@ai-workbench/remote-agent 0.8.19 → 0.8.21

package/README.md

@@ -1,10 +1,10 @@
-**`@ai-workbench/remote-agent@0.8.19` 发布形态包。包含X2主机目录上下文与审批位置修正；本版以aw.4对齐原生本机MCP过滤、保留远端关闭首因并汇总成功连接核对。继承0.8.18的执行时序、去重复SSH和失败先交还。通过官方插件 → 添加插件安装；固定包由编排发布，X不publish。工程/包证明与leo产品验收分别记录，未运行的门保持NOT_RUN。**
+**`@ai-workbench/remote-agent@0.8.21` 发布形态包。包含X2主机目录上下文与审批位置修正；本版将本机HTTP扩展策略默认改为ignore，并按名称给出员工提示；stdio说明与协议细节仅在技术详情；继承aw.4原生MCP过滤、关闭首因保留与成功连接核对汇总。继承0.8.18的执行时序、去重复SSH和失败先交还。通过官方插件 → 添加插件安装；固定包由编排发布，X不publish。工程/包证明与leo产品验收分别记录，未运行的门保持NOT_RUN。**
 
 # 远程ACP插件
 
 一个插件提供 **Claude（远程主机）** 和 **Codex（远程主机）**，通过员工主机上的官方CLI运行。Codex保留单次模式；Claude固定会话模式。只用官方模型列表、插件管理和配置入口，不提供自制面板、问答或登录按钮。登录和原生工作区绑定唯一归连接插件L。
 
-当前版本0.8.19，在0.8.18/aw.3基础上修复本机MCP过滤、关闭首因和连接核对降噪，需aw.4；包含X2主机目录上下文与审批位置修正；0.8.17的主机来源执行和L具体Need透传完整保留；包名采用`@ai-workbench/remote-agent`以涵盖两个品牌；本轮按编排放行准备发布形态包，供 leo 真机自验；X 不执行实际发布，由编排统一发布。开发fixture逐字节保留L0.7.20固定包，公开类型与SSH导出从该包消费。运行时仍要求L的`getContractInfo()`同时返回API0.7.0、implemented、native-local-v1；旧L包、draft.3或只有版本号的不完整实现会明确报缺项。依赖范围为`~0.7.20`，L由官方插件管理单独安装，不打进X。组件验证不代表真实开通、模型或leo E通过；HanaMesh另验。
+当前版本0.8.21，继承0.8.19的本机MCP过滤、关闭首因和连接核对汇总，并将本机HTTP扩展策略默认改为ignore、按名称给出员工提示；stdio说明及协议细节仅在技术详情，新缺省需aw.5（显式策略仍兼容aw.4）；包含X2主机目录上下文与审批位置修正；0.8.17的主机来源执行和L具体Need透传完整保留；包名采用`@ai-workbench/remote-agent`以涵盖两个品牌；本轮按编排放行准备发布形态包，供 leo 真机自验；X 不执行实际发布，由编排统一发布。开发fixture逐字节保留L0.7.20固定包，公开类型与SSH导出从该包消费。运行时仍要求L的`getContractInfo()`同时返回API0.7.0、implemented、native-local-v1；旧L包、draft.3或只有版本号的不完整实现会明确报缺项。依赖范围为`~0.7.20`，L由官方插件管理单独安装，不打进X。组件验证不代表真实开通、模型或leo E通过；HanaMesh另验。
 
 已包含L0.7.18消费增量：来源确认、输入接纳、登录、本机接纳、输入准备、模型目录及运行时解析的早期失败，用正式`preflightDiagnostics:1` / `preflight-check`进入L「连接前技术详情（含登录与工作区确认）」。阶段、真实来源/状态和错误代码可展开；未知来源为null，旧login-check的完整安全原因保留。记录不选择来源、不接纳输入、不自动重发；无原生会话的菜单查询仍在模型设置报告。当前工程和设置组件验证不等于leo GUI验收。
 
@@ -12,7 +12,7 @@
 
 ## 员工路径
 
-从官方插件管理安装，照常使用默认工作区/会话/模型入口。L沿唯一“远程主机连接”设置节记录文件来源；L0.7.20新选主机位置由两品牌按已核验的规范目录执行，旧legacy主机绑定仍沿原规则；本地来源接入N0.4.4/S0.4.11员工端点。旧映射可在本轮官方一次确认中选择改用本机文件夹；拒绝、取消或输入/来源变化时不切换、不执行。也可在L设置逐工作区确认沿用原主机关联。缺正式host解析能力时明确说明所缺组件、保留原话，本轮不派发。本地六类工具经Claude公开toolAliases路由到员工电脑：cwd是员工选定目录，Git使用本机仓库，不回退主机同名目录。本地真实员工输入先取得官方当前轮次CAS预期，再调用L0.7.17 acceptLocalWorkspaceUserTurn；核回包后才打开D19和本轮主机目录/执行。每轮localAcceptanceId冻结进原详情sink，迟到结果不借新轮ID；LOCAL_USER_TURN_CHANGED立即停止本轮，不重接纳或退legacy。已用固定真包完成本地D19组件联测；编排已回证0.8.14 Claude/Opus5/Default在leo本地目录首轮写文件成功；该回证不覆盖本0.8.19或Codex，产品验收以各版本leo实际结果为准。本地文件不自动上传，X不猜目录、不选首项。首次说明使用官方普通回复；先经官方会话提交、持久化并读回核对，才向L确认。持久记录不等于员工已看见，GUI另验；日志丢失后的未知claim由L保留，不宣称端到端恰好一次。
+从官方插件管理安装，照常使用默认工作区/会话/模型入口。L沿唯一“远程主机连接”设置节记录文件来源；L0.7.20新选主机位置由两品牌按已核验的规范目录执行，旧legacy主机绑定仍沿原规则；本地来源接入N0.4.4/S0.4.11员工端点。旧映射可在本轮官方一次确认中选择改用本机文件夹；拒绝、取消或输入/来源变化时不切换、不执行。也可在L设置逐工作区确认沿用原主机关联。缺正式host解析能力时明确说明所缺组件、保留原话，本轮不派发。本地六类工具经Claude公开toolAliases路由到员工电脑：cwd是员工选定目录，Git使用本机仓库，不回退主机同名目录。本地真实员工输入先取得官方当前轮次CAS预期，再调用L0.7.17 acceptLocalWorkspaceUserTurn；核回包后才打开D19和本轮主机目录/执行。每轮localAcceptanceId冻结进原详情sink，迟到结果不借新轮ID；LOCAL_USER_TURN_CHANGED立即停止本轮，不重接纳或退legacy。已用固定真包完成本地D19组件联测；编排已回证0.8.14 Claude/Opus5/Default在leo本地目录首轮写文件成功；该回证不覆盖本0.8.21；编排06:16另已回证0.8.19/aw.4的Sol本机你好及写文件通过，产品验收以各版本leo实际结果为准。本地文件不自动上传，X不猜目录、不选首项。首次说明使用官方普通回复；先经官方会话提交、持久化并读回核对，才向L确认。持久记录不等于员工已看见，GUI另验；日志丢失后的未知claim由L保留，不宣称端到端恰好一次。
 
 新主机位置允许当前SSH员工账号可访问的已选绝对目录、文件系统根目录、非Git或只读目录；不改写原projectRoot、不创建Git、不转本机同名文件夹。read/execute必须可核实，write=false不额外一刀切拒绝，实际写入服从主机系统权限。运行前必核来源UUID、连接代次、目录及链接入口dev/ino和权限；revision与内容增删导致的mtime/ctime变化不单独失效。此核对属于正确性条件，不可关闭。最后inspect到主机spawn之间仍有OS时序边界，不表示原子目录句柄租约。
 
