@ai-workbench/remote-agent 0.8.2 → 0.8.10

package/dist/index.js

@@ -2,7 +2,8 @@ import { SessionId } from '@deepseek-ai/dsh-session';
 import Schema from '@deepseek-ai/schemastery';
 import { LlmAdapter, LlmError } from '@deepseek-ai/dsh-llm';
 import { fileURLToPath } from 'node:url';
-import { createHash } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
+import { recoveryJournal, runtimeRecoveryKey, supportsCodexContextPolicy } from "./recovery.js";
 import * as unstable from '@agentclientprotocol/sdk/unstable';
 import * as acp from '@agentclientprotocol/sdk';
 import { AcpSession } from "./acp.js";
@@ -11,18 +12,29 @@ import { StreamMapper } from "./mapping.js";
 import { connectProvider } from "./provider.js";
 import { brokerFactory } from "./broker.js";
 import { AGENTS, CODEX_AGENT } from "./agents.js";
-import { prepareInput } from "./input.js";
+import { prepareInput, prepareContinuation } from "./input.js";
 import { createWorkspaceNoticeConsumer, isWorkspaceNoticeMessage } from "./workspace-notice.js";
 import { NeedError } from "./remote.js";
 import { employeeFailure } from "./presentation.js";
 import { createRemoteDetails } from "./remote-details.js";
 import { PROVIDER_NAMES, ProviderLocaleRemote } from "./provider-locale.js";
+import { approvalLabel } from "./approval-label.js";
+import { StageTiming } from "./stage-timing.js";
+import { verifyRecoveryCheckpoint, currentInputIds } from "./recovery-checkpoint.js";
+import { ModelCatalog, modelInfo } from "./model-catalog.js";
+import { ModelConfigurationError } from "./model-configuration.js";
+import { officialEmployeeWorkspace } from "./employee-workspace.js";
+import { resolveEmployeeNative } from "./employee-native.js";
+import { createLocalUserTurnObserver } from "./local-user-turn.js";
+import { createClaudeLocalProvider } from "./claude-local.js";
+import { readLocalUserTurn } from "./local-user-turn.js";
+import { readEmployeeWorkspace } from "./employee-workspace.js";
 export const name = 'ai-workbench-remote-agent';
 export const settingsNamespace = 'ai-workbench-codex';
 // L can be installed/enabled after X; keeping X mounted lets it explain the prerequisite.
 export const inject = ['llm'];
 /** Owner-approved defaults; administrators may override through the existing settings. */
-export const DEFAULT_CONFIG = Object.freeze({ mode: 'session', acpMaxMessageBytes: 4194304, brokerMaxFrameBytes: 2097152, brokerControlMaxBytes: 1048576, oneShotSandbox: 'workspace-write', oneShotApproval: 'never' });
+export const DEFAULT_CONFIG = Object.freeze({ mode: 'session', acpMaxMessageBytes: 4194304, brokerMaxFrameBytes: 2097152, brokerControlMaxBytes: 1048576, oneShotSandbox: 'workspace-write', oneShotApproval: 'never', employeeShellKillGraceMs: 1000 });
 export const Config = Schema.object({
     mode: Schema.union([Schema.const('session').i18n({ en: 'Session', zh: '会话模式' }), Schema.const('one-shot').i18n({ en: 'One-shot', zh: '单次模式' })]).i18n({ en: 'Run mode; start a new session after switching modes', zh: 'Codex运行模式；Claude固定会话模式；切换后请新建会话' }).default(DEFAULT_CONFIG.mode).volatile(),
     acpMaxMessageBytes: Schema.number().min(1).step(1).i18n({ en: 'Session message limit; default 4 MiB, adjustable by administrators', zh: '会话消息容量；默认4 MiB，管理员可调整' }).default(DEFAULT_CONFIG.acpMaxMessageBytes).volatile(),
@@ -30,11 +42,13 @@ export const Config = Schema.object({
     brokerControlMaxBytes: Schema.number().min(1).step(1).i18n({ en: 'Host session control reply limit; default 1 MiB, adjustable by administrators', zh: '主机会话管理回复容量；默认1 MiB，管理员可调整' }).default(DEFAULT_CONFIG.brokerControlMaxBytes).volatile(),
     oneShotSandbox: Schema.union(['read-only', 'workspace-write', 'danger-full-access']).i18n({ en: 'One-shot sandbox; workspace changes are allowed by default', zh: '单次任务沙箱；默认允许工作区内修改' }).default(DEFAULT_CONFIG.oneShotSandbox).volatile(),
     oneShotApproval: Schema.const('never').i18n({ en: 'Non-interactive approval; permissions follow the launch policy, never automatic approval', zh: '单次模式无交互审批；权限由启动策略决定，不表示自动批准' }).default(DEFAULT_CONFIG.oneShotApproval).volatile(),
+    employeeShellKillGraceMs: Schema.number().min(0).max(2147483647).step(1).i18n({ en: 'Local command SSH cleanup grace in milliseconds; cancellation keeps the remote result unknown', zh: '本机命令SSH取消后的清理宽限毫秒；默认1000，取消仍保留员工端结果未知' }).default(DEFAULT_CONFIG.employeeShellKillGraceMs).volatile(),
 });
 /** DSH volatile settings are handles; adapters freeze their values once per invocation. */
 export function readConfig(config) {
     return Object.fromEntries(Object.entries(config).map(([key, value]) => [key, typeof value === 'object' && value !== null && 'get' in value ? value.get() : value]));
 }
+function validContextDigest(value) { return typeof value === 'string' && /^[a-fA-F0-9]{64}$/u.test(value); }
 function readPointer(options, agent) {
     const last = options.messages.findLast(message => message.role === 'assistant' && !isWorkspaceNoticeMessage(message));
     if (!last || last.role !== 'assistant')
@@ -47,6 +61,8 @@ function readPointer(options, agent) {
         throw new NeedError('SESSION_STATE_INVALID', '原对话缺少新版工作区/模型绑定，不能静默迁移，请新建会话', '有效的新一代远端会话恢复记录');
     if (options.sessionId && pointer.dshSessionId !== options.sessionId)
         throw new NeedError('SESSION_CONTEXT_MISMATCH', '此恢复记录属于另一会话，复制或分叉后不能沿用原远端进程，请新建会话', '当前DSH会话自己的远端恢复记录');
