@ai-workbench/remote-agent 0.8.2 → 0.8.10

package/dist/claude-local.js

@@ -0,0 +1,207 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { isDeepStrictEqual } from 'node:util';
+import { openEmployeeLease } from "./employee-endpoint.js";
+import { openEmployeeMcp } from "./employee-mcp.js";
+import { createEmployeeShell } from "./employee-shell.js";
+import { sameTarget, unwrap } from "./provider.js";
+import { sshIo } from "./broker.js";
+import { NeedError, shellQuote } from "./remote.js";
+import { awaitL } from "./provider.js";
+const failure = (code) => new NeedError(code, '当前本机执行上下文无法确认，本轮已停止；没有改在主机执行。', 'L当前本地绑定、N员工端点与S同代桥');
+const NOTICE = '本轮六类文件与命令工具在你的电脑执行，使用你选择的文件夹；Git也使用本机仓库。子代理和内部直接调用尚不支持本机，可能仍在主机；已识别的此类审批不会执行。PDF等二进制读取、后台命令暂不支持。';
+/** Local source only. Host and legacy-host remain with the original provider. */
+export function createClaudeLocalProvider(options) {
+    const entries = new Map();
+    const admitted = new WeakMap();
+    const admit = async (request, api, connection, target) => {
+        if (admitted.has(request))
+            return;
+        try {
+            if (api.getContractInfo?.().workspaceLocations !== 1)
+                return;
+            const local = api;
+            if (typeof local.getWorkspaceLocationState !== 'function')
+                throw failure('EMPLOYEE_CONTEXT_UNAVAILABLE');
+            const workspace = await options.readWorkspace(request.sessionId), state = local.getWorkspaceLocationState(), matches = state.items.filter(row => row.workspaceId === workspace.workspaceId);
+            if (matches.length !== 1 || state.phase !== 'ready' || state.instanceId !== connection.instanceId || state.epoch !== connection.epoch)
+                throw failure('EMPLOYEE_CONTEXT_CHANGED');
+            const item = matches[0];
+            if (item.source !== 'local')
+                return;
+            if (item.status !== 'selected' || !item.bindingId || api.getContractInfo?.().localUserTurnAcceptance !== 1 || typeof api.acceptLocalWorkspaceUserTurn !== 'function' || typeof local.getLocalWorkspaceContext !== 'function')
+                throw failure('EMPLOYEE_CONTEXT_UNAVAILABLE');
+            const context = unwrap(await awaitL(() => local.getLocalWorkspaceContext({ instanceId: connection.instanceId, epoch: connection.epoch, workspaceId: workspace.workspaceId, expectedBindingId: item.bindingId }), request.signal));
+            if (context.instanceId !== connection.instanceId || context.epoch !== connection.epoch || context.workspaceId !== workspace.workspaceId || context.bindingId !== item.bindingId || context.source !== 'local' || !isDeepStrictEqual(context.directory, workspace.directory))
+                throw failure('EMPLOYEE_CONTEXT_CHANGED');
+            const proof = await options.readUserTurn(request);
+            proof.assertCurrent();
+            const accepted = unwrap(await awaitL(() => api.acceptLocalWorkspaceUserTurn({ instanceId: connection.instanceId, epoch: connection.epoch, sessionId: request.sessionId, provider: 'claude', purpose: 'user-turn', workspaceId: workspace.workspaceId, expectedBindingId: item.bindingId, expectedDirectory: { device: workspace.directory.device, inode: workspace.directory.inode }, expectedUserTurn: { ...proof.expectedUserTurn } }), request.signal));
+            proof.assertCurrent();
+            request.signal?.throwIfAborted();
+            const now = api.getConnectionState();
+            if (options.getConnect() !== api || now.phase !== 'connected' || now.instanceId !== connection.instanceId || now.epoch !== connection.epoch)
+                throw failure('CONNECTION_LOST');