@@ -49,7 +49,7 @@ Codex单次模式首版仅文本，不转接中途审批；图片或系统/开
 | oneShotSandbox | workspace-write | Codex单次可选read-only/workspace-write/danger-full-access |
 | oneShotApproval | never | 当前单次通道无中途交互审批；不代表自动批准 |
 | employeeShellKillGraceMs | 1000 | 0至2147483647的整数；取消后外层SSH清理宽限毫秒。取消结果仍未知，不将宽限作为员工端退出证明 |
-| employeeHttpMcpPolicy | reject | reject / ignore；新连接生效，默认拒绝原生会采用的本机HTTP MCP；ignore仅剔除会话投影后继续。不改员工配置；stdio按原生规则忽略并可见说明名称 |
+| employeeHttpMcpPolicy | ignore | reject / ignore；新连接生效。默认ignore仅剔除原生会采用的本机HTTP扩展投影后继续；可选reject保留固定拒绝原因。不改员工配置。忽略的HTTP扩展按名称用员工用语提示，stdio名称及协议细节仅进技术详情 |
 
 原六项默认保留；D20新增employeeShellKillGraceMs供管理员调节自己的SSH清理。非法值拒绝，删除覆盖遵循官方配置继承。SSH可执行程序从当前PATH发现，不写死某一系统路径。原始错误码保留在官方失败代码/技术详情，原始stderr、凭据和URL不展开。
 
@@ -66,7 +66,7 @@ Codex单次模式首版仅文本，不转接中途审批；图片或系统/开
 
 ## 历史实现记录（0.8.1–0.8.16）
 
-以下按版本保留当轮的设置数量、依赖、首红与验收状态；“本轮/当前”均指对应历史轮次。0.8.19当前配置以开头、管理员八项表及末节为准；这些历史工程记录不替代本版产品验收。
+以下按版本保留当轮的设置数量、依赖、首红与验收状态；“本轮/当前”均指对应历史轮次。0.8.21当前配置以开头、管理员八项表及末节为准；这些历史工程记录不替代本版产品验收。
 
 D19（0.8.1）：相邻正文增量合成连续文本块，工作区首次说明合入真实回复，按官方持久记录核对后才回报“已记入可核对回复”。这不代表界面已经显示。
 
@@ -85,7 +85,7 @@ D21（0.8.5）：两个品牌的官方模型菜单从 L 的 `modelCatalogTarget:
 
 每轮先核对目录代次和所选模型，再经 ACP 逐项配置模型及推理等级，收到完整配置确认后才发送输入。Claude 别名每轮须有精确的模型配置成功回执，并由同一员工主机、同一连接代际的目录唯一映射到具体型号。具体型号注明来自主机目录，会话未单独回报；旧恢复记录不作本轮证据。目录缺项、映射不唯一、回执不符或身份/代际变化时不发送输入。所选值、远端确认值及型号来源仅在恢复标识与技术详情保留，插件不向真实回复追加技术参数，确认配置不等于验证推理效果。连接/身份/目录变化清除旧确认；远端清理待定或结果未知时阻止派发，不自动清理重试或另开替代会话。Codex 单次模式当前不能确认此选择，会在发送前明确拒绝。新增设置 0；本轮工程证据、真实只读链路与产品未验项见 `docs/evidence/2026-10-22-X2-D21/`。
 
-0.8.5统一包原依赖L `~0.7.13`；0.8.16原对齐L `~0.7.19`；当前0.8.19对齐L `~0.7.20`。D8模型目录双事件长期监听保留；同epoch的recovery提示/失败消息变化不触发执行状态失效，真实实例/epoch/phase/可信目标/登录变化仍失效。完整D9两品牌正文/状态/就绪门呈现按编排00:50允许的范围记下一版，本版不宣称已消费完成；L的connectionMessages.administratorAfterMs仍只由L管理；X本版新增employeeHttpMcpPolicy见末节。
+0.8.5统一包原依赖L `~0.7.13`；0.8.16原对齐L `~0.7.19`；当前0.8.21对齐L `~0.7.20`。D8模型目录双事件长期监听保留；同epoch的recovery提示/失败消息变化不触发执行状态失效，真实实例/epoch/phase/可信目标/登录变化仍失效。完整D9两品牌正文/状态/就绪门呈现按编排00:50允许的范围记下一版，本版不宣称已消费完成；L的connectionMessages.administratorAfterMs仍只由L管理；employeeHttpMcpPolicy自0.8.19新增，见后文；0.8.20无新增设置。
 
 D18（0.8.6）：Codex 需要主机自有 adapter `2.2.2-aw.1` 的明确新建会话上下文政策，官方 CLI 仍为未改的0.160.1。系统/开发者要求仅在新建时生效；恢复时与初建摘要相同则正常恢复且省略新建专用字段，不声称恢复接口会更新指令。要求不同或清空时，在同一真实回复说明“会话要求已变化，已新建 Codex 会话继续处理，原会话仍保留。”，并新建远端承接公开对话，保留旧标识和查询记录；旧/非法初建摘要明确拒绝，不能猜测。
 
@@ -145,8 +145,30 @@ L接纳每轮真实输入时核对实际目录和N端点/代次。X只在该代
 
 ## 0.8.19 / aw.4 本机 MCP 与失败原因
 
-按 Codex 0.160.1 原生层合并和 HTTP/header 能力过滤处理员工 MCP。stdio（例如 node_repl）不拒绝，显示“已忽略本机 stdio MCP: 名称”；不转发其 command、args、env 值，不修改员工文件。真正的 HTTP 条目使用具名设置 employeeHttpMcpPolicy：默认 reject 保留 AW_EMPLOYEE_EXECUTOR_MCP_UNSUPPORTED；ignore 只在会话投影剔除后继续。管理员可在现有远程助手参数页及官方配置文件入口编辑，范围、默认值、生效与后果均可见。此项在新连接冻结，修改不增加中止当前轮或旧会话的条件。stdio 的过滤来自固定原生协议，不是可调阈值。
+按 Codex 0.160.1 原生层合并和 HTTP/header 能力过滤处理员工 MCP。stdio（例如 node_repl）不拒绝；0.8.20起仅在技术详情显示“已忽略本机 stdio MCP: 名称”，不注入模型正文；不转发其 command、args、env 值，不修改员工文件。真正的 HTTP 条目使用具名设置 employeeHttpMcpPolicy：默认 reject 保留 AW_EMPLOYEE_EXECUTOR_MCP_UNSUPPORTED；ignore 只在会话投影剔除后继续。管理员可在现有远程助手参数页及官方配置文件入口编辑，范围、默认值、生效与后果均可见。此项在新连接冻结，修改不增加中止当前轮或旧会话的条件。stdio 的过滤来自固定原生协议，不是可调阈值。
 
 aw.4 仅在客户端声明 closeReason:1 后发送白名单 close.reason；旧端形状保持兼容。新版 X 接到明确远端 close 后释放员工 carrier，保留在途主机 session/new 回应，再由原本收尾释放 broker；非预期 EOF 仍按既有路径关闭。技术详情分别显示运行原因、首次观察和远端固定关闭原因；它们不因详情保存或清理失败而被替代。成功 connection-confirm 按阶段汇总次数和耗时，失败仍即时记录；实际确认操作不减少，无新增超时、重试、慢阈值或中止检查。
 