+    if (agent.loginProvider === 'codex' && (!validContextDigest(pointer.contextSha256) || (pointer.previousRemoteSessions !== undefined && (!Array.isArray(pointer.previousRemoteSessions) || !pointer.previousRemoteSessions.every(ref => ref && typeof ref.sessionId === 'string' && ref.sessionId.length > 0 && validContextDigest(ref.contextSha256))))))
+        throw new NeedError('SESSION_CONTEXT_DIGEST_INVALID', '原Codex会话的初建上下文摘要未知或无效，不能猜测是否相同，本轮未发送', '原会话合法的64位十六进制初建上下文摘要');
     return pointer;
 }
 export class CodexRemoteAdapter extends LlmAdapter {
@@ -56,11 +72,15 @@ export class CodexRemoteAdapter extends LlmAdapter {
     agent;
     readImage;
     reportLoginFailure;
+    directory;
     config;
     sessions = new Map();
     turns = new Map();
     lifetime = new AbortController();
-    constructor(config, resolveRuntime, approve, providerName = () => PROVIDER_NAMES.en, agent = CODEX_AGENT, readImage, reportLoginFailure) {
+    shuttingDown = false;
+    detached = new Set();
+    cleanups = new WeakMap();
+    constructor(config, resolveRuntime, approve, providerName = () => PROVIDER_NAMES.en, agent = CODEX_AGENT, readImage, reportLoginFailure, directory) {
         super();
         this.resolveRuntime = resolveRuntime;
         this.approve = approve;
@@ -68,23 +88,81 @@ export class CodexRemoteAdapter extends LlmAdapter {
         this.agent = agent;
         this.readImage = readImage;
         this.reportLoginFailure = reportLoginFailure;
+        this.directory = directory;
         this.config = typeof config === 'function' ? config : () => config;
     }
     providerInfo(provider) { return { id: provider, name: this.providerName() }; }
-    async listModels(provider) { return [{ provider, id: 'remote', name: this.providerName(), inputModalities: ((this.agent.oneShot && this.config().mode === 'one-shot') ? ['text'] : ['text', 'image']) }]; }
+    catalog(signal) { if (!this.directory)
+        throw new LlmError('无法获取模型列表：缺少可信主机目录能力', 'MODEL_CATALOG_UNAVAILABLE'); return this.directory.read(this.agent, signal); }
+    async listModels(provider) { const catalog = await this.catalog(); try {
+        return catalog.models.map(model => modelInfo(provider, model));
+    }
+    finally {
+        catalog.release();
+    } }
+    async resolveModel(provider, id, signal) { const catalog = await this.catalog(signal); try {
+        const model = catalog.models.find(model => model.id === id);
+        if (!model)
+            throw new LlmError('无法获取模型列表：所选模型已不在当前主机目录中', 'MODEL_CATALOG_UNAVAILABLE');
+        return modelInfo(provider, model);
+    }
+    finally {
+        catalog.release();
+    } }
+    async invalidateModelState() { for (const turn of this.turns.values())
+        turn.abort(); await Promise.all([...this.sessions.keys()].map(id => this.disposeSession(id))); }
+    async invalidateEmployeeState() { await Promise.all([...this.sessions].filter(([, live]) => live.runtime.employeeExecutionMeta || live.runtime.execution).map(([id]) => this.disposeSession(id))); }
     providerRetryPolicy() { return { mode: 'normal', maxRetries: 0, retryableCodes: [], initialDelayMs: 0, maxDelayMs: 0, jitterRatio: 0 }; }
+    cleanupRuntime(runtime) {
+        const existing = this.cleanups.get(runtime);
+        if (existing)
+            return existing;
+        const cleanup = Promise.resolve().then(() => runtime.dispose?.()).catch(() => {
+            const failure = new NeedError('REMOTE_CLEANUP_UNCONFIRMED', '原主机会话的清理结果未确认，不能继续或重开此会话', '管理员核对并结束原主机会话');
+            for (const live of this.sessions.values())
+                if (live.runtime === runtime) {
+                    live.cleanupFailure = failure;
+                    live.failure ??= { cause: failure };
+                }
+            throw failure;
+        });
+        this.cleanups.set(runtime, cleanup);
+        return cleanup;
+    }
     async disposeSession(sessionId) {
         this.turns.get(sessionId)?.abort();
         const current = this.sessions.get(sessionId);
         if (!current)
             return;
-        this.sessions.delete(sessionId);
+        if (current.disposal)
+            return current.disposal;
         current.session.close();
-        await current.runtime.dispose?.();
+        current.disposal = this.cleanupRuntime(current.runtime).then(() => { if (this.sessions.get(sessionId) === current)
+            this.sessions.delete(sessionId); });
+        return current.disposal;
+    }
+    async detachSession(sessionId) {
+        const current = this.sessions.get(sessionId), turn = this.turns.get(sessionId);
+        if (!current && !turn)
+            return;
+        this.detached.add(sessionId);
+        if (current) {
+            try {
+                await current.runtime.detach?.();
+            }
+            finally {
+                current.session.close();
+                this.sessions.delete(sessionId);
+                turn?.abort();
+            }
+        }
+        else
+            turn?.abort();
     }
     async dispose() {
+        this.shuttingDown = true;
+        const results = await Promise.allSettled([...new Set([...this.sessions.keys(), ...this.turns.keys()])].map(id => this.detachSession(id)));
         this.lifetime.abort();
-        const results = await Promise.allSettled([...this.sessions.keys()].map(id => this.disposeSession(id)));
         const failure = results.find(result => result.status === 'rejected');
         if (failure?.status === 'rejected')