+            if (!accepted || accepted.version !== 1 || typeof accepted.acceptanceId !== 'string' || !accepted.acceptanceId.trim() || accepted.instanceId !== connection.instanceId || accepted.epoch !== connection.epoch || accepted.sessionId !== request.sessionId || accepted.provider !== 'claude' || accepted.workspaceId !== workspace.workspaceId || accepted.bindingId !== item.bindingId || accepted.source !== 'local' || !isDeepStrictEqual(accepted.directory, workspace.directory) || accepted.userTurn?.turn !== proof.expectedUserTurn.turn || accepted.userTurn.userMessageId !== proof.expectedUserTurn.userMessageId || accepted.userTurn.startSequence !== proof.startSequence || accepted.userTurn.userMessageSequence !== proof.userMessageSequence)
+                throw failure('REMOTE_DETAIL_RESPONSE_INVALID');
+            Object.defineProperty(request, 'localAcceptanceId', { value: accepted.acceptanceId, enumerable: true });
+            request.detailChannel = await options.details(request, api, connection, target);
+            admitted.set(request, { api, workspace: structuredClone(workspace), bindingId: item.bindingId, connection: structuredClone(connection) });
+        }
+        catch (error) {
+            const code = error instanceof NeedError ? error.code : 'LOCAL_ADMISSION_FAILED';
+            try {
+                await options.reportAdmissionFailure(request, code);
+            }
+            catch {
+                throw new NeedError(code, '本轮输入无法核对，已停止本次处理；诊断保存也未完成。', '原原因 ' + code + '；私有诊断 REMOTE_DETAIL_STORAGE_FAILED');
+            }
+            throw error;
+        }
+    };
+    const resolve = async (request, api, connection, target) => {
+        if (api.getContractInfo?.().workspaceLocations !== 1)
+            return;
+        const local = api;
+        if (typeof local.getWorkspaceLocationState !== 'function')
+            throw failure('EMPLOYEE_CONTEXT_UNAVAILABLE');
+        const workspace = await options.readWorkspace(request.sessionId), state = local.getWorkspaceLocationState(), matches = state.items.filter(row => row.workspaceId === workspace.workspaceId);
+        if (state.phase !== 'ready' || state.instanceId !== connection.instanceId || state.epoch !== connection.epoch || matches.length !== 1)
+            throw failure('EMPLOYEE_CONTEXT_CHANGED');
+        const item = matches[0];
+        if (item.source !== 'local')
+            return;
+        if (!admitted.has(request))
+            await admit(request, api, connection, target);
+        const acceptance = admitted.get(request);
+        if (!acceptance || acceptance.api !== api || acceptance.bindingId !== item.bindingId || acceptance.connection.instanceId !== connection.instanceId || acceptance.connection.epoch !== connection.epoch || !isDeepStrictEqual(acceptance.workspace, workspace))
+            throw failure('EMPLOYEE_CONTEXT_CHANGED');
+        if (item.status !== 'selected' || !item.bindingId || local.getContractInfo().localWorkspaceContext !== 1)
+            throw failure('EMPLOYEE_CONTEXT_UNAVAILABLE');
+        if (request.cwd && request.cwd !== workspace.directory.path || request.bindingId && request.bindingId !== item.bindingId || request.workspaceId && request.workspaceId !== workspace.workspaceId)
+            throw failure('SESSION_CONTEXT_MISMATCH');
+        const configuration = options.configuration(), maximum = request.acpMaxMessageBytes ?? configuration.acpMaxMessageBytes, control = request.brokerSettings?.brokerControlMaxBytes ?? configuration.brokerControlMaxBytes, grace = configuration.employeeShellKillGraceMs;
+        if (![maximum, control, grace].every(n => Number.isSafeInteger(n) && n >= 0) || !maximum || !control)
+            throw failure('SETTINGS_REQUIRED');
