, config.employeeShellKillGraceMs]);
             if (live && live.configuration !== configuration)
                 throw new NeedError('SESSION_CONTEXT_MISMATCH', '会话运行设置已改变，请新建会话', '原会话运行设置');
-            Object.assign(request, { timing, acpMaxMessageBytes: config.acpMaxMessageBytes, resumeSessionId: previous?.sessionId, recoveryCheckpointId: previous?.recoveryCheckpointId, sessionId: options.sessionId, mode, cwd: previous?.cwd, identity: previous?.identity, bindingId: previous?.bindingId, workspaceId: previous?.workspaceId, agent: this.agent, retainProcess: !!key && mode === 'session', signal, brokerSettings: Object.freeze({ brokerMaxFrameBytes: config.brokerMaxFrameBytes, brokerControlMaxBytes: config.brokerControlMaxBytes }) });
+            Object.assign(request, { timing, employeeHttpMcpPolicy: config.employeeHttpMcpPolicy ?? DEFAULT_CONFIG.employeeHttpMcpPolicy, acpMaxMessageBytes: config.acpMaxMessageBytes, resumeSessionId: previous?.sessionId, recoveryCheckpointId: previous?.recoveryCheckpointId, sessionId: options.sessionId, mode, cwd: previous?.cwd, identity: previous?.identity, bindingId: previous?.bindingId, workspaceId: previous?.workspaceId, agent: this.agent, retainProcess: !!key && mode === 'session', signal, brokerSettings: Object.freeze({ brokerMaxFrameBytes: config.brokerMaxFrameBytes, brokerControlMaxBytes: config.brokerControlMaxBytes }) });
             if (requireFreshSession) {
                 request.requireFreshSession = true;
                 request.resumeSessionId = undefined;
@@ -487,12 +488,17 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 if (contextChanged)
                     input = await timing.run('input-prepare', () => prepareContinuation(options, input, this.readImage));
             }
+            input = projectHostWorkspaceInput(input, runtime.hostWorkspace);
+            if (runtime.hostWorkspace && mode === 'session' && Buffer.byteLength(JSON.stringify({ prompt: input.prompt, systemPrompt: input.systemPrompt }), 'utf8') > config.acpMaxMessageBytes)
+                throw new NeedError('ACP_MESSAGE_TOO_LARGE', '本轮输入超过已设置的会话消息容量，未截断或发送', '管理员调整acpMaxMessageBytes');
             const details = runtime.details;
             if (!details)
                 throw new NeedError('TECHNICAL_DETAILS_UNAVAILABLE', '技术详情暂不可用，请更新远程主机连接组件。', 'L技术详情持久接收能力');
             recordInformation();
             timing.bind(detail => details.record(detail));
             request.recordEarlyFailure = undefined;
+            if (runtime.hostWorkspace)
+                details.record({ kind: 'session', severity: 'info', code: 'HOST_WORKSPACE_CONTEXT', summary: '本轮模型工作区上下文及审批会话目录使用已确认的主机目录。', payload: { source: 'host', cwd: runtime.hostWorkspace.cwd } });
             const mapper = new StreamMapper(mode === 'session' && !contextChanged ? (runtime.restartNotice ? undefined : live ? live.usageSnapshot : previous ? (previous.usageSnapshot ?? null) : undefined) : undefined, observation => details.record(observation));
             activeMapper = mapper;
             let id;
@@ -541,11 +547,11 @@ export class CodexRemoteAdapter extends LlmAdapter {
                             }
                             await execution.validate(approvalSignal);
                         }
-                        const answer = await this.approve?.(permission, approvalSignal, options, execution && toolName?.startsWith('mcp__employee__') ? 'employee-local' : undefined) ?? 'unavailable';
+                        const answer = await this.approve?.(permission, approvalSignal, options, execution && toolName?.startsWith('mcp__employee__') ? 'employee-local' : undefined, runtime.hostWorkspace) ?? 'unavailable';
                         if (execution && answer === 'allowed-once')
                             await execution.validate(approvalSignal);
                         return answer;
-                    }, onUpdate: notification => { try {
+                    }, onEmployeeNotice: notice => push(mapper.text(notice + '\n\n')), onUpdate: notification => { try {
                         push(mapper.acp(notification.update));
                     }
                     catch (error) {
@@ -663,6 +669,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
                         yield chunk;
                 }
             }
+            mapper.flushMetadata();
             recordInformation();
             details.endTurn();
             await timing.run('details-flush', () => details.flush());
@@ -704,9 +711,16 @@ export class CodexRemoteAdapter extends LlmAdapter {
             runtime?.closeDiagnostics?.record({ layer: 'adapter', initiator: 'adapter.turn-failure', reason: closeCode(error, signal.aborted ? 'ABORTED' : 'TURN_FAILED'), action: 'failure' });
             recordInformation();
             failureCode = error instanceof NeedError || error instanceof ModelConfigurationError ? error.code : error instanceof LlmError ? error.code : 'TURN_PREPARATION_FAILED';
+            withRemoteFailureEvidence(error, runtime?.employeeRemoteCloseReason?.(), failureCode);
             if (live && session && session.promptDispatchCount > promptBaseline)
                 live.failure = { cause: error };
             const reporting = [];
+            try {
+                activeMapper?.flushMetadata();
+            }
+            catch (failure) {
+                reporting.push(failure);
+            }
             const reportFailure = async () => {
                 if (request?.recordEarlyFailure) {
                     const record = request.recordEarlyFailure;
@@ -969,12 +983,12 @@ export function apply(ctx, live) {
     ctx.effect(() => () => { modelDirectory.dispose(); return adapter.dispose(); });
 }
 export function dshApproval(ctx) {
-    return async (request, signal, options, context) => {
+    return async (request, signal, options, context, hostWorkspace) => {
         const agent = options.sessionId ? ctx.get('agents')?.get(options.sessionId) : undefined;
         const approval = ctx.get('approval');
         if (!agent || !approval)
             return 'unavailable';
-        const label = approvalLabel(request, context === 'employee-local' ? 'local' : 'host');
+        const label = approvalLabel(request, context === 'employee-local' ? 'local' : 'host', hostWorkspace);
         if (!label)
             return 'unavailable';
         return approval.request({ agent, ...label, signal });