             throw failure.reason;
@@ -94,9 +172,11 @@ export class CodexRemoteAdapter extends LlmAdapter {
             yield* this.generate(options);
         }
         catch (error) {
+            if (error instanceof ModelConfigurationError)
+                throw new LlmError(error.message, error.code, { cause: error });
             if (error instanceof NeedError) {
                 const rpc = /RPC 错误码 (-?\d+)/u.exec(error.requires)?.[1];
-                const message = employeeFailure(error.code) + (rpc ? `（技术详情：RPC 错误码 ${rpc}）` : '');
+                const message = employeeFailure(error.code, this.agent.loginProvider) + (rpc ? `（技术详情：RPC 错误码 ${rpc}）` : '');
                 let diagnostic = error.technical ? JSON.stringify(error.technical) : '';
                 if (error.technical && this.reportLoginFailure) {
                     try {
@@ -125,12 +205,17 @@ export class CodexRemoteAdapter extends LlmAdapter {
             this.turns.set(key, turn);
         const signal = AbortSignal.any([this.lifetime.signal, turn.signal, ...(original.signal ? [original.signal] : [])]);
         const options = { ...original, signal };
+        const timing = new StageTiming();
         let runtime;
         let session;
         let live;
         let succeeded = false;
         let remoteAttempted = false;
+        let preserveRecoveredRuntime = false;
         let activeMapper;
+        let catalog;
+        let selected;
+        let modelConfiguration;
         const config = this.config();
         const mode = this.agent.oneShot ? config.mode : 'session';
         try {
@@ -139,43 +224,118 @@ export class CodexRemoteAdapter extends LlmAdapter {
             const previous = readPointer(options, this.agent);
             if (previous && previous.mode !== mode)
                 throw new NeedError('SESSION_CONTEXT_MISMATCH', '运行模式与原会话不一致，请新建会话', '原会话模式');
+            if (previous && !previous.modelConfiguration)
+                throw new NeedError('MODEL_SELECTION_REQUIRED', '旧远端恢复记录没有明确模型选择，请新建会话并选择模型', '本轮明确选择的模型');
             live = key ? this.sessions.get(key) : undefined;
+            if (live?.disposal || live?.cleanupFailure)
+                throw live.cleanupFailure ?? new NeedError('REMOTE_CLEANUP_UNCONFIRMED', '原主机会话正在结束，清理结果尚未确认，不能继续或重开此会话', '管理员核对原主机会话清理结果');
             if (live?.failure)
                 throw new NeedError('SESSION_STATE_UNCONFIRMED', '上轮远端状态未确认，不能自动重发或重开，请新建会话并核对项目', '管理员核对原会话状态');
             if (live && !previous)
                 throw new NeedError('SESSION_STATE_MISSING', '上一轮回复尚无持久恢复记录，不能继续当前远端会话', '原会话的持久回复记录');
-            const configuration = JSON.stringify([mode, config.acpMaxMessageBytes, config.brokerMaxFrameBytes, config.brokerControlMaxBytes]);
+            const configuration = JSON.stringify([mode, config.acpMaxMessageBytes, config.brokerMaxFrameBytes, config.brokerControlMaxBytes, config.employeeShellKillGraceMs]);
             if (live && live.configuration !== configuration)
                 throw new NeedError('SESSION_CONTEXT_MISMATCH', '会话运行设置已改变，请新建会话', '原会话运行设置');
-            const request = { sessionId: options.sessionId, mode, cwd: previous?.cwd, identity: previous?.identity, bindingId: previous?.bindingId, workspaceId: previous?.workspaceId, agent: this.agent, retainProcess: !!key && mode === 'session', signal, brokerSettings: Object.freeze({ brokerMaxFrameBytes: config.brokerMaxFrameBytes, brokerControlMaxBytes: config.brokerControlMaxBytes }) };
+            const request = { timing, acpMaxMessageBytes: config.acpMaxMessageBytes, resumeSessionId: previous?.sessionId, recoveryCheckpointId: previous?.recoveryCheckpointId, sessionId: options.sessionId, mode, cwd: previous?.cwd, identity: previous?.identity, bindingId: previous?.bindingId, workspaceId: previous?.workspaceId, agent: this.agent, retainProcess: !!key && mode === 'session', signal, brokerSettings: Object.freeze({ brokerMaxFrameBytes: config.brokerMaxFrameBytes, brokerControlMaxBytes: config.brokerControlMaxBytes }) };
+            const after = options.messages.findLastIndex(message => message.role === 'assistant' && !isWorkspaceNoticeMessage(message));
+            request.userInputIds = Object.freeze(options.messages.slice(after + 1).flatMap(message => message.role === 'user' && message.source?.kind === 'user' && typeof message.id === 'string' ? [message.id] : []));
+            request.userMessageIds = request.userInputIds;
             await this.resolveRuntime.preflight?.(request);
-            const input = await prepareInput(options, this.readImage);
+            let input = await timing.run('input-prepare', () => prepareInput(options, this.readImage));
             const contextSha256 = createHash('sha256').update(input.systemPrompt ?? '').digest('hex');
+            request.contextSha256 = contextSha256;
+            const codex = this.agent.loginProvider === 'codex';
+            if (codex && live && previous && live.contextSha256 !== previous.contextSha256.toLowerCase())
+                throw new NeedError('SESSION_CONTEXT_DIGEST_INVALID', '持久上下文摘要与当前远端会话的初建摘要不一致，本轮未发送', '原会话一致的初建上下文摘要');
+            const contextChanged = !!previous && codex && previous.contextSha256.toLowerCase() !== contextSha256;
+            // Only identical durable context can prove a legacy context-bound journal.
+            // New Codex transport scopes are independent of the native context digest.