 03:44 现场的 stdio 首因仍属强推断，主机当时原码没有落盘；离线回放不能补造现场证据。aw.4 由编排审后交 S 安装，客户端固定包不由 X 发布；真实 leo Sol/Luna“你好”及写文件验收单独记录，不能用离线或包门代替。
+
+## 0.8.20 员工正文与剩余产品门
+
+本机扩展处理信息只进入既有技术详情，成功建会与失败关闭均不向员工正文注入stdio/MCP或扩展名；模型回复和固定失败原因保持原语义，不另加说明气泡。此项是界面呈现不变量，不新增设置、阈值、超时、重试或中止条件；主机aw.4字节不变。
+
+实际L0.7.22组合负例另确认：目录替换时L先发布具体Need，X原有取消等待会盖成ABORTED。现只保留同一主机观察器已记录的具体Need及员工下一步动作；用户主动取消和非公开错误保持原分支，不新增目录核验、撤销条件、请求或等待。
+
+编排10-24 06:16已确认L0.7.22/X0.8.19/N0.4.5/aw.4在leo本机目录Sol你好35秒完成，同会话自验-codex-1024h.md约30秒写入本机且内容正确。这是编排产品回证；本版仍须另验Luna本机你好及写文件、Sol默认工作区主机目录写文件。仅在N回执明确交还GUI后走SSH脚本，首红即停，系统弹窗不点。工程/包证据与各项实机结果见源码docs/evidence/2026-10-24-X-0820/RESULT.md。
+
+## 0.8.21 Claude执行核验的位置（不可关闭）
+
+主机目录在每轮接纳时由L核验登录、可信主机与物理目录；之后Claude/Codex每条消息、审批回复、检查点只核对内存中的连接、登录与工作区状态，沿原L连接/位置事件撤销。Claude本机每轮真实输入仍先由L接纳；租约打开时核验物理目录、L上下文、N prepare与S同代target，之后只核对内存里的连接、位置、网络和租约信号。旧租约被事件撤销后不能复活，不迁移跨代在途操作，不回退主机；实际本机工具入口保留原物理目录核验与永久撤销，命令执行前原dev/ino/UID核对不变。没有关闭开关、超时、重试或新增中止条件。管理页固定约束及每轮HOST_EXECUTION_VALIDATION_POLICY/CLAUDE_EMPLOYEE_VALIDATION_POLICY列明核验点与撤销来源。
+
+Claude文本分片扩展按官方messageId汇总一条ACP_MODEL_METADATA，逐片脱敏快照及顺序保留；官方无messageId时按连续正文/思考段汇总，不捏造官方消息身份。响应、正常收尾及失败收尾都会提交未写扩展，正文/工具/审批转换原样。主机SSH偶发10–15秒受理卡顿、L单条写入耗时的底层根因仍未查明；去掉重复核验不代表这些问题已修复。leo两条路径的真实耗时与包交付证据另记，不以源码门冒充产品通过。
+
+## 0.8.21 / aw.5 owner HTTP 扩展策略
+
+owner 10-24决定：employeeHttpMcpPolicy 默认由 reject 改为 ignore，管理界面仍保留 reject。客户端schema、缺省请求与aw.5主机缺省统一；管理员已显式保存的 reject 不被覆盖。新连接冻结策略，修改设置不新增中止当前轮或旧会话的条件。ignore仅清空本次环境配置投影，不改员工文件、不启动扩展、不新增网络路径；显式reject保留AW_EMPLOYEE_EXECUTOR_MCP_UNSUPPORTED。原aw.4固定字节不变，aw.5四输入经编排审后交S受保护安装。
+
+被忽略的HTTP扩展仅把安全名称转成员工提示，例如“你电脑上的『Jira』扩展本次不可用。”，不加入MCP/HTTP等协议词；原生能力过滤掉的HTTP扩展同样提示。同轮相同提示只出一次，名称用安全文本引用，控制字符名称不打印，使用员工通用说明。stdio始终只进技术详情；模型自身文本不滤词。完整协议原因和计数仍在技术详情，失败首因保持。此提示是执行事实不变量，没有另设开关、条数/长度阈值、超时、重试或新的中止检查。
+
+客户端统一由X2在D22与本增量合并main后出唯一0.8.21；本分支不产另一份同版包。0.8.20固定包及其真机记录不因本次默认值变化而重写。aw.5安装与0.8.21真实HTTP提示验收另记，源码/离线测试不冒产品通过。

package/dist/acp.d.ts

@@ -16,9 +16,9 @@ export interface AcpHooks {
     onResponse?: (response: acp.PromptResponse) => void;
     approve?: (request: acp.RequestPermissionRequest, signal?: AbortSignal) => Promise<ApprovalOutcome>;
     onNeed?: (need: Need) => void;
+    onEmployeeNotice?: (notice: string) => void;
     onDetail?: (detail: Readonly<SanitizedObservation>) => void;
     broker?: BrokerTransport;
-    onEmployeeInfo?: (summary: string) => void;
     employeeExecution?: (params: unknown, signal?: AbortSignal) => Promise<Record<string, unknown>>;
 }
 export interface EmployeeExecutionMeta {
@@ -78,6 +78,8 @@ export declare class AcpSession {
     private stage;
     get diagnostics(): readonly Readonly<SanitizedObservation>[];
     private detail;
+    private employeeNoticeNames;
+    private employeeNoticeUnshown;
     private employeeInfo;
     private need;
     private checkReporting;

package/dist/acp.js

@@ -1,4 +1,4 @@
-import { employeeExecutionInfo, employeeMcpSummary } from "./employee-info.js";
+import { employeeExecutionInfo, employeeMcpSummary, employeeHttpNotice } from "./employee-info.js";
 import { employeeAdapterCodes, employeeOpenCauseCodes } from "./employee-reasons.js";
 import { CloseDiagnostics, withFailureEvidence } from "./close-diagnostics.js";
 import * as acp from '@agentclientprotocol/sdk/unstable';
@@ -7,7 +7,7 @@ import { employeeFailure } from "./presentation.js";
 import { StageTiming } from "./stage-timing.js";
 import { isolateRpcIds } from "./rpc-namespace.js";
 import { recoveryCapabilities, supportsCodexContextPolicy } from "./recovery.js";
-import { sanitizeObservation } from "./conversation-details.js";
+import { sanitizeObservation, sanitizeDisplayLabel } from "./conversation-details.js";
 import { ModelConfiguration, ModelConfigurationError } from "./model-configuration.js";
 /** ACP v1 with explicitly negotiated SDK 2.0 lifecycle/context extensions. */
 export class AcpSession {
@@ -135,14 +135,22 @@ export class AcpSession {
                 this.close({ layer: 'acp', initiator: 'acp.reporting-failure', reason: 'CONVERSATION_DETAILS_FAILED', action: 'close' });
         }
     }
+    employeeNoticeNames = new Set();
+    employeeNoticeUnshown = false;
     employeeInfo(value) {
         const info = employeeExecutionInfo(value);
         if (!info)
             return;
         const summary = employeeMcpSummary(info);
         this.detail({ kind: 'session', severity: 'info', code: 'EMPLOYEE_MCP_INFORMATION', summary: summary || '本机MCP策略已应用：' + info.httpMcpPolicy, payload: info });
-        if (summary)
-            this.hooks.onEmployeeInfo?.(summary);
+        const notice = employeeHttpNotice({ ...info, ignoredHttp: info.ignoredHttp.filter(name => !this.employeeNoticeNames.has(name)), ignoredNativeHttp: info.ignoredNativeHttp.filter(name => !this.employeeNoticeNames.has(name)), ignoredHttpUnshown: this.employeeNoticeUnshown ? 0 : info.ignoredHttpUnshown, ignoredNativeHttpUnshown: this.employeeNoticeUnshown ? 0 : info.ignoredNativeHttpUnshown }, sanitizeDisplayLabel, !this.employeeNoticeUnshown);
+        if (notice) {
+            for (const name of [...(info.httpMcpPolicy === 'ignore' ? info.ignoredHttp : []), ...info.ignoredNativeHttp])
+                this.employeeNoticeNames.add(name);
+            if ((info.httpMcpPolicy === 'ignore' && info.ignoredHttpUnshown) || info.ignoredNativeHttpUnshown || [...(info.httpMcpPolicy === 'ignore' ? info.ignoredHttp : []), ...info.ignoredNativeHttp].some(name => sanitizeDisplayLabel(name) !== name || name.includes('[已脱敏：')))
+                this.employeeNoticeUnshown = true;
+            this.hooks.onEmployeeNotice?.(notice);
+        }
     }
     need(need, hooks = this.hooks) {
         this.detail({ kind: 'need', severity: 'action-required', code: need.code, summary: need.message, payload: { requires: need.requires } }, hooks);
@@ -385,6 +393,8 @@ export class AcpSession {
         if (this.busy || this.updating || this.selecting)
             throw new NeedError('TURN_BUSY', '上一轮或配置更新结束前不能更换会话钩子', '上一轮结束');
         this.hooks = hooks;
+        this.employeeNoticeNames.clear();
+        this.employeeNoticeUnshown = false;
     }
     get closed() { return this.connection.closed; }
     validateNewContext(text, requirePolicy = false) {
@@ -405,7 +415,7 @@ export class AcpSession {
         signal?.addEventListener('abort', abort, { once: true });
         try {
             const hello = await this.stage('acp-initialize', () => this.connection.agent.request(acp.methods.agent.initialize, {
-                protocolVersion: acp.PROTOCOL_VERSION, clientInfo: { name: '@ai-workbench/remote-agent', version: '0.8.19' },
+                protocolVersion: acp.PROTOCOL_VERSION, clientInfo: { name: '@ai-workbench/remote-agent', version: '0.8.21' },
                 clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, terminal: false, session: { notices: {} }, ...(this.employeeMeta ? { _meta: { awEmployeeExecution: { version: 1, closeReason: 1 } } } : {}) },
             }, { cancellationSignal: signal }));
             this.hooks.broker?.acknowledge(acp.methods.agent.initialize);