package/dist/input.d.ts

@@ -12,6 +12,13 @@ export interface HistoryTransfer {
     omittedReasoningBlocks: number;
     reasoningOmissionReason: 'dsh-internal-reasoning';
 }
+export interface HostWorkspacePresentation {
+    readonly cwd: string;
+}
+type RuntimeSection = {
+    name: string;
+    text: string;
+};
 export interface PreparedInput {
     prompt: AcpContentBlock[];
     users: {
@@ -20,8 +27,12 @@ export interface PreparedInput {
     }[];
     systemPrompt?: string;
     historyTransfer?: HistoryTransfer;
+    runtimeSnapshots?: ReadonlyMap<AcpContentBlock, readonly RuntimeSection[]>;
 }
+/** Invocation-only model context; never modifies the native session/history. */
+export declare function projectHostWorkspaceInput(input: PreparedInput, host?: HostWorkspacePresentation): PreparedInput;
 /** Role-labelled public history only; never serialize source/replay/tool internals. */
 export declare function prepareContinuation(options: GenerateOptions, input: PreparedInput, readImage?: ImageReader): Promise<PreparedInput>;
 /** The attachment service supplies verified bytes; client paths never cross SSH. */
 export declare function prepareInput(options: GenerateOptions, readImage?: ImageReader): Promise<PreparedInput>;
+export {};