+            if (contextChanged)
+                request.contextSha256 = undefined;
             if (previous && this.agent.loginProvider === 'claude' && previous.contextSha256 !== contextSha256)
                 throw new NeedError('SYSTEM_PROMPT_UPDATE_PENDING', 'Claude原会话的系统或开发者要求已变化；主机仅承诺下次上下文整理后生效，本轮未发送，请新建会话应用新要求', '新建Claude会话以立即应用当前系统与开发者要求');
+            if (contextChanged)
+                input = await prepareContinuation(options, input, this.readImage);
             if (live) {
-                live.session.validateContext({ systemPrompt: input.systemPrompt });
+                if (contextChanged)
+                    live.session.validateNewSessionContext({ systemPrompt: input.systemPrompt });
+                else
+                    live.session.validateContext({ systemPrompt: input.systemPrompt });
                 live.session.validatePrompt(input.prompt);
             }
             if (mode === 'one-shot' && (input.systemPrompt || input.prompt.some(block => block.type !== 'text')))
                 throw new NeedError('ONESHOT_CONTEXT_REQUIRED', '首版单次模式不支持图片或系统/开发者上下文，请使用会话模式', 'Codex会话模式');
             if (mode === 'session' && Buffer.byteLength(JSON.stringify({ prompt: input.prompt, systemPrompt: input.systemPrompt }), 'utf8') > config.acpMaxMessageBytes)
                 throw new NeedError('ACP_MESSAGE_TOO_LARGE', '本轮输入超过已设置的会话消息容量，未截断或发送', '管理员调整acpMaxMessageBytes');
+            if (mode === 'one-shot')
+                throw new NeedError('MODEL_CONFIGURATION_UNSUPPORTED', '单次模式不支持确认当前模型与推理等级，请改用会话模式', '支持模型配置确认的会话模式');
+            request.localAdmissionCheck?.();
+            catalog = await this.catalog(signal);
+            selected = catalog.models.find(model => model.id === options.model);
+            if (!selected)
+                throw new ModelConfigurationError('所选模型不在本次可信主机目录中，请重新选择模型');
+            if (options.reasoningEffort !== undefined && !selected.reasoning.options.some(option => option.value === options.reasoningEffort))
+                throw new ModelConfigurationError('所选推理等级不在本次模型目录中');
+            let modelSignal = AbortSignal.any([signal, catalog.signal]);
+            options.signal = modelSignal;
+            request.signal = modelSignal;
             runtime = await this.resolveRuntime(request);
             signal.throwIfAborted();
+            if (runtime.execution?.signal) {
+                modelSignal = AbortSignal.any([modelSignal, runtime.execution.signal]);
+                options.signal = modelSignal;
+                request.signal = modelSignal;
+                modelSignal.throwIfAborted();
+            }
+            catalog.assertCurrent();
+            if (runtime.connection && (runtime.connection.instanceId !== catalog.target.instanceId || runtime.connection.epoch !== catalog.target.epoch) || runtime.identity !== `${catalog.target.target.username}@${catalog.target.target.host}:${catalog.target.target.port}`)
+                throw new ModelConfigurationError('模型目录与当前会话可信员工主机不一致');
             if (previous && (previous.identity !== runtime.identity || previous.cwd !== runtime.cwd || previous.bindingId && previous.bindingId !== runtime.binding?.bindingId || previous.workspaceId && previous.workspaceId !== runtime.binding?.workspaceId))
                 throw new NeedError('SESSION_CONTEXT_MISMATCH', '原会话的员工主机或工作区已改变，请新建会话', '原会话的可信目标和工作区');
+            if (contextChanged && runtime.recoveredSession) {
+                const capabilities = runtime.recoveredSession.capabilities;
+                // A clean reattach has sent no ACP input. A known policy refusal must
+                // detach it, preserving the original native session and checkpoint.
+                if (!capabilities.sessionCapabilities?.systemPrompt || !supportsCodexContextPolicy(capabilities)) {
+                    preserveRecoveredRuntime = true;
+                    if (!capabilities.sessionCapabilities?.systemPrompt)
+                        throw new NeedError('SYSTEM_PROMPT_UNSUPPORTED', '远端未声明系统与开发者上下文能力，不能丢弃这些要求继续', '支持 systemPrompt 的公开 ACP 能力');
+                    throw new NeedError('SYSTEM_PROMPT_POLICY_UNSUPPORTED', '远端没有明确声明Codex上下文仅新建生效的兼容政策，本轮未发送', 'systemPrompt与精确的aiWorkbenchSystemPrompt新建政策');
+                }
+            }
+            if (runtime.restartNotice) {
+                const ids = runtime.restartInputIds;
+                if (!ids?.length || new Set(ids).size !== ids.length || ids.some(id => input.users.filter(u => u.id === id).length !== 1))
+                    throw new NeedError('CURRENT_INPUT_UNCONFIRMED', '无法核对本次输入，尚未发送给模型', '官方当前步骤的已接纳用户输入');
+                input = { ...input, prompt: ids.flatMap(id => input.users.find(u => u.id === id).prompt) };
+                if (contextChanged)
+                    input = await timing.run('input-prepare', () => prepareContinuation(options, input, this.readImage));
+            }
             const details = runtime.details;
             if (!details)
                 throw new NeedError('TECHNICAL_DETAILS_UNAVAILABLE', '技术详情暂不可用，请更新远程主机连接组件。', 'L技术详情持久接收能力');
-            const mapper = new StreamMapper(mode === 'session' ? (live ? live.usageSnapshot : previous ? (previous.usageSnapshot ?? null) : undefined) : undefined, observation => details.record(observation));
+            timing.bind(detail => details.record(detail));
+            const mapper = new StreamMapper(mode === 'session' && !contextChanged ? (runtime.restartNotice ? undefined : live ? live.usageSnapshot : previous ? (previous.usageSnapshot ?? null) : undefined) : undefined, observation => details.record(observation));