package/dist/claude-local.js

@@ -12,7 +12,7 @@ import { isDeepStrictEqual } from 'node:util';
 import { openEmployeeLease } from "./employee-endpoint.js";
 import { openEmployeeMcp } from "./employee-mcp.js";
 import { createEmployeeShell } from "./employee-shell.js";
-import { sameTarget, unwrap } from "./provider.js";
+import { unwrap } from "./provider.js";
 import { sshIo } from "./broker.js";
 import { NeedError, shellQuote } from "./remote.js";
 import { awaitL } from "./provider.js";
@@ -101,13 +101,14 @@ export function createClaudeLocalProvider(options) {
         closeDiagnostics.bind(event => details.record(event));
         request.closeDiagnostics = closeDiagnostics;
         request.timing?.bind(observation => details.record(observation));
+        details.record({ kind: 'session', severity: 'info', code: 'CLAUDE_EMPLOYEE_VALIDATION_POLICY', summary: '本机执行核验不可关闭：每轮真实输入仍由L接纳核验；本机租约打开时核验物理目录、L上下文、N端点与S同代target。之后消息、审批与检查点只核对内存中的连接、位置、网络及租约信号，靠既有L连接/位置、N网络事件与执行通道关闭撤销；实际本机工具入口保留物理目录核验，命令执行前仍核对dev/ino，不回退主机。' });
         const trusted = async (ignoreCancellation = false) => {
             if (!ignoreCancellation)
                 request.signal?.throwIfAborted();
             if (options.getConnect() !== api)
                 throw failure('CONNECTION_LOST');
             const now = api.getConnectionState();
-            if (now.phase !== 'connected' || now.instanceId !== connection.instanceId || now.epoch !== connection.epoch || !sameTarget(unwrap(await api.getSshTarget()), target))
+            if (now.phase !== 'connected' || now.instanceId !== connection.instanceId || now.epoch !== connection.epoch)
                 throw failure('CONNECTION_LOST');
         };
         const openRequest = (row, cold = false) => ({ ...request, detailChannel: details, bindingId: item.bindingId, workspaceId: workspace.workspaceId, bindingRevision: state.revision, ...cold ? { recoveryCheckpointId: undefined } : {}, validateContext: async (cleanup = false) => { await trusted(cleanup); if (!cleanup)