+        const scope = { target, workspace, bindingId: item.bindingId, instanceId: connection.instanceId, epoch: connection.epoch, maximum, control, grace };
+        let entry = entries.get(request.sessionId);
+        if (entry && (entry.closing || !isDeepStrictEqual(entry.scope, scope) || entry.lease.signal.aborted))
+            throw failure('EMPLOYEE_CONTEXT_CHANGED');
+        const details = request.detailChannel;
+        request.timing?.bind(observation => details.record(observation));
+        const trusted = async (ignoreCancellation = false) => {
+            if (!ignoreCancellation)
+                request.signal?.throwIfAborted();
+            if (options.getConnect() !== api)
+                throw failure('CONNECTION_LOST');
+            const now = api.getConnectionState();
+            if (now.phase !== 'connected' || now.instanceId !== connection.instanceId || now.epoch !== connection.epoch || !sameTarget(unwrap(await api.getSshTarget()), target))
+                throw failure('CONNECTION_LOST');
+        };
+        const openRequest = (row, cold = false) => ({ ...request, detailChannel: details, bindingId: item.bindingId, workspaceId: workspace.workspaceId, bindingRevision: state.revision, ...cold ? { recoveryCheckpointId: undefined } : {}, validateContext: async (cleanup = false) => { await trusted(cleanup); if (!cleanup)
+                await row.lease.validate(request.signal); } });
+        if (entry) {
+            entry.details = details;
+            entry.request = request;
+            await entry.lease.validate(request.signal);
+            const base = await options.open(target, { name: workspace.workspaceId, path: target.session.root }, openRequest(entry));
+            if (base.acpTransport !== entry.runtime.acpTransport)
+                throw failure('SESSION_TRANSPORT_MISMATCH');
+            entry.runtime.details = details;
+            entry.runtime.restartNotice = base.restartNotice;
+            entry.runtime.restartInputIds = base.restartInputIds;
+            return entry.runtime;
+        }
+        let io;
+        const transport = async () => { if (!io) {
+            const name = '@ai-workbench/connect';
+            const l = await import(__rewriteRelativeImportExtension(name));
+            if (typeof l.sshArgs !== 'function')
+                throw failure('DEPENDENCY_REQUIRED');
+            io = sshIo(target, l.sshArgs, control);
+        } return io; };
+        let lease, mcp, base;
+        let privateFailure, privateTail = Promise.resolve();
+        try {
+            const unscoped = (observation) => { if (privateFailure)
+                throw privateFailure; privateTail = privateTail.then(() => options.recordUnscoped(request, observation)).catch(error => { privateFailure ??= error; void lease?.close().catch(failure => { privateFailure ??= failure; }); }); };
+            lease = await (options.ports?.lease ?? openEmployeeLease)({ getConnect: () => options.getConnect(), getNetwork: options.getNetwork, readWorkspace: () => options.readWorkspace(request.sessionId), host: target, sessionId: request.sessionId, control: async (_target, command, signal) => (await transport()).run(command, signal), detail: unscoped }, request.signal);
+            const shell = (options.ports?.shell ?? createEmployeeShell)({ target: lease.target, maxBytes: maximum, killGraceMs: grace, attach: async (spec) => (await transport()).attach([spec.command, ...spec.args].map(shellQuote).join(' ')) });
+            mcp = await (options.ports?.mcp ?? openEmployeeMcp)({ lease, maxBytes: maximum, killGraceMs: grace, runShell: shell, activeSignal: () => entry?.active?.signal, captureDetail: () => { const sink = entry?.active?.details; if (!sink)