             activeMapper = mapper;
             let id;
             let stop;
+            if (runtime.employeePresentation) {
+                yield* mapper.text(runtime.employeePresentation + '\n\n');
+                yield* mapper.flush();
+            }
             if (runtime.workspaceNotice) {
                 yield* mapper.text(runtime.workspaceNotice.text);
                 yield* mapper.flush();
             }
+            if (runtime.restartNotice) {
+                yield* mapper.text(runtime.restartNotice + '\n\n');
+                yield* mapper.flush();
+            }
+            if (runtime.execution) {
+                details.record({ kind: 'session', severity: 'warning', code: 'CLAUDE_EMPLOYEE_SCOPE', summary: '本机工具路由及未覆盖操作范围', payload: runtime.execution.scope });
+                yield* mapper.text(runtime.execution.notice + '\n\n');
+                yield* mapper.flush();
+            }
             if (mode === 'session') {
                 if (live && live.runtime !== runtime)
                     throw new NeedError('SESSION_TRANSPORT_MISMATCH', '原会话的主机通道已更换，不能自动切换进程', '原主机会话通道');
@@ -186,7 +346,22 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 let done = false;
                 let failure;
                 const push = (chunks) => { queue.push(...chunks); wake?.(); wake = undefined; };
-                const hooks = { broker: runtime.broker, approve: (permission, approvalSignal) => this.approve?.(permission, approvalSignal, options) ?? Promise.resolve('unavailable'), onUpdate: notification => { try {
+                const hooks = { broker: runtime.broker, employeeExecution: runtime.employeeExecution, timing, approve: async (permission, approvalSignal) => {
+                        const execution = runtime.execution;
+                        const toolName = permission.toolCall.name ?? permission.toolCall._meta?.claudeCode?.toolName;
+                        if (execution) {
+                            if (toolName && ['Agent', 'Task', 'TaskOutput', 'TaskStop', 'Read', 'Write', 'Edit', 'Glob', 'Grep', 'Bash'].includes(toolName)) {
+                                details.record({ kind: 'need', severity: 'warning', code: 'CLAUDE_HOST_TOOL_UNSUPPORTED', summary: '这类原生调用没有经过员工端别名，本机来源不支持；本次审批已取消', payload: { operation: toolName } });
+                                push(mapper.text('\n这类操作尚不支持在本机执行，已取消本次审批，没有在主机代跑。\n'));
+                                return 'cancelled';
+                            }
+                            await execution.validate(approvalSignal);
+                        }
+                        const answer = await this.approve?.(permission, approvalSignal, options, execution && toolName?.startsWith('mcp__employee__') ? 'employee-local' : undefined) ?? 'unavailable';
+                        if (execution && answer === 'allowed-once')
+                            await execution.validate(approvalSignal);
+                        return answer;
+                    }, onUpdate: notification => { try {
                         push(mapper.acp(notification.update));
                     }
                     catch (error) {
@@ -197,7 +372,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 if (fresh) {
                     const transport = runtime.acpTransport instanceof acp.AgentApp || runtime.acpTransport instanceof unstable.AgentApp ? runtime.acpTransport : acp.ndJsonStream(runtime.acpTransport.writable, runtime.acpTransport.readable, { maxMessageBytes: config.acpMaxMessageBytes });
                     session = new AcpSession(transport, hooks);
-                    live = { session, runtime, configuration, usageSnapshot: mapper.usageSnapshot };
+                    live = { session, runtime, configuration, contextSha256, usageSnapshot: mapper.usageSnapshot };
                     if (key)
                         this.sessions.set(key, live);
                 }
@@ -209,20 +384,67 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 }
                 const task = (async () => {
                     remoteAttempted = true;
-                    if (fresh)
-                        await session.start(runtime.cwd, previous?.sessionId, signal, { systemPrompt: input.systemPrompt });
-                    else {
-                        const updated = await session.updateContext({ systemPrompt: input.systemPrompt }, signal);
-                        if (updated && this.agent.loginProvider === 'claude')
-                            throw new NeedError('SYSTEM_PROMPT_UPDATE_PENDING', 'Claude原会话的系统或开发者要求已变化；主机仅承诺下次上下文整理后生效，本轮未发送，请新建会话应用新要求', '新建Claude会话以立即应用当前系统与开发者要求');
+                    try {
+                        if (fresh && runtime.recoveredSession) {
+                            if (previous && runtime.recoveredSession.sessionId !== previous.sessionId)
+                                throw new NeedError('SESSION_STATE_INVALID', '已接回的会话与持久标识不一致，本轮未发送', '原会话的恢复标识');
+                            session.restore(runtime.execution?.hostCwd ?? runtime.cwd, runtime.recoveredSession, { systemPrompt: input.systemPrompt, ...(runtime.execution ? { employeeRouting: runtime.execution.routing } : {}), ...(codex ? { codexNewSessionOnly: true } : {}) }, codex && !!previous && !contextChanged);
+                            session.validatePrompt(input.prompt);
+                            if (contextChanged)
+                                await session.newContextSession({ systemPrompt: input.systemPrompt }, modelSignal);