package/dist/client.js

@@ -1,12 +1,13 @@
 /* Official locale and provider-registration updates only; no custom UI or refresh. */
 window.__ModuleLoader__.load({id:'@ai-workbench/remote-agent',factory(require){
   const messages={"en":{"administratorNote":"Settings → Built-in plugins → 远程助手参数. Eight named settings with defaults, scope and effects.","providerName":"Codex (Remote Host)"},"zh":{"administratorNote":"管理员：设置 → 内置插件 → 远程助手参数。八项设置含默认值、范围、生效和后果说明。","providerName":"Codex（远程主机）"}};
-  const settingsFields=[{"key":"mode","name":"Codex 运行方式","kind":"select","options":[{"value":"session","name":"会话模式"},{"value":"one-shot","name":"单次模式（当前版本不可运行）"}],"range":"session / one-shot","scope":"仅 Codex；Claude 始终使用会话模式。","when":"当前轮不变；更改后原会话下一轮会拒绝继续，需新建会话。","consequence":"会话模式保留连续对话；当前单次模式会明确拒绝运行，不会发给模型。不提供关闭会话身份核对的选项。","defaultValue":"session"},{"key":"acpMaxMessageBytes","name":"完整消息与工具输出容量（字节）","kind":"number","min":1,"max":9007199254740991,"range":"1～9007199254740991 的整数；0不能关闭上限","scope":"两位远程助手的完整会话消息；也用于模型目录、本机 MCP、员工执行 RPC 和工具输出容量。","when":"当轮快照不变；下一次独立目录查询读取新值；已有会话需新建后使用。","consequence":"调大可接收更大消息、占用更多内存；调小更早拒绝超限。超限明确停止，不截断、不自动重试；不能用0取消完整消息保护。","defaultValue":4194304},{"key":"brokerMaxFrameBytes","name":"主机会话回传单段容量（字节）","kind":"number","min":1,"max":9007199254740991,"range":"1～9007199254740991 的整数；0不能关闭上限","scope":"本插件接收主机会话单段输出的容量；不会替主机修改它自己的输出策略。","when":"当轮快照不变；更改后已有会话需新建。","consequence":"调大允许更大回传段、占用更多内存；调小可能拒绝主机合法输出。超限停止，不截断；不能关闭协议帧核验。","defaultValue":2097152},{"key":"brokerControlMaxBytes","name":"主机会话管理回复容量（字节）","kind":"number","min":1,"max":9007199254740991,"range":"1～9007199254740991 的整数；0不能关闭上限","scope":"主机会话管理命令的标准输出、标准错误各自容量；也用于本机执行桥的管理回复。","when":"当轮快照不变；更改后已有会话需新建。","consequence":"调大允许更长管理回复、占用更多内存；调小可能无法核实状态。超限明确停止，不能把不完整回复当成功；0不表示无限。","defaultValue":1048576},{"key":"oneShotSandbox","name":"Codex 单次任务权限模式","kind":"select","options":[{"value":"read-only","name":"只读"},{"value":"workspace-write","name":"工作区内可写"},{"value":"danger-full-access","name":"完全访问（高权限）"}],"range":"read-only / workspace-write / danger-full-access","scope":"仅 Codex 单次通道；不改变会话模式、本机工具或员工账号的系统权限。","when":"仅单次任务启动时适用；当前版本单次任务被拒绝，因此目前不生效。","consequence":"只读不允许单次任务写入；工作区内可写允许该目录写入；完全访问放宽单次沙箱。此项不是员工目录的权限开关，也不会解锁当前不可用的单次模式。","defaultValue":"workspace-write"},{"key":"oneShotApproval","name":"Codex 单次任务审批方式","kind":"fixed","readOnly":true,"range":"固定 never；不能切换","scope":"仅 Codex 单次通道；不改变会话模式的员工审批。","when":"仅单次启动参数；当前单次模式不可运行。","consequence":"单次通道没有中途交互审批能力，所以必须固定为无中途交互；不表示自动批准或允许所有操作。不能切换为自动回答旧审批。","defaultValue":"never"},{"key":"employeeShellKillGraceMs","name":"本机命令外层连接清理宽限（毫秒）","kind":"number","min":0,"max":2147483647,"range":"0～2147483647 的整数","scope":"仅 Claude 本机 Bash 取消后，本插件自己的外层 SSH 进程清理；不控制员工命令或 Codex 执行器。","when":"当轮快照不变；更改后已有会话需新建。","consequence":"大于0时先请求外层连接退出，再等待所设毫秒后强制清理；0表示不留宽限、立即强制清理外层连接，不是关闭取消。没有员工端退出确认时结果仍未知，不能据此自动重放或声称命令已停止。","defaultValue":1000},{"key":"employeeHttpMcpPolicy","name":"本机 HTTP MCP 策略","kind":"select","options":[{"value":"reject","name":"拒绝（默认）"},{"value":"ignore","name":"忽略后继续"}],"range":"reject / ignore","scope":"仅 Codex 员工本机执行器实际会采用的 HTTP MCP；stdio 始终依原生过滤忽略并说明名称。","when":"新连接建立时读取并冻结；修改不停止当轮或已有会话，需新建会话使用新值。","consequence":"默认 reject 会以明确代码拒绝这些 HTTP 条目；ignore 仅剔除会话投影后继续，不改员工配置、不启动 MCP、不新增网络路径。两种模式都显示实际忽略的安全名称。","defaultValue":"reject"}];
+  const settingsFields=[{"key":"mode","name":"Codex 运行方式","kind":"select","options":[{"value":"session","name":"会话模式"},{"value":"one-shot","name":"单次模式（当前版本不可运行）"}],"range":"session / one-shot","scope":"仅 Codex；Claude 始终使用会话模式。","when":"当前轮不变；更改后原会话下一轮会拒绝继续，需新建会话。","consequence":"会话模式保留连续对话；当前单次模式会明确拒绝运行，不会发给模型。不提供关闭会话身份核对的选项。","defaultValue":"session"},{"key":"acpMaxMessageBytes","name":"完整消息与工具输出容量（字节）","kind":"number","min":1,"max":9007199254740991,"range":"1～9007199254740991 的整数；0不能关闭上限","scope":"两位远程助手的完整会话消息；也用于模型目录、本机 MCP、员工执行 RPC 和工具输出容量。","when":"当轮快照不变；下一次独立目录查询读取新值；已有会话需新建后使用。","consequence":"调大可接收更大消息、占用更多内存；调小更早拒绝超限。超限明确停止，不截断、不自动重试；不能用0取消完整消息保护。","defaultValue":4194304},{"key":"brokerMaxFrameBytes","name":"主机会话回传单段容量（字节）","kind":"number","min":1,"max":9007199254740991,"range":"1～9007199254740991 的整数；0不能关闭上限","scope":"本插件接收主机会话单段输出的容量；不会替主机修改它自己的输出策略。","when":"当轮快照不变；更改后已有会话需新建。","consequence":"调大允许更大回传段、占用更多内存；调小可能拒绝主机合法输出。超限停止，不截断；不能关闭协议帧核验。","defaultValue":2097152},{"key":"brokerControlMaxBytes","name":"主机会话管理回复容量（字节）","kind":"number","min":1,"max":9007199254740991,"range":"1～9007199254740991 的整数；0不能关闭上限","scope":"主机会话管理命令的标准输出、标准错误各自容量；也用于本机执行桥的管理回复。","when":"当轮快照不变；更改后已有会话需新建。","consequence":"调大允许更长管理回复、占用更多内存；调小可能无法核实状态。超限明确停止，不能把不完整回复当成功；0不表示无限。","defaultValue":1048576},{"key":"oneShotSandbox","name":"Codex 单次任务权限模式","kind":"select","options":[{"value":"read-only","name":"只读"},{"value":"workspace-write","name":"工作区内可写"},{"value":"danger-full-access","name":"完全访问（高权限）"}],"range":"read-only / workspace-write / danger-full-access","scope":"仅 Codex 单次通道；不改变会话模式、本机工具或员工账号的系统权限。","when":"仅单次任务启动时适用；当前版本单次任务被拒绝，因此目前不生效。","consequence":"只读不允许单次任务写入；工作区内可写允许该目录写入；完全访问放宽单次沙箱。此项不是员工目录的权限开关，也不会解锁当前不可用的单次模式。","defaultValue":"workspace-write"},{"key":"oneShotApproval","name":"Codex 单次任务审批方式","kind":"fixed","readOnly":true,"range":"固定 never；不能切换","scope":"仅 Codex 单次通道；不改变会话模式的员工审批。","when":"仅单次启动参数；当前单次模式不可运行。","consequence":"单次通道没有中途交互审批能力，所以必须固定为无中途交互；不表示自动批准或允许所有操作。不能切换为自动回答旧审批。","defaultValue":"never"},{"key":"employeeShellKillGraceMs","name":"本机命令外层连接清理宽限（毫秒）","kind":"number","min":0,"max":2147483647,"range":"0～2147483647 的整数","scope":"仅 Claude 本机 Bash 取消后，本插件自己的外层 SSH 进程清理；不控制员工命令或 Codex 执行器。","when":"当轮快照不变；更改后已有会话需新建。","consequence":"大于0时先请求外层连接退出，再等待所设毫秒后强制清理；0表示不留宽限、立即强制清理外层连接，不是关闭取消。没有员工端退出确认时结果仍未知，不能据此自动重放或声称命令已停止。","defaultValue":1000},{"key":"employeeHttpMcpPolicy","name":"本机 HTTP MCP 策略","kind":"select","options":[{"value":"reject","name":"拒绝"},{"value":"ignore","name":"忽略后继续（默认）"}],"range":"reject / ignore","scope":"仅 Codex 员工本机执行器实际会采用的 HTTP MCP；stdio 始终依原生过滤忽略，名称仅在技术详情说明。","when":"新连接建立时读取并冻结；修改不停止当轮或已有会话，需新建会话使用新值。","consequence":"默认 ignore 仅剔除会话投影后继续；可选 reject 会以明确代码拒绝这些 HTTP 条目。ignore 不改员工配置、不启动 MCP、不新增网络路径。被忽略的 HTTP 扩展在正文按名称提示，技术细节仅在技术详情。","defaultValue":"ignore"}];
   /* Public settings.plugins.tab + shared ConfigForms. No private client services. */
 function mountRuntimeSettings(ctx,React,fields){
  const h=React.createElement;
  const invariants=[
   ['员工、主机和文件夹核对','始终开启，不可关闭','每次派发前核对当前连接、员工与工作区，避免操作到别人的文件或旧位置；核对失败即停止。'],
+  ['执行核验的位置与撤销','始终开启，不可关闭','主机目录在每轮接纳时核验身份、登录与物理目录；Claude本机租约在打开时核验物理目录、L上下文、N端点和S同代target；Codex本机同代通道也在打开时核验。后续消息、审批回复与检查点只核对内存状态，靠既有连接、位置、网络事件与执行通道关闭撤销，不重复SSH。每轮真实输入接纳和实际本机工具入口的物理目录核验仍保持。'],
   ['本轮输入与技术详情归属','始终开启，不可关闭','真实输入须先接纳，技术详情须确认保存；迟到结果仍属于原轮次，不能借下一轮的记录继续执行。'],
   ['模型选择确认','始终开启，不可关闭','主机须完整确认所选模型和推理等级，不能静默换模型继续。'],
   ['完整消息与精确整数','始终开启，不可关闭','容量不能用0关闭，超限明确停止、不截断；整数必须能精确表示，防止消息缺失或容量计算失真。'],