+                    throw failure('EMPLOYEE_NO_ACTIVE_TURN'); return observation => sink.record(observation); }, detail: unscoped });
+            entry = { runtime: undefined, scope, lease, details, request };
+            const row = entry;
+            base = await options.open(target, { name: workspace.workspaceId, path: target.session.root }, openRequest(row, true));
+            const underlying = base, endpoint = mcp;
+            const close = (detach) => row.closing ??= Promise.resolve().then(async () => {
+                row.active = undefined;
+                const errors = [];
+                try {
+                    await endpoint.close();
+                }
+                catch (error) {
+                    errors.push(error);
+                }
+                await privateTail;
+                if (privateFailure)
+                    errors.push(privateFailure);
+                try {
+                    await (detach ? underlying.detach?.() : underlying.dispose?.());
+                }
+                catch (error) {
+                    errors.push(error);
+                }
+                if (errors.length)
+                    throw new AggregateError(errors, 'EMPLOYEE_CLEANUP_UNCONFIRMED');
+                if (entries.get(request.sessionId) === row)
+                    entries.delete(request.sessionId);
+            });
+            const executionSignal = AbortSignal.any([lease.signal, ...mcp.signal ? [mcp.signal] : []]);
+            row.runtime = { ...underlying, cwd: workspace.directory.path, details, connection: { ...connection }, binding: { bindingId: item.bindingId, workspaceId: workspace.workspaceId, revision: state.revision }, execution: { hostCwd: target.session.root, routing: mcp.routing, notice: NOTICE, signal: executionSignal, scope: { source: 'local', cwd: workspace.directory.path, hostCwd: target.session.root, uid: lease.target.endpoint.remoteUid, claudeAcpVersion: '0.94.0', sdkVersion: '0.3.303', unsupported: ['subagents', 'internal-direct-calls', 'binary-read', 'background-shell'] }, validate: async (signal) => { executionSignal.throwIfAborted(); await row.lease.validate(signal); }, beginTurn: async (signal) => { executionSignal.throwIfAborted(); if (row.closing || row.active)
+                        throw failure('TURN_BUSY'); await row.lease.validate(signal); executionSignal.throwIfAborted(); row.active = { signal, details: row.details }; }, endTurn: () => { row.active = undefined; } }, dispose: () => close(false), detach: () => close(true) };
+            entries.set(request.sessionId, row);
+            lease.signal.addEventListener('abort', () => { void close(false).catch(() => { }); }, { once: true });
+            if (lease.signal.aborted) {
+                await close(false);
+                throw failure('EMPLOYEE_CONTEXT_CHANGED');
+            }
+            return row.runtime;
+        }
+        catch (error) {
+            const cleanup = [];
+            try {
+                await mcp?.close();
+                await lease?.close();
+            }
+            catch (e) {
+                cleanup.push(e);
+            }
+            try {
+                await base?.dispose?.();
+            }
+            catch (e) {
+                cleanup.push(e);
+            }
+            await privateTail;
+            if (privateFailure)
+                cleanup.push(privateFailure);
+            try {
+                await details.flush();
+            }
+            catch (e) {
+                cleanup.push(e);
+            }
+            if (cleanup.length)
+                throw new AggregateError([error, ...cleanup], 'EMPLOYEE_OPEN_CLEANUP_UNCONFIRMED');
+            throw error;