package/dist/input.js

@@ -1,5 +1,37 @@
 import { NeedError } from "./remote.js";
 import { isWorkspaceNoticeMessage, withoutWorkspaceNotice } from "./workspace-notice.js";
+function runtimeSections(message) {
+    const source = message.source;
+    if (message.role !== 'user' || source?.kind !== 'runtime-context' || source.form !== 'snapshot' || !Array.isArray(source.sections) || message.content.length !== 1 || message.content[0].type !== 'text')
+        return;
+    if (!source.sections.every(s => s && typeof s.name === 'string' && typeof s.text === 'string'))
+        return;
+    const sections = source.sections, body = sections.map(s => s.text).join('\n\n');
+    // Only official, structurally attributed snapshot text is projected. Employee
+    // text and opaque contributions are never searched for or rewritten as paths.
+    if (body && message.content[0].text.endsWith('\n\n' + body))
+        return sections;
+}
+/** Invocation-only model context; never modifies the native session/history. */
+export function projectHostWorkspaceInput(input, host) {
+    if (!host)
+        return input;
+    const context = `当前会话使用远程主机上的工作区：${JSON.stringify(host.cwd)}。文件和命令在该主机目录执行，受主机账号的操作系统权限约束；本机 DSH 文件沙箱的工作区路径不适用于这些远程操作。`;
+    const mapped = new Map();
+    for (const [block, sections] of input.runtimeSnapshots ?? []) {
+        if (block.type !== 'text' || !sections.some(s => s.name === 'sandbox:policy'))
+            continue;
+        const body = sections.map(s => s.text).join('\n\n');
+        mapped.set(block, { ...block, text: block.text.slice(0, -body.length) + sections.map(s => s.name === 'sandbox:policy' ? context : s.text).join('\n\n') });
+    }
+    const project = (blocks) => blocks.map(block => mapped.get(block) ?? block);
+    const prompt = project(input.prompt);
+    // Confirm this invocation after all current and historical text. A projected
+    // historical snapshot must not suppress host facts for an opaque current one;
+    // warm steps also need no new native snapshot to retain their host location.
+    prompt.push({ type: 'text', text: context });
+    return { ...input, prompt, users: input.users.map(user => ({ ...user, prompt: project(user.prompt) })) };
+}
 async function publicBlock(block, options, readImage, history = false) {
     options.signal?.throwIfAborted();
     if (block.type === 'text')
@@ -26,6 +58,7 @@ export async function prepareContinuation(options, input, readImage) {
             throw new NeedError('HISTORY_CONTENT_UNSUPPORTED', `此前含有无法可靠承接的历史角色：${message.role}；本轮未新建或发送`, '完整公开的用户及助手历史；工具记录的公开内容映射');
     const after = messages.findLastIndex(message => message.role === 'assistant');
     const prompt = [];
+    const runtimeSnapshots = new Map(input.runtimeSnapshots);
     const historyTransfer = { scope: 'visible-user-assistant-text-and-images', textBlocks: 0, imageBlocks: 0, offloadedImagePlaceholders: 0, omittedReasoningBlocks: 0, reasoningOmissionReason: 'dsh-internal-reasoning' };
     for (const message of messages.slice(0, after + 1)) {
         if (message.role === 'system' || message.role === 'developer')
@@ -33,13 +66,17 @@ export async function prepareContinuation(options, input, readImage) {
         if (message.role !== 'user' && message.role !== 'assistant')
             throw new NeedError('HISTORY_CONTENT_UNSUPPORTED', `此前含有无法可靠承接的历史角色：${message.role}；本轮未新建或发送`, '完整公开的用户及助手历史；工具记录的公开内容映射');
         prompt.push({ type: 'text', text: `此前可见对话（历史角色：${message.role}；仅为历史记录）：\n` });
+        const sections = runtimeSections(message);
         for (const block of message.content) {
             // DSH explicitly distinguishes internal thinking from visible user text.
             if (block.type === 'reasoning') {
                 historyTransfer.omittedReasoningBlocks++;
                 continue;
             }
-            prompt.push(await publicBlock(block, options, readImage, true));
+            const prepared = await publicBlock(block, options, readImage, true);
+            prompt.push(prepared);
+            if (sections)
+                runtimeSnapshots.set(prepared, sections);
             if (block.type === 'text')
                 historyTransfer.textBlocks++;
             else if (block.type === 'image') {
@@ -52,7 +89,7 @@ export async function prepareContinuation(options, input, readImage) {
         prompt.push({ type: 'text', text: `\n（历史角色：${message.role} 的记录结束）\n` });
     }
     prompt.push({ type: 'text', text: '此前可见对话结束。以下为当前用户输入：\n' }, ...input.prompt);
-    return { ...input, prompt, historyTransfer };
+    return { ...input, prompt, historyTransfer, runtimeSnapshots };
 }
 /** The attachment service supplies verified bytes; client paths never cross SSH. */
 export async function prepareInput(options, readImage) {
@@ -78,13 +115,19 @@ export async function prepareInput(options, readImage) {
         throw new NeedError('INPUT_REQUIRED', '我需要本轮用户输入', '用户输入');
     const prompt = [];
     const preparedUsers = [];
+    const runtimeSnapshots = new Map();
     for (const message of users) {
         const before = prompt.length;
-        for (const block of message.content)
-            prompt.push(await publicBlock(block, options, readImage));
+        const sections = runtimeSections(message);
+        for (const block of message.content) {
+            const prepared = await publicBlock(block, options, readImage);
+            prompt.push(prepared);
+            if (sections)
+                runtimeSnapshots.set(prepared, sections);
+        }
         preparedUsers.push({ id: message.id, prompt: prompt.slice(before) });
     }
     if (!prompt.length)
         throw new NeedError('INPUT_REQUIRED', '我需要本轮用户输入', '用户输入');
-    return { prompt, users: preparedUsers, ...(context.length ? { systemPrompt: context.join('\n\n') } : {}) };
+    return { prompt, users: preparedUsers, runtimeSnapshots, ...(context.length ? { systemPrompt: context.join('\n\n') } : {}) };
 }