package/dist/employee-endpoint.d.ts

@@ -89,5 +89,7 @@ export interface EmployeeLease {
     signal: AbortSignal;
     validate(callerSignal?: AbortSignal): Promise<EmployeeEndpointTarget>;
     close(cause?: CloseCause): Promise<void>;
+    /** Existing physical fence, relocated to actual local tools rather than broker messages. */
+    validateDirectory(callerSignal?: AbortSignal): Promise<EmployeeEndpointTarget>;
 }
 export declare function openEmployeeLease(options: EmployeeLeaseOptions, initialSignal?: AbortSignal): Promise<EmployeeLease>;

package/dist/employee-endpoint.js

@@ -68,19 +68,23 @@ export async function openEmployeeLease(options, initialSignal) {
     } };
     offs.push(api.onConnectionState(() => changed('lease.connection-change')), api.onWorkspaceLocationState(() => changed('lease.workspace-change')), network.onState(event => { if (event?.kind === 'lost' || network.getState().phase !== 'online')
         invalidate('EMPLOYEE_ENDPOINT_UNAVAILABLE', 'lease.network-loss'); }));
-    async function validate(callerSignal) {
+    async function physicalDirectory(signal) {
+        current();
+        const now = await options.readWorkspace();
+        signal.throwIfAborted();
+        current();
+        const stat = await lstat(workspace.directory.path), canonical = await realpath(workspace.directory.path);
+        if (!isDeepStrictEqual(now, workspace) || !stat.isDirectory() || stat.isSymbolicLink() || canonical !== workspace.directory.path || stat.dev !== workspace.directory.device || stat.ino !== workspace.directory.inode)
+            throw fail();
+    }
+    // Remote endpoint discovery belongs to lease opening only.
+    async function openTarget(callerSignal) {
         if (diagnosticFailure)
             throw diagnosticFailure;
         callerSignal?.throwIfAborted();
         const signal = AbortSignal.any([lifetime.signal, ...callerSignal ? [callerSignal] : []]);
         try {
-            current();
-            const now = await options.readWorkspace();
-            signal.throwIfAborted();
-            current();
-            const stat = await lstat(workspace.directory.path), canonical = await realpath(workspace.directory.path);
-            if (!isDeepStrictEqual(now, workspace) || !stat.isDirectory() || stat.isSymbolicLink() || canonical !== workspace.directory.path || stat.dev !== workspace.directory.device || stat.ino !== workspace.directory.inode)
-                throw fail();
+            await physicalDirectory(signal);
             const context = unwrap(await api.getLocalWorkspaceContext(request));
             signal.throwIfAborted();
             current();
@@ -123,9 +127,38 @@ export async function openEmployeeLease(options, initialSignal) {
             throw error instanceof NeedError || callerSignal?.aborted ? error : fail();
         }
     }
+    async function validate(callerSignal) {
+        if (diagnosticFailure)
+            throw diagnosticFailure;
+        callerSignal?.throwIfAborted();
+        try {
+            current();
+            return structuredClone(target);
+        }
+        catch (error) {
+            if (!callerSignal?.aborted)
+                invalidate(error instanceof NeedError ? error.code : 'EMPLOYEE_CONTEXT_CHANGED');
+            throw error instanceof NeedError || callerSignal?.aborted ? error : fail();
+        }
+    }
+    async function validateDirectory(callerSignal) {
+        if (diagnosticFailure)
+            throw diagnosticFailure;
+        callerSignal?.throwIfAborted();
+        const signal = AbortSignal.any([lifetime.signal, ...callerSignal ? [callerSignal] : []]);
+        try {
+            await physicalDirectory(signal);
+            return await validate(callerSignal);
+        }
+        catch (error) {
+            if (!callerSignal?.aborted)
+                invalidate(error instanceof NeedError ? error.code : 'EMPLOYEE_CONTEXT_CHANGED');
+            throw error instanceof NeedError || callerSignal?.aborted ? error : fail();
+        }
+    }
     try {
-        await validate(initialSignal);
-        return { target: structuredClone(target), request: Object.freeze({ ...request }), signal: lifetime.signal, validate, close: async (cause = { layer: 'endpoint', initiator: 'lease.close', reason: 'EMPLOYEE_EXECUTOR_CLOSED', action: 'close' }) => { options.closeDiagnostics?.record({ ...cause, changes: cause.changes ?? [{ field: 'lease.closed', before: closed, after: true }] }); if (!closed) {
+        await openTarget(initialSignal);
+        return { target: structuredClone(target), request: Object.freeze({ ...request }), signal: lifetime.signal, validate, validateDirectory, close: async (cause = { layer: 'endpoint', initiator: 'lease.close', reason: 'EMPLOYEE_EXECUTOR_CLOSED', action: 'close' }) => { options.closeDiagnostics?.record({ ...cause, changes: cause.changes ?? [{ field: 'lease.closed', before: closed, after: true }] }); if (!closed) {
                 closed = true;
                 lifetime.abort(fail('EMPLOYEE_EXECUTOR_CLOSED'));
                 for (const off of offs)

package/dist/employee-info.d.ts

@@ -11,3 +11,5 @@ export interface EmployeeExecutionInfo {
 }
 export declare function employeeExecutionInfo(value: unknown): EmployeeExecutionInfo | undefined;
 export declare function employeeMcpSummary(info: EmployeeExecutionInfo): string;
+/** Employee-facing execution fact; protocol terms and stdio names remain in details. */
+export declare function employeeHttpNotice(info: EmployeeExecutionInfo, sanitizeLabel: (name: string) => string, showUnshown: boolean): string;

package/dist/employee-info.js

@@ -26,3 +26,13 @@ export function employeeMcpSummary(info) {
     }
     return parts.join('。');
 }
+/** Employee-facing execution fact; protocol terms and stdio names remain in details. */
+export function employeeHttpNotice(info, sanitizeLabel, showUnshown) {
+    const rawNames = [...new Set([...(info.httpMcpPolicy === 'ignore' ? info.ignoredHttp : []), ...info.ignoredNativeHttp])];
+    const names = rawNames.filter(name => sanitizeLabel(name) === name && !name.includes('[已脱敏：'));
+    const unshown = showUnshown && (rawNames.length - names.length + (info.httpMcpPolicy === 'ignore' ? info.ignoredHttpUnshown : 0) + info.ignoredNativeHttpUnshown) > 0;
+    if (!names.length)
+        return unshown ? '你电脑上的一项本地扩展本次不可用，详情见技术详情。' : '';
+    const named = names.map(name => '『' + quoted([name]) + '』').join('、');
+    return '你电脑上的' + named + '扩展本次不可用。' + (unshown ? '另有本地扩展本次不可用，详情见技术详情。' : '');
+}

package/dist/employee-mcp.js

@@ -88,7 +88,7 @@ export async function openEmployeeMcp(options) {
     if (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 1)
         throw new NeedError('SETTINGS_REQUIRED', '本机工具消息容量无效。', 'acpMaxMessageBytes');
     await access('/usr/bin/nc', constants.X_OK);
-    const tools = createEmployeeTools({ closeDiagnostics: options.closeDiagnostics, cwd: options.lease.target.local.directory.path, shell: options.lease.target.endpoint.endpointShell, uid: options.lease.target.endpoint.remoteUid, maxBytes: options.maxBytes, killGraceMs: options.killGraceMs, detail: observe, runShell: options.runShell, validate: signal => options.lease.validate(signal).then(() => { }) });
+    const tools = createEmployeeTools({ closeDiagnostics: options.closeDiagnostics, cwd: options.lease.target.local.directory.path, shell: options.lease.target.endpoint.endpointShell, uid: options.lease.target.endpoint.remoteUid, maxBytes: options.maxBytes, killGraceMs: options.killGraceMs, detail: observe, runShell: options.runShell, validate: signal => options.lease.validateDirectory(signal).then(() => { }) });
     const root = await mkdtemp('/private/tmp/aw-x87-'), socketPath = root + '/mcp';
     try {
         const info = await lstat(root);