+        }
+    };
+    resolve.admit = admit;
+    return resolve;
+}

package/dist/client.js

@@ -1,7 +1,76 @@
 /* Official locale and provider-registration updates only; no custom UI or refresh. */
-window.__ModuleLoader__.load({id:'@ai-workbench/remote-agent',factory(){
-  const messages={"en":{"administratorNote":"Administrators: use Settings → Open configuration file to edit the existing plugin entry. See README for the six fields and approved defaults.","providerName":"Codex (Remote Host)"},"zh":{"administratorNote":"管理员：从设置使用“打开配置文件”，修改已有插件条目；六个字段和已批准默认值见 README。","providerName":"Codex（远程主机）"}};
+window.__ModuleLoader__.load({id:'@ai-workbench/remote-agent',factory(require){
+  const messages={"en":{"administratorNote":"Settings → Built-in plugins → 远程助手参数. Seven named settings with defaults, scope and effects.","providerName":"Codex (Remote Host)"},"zh":{"administratorNote":"管理员：设置 → 内置插件 → 远程助手参数。七项设置含默认值、范围、生效和后果说明。","providerName":"Codex（远程主机）"}};
+  const settingsFields=[{"key":"mode","name":"Codex 运行方式","kind":"select","options":[{"value":"session","name":"会话模式"},{"value":"one-shot","name":"单次模式（当前版本不可运行）"}],"range":"session / one-shot","scope":"仅 Codex；Claude 始终使用会话模式。","when":"当前轮不变；更改后原会话下一轮会拒绝继续，需新建会话。","consequence":"会话模式保留连续对话；当前单次模式会明确拒绝运行，不会发给模型。不提供关闭会话身份核对的选项。","defaultValue":"session"},{"key":"acpMaxMessageBytes","name":"完整消息与工具输出容量（字节）","kind":"number","min":1,"max":9007199254740991,"range":"1～9007199254740991 的整数；0不能关闭上限","scope":"两位远程助手的完整会话消息；也用于模型目录、本机 MCP、员工执行 RPC 和工具输出容量。","when":"当轮快照不变；下一次独立目录查询读取新值；已有会话需新建后使用。","consequence":"调大可接收更大消息、占用更多内存；调小更早拒绝超限。超限明确停止，不截断、不自动重试；不能用0取消完整消息保护。","defaultValue":4194304},{"key":"brokerMaxFrameBytes","name":"主机会话回传单段容量（字节）","kind":"number","min":1,"max":9007199254740991,"range":"1～9007199254740991 的整数；0不能关闭上限","scope":"本插件接收主机会话单段输出的容量；不会替主机修改它自己的输出策略。","when":"当轮快照不变；更改后已有会话需新建。","consequence":"调大允许更大回传段、占用更多内存；调小可能拒绝主机合法输出。超限停止，不截断；不能关闭协议帧核验。","defaultValue":2097152},{"key":"brokerControlMaxBytes","name":"主机会话管理回复容量（字节）","kind":"number","min":1,"max":9007199254740991,"range":"1～9007199254740991 的整数；0不能关闭上限","scope":"主机会话管理命令的标准输出、标准错误各自容量；也用于本机执行桥的管理回复。","when":"当轮快照不变；更改后已有会话需新建。","consequence":"调大允许更长管理回复、占用更多内存；调小可能无法核实状态。超限明确停止，不能把不完整回复当成功；0不表示无限。","defaultValue":1048576},{"key":"oneShotSandbox","name":"Codex 单次任务权限模式","kind":"select","options":[{"value":"read-only","name":"只读"},{"value":"workspace-write","name":"工作区内可写"},{"value":"danger-full-access","name":"完全访问（高权限）"}],"range":"read-only / workspace-write / danger-full-access","scope":"仅 Codex 单次通道；不改变会话模式、本机工具或员工账号的系统权限。","when":"仅单次任务启动时适用；当前版本单次任务被拒绝，因此目前不生效。","consequence":"只读不允许单次任务写入；工作区内可写允许该目录写入；完全访问放宽单次沙箱。此项不是员工目录的权限开关，也不会解锁当前不可用的单次模式。","defaultValue":"workspace-write"},{"key":"oneShotApproval","name":"Codex 单次任务审批方式","kind":"fixed","readOnly":true,"range":"固定 never；不能切换","scope":"仅 Codex 单次通道；不改变会话模式的员工审批。","when":"仅单次启动参数；当前单次模式不可运行。","consequence":"单次通道没有中途交互审批能力，所以必须固定为无中途交互；不表示自动批准或允许所有操作。不能切换为自动回答旧审批。","defaultValue":"never"},{"key":"employeeShellKillGraceMs","name":"本机命令外层连接清理宽限（毫秒）","kind":"number","min":0,"max":2147483647,"range":"0～2147483647 的整数","scope":"仅 Claude 本机 Bash 取消后，本插件自己的外层 SSH 进程清理；不控制员工命令或 Codex 执行器。","when":"当轮快照不变；更改后已有会话需新建。","consequence":"大于0时先请求外层连接退出，再等待所设毫秒后强制清理；0表示不留宽限、立即强制清理外层连接，不是关闭取消。没有员工端退出确认时结果仍未知，不能据此自动重放或声称命令已停止。","defaultValue":1000}];
+  /* Public settings.plugins.tab + shared ConfigForms. No private client services. */
+function mountRuntimeSettings(ctx,React,fields){
+ const h=React.createElement;
+ const invariants=[
+  ['员工、主机和文件夹核对','始终开启，不可关闭','每次派发前核对当前连接、员工与工作区，避免操作到别人的文件或旧位置；核对失败即停止。'],
+  ['本轮输入与技术详情归属','始终开启，不可关闭','真实输入须先接纳，技术详情须确认保存；迟到结果仍属于原轮次，不能借下一轮的记录继续执行。'],