package/dist/mapping.d.ts

@@ -26,6 +26,9 @@ export declare class StreamMapper {
     private seen;
     private baseline;
     private readonly observations;
+    private readonly modelMetadata;
+    private anonymousMetadata;
+    private lastMetadataType;
     private readonly onDiagnostic;
     /** Omitted argument is exclusively for a known new session; pass null on unknown resume. */
     constructor(previousUsage?: UsageSnapshot | null, onDiagnostic?: (observation: Readonly<SanitizedObservation>) => void);
@@ -33,6 +36,8 @@ export declare class StreamMapper {
     get diagnostics(): readonly Readonly<SanitizedObservation>[];
     private diagnostic;
     private usageWarning;
+    /** One durable observation per official message; keep ordered, sanitized fragment snapshots. */
+    flushMetadata(): void;
     text(text: string, reasoning?: boolean): StreamChunk[];
     /** Close the current text or reasoning block once, before the stream settles. */
     flush(): StreamChunk[];

package/dist/mapping.js

@@ -9,6 +9,9 @@ export class StreamMapper {
     seen = new Map();
     baseline;
     observations = [];
+    modelMetadata = new Map();
+    anonymousMetadata = 0;
+    lastMetadataType;
     onDiagnostic;
     /** Omitted argument is exclusively for a known new session; pass null on unknown resume. */
     constructor(previousUsage = { version: 1, kind: 'zero' }, onDiagnostic) {
@@ -30,6 +33,15 @@ export class StreamMapper {
     usageWarning(summary) {
         return this.diagnostic({ kind: 'usage', severity: 'warning', code: 'USAGE_UNAVAILABLE', summary });
     }
+    /** One durable observation per official message; keep ordered, sanitized fragment snapshots. */
+    flushMetadata() {
+        for (const [key, payload] of this.modelMetadata) {
+            // A throwing sink may already have enqueued its write. Never replay that message.
+            this.modelMetadata.delete(key);
+            this.diagnostic({ kind: 'extension', severity: 'info', code: 'ACP_MODEL_METADATA', summary: '远端模型消息扩展（按消息汇总）', method: 'session/update', payload });
+        }
+        this.lastMetadataType = undefined;
+    }
     text(text, reasoning = false) {
         if (!text)
             return [];
@@ -55,15 +67,31 @@ export class StreamMapper {
     acp(update) {
         if (update.sessionUpdate === 'agent_message_chunk' || update.sessionUpdate === 'agent_thought_chunk') {
             if (update.content.type === 'text' && typeof update.content.text === 'string') {
-                // The whole update preserves every extension layer without inventing a display mapping.
+                const messageId = typeof update.messageId === 'string' ? update.messageId : undefined;
+                if (messageId !== undefined)
+                    this.lastMetadataType = undefined;
+                else {
+                    if (this.lastMetadataType !== update.sessionUpdate)
+                        this.anonymousMetadata++;
+                    this.lastMetadataType = update.sessionUpdate;
+                }
+                // Capture each extension layer now, before the caller can mutate it. Text mapping is unchanged.
                 if (Object.keys(update).some(key => key !== 'sessionUpdate' && key !== 'content')
                     || Object.keys(update.content).some(key => key !== 'type' && key !== 'text')) {
-                    this.diagnostic({ kind: 'extension', severity: 'info', code: 'ACP_MODEL_METADATA', summary: '远端模型消息扩展', method: 'session/update', payload: update });
+                    const key = JSON.stringify(messageId !== undefined ? ['message', messageId] : ['segment', this.anonymousMetadata]);
+                    let pending = this.modelMetadata.get(key);
+                    if (!pending) {
+                        pending = { sessionUpdate: update.sessionUpdate, ...(messageId !== undefined ? { messageId } : {}), fragments: [] };
+                        this.modelMetadata.set(key, pending);
+                    }
+                    pending.fragments.push(sanitizeObservation({ kind: 'extension', severity: 'info', code: 'ACP_MODEL_METADATA', summary: '远端模型消息扩展', payload: update }).payload);
                 }
                 return this.text(update.content.text, update.sessionUpdate === 'agent_thought_chunk');
             }
+            this.lastMetadataType = undefined;
             return this.diagnostic({ kind: 'extension', severity: 'warning', code: 'ACP_CONTENT_UNSUPPORTED', summary: '远端非文本内容，需要对应的公开显示映射', method: 'session/update', payload: update });
         }
+        this.lastMetadataType = undefined;
         let kind = 'session';
         let code = 'ACP_SESSION_UPDATE';
         let summary = '远端会话事件';
@@ -111,6 +139,7 @@ export class StreamMapper {
     }
     /** ACP usage and the fixed Claude quota both accumulate across the session, not per turn. */
     acpResponse(response) {
+        this.flushMetadata();
         this.diagnostic({ kind: 'usage', severity: 'info', code: 'ACP_PROMPT_RESPONSE', summary: '远端响应与真实用量', method: 'session/prompt', payload: response });
         const quota = record(response._meta?.quota);
         const tokens = record(quota?.token_count);