package/dist/employee-provider.js

@@ -255,7 +255,7 @@ export function createEmployeeProvider(get, options, agent) {
             }
             const disposers = [];
             const execution = new EmployeeExecution({ closeDiagnostics, bindingId: admitted.bindingId, acpMaxMessageBytes: request.acpMaxMessageBytes, validate, transport: signal => createEmployeeSshTransport(ssh, signal) });
-            const runtime = { ...host, closeDiagnostics, cwd: admitted.cwd, details, connection: { ...connection }, binding: { bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, revision: state.revision }, saveCheckpoint: undefined, recoveredSession: undefined, employeeExecutionMeta: { version: 1, bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, cwd: admitted.cwd, acpMaxMessageBytes: request.acpMaxMessageBytes, httpMcpPolicy: request.employeeHttpMcpPolicy ?? 'reject' }, employeePresentation: CODEX_EMPLOYEE_SCOPE_NOTICE };
+            const runtime = { ...host, closeDiagnostics, cwd: admitted.cwd, details, connection: { ...connection }, binding: { bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, revision: state.revision }, saveCheckpoint: undefined, recoveredSession: undefined, employeeExecutionMeta: { version: 1, bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, cwd: admitted.cwd, acpMaxMessageBytes: request.acpMaxMessageBytes, httpMcpPolicy: request.employeeHttpMcpPolicy ?? 'ignore' }, employeePresentation: CODEX_EMPLOYEE_SCOPE_NOTICE };
             runtime.employeeRemoteCloseReason = () => execution.remoteClose?.reason;
             entry = { scope, runtime, current: input, details, execution, network, ended: false, dispose: (reason, cause = { layer: 'runtime', initiator: 'provider.dispose', reason: reason?.code ?? 'EMPLOYEE_EXEC_CLOSED', action: 'dispose' }) => {
                     closeDiagnostics.record({ ...cause, changes: cause.changes ?? [{ field: 'provider.ended', before: entry.ended, after: true }] });

package/dist/host-workspace.js

@@ -96,8 +96,12 @@ export async function hostWorkspaceGuard(get, api, connection, target, request,
                     return value;
                 }
                 catch (error) {
-                    if (!request.signal?.aborted)
+                    if (!request.signal?.aborted) {
+                        const cause = revoked.signal.reason;
                         revoke(error);
+                        if (cause instanceof NeedError)
+                            throw cause;
+                    }
                     throw error;
                 }
             }

package/dist/index.d.ts

@@ -21,7 +21,7 @@ export declare const DEFAULT_CONFIG: Readonly<{
     readonly oneShotSandbox: "workspace-write";
     readonly oneShotApproval: "never";
     readonly employeeShellKillGraceMs: 1000;
-    readonly employeeHttpMcpPolicy: "reject";
+    readonly employeeHttpMcpPolicy: "ignore";
 }>;
 export declare const Config: Schema<Schemastery.ObjectS<NoInfer<{
     employeeHttpMcpPolicy: Schema<"reject" | "ignore", "reject" | "ignore", "volatile-defined">;

package/dist/index.js

@@ -45,9 +45,9 @@ export const settingsNamespace = 'ai-workbench-codex';
 // L can be installed/enabled after X; keeping X mounted lets it explain the prerequisite.
 export const inject = ['llm'];
 /** Owner-approved defaults; administrators may override through the existing settings. */
-export const DEFAULT_CONFIG = Object.freeze({ mode: 'session', acpMaxMessageBytes: 4194304, brokerMaxFrameBytes: 2097152, brokerControlMaxBytes: 1048576, oneShotSandbox: 'workspace-write', oneShotApproval: 'never', employeeShellKillGraceMs: 1000, employeeHttpMcpPolicy: 'reject' });
+export const DEFAULT_CONFIG = Object.freeze({ mode: 'session', acpMaxMessageBytes: 4194304, brokerMaxFrameBytes: 2097152, brokerControlMaxBytes: 1048576, oneShotSandbox: 'workspace-write', oneShotApproval: 'never', employeeShellKillGraceMs: 1000, employeeHttpMcpPolicy: 'ignore' });
 export const Config = Schema.object({
-    employeeHttpMcpPolicy: Schema.union([Schema.const('reject').i18n({ zh: '拒绝本机 HTTP MCP（默认）', en: '拒绝本机 HTTP MCP（默认）' }), Schema.const('ignore').i18n({ zh: '忽略本机 HTTP MCP 后继续', en: '忽略本机 HTTP MCP 后继续' })]).i18n({ zh: '本机 HTTP MCP 策略；默认拒绝；忽略仅剔除会话投影，不改员工配置。新连接生效，stdio 始终按原生规则忽略并说明名称', en: '本机 HTTP MCP 策略；默认拒绝；忽略仅剔除会话投影，不改员工配置。新连接生效，stdio 始终按原生规则忽略并说明名称' }).default(DEFAULT_CONFIG.employeeHttpMcpPolicy).volatile(),
+    employeeHttpMcpPolicy: Schema.union([Schema.const('reject').i18n({ zh: '拒绝本机 HTTP MCP', en: '拒绝本机 HTTP MCP' }), Schema.const('ignore').i18n({ zh: '忽略本机 HTTP MCP 后继续（默认）', en: '忽略本机 HTTP MCP 后继续（默认）' })]).i18n({ zh: '本机 HTTP MCP 策略；默认忽略；忽略仅剔除会话投影，不改员工配置。新连接生效，stdio 始终按原生规则忽略，名称仅在技术详情说明；HTTP 忽略在正文按扩展名称提示', en: '本机 HTTP MCP 策略；默认忽略；忽略仅剔除会话投影，不改员工配置。新连接生效，stdio 始终按原生规则忽略，名称仅在技术详情说明；HTTP 忽略在正文按扩展名称提示' }).default(DEFAULT_CONFIG.employeeHttpMcpPolicy).volatile(),
     mode: Schema.union([Schema.const('session').i18n({ en: 'Session', zh: '会话模式' }), Schema.const('one-shot').i18n({ en: 'One-shot', zh: '单次模式' })]).i18n({ en: 'Run mode; start a new session after switching modes', zh: 'Codex运行模式；Claude固定会话模式；切换后请新建会话' }).default(DEFAULT_CONFIG.mode).volatile(),
     acpMaxMessageBytes: Schema.number().min(1).step(1).i18n({ en: 'Session message limit; default 4 MiB, adjustable by administrators', zh: '会话消息容量；默认4 MiB，管理员可调整' }).default(DEFAULT_CONFIG.acpMaxMessageBytes).volatile(),
     brokerMaxFrameBytes: Schema.number().min(1).step(1).i18n({ en: 'Host output chunk limit; default 2 MiB, adjustable by administrators', zh: '主机回传单段容量；默认2 MiB，管理员可调整' }).default(DEFAULT_CONFIG.brokerMaxFrameBytes).volatile(),
@@ -536,7 +536,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 let done = false;
                 let failure;
                 const push = (chunks) => { queue.push(...chunks); wake?.(); wake = undefined; };
-                const hooks = { onEmployeeInfo: summary => push(mapper.text(summary + '\n\n')), closeDiagnostics: runtime.closeDiagnostics, broker: runtime.broker, employeeExecution: runtime.employeeExecution, timing, approve: async (permission, approvalSignal) => {
+                const hooks = { closeDiagnostics: runtime.closeDiagnostics, broker: runtime.broker, employeeExecution: runtime.employeeExecution, timing, approve: async (permission, approvalSignal) => {
                         const execution = runtime.execution;
                         const toolName = permission.toolCall.name ?? permission.toolCall._meta?.claudeCode?.toolName;
                         if (execution) {
@@ -551,7 +551,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
                         if (execution && answer === 'allowed-once')
                             await execution.validate(approvalSignal);
                         return answer;
-                    }, onUpdate: notification => { try {
+                    }, onEmployeeNotice: notice => push(mapper.text(notice + '\n\n')), onUpdate: notification => { try {
                         push(mapper.acp(notification.update));
                     }
                     catch (error) {
@@ -669,6 +669,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
                         yield chunk;
                 }
             }
+            mapper.flushMetadata();
             recordInformation();
             details.endTurn();
             await timing.run('details-flush', () => details.flush());
@@ -714,6 +715,12 @@ export class CodexRemoteAdapter extends LlmAdapter {
             if (live && session && session.promptDispatchCount > promptBaseline)
                 live.failure = { cause: error };
             const reporting = [];
+            try {
+                activeMapper?.flushMetadata();
+            }
+            catch (failure) {
+                reporting.push(failure);
+            }
             const reportFailure = async () => {
                 if (request?.recordEarlyFailure) {
                     const record = request.recordEarlyFailure;