+                        }
+                        else if (fresh)
+                            await session.start(runtime.execution?.hostCwd ?? runtime.cwd, contextChanged || runtime.restartNotice ? undefined : previous?.sessionId, modelSignal, { systemPrompt: contextChanged ? (input.systemPrompt ?? '') : input.systemPrompt, ...(runtime.execution ? { employeeRouting: runtime.execution.routing } : {}), ...(codex ? { codexNewSessionOnly: true } : {}), ...(runtime.employeeExecutionMeta ? { employeeExecution: runtime.employeeExecutionMeta } : {}) }, input.prompt);
+                        else if (contextChanged)
+                            await session.newContextSession({ systemPrompt: input.systemPrompt }, modelSignal);
+                        else {
+                            const updated = await session.updateContext({ systemPrompt: input.systemPrompt }, modelSignal);
+                            if (updated && this.agent.loginProvider === 'claude')
+                                throw new NeedError('SYSTEM_PROMPT_UPDATE_PENDING', 'Claude原会话的系统或开发者要求已变化；主机仅承诺下次上下文整理后生效，本轮未发送，请新建会话应用新要求', '新建Claude会话以立即应用当前系统与开发者要求');
+                        }
+                        if (contextChanged) {
+                            if (session.id === previous.sessionId)
+                                throw new NeedError('SESSION_STATE_INVALID', '新会话标识与原会话相同，无法确认独立承接，本轮未发送', '独立的新远端会话标识');
+                            live.contextSha256 = contextSha256;
+                            live.usageSnapshot = mapper.usageSnapshot;
+                            details.record({ kind: 'session', severity: 'info', code: 'CODEX_CONTEXT_SESSION_REPLACED', summary: 'Codex要求仅在新建生效，已保留原会话；新会话承接可见用户及助手正文，内部推理不转发', payload: { reason: 'system-context-changed', oldSessionId: previous.sessionId, newSessionId: session.id, oldContextSha256: previous.contextSha256, newContextSha256: contextSha256, history: input.historyTransfer } });
+                        }
+                        catalog.assertCurrent();
+                        const actual = await session.selectModel(selected.value, options.reasoningEffort, modelSignal);
+                        catalog.assertCurrent();
+                        session.assertModelSelection(selected.value, options.reasoningEffort);
+                        let resolved = selected.resolvedModel;
+                        if (this.agent.loginProvider === 'claude') {
+                            const evidence = session.resolvedModelEvidence;
+                            if (!resolved || (selected.value !== resolved && (!evidence || evidence.modelValue !== selected.value || evidence.resolvedModel !== resolved)))
+                                throw new NeedError('MODEL_RESOLUTION_UNCONFIRMED', '所选模型的具体型号未获得当前会话确认，本轮未发送', '当前会话的具体型号证据');
+                            if (evidence && evidence.resolvedModel !== resolved)
+                                throw new NeedError('MODEL_RESOLUTION_UNCONFIRMED', '当前会话具体型号与所选目录不一致，本轮未发送', '完全一致的具体型号证据');
+                        }
+                        if (!resolved)
+                            throw new NeedError('MODEL_RESOLUTION_UNCONFIRMED', '远端没有提供具体型号证据，本轮未发送', '具体型号证据');
+                        modelConfiguration = { selected: { ...selected, ...(options.reasoningEffort === undefined ? {} : { effort: options.reasoningEffort }) }, configured: actual, resolvedModel: resolved, status: 'remote-configured' };
+                        details.record({ kind: 'session', severity: 'info', code: 'MODEL_CONFIGURATION_CONFIRMED', summary: '本轮选择已由远端配置回执确认；不代表推理效果已验证', payload: modelConfiguration });
                     }
+                    catch (error) {
+                        details.record({ kind: 'session', severity: 'action-required', code: 'MODEL_CONFIGURATION_FAILED', summary: '本轮模型配置未获完整确认，未发送用户输入', payload: { selected, requestedEffort: options.reasoningEffort ?? null, actual: session.modelConfiguration ?? null, reason: error instanceof NeedError ? error.code : error instanceof ModelConfigurationError ? error.message : 'MODEL_CONFIGURATION_FAILED' } });
+                        throw error;
+                    }
+                    await timing.run('details-flush', () => details.flush());
                     await details.flush();
                     details.beginTurn(runtime.detailContext?.() ?? { turn: null, step: null });
+                    catalog.assertCurrent();
+                    session.assertModelSelection(selected.value, options.reasoningEffort);
+                    await runtime.execution?.beginTurn(modelSignal);
                     id = session.id;
                     try {
-                        return await session.prompt(input.prompt, signal);
+                        const result = await session.prompt(input.prompt, modelSignal);
+                        if (contextChanged)
+                            push(mapper.text(runtime.restartNotice ? '\n\n会话要求已变化，已把此前可见对话带入新 Codex 会话继续处理。' : '\n\n会话要求已变化，已新建 Codex 会话继续处理，原会话仍保留。'));
+                        return result;
                     }
                     finally {
+                        runtime.execution?.endTurn();
                         details.endTurn();
                     }
                 })();
@@ -254,13 +476,28 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 }
             }
             details.endTurn();
-            await details.flush();
+            await timing.run('details-flush', () => details.flush());
+            await details.flush(); // The timing record is a new ordered write, not a retry.