+  ['模型选择确认','始终开启，不可关闭','主机须完整确认所选模型和推理等级，不能静默换模型继续。'],
+  ['完整消息与精确整数','始终开启，不可关闭','容量不能用0关闭，超限明确停止、不截断；整数必须能精确表示，防止消息缺失或容量计算失真。'],
+  ['未知结果与旧审批保护','始终开启，不可关闭','断线或取消不等于员工命令已结束；不自动重放未知操作，不代答旧审批，清理未确认时不擅自重开。'],
+  ['本机执行位置','始终开启，不可关闭','已提供的本机工具通道不悄悄回退主机；文件夹不是权限隔离根，也不新增目录白名单。Claude子代理及内部直接调用尚未完整覆盖，可能仍在主机，每轮另有范围提示。']
+ ];
+ function Panel({form}){
+  const snapshot=React.useSyncExternalStore(fn=>form.subscribe(fn),()=>form.getSnapshot(),()=>form.getSnapshot());
+  const [draft,setDraft]=React.useState({}),[busy,setBusy]=React.useState(false),[notice,setNotice]=React.useState('');
+  const revision=React.useRef(undefined),saving=React.useRef(false),alive=React.useRef(true),prefix=React.useId();
+  React.useEffect(()=>{alive.current=true;return()=>{alive.current=false;};},[]);
+  const ready=snapshot.status==='ready',writable=ready&&snapshot.writable===true&&snapshot.mode==='host'&&snapshot.revision!==undefined;
+  const changed=Object.keys(draft).length>0,stale=changed&&revision.current!==snapshot.revision;
+  const edit=(key,value)=>{if(saving.current||!writable)return;if(!changed)revision.current=snapshot.revision;setDraft(previous=>({...previous,[key]:value}));setNotice('修改尚未保存。');};
+  const discard=()=>{if(saving.current)return;setDraft({});revision.current=undefined;setNotice('已放弃未保存修改，显示当前配置。');};
+  const save=async()=>{
+   if(saving.current||!writable||!changed||stale)return;
+   const ops=[];
+   for(const field of fields){const entry=draft[field.key];if(!entry)continue;
+    if(field.readOnly){setNotice('固定约束不能修改。');return;}
+    if(entry.op==='unset'){ops.push({op:'unset',path:[field.key]});continue;}
+    const raw=entry.value,value=field.kind==='number'?Number(raw):raw;
+    if(field.kind==='number'&&(String(raw).trim()===''||!Number.isSafeInteger(value)||value<field.min||value>field.max)||field.kind==='select'&&!field.options.some(option=>option.value===value)){setNotice(field.name+'的值不在所列范围内，未保存。');return;}
+    ops.push({op:'set',path:[field.key],value});
+   }
+   saving.current=true;setBusy(true);setNotice('正在保存，请稍候。');
+   try{
+    const accepted=await form.mutate(ops,revision.current);
+    if(!alive.current)return;
+    if(accepted===true){setDraft({});revision.current=undefined;setNotice('已保存。运行中的这一轮不变；请按各项生效说明使用新会话。');}
+    else setNotice('未保存：配置已变化或官方设置服务拒绝了修改。草稿已保留；核对当前值后可放弃草稿重新修改，不会自动重试。');
+   }catch{if(alive.current)setNotice('保存失败，草稿已保留。请检查连接及官方配置状态；不会自动重试。');}
+   finally{saving.current=false;if(alive.current)setBusy(false);}
+  };
+  const stateMessage=snapshot.mode!=='host'?'当前连接不提供持久配置写入，本页不能保存。':!ready?'尚未取得官方配置，当前不能修改。':!snapshot.writable?'当前配置由更高层覆盖或不可写，本页不能修改。':stale?'其他地方已更新配置；本页草稿保留。请放弃草稿后按最新值重新修改。':'';
+  return h('section',{'aria-label':'远程助手参数',style:{maxWidth:850}},
+   h('h2',null,'远程助手参数'),
+   h('p',null,'这些参数用于本客户端当前配置下的 Claude（远程主机）和 Codex（远程主机），不改变其他模型或主机账号权限。没有总开关；关闭整个插件请使用官方插件管理。'),
+   stateMessage&&h('p',{role:'status'},stateMessage),
+   h('form',{onSubmit:event=>{event.preventDefault();void save();}},
+    ...fields.map(field=>{
+     const entry=draft[field.key],accepted=ready?snapshot.value?.[field.key]:undefined;
+     const base=snapshot.base,hasBase=base!==null&&typeof base==='object'&&Object.hasOwn(base,field.key)&&base[field.key]!==undefined;
+     const value=entry?.op==='set'?entry.value:entry?.op==='unset'&&hasBase?base[field.key]:accepted;
+     const id=prefix+'-'+field.key,description=id+'-description';