package/dist/mapping.d.ts

@@ -26,6 +26,9 @@ export declare class StreamMapper {
     private seen;
     private baseline;
     private readonly observations;
+    private readonly modelMetadata;
+    private anonymousMetadata;
+    private lastMetadataType;
     private readonly onDiagnostic;
     /** Omitted argument is exclusively for a known new session; pass null on unknown resume. */
     constructor(previousUsage?: UsageSnapshot | null, onDiagnostic?: (observation: Readonly<SanitizedObservation>) => void);
@@ -33,6 +36,8 @@ export declare class StreamMapper {
     get diagnostics(): readonly Readonly<SanitizedObservation>[];
     private diagnostic;
     private usageWarning;
+    /** One durable observation per official message; keep ordered, sanitized fragment snapshots. */
+    flushMetadata(): void;
     text(text: string, reasoning?: boolean): StreamChunk[];
     /** Close the current text or reasoning block once, before the stream settles. */
     flush(): StreamChunk[];

package/dist/mapping.js

@@ -9,6 +9,9 @@ export class StreamMapper {
     seen = new Map();
     baseline;
     observations = [];
+    modelMetadata = new Map();
+    anonymousMetadata = 0;
+    lastMetadataType;
     onDiagnostic;
     /** Omitted argument is exclusively for a known new session; pass null on unknown resume. */
     constructor(previousUsage = { version: 1, kind: 'zero' }, onDiagnostic) {
@@ -30,6 +33,15 @@ export class StreamMapper {
     usageWarning(summary) {
         return this.diagnostic({ kind: 'usage', severity: 'warning', code: 'USAGE_UNAVAILABLE', summary });
     }
+    /** One durable observation per official message; keep ordered, sanitized fragment snapshots. */
+    flushMetadata() {
+        for (const [key, payload] of this.modelMetadata) {
+            // A throwing sink may already have enqueued its write. Never replay that message.
+            this.modelMetadata.delete(key);
+            this.diagnostic({ kind: 'extension', severity: 'info', code: 'ACP_MODEL_METADATA', summary: '远端模型消息扩展（按消息汇总）', method: 'session/update', payload });
+        }
+        this.lastMetadataType = undefined;
+    }
     text(text, reasoning = false) {
         if (!text)
             return [];
@@ -55,15 +67,31 @@ export class StreamMapper {
     acp(update) {
         if (update.sessionUpdate === 'agent_message_chunk' || update.sessionUpdate === 'agent_thought_chunk') {
             if (update.content.type === 'text' && typeof update.content.text === 'string') {
-                // The whole update preserves every extension layer without inventing a display mapping.
+                const messageId = typeof update.messageId === 'string' ? update.messageId : undefined;
+                if (messageId !== undefined)
+                    this.lastMetadataType = undefined;
+                else {
+                    if (this.lastMetadataType !== update.sessionUpdate)
+                        this.anonymousMetadata++;
+                    this.lastMetadataType = update.sessionUpdate;
+                }
+                // Capture each extension layer now, before the caller can mutate it. Text mapping is unchanged.
                 if (Object.keys(update).some(key => key !== 'sessionUpdate' && key !== 'content')
                     || Object.keys(update.content).some(key => key !== 'type' && key !== 'text')) {
-                    this.diagnostic({ kind: 'extension', severity: 'info', code: 'ACP_MODEL_METADATA', summary: '远端模型消息扩展', method: 'session/update', payload: update });
+                    const key = JSON.stringify(messageId !== undefined ? ['message', messageId] : ['segment', this.anonymousMetadata]);
+                    let pending = this.modelMetadata.get(key);
+                    if (!pending) {
+                        pending = { sessionUpdate: update.sessionUpdate, ...(messageId !== undefined ? { messageId } : {}), fragments: [] };
+                        this.modelMetadata.set(key, pending);
+                    }
+                    pending.fragments.push(sanitizeObservation({ kind: 'extension', severity: 'info', code: 'ACP_MODEL_METADATA', summary: '远端模型消息扩展', payload: update }).payload);
                 }
                 return this.text(update.content.text, update.sessionUpdate === 'agent_thought_chunk');
             }
+            this.lastMetadataType = undefined;
             return this.diagnostic({ kind: 'extension', severity: 'warning', code: 'ACP_CONTENT_UNSUPPORTED', summary: '远端非文本内容，需要对应的公开显示映射', method: 'session/update', payload: update });
         }
+        this.lastMetadataType = undefined;
         let kind = 'session';
         let code = 'ACP_SESSION_UPDATE';
         let summary = '远端会话事件';
@@ -111,6 +139,7 @@ export class StreamMapper {
     }
     /** ACP usage and the fixed Claude quota both accumulate across the session, not per turn. */
     acpResponse(response) {
+        this.flushMetadata();
         this.diagnostic({ kind: 'usage', severity: 'info', code: 'ACP_PROMPT_RESPONSE', summary: '远端响应与真实用量', method: 'session/prompt', payload: response });
         const quota = record(response._meta?.quota);
         const tokens = record(quota?.token_count);

package/dist/provider.js

@@ -305,6 +305,8 @@ export function connectProvider(get, options = {}) {
                     request.timing.bind(detail => details.record(detail));
                 await stable();
                 host?.assertCurrent();
+                if (host)
+                    details?.record({ kind: 'session', severity: 'info', code: 'HOST_EXECUTION_VALIDATION_POLICY', summary: '主机目录核验不可关闭：每轮接纳时由L核验主机身份、登录与物理目录；之后消息、审批回复与检查点只核对内存中的连接、登录与位置，靠已订阅的L连接和位置事件撤销，不重复SSH。' });
                 let workspaceNotice = undefined;
                 const notice = !host && 'notice' in resolved ? resolved.notice : undefined;
                 if (notice) {
@@ -319,8 +321,6 @@ export function connectProvider(get, options = {}) {
                 const validateContext = async (ignoreCancellation = false) => {
                     const check = () => waitForLogin(api, agent.loginProvider, connection, get, ignoreCancellation ? undefined : request.signal);
                     await check();
-                    if (host && !ignoreCancellation)
-                        await host.resolve();
                     if (observedBinding) {
                         const current = api.getWorkspaceBindingState();
                         if (current.instanceId !== observedBinding.instanceId || !current.items.some(item => item.bindingId === resolved.bindingId && item.workspaceId === resolved.workspaceId && item.status === 'ready'))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-workbench/remote-agent",
-  "version": "0.8.19",
+  "version": "0.8.21",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",