             if (!id)
                 throw new NeedError('SESSION_ID_MISSING', '远端没有返回会话标识', '有效的远端会话标识');
             if (live)
                 live.usageSnapshot = mapper.usageSnapshot;
+            if (modelConfiguration) {
+                const actual = session.modelConfiguration;
+                if (!actual?.confirmed || actual.model !== modelConfiguration.configured.model || actual.effort !== modelConfiguration.configured.effort)
+                    throw new ModelConfigurationError('远端会话在本轮期间改变了模型配置，不能沿用旧回执');
+                catalog.assertCurrent();
+                yield* mapper.text(`\n\n本轮所选模型：${modelConfiguration.selected.name}（${modelConfiguration.selected.value}）；推理等级：${modelConfiguration.selected.effort ?? '沿用远端配置'}。远端已配置模型：${modelConfiguration.configured.model}；具体型号：${modelConfiguration.resolvedModel}；推理等级：${modelConfiguration.configured.effort ?? '远端未提供'}（配置已确认，推理效果未验证）。`);
+            }
             yield* mapper.flush();
-            const pointer = { ...(runtime.workspaceNotice ? { presentation: { workspaceNotice: runtime.workspaceNotice } } : {}), version: 2, agent: this.agent.id, contextSha256, ...(mode === 'session' ? { usageSnapshot: mapper.usageSnapshot } : {}), ...(options.sessionId ? { dshSessionId: options.sessionId } : {}), mode, identity: runtime.identity, cwd: runtime.cwd, sessionId: id, ...(runtime.binding ? { bindingId: runtime.binding.bindingId, workspaceId: runtime.binding.workspaceId } : {}) };
+            let recoveryCheckpointId;
+            if (session?.checkpoint && runtime.saveCheckpoint) {
+                const id = randomUUID();
+                if (await runtime.saveCheckpoint(id, session.checkpoint))
+                    recoveryCheckpointId = id;
+            }
+            const previousRemoteSessions = [...(previous?.previousRemoteSessions ?? []), ...(contextChanged ? [{ sessionId: previous.sessionId, contextSha256: previous.contextSha256 }] : [])];
+            const pointer = { ...(previousRemoteSessions.length ? { previousRemoteSessions } : {}), ...(modelConfiguration ? { modelConfiguration } : {}), ...(recoveryCheckpointId ? { recoveryCheckpointId } : {}), ...(runtime.workspaceNotice ? { presentation: { workspaceNotice: runtime.workspaceNotice } } : {}), version: 2, agent: this.agent.id, contextSha256, ...(mode === 'session' ? { usageSnapshot: mapper.usageSnapshot } : {}), ...(options.sessionId ? { dshSessionId: options.sessionId } : {}), mode, identity: runtime.identity, cwd: runtime.cwd, sessionId: id, ...(runtime.binding ? { bindingId: runtime.binding.bindingId, workspaceId: runtime.binding.workspaceId } : {}) };
             succeeded = true;
             yield { type: 'finish', reason: { kind: stop === 'max_tokens' || stop === 'max_turn_requests' ? 'max-tokens' : 'stop' }, replayState: { response: pointer } };
         }
@@ -281,27 +518,44 @@ export class CodexRemoteAdapter extends LlmAdapter {
             throw error;
         }
         finally {
-            if (!succeeded || !key || mode !== 'session') {
-                session?.close();
-                await runtime?.dispose?.();
+            runtime?.execution?.endTurn();
+            catalog?.release();
+            try {
+                if (preserveRecoveredRuntime || this.shuttingDown || key && this.detached.has(key)) {
+                    session?.close();
+                    await runtime?.detach?.();
+                }
+                else if (!succeeded || !key || mode !== 'session') {
+                    session?.close();
+                    if (runtime)
+                        await this.cleanupRuntime(runtime);
+                }
+            }
+            finally {
+                if (key && this.turns.get(key) === turn)
+                    this.turns.delete(key);
+                if (key)
+                    this.detached.delete(key);
             }
-            if (key && this.turns.get(key) === turn)
-                this.turns.delete(key);
         }
     }
 }
 /** One official registration owns both routes, preserving opaque replay ownership. */
 export class RemoteAgentsAdapter extends LlmAdapter {
     adapters = new Map();
-    constructor(config, makeRuntime, approve, nameFor, readImage, reportLoginFailure) { super(); for (const agent of AGENTS)
-        this.adapters.set(agent.id, new CodexRemoteAdapter(config, makeRuntime(agent), approve, () => nameFor(agent), agent, readImage, reportLoginFailure)); }
+    constructor(config, makeRuntime, approve, nameFor, readImage, reportLoginFailure, directory) { super(); for (const agent of AGENTS)
+        this.adapters.set(agent.id, new CodexRemoteAdapter(config, makeRuntime(agent), approve, () => nameFor(agent), agent, readImage, reportLoginFailure, directory)); }
     adapter(provider) { const adapter = this.adapters.get(provider); if (!adapter)
         throw new LlmError('远程模型未注册', 'PROVIDER_NOT_FOUND'); return adapter; }
     providerInfo(provider) { return this.adapter(provider).providerInfo(provider); }
     listModels(provider) { return this.adapter(provider).listModels(provider); }
+    resolveModel(provider, model, signal) { return this.adapter(provider).resolveModel(provider, model, signal); }
+    async invalidateModelState() { await Promise.all([...this.adapters.values()].map(adapter => adapter.invalidateModelState())); }
+    async invalidateEmployeeState() { await Promise.all([...this.adapters.values()].map(adapter => adapter.invalidateEmployeeState())); }
     providerRetryPolicy() { return { mode: 'normal', maxRetries: 0, retryableCodes: [], initialDelayMs: 0, maxDelayMs: 0, jitterRatio: 0 }; }
     stream(options) { return this.adapter(options.provider).stream(options); }
     async disposeSession(sessionId) { await Promise.all([...this.adapters.values()].map(adapter => adapter.disposeSession(sessionId))); }
+    async detachSession(sessionId) { await Promise.all([...this.adapters.values()].map(adapter => adapter.detachSession(sessionId))); }
     async dispose() { await Promise.all([...this.adapters.values()].map(adapter => adapter.dispose())); }
 }
 export function apply(ctx, live) {
@@ -315,6 +569,7 @@ export function apply(ctx, live) {
         return attachments.readImage(ref, signal);
     };
     const openByAgent = new Map(AGENTS.map(agent => [agent.id, brokerFactory(get, undefined, config)]));
+    const localTurns = createLocalUserTurnObserver(ctx);
     const detailManagers = new Map();
     const managerForProfile = () => {
         const profile = ctx.get('profileContext');
@@ -327,9 +582,19 @@ export function apply(ctx, live) {
         }
         return manager;
     };
-    const adapter = new RemoteAgentsAdapter(config, agent => connectProvider(get, { agent, notice: createWorkspaceNoticeConsumer(ctx, agent), details: async (request, api, connection, target) => {