+     const control=field.readOnly?h('p',{'aria-label':field.name+'当前值'},String(value??'尚未读取')+'（固定，不可切换）'):field.kind==='select'?h('select',{id,value:value??'',disabled:!writable||busy,'aria-describedby':description,onChange:event=>edit(field.key,{op:'set',value:event.target.value})},value===undefined&&h('option',{value:'',disabled:true},'尚未读取'),...field.options.map(option=>h('option',{key:option.value,value:option.value},option.name))):h('input',{id,type:'number',step:1,min:field.min,max:field.max,value:value??'',disabled:!writable||busy,'aria-describedby':description,onChange:event=>edit(field.key,{op:'set',value:event.target.value})});
+     return h('fieldset',{key:field.key,style:{marginBottom:18,padding:14,border:'1px solid currentColor',borderRadius:6}},
+      h('legend',null,field.name),h('label',{htmlFor:field.readOnly?undefined:id},field.name+'（'+field.key+'）'),
+      h('div',null,control),h('div',{id:description},
+       h('p',null,'默认值：'+field.defaultValue+'；范围：'+field.range),
+       h('p',null,'生效范围：'+field.scope),h('p',null,'生效时间：'+field.when),h('p',null,'调整或关闭的后果：'+field.consequence)),
+      entry?.op==='unset'&&h('p',null,hasBase?'将移除本项覆盖，恢复所示继承值；尚未保存。':'将移除本项覆盖；继承层未设此项，保存后由官方配置确定（默认值：'+field.defaultValue+'）。输入框仍显示保存前值，尚未保存。'),
+      !field.readOnly&&h('button',{type:'button',disabled:!writable||busy,onClick:()=>edit(field.key,{op:'unset'})},'恢复继承值：'+field.name));
+    }),
+    h('div',null,h('button',{type:'submit',disabled:!writable||!changed||busy||stale},busy?'正在保存…':'保存修改'),h('button',{type:'button',disabled:!changed||busy,onClick:discard},'放弃未保存修改'))),
+   h('p',{role:'status','aria-live':'polite'},notice),h('h3',null,'必须保持的正确性约束'),
+   h('p',null,'以下保护默认开启且不能关闭。关闭会使输入、审批、执行位置或记录失去可信归属，并非可以放宽的偏好。'),
+   h('dl',null,...invariants.flatMap(([name,state,why])=>[h('dt',{key:name},name+'：'+state),h('dd',{key:name+'-why'},why)])));
+ }
+ ctx.effect(()=>ctx.configForms.whileServed(['ai-workbench-codex'],()=>ctx.slots.inject('settings.plugins.tab',()=>ctx.slots.register({name:'settings.plugins.tab',id:'ai-workbench-remote-parameters',order:90,label:()=> '远程助手参数',inject:()=>({form:ctx.configForms.get('ai-workbench-codex')})},Panel))));
+}
+
   return{inject:['locale','connection'],apply(ctx){
+    ctx.inject(['slots','configForms'],settings=>mountRuntimeSettings(settings,require('react'),settingsFields));
     ctx.effect(()=>ctx.locale.register('ai-workbench-codex',messages),'Codex official translations');
     ctx.effect(()=>{
       let disposed=false,connected=false,previous,generation=0,request=new AbortController(),queue=Promise.resolve();

package/dist/conversation-details.d.ts

@@ -31,7 +31,7 @@ export type DetailSink = {
 };
 /** Only objects created by this module are trusted as redaction markers. */
 export declare function isSanitizedRedaction(value: unknown): boolean;
-/** Sanitize an internal observation without attaching any L wire semantics. */
+export declare function sanitizeDisplayLabel(value: string): string;
 export declare function sanitizeObservation(observation: DetailObservation, protectModelMaterial?: boolean): Readonly<SanitizedObservation>;
 /** Internal diagnostic recorder; a sink is not an assertion that an L wire API exists. */
 export declare class ConversationDetails {

package/dist/conversation-details.js

@@ -1,4 +1,5 @@
 import { randomUUID } from 'node:crypto';
+import { STAGES } from "./stage-timing.js";
 const redactionMarkers = new WeakSet();
 function redaction(fields) {
     const marker = { redacted: true, ...fields };
@@ -92,7 +93,7 @@ function safeText(value) {
     const url = cleanUrls(value);
     return url.changed ? redaction({ reason: 'URL敏感部分', value: url.value }) : value;
 }
-function safeLabel(value) {
+export function sanitizeDisplayLabel(value) {
     if (typeof value !== 'string')
         throw new TypeError('Detail observation labels must be strings');
     // Inspect credentials before removing control characters, so a bearer newline cannot evade detection.