-            return managerForProfile().open({ sessionId: request.sessionId, provider: agent.loginProvider, identity: `${target.username}@${target.host}:${target.port}`, connection });
-        }, open: async (...args) => {
+    let changed = () => { };
+    const modelDirectory = new ModelCatalog(get, () => config().acpMaxMessageBytes, undefined, () => changed());
+    const adapter = new RemoteAgentsAdapter(config, agent => {
+        const details = async (request, api, connection, target) => {
+            return managerForProfile().open({ sessionId: request.sessionId, provider: agent.loginProvider, identity: `${target.username}@${target.host}:${target.port}`, connection, localAcceptanceId: request.localAcceptanceId ?? request.localAcceptance?.acceptanceId });
+        };
+        const open = async (...args) => {
+            const profile = ctx.get('profileContext');
+            if (!profile?.dir)
+                throw new NeedError('RECOVERY_STORAGE_REQUIRED', '会话恢复需要官方profile目录', '官方profileContext.dir');
+            args[2].recoveryJournal = recoveryJournal(profile.dir, runtimeRecoveryKey(`${args[0].username}@${args[0].host}:${args[0].port}`, agent.id, args[2].sessionId, args[2].employeeScope));
+            args[2].verifyRecovery = () => verifyRecoveryCheckpoint(ctx, args[2], agent.id);
+            args[2].currentInputIds = await currentInputIds(ctx, args[2]);
             const runtime = await openByAgent.get(agent.id)(...args);
             runtime.detailContext = () => {
                 const events = args[2].sessionId ? ctx.get('agents')?.get(SessionId(args[2].sessionId))?.session.snapshotEvents() : undefined;
@@ -351,7 +616,19 @@ export function apply(ctx, live) {
                 return { turn, step };
             };
             return runtime;
-        } }), dshApproval(ctx), agent => agent.name[language], readImage, (sessionId, code, diagnostic) => {
+        };
+        const local = agent.loginProvider === 'claude' ? createClaudeLocalProvider({ getConnect: get, getNetwork: () => ctx.get('aiWorkbenchNetwork'), readWorkspace: id => readEmployeeWorkspace(ctx, id), readUserTurn: request => readLocalUserTurn(ctx, { sessionId: request.sessionId, route: agent.id, userMessageIds: request.userMessageIds ?? [] }), reportAdmissionFailure: (request, code) => managerForProfile().recordLocalFailure({ sessionId: request.sessionId, provider: 'claude', code }), recordUnscoped: (request, observation) => managerForProfile().recordLocalFailure({ sessionId: request.sessionId, provider: 'claude', code: observation.code, observation }), configuration: config, details, open }) : undefined;
+        return connectProvider(get, { agent, ...(agent.loginProvider === 'codex' ? { employee: {
+                    currentUserTurn: request => localTurns.current(request),
+                    getNetwork: () => ctx.get('aiWorkbenchNetwork'),
+                    workspace: async (request) => {
+                        const services = ctx;
+                        const registry = services.get('workspaceRegistry');
+                        const sessions = services.get('sessions');
+                        return officialEmployeeWorkspace(request.sessionId, registry, sessions?.get(request.sessionId)?.header);
+                    }, native: () => resolveEmployeeNative(),
+                } } : {}), notice: createWorkspaceNoticeConsumer(ctx, agent), details, open, local });
+    }, dshApproval(ctx), agent => agent.name[language], readImage, (sessionId, code, diagnostic) => {
         const events = sessionId ? ctx.get('agents')?.get(SessionId(sessionId))?.session.snapshotEvents() : undefined;
         let turn = null, step = null;
         for (const event of events ?? []) {
@@ -369,17 +646,31 @@ export function apply(ctx, live) {
                 step = null;
         }
         return managerForProfile().recordLoginFailure({ sessionId, code, diagnostic, context: { turn, step } });
-    });
+    }, modelDirectory);
     const ids = AGENTS.map(agent => agent.id);
     const entries = () => AGENTS.map(agent => ({ provider: agent.id, displayName: agent.name[language], settingsNs: settingsNamespace, settingsPath: [] }));
     const directory = ctx.llm.registerConfigurableProviders(entries());
     const registration = ctx.llm.registerAdapter(ids, adapter);
+    changed = () => { registration.replace(ids); void adapter.invalidateModelState().catch(() => { ctx.logger('remote-agent').warn('原会话清理结果未确认，已阻断继续发送；请联系管理员核对。'); }); };
+    const serviceValue = (name) => ctx.get(name);
+    let employeeConnect = serviceValue('aiWorkbenchConnect'), employeeNetwork = serviceValue('aiWorkbenchNetwork');
+    ctx.on('internal/service', service => {
+        if (service === 'aiWorkbenchConnect')
+            modelDirectory.refresh();
+        if (service !== 'aiWorkbenchConnect' && service !== 'aiWorkbenchNetwork')
+            return;
+        const nextConnect = serviceValue('aiWorkbenchConnect'), nextNetwork = serviceValue('aiWorkbenchNetwork');
+        if (nextConnect === employeeConnect && nextNetwork === employeeNetwork)
+            return;
+        employeeConnect = nextConnect;
+        employeeNetwork = nextNetwork;
+        void adapter.invalidateEmployeeState().catch(() => { ctx.logger('remote-agent').warn('本机执行连接的清理结果未确认，已阻断继续发送；请联系管理员核对。'); });
+    });
     new ProviderLocaleRemote(ctx, next => { language = next; directory.replace(entries()); registration.replace(ids); });
-    const cleanup = (id) => adapter.disposeSession(id);
+    const cleanup = (id) => adapter.detachSession(id);
     ctx.on('agent/disposed', ({ agent }) => cleanup(agent.session.id));
     ctx.on('session/disposed', session => cleanup(session.id));
-    ctx.on('workspace/session-stop', ((request) => cleanup(request.sessionId)));
-    ctx.effect(() => () => adapter.dispose());
+    ctx.effect(() => () => { modelDirectory.dispose(); return adapter.dispose(); });
 }
 export function dshApproval(ctx) {
     return async (request, signal, options, context) => {
@@ -387,7 +678,9 @@ export function dshApproval(ctx) {
         const approval = ctx.get('approval');
         if (!agent || !approval)
             return 'unavailable';
-        return approval.request({ agent, toolName: request.toolCall.name ?? request.toolCall.title ?? '远端工具',
-            reason: `${context ?? '主机'} · 会话 ${request.sessionId}：${request.toolCall.title ?? request.toolCall.toolCallId}`, signal });
+        const label = approvalLabel(request, context === 'employee-local' ? 'local' : 'host');
+        if (!label)
+            return 'unavailable';
+        return approval.request({ agent, ...label, signal });
     };
 }