@@ -254,19 +255,98 @@ function usageStructure(value, key = '') {
         return value;
     return opaqueStructure(value);
 }
+/** Only fixed local stage names and finite nonnegative millisecond observations. */
+function timingStructure(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return opaqueStructure(value);
+    return Object.fromEntries(Object.entries(value).map(([key, child]) => {
+        if (key === 'phase' && typeof child === 'string' && Object.hasOwn(STAGES, child))
+            return [key, child];
+        if (key === 'clock' && child === 'client-monotonic' || key === 'outcome' && (child === 'ok' || child === 'failed'))
+            return [key, child];
+        if (['durationMs', 'elapsedMs'].includes(key) && typeof child === 'number' && Number.isFinite(child) && child >= 0)
+            return [key, child];
+        return [key, opaqueStructure(child)];
+    }));
+}
+/** Only our two model-configuration observations approve these exact diagnostic
+ * paths. Directory source, config metadata and arbitrary subtrees stay opaque. */
+function modelConfigurationStructure(value, level = 'root') {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return opaqueStructure(value);
+    if (isSanitizedRedaction(value))
+        return value;
+    const strings = {
+        root: ['resolvedModel', 'requestedEffort', 'reason'], selected: ['id', 'value', 'name', 'resolvedModel', 'effort'],
+        actual: ['model', 'effort', 'modelConfigId', 'effortConfigId'], reasoning: ['defaultValue'], effort: ['value', 'name'],
+    };
+    return Object.fromEntries(Object.entries(value).map(([key, child]) => {
+        if (typeof child === 'string' && strings[level].includes(key))
+            return [key, child];
+        if (level === 'root' && key === 'status' && child === 'remote-configured')
+            return [key, child];
+        if (level === 'actual' && typeof child === 'boolean' && ['confirmed', 'effortAvailable'].includes(key))
+            return [key, child];
+        if (level === 'reasoning' && key === 'defaultKnown' && typeof child === 'boolean')
+            return [key, child];
+        if (child === null && ((level === 'root' && ['actual', 'requestedEffort'].includes(key)) || (level === 'selected' && key === 'resolvedModel') || (level === 'reasoning' && key === 'defaultValue')))
+            return [key, null];
+        if (level === 'root' && key === 'selected')
+            return [key, modelConfigurationStructure(child, 'selected')];
+        if (level === 'root' && ['configured', 'actual'].includes(key))
+            return [key, modelConfigurationStructure(child, 'actual')];
+        if (level === 'selected' && key === 'reasoning')
+            return [key, modelConfigurationStructure(child, 'reasoning')];
+        if (level === 'reasoning' && key === 'options' && Array.isArray(child))
+            return [key, child.map(option => modelConfigurationStructure(option, 'effort'))];
+        return [key, opaqueStructure(child)];
+    }));
+}
 /** Sanitize an internal observation without attaching any L wire semantics. */
+function contextTransitionStructure(value, history = false) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value) || isSanitizedRedaction(value))
+        return opaqueStructure(value);
+    return Object.fromEntries(Object.entries(value).map(([key, child]) => {
+        if (!history && key === 'history')
+            return [key, contextTransitionStructure(child, true)];
+        if (!history && typeof child === 'string' && (['oldSessionId', 'newSessionId'].includes(key) || (['oldContextSha256', 'newContextSha256'].includes(key) && /^[a-fA-F0-9]{64}$/u.test(child)) || (key === 'reason' && child === 'system-context-changed')))
+            return [key, child];
+        if (history && ((key === 'scope' && child === 'visible-user-assistant-text-and-images') || (key === 'reasoningOmissionReason' && child === 'dsh-internal-reasoning') || (['textBlocks', 'imageBlocks', 'offloadedImagePlaceholders', 'omittedReasoningBlocks'].includes(key) && typeof child === 'number' && Number.isSafeInteger(child) && child >= 0)))
+            return [key, child];
+        return [key, opaqueStructure(child)];
+    }));
+}
+function employeeStructure(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return opaqueStructure(value);
+    const strings = new Set(['executionId', 'workspaceId', 'bindingId', 'instanceId', 'deviceId', 'endpointInstanceId', 'executionContextId', 'bridgeInstanceId', 'cwd', 'hostCwd', 'remoteUser', 'operation', 'status', 'reason', 'source', 'claudeAcpVersion', 'sdkVersion']);
+    const numbers = new Set(['uid', 'pid', 'childPid', 'generation', 'epoch', 'device', 'inode', 'killGraceMs', 'maxBytes']);
+    return Object.fromEntries(Object.entries(value).map(([key, child]) => {
+        if (strings.has(key) && typeof child === 'string')
+            return [key, child];
+        if (numbers.has(key) && typeof child === 'number' && Number.isSafeInteger(child) && child >= 0)
+            return [key, child];
+        if (['supported', 'unsupported'].includes(key) && Array.isArray(child))
+            return [key, child.map(x => typeof x === 'string' ? x : opaqueStructure(x))];
+        return [key, opaqueStructure(child)];
+    }));
+}
 export function sanitizeObservation(observation, protectModelMaterial = false) {
     const payload = snapshotPayload(observation.payload, new Set(), protectModelMaterial && observation.kind !== 'commands');
     return freezeDeep({
         kind: observation.kind, severity: observation.severity,
-        code: safeLabel(observation.code), summary: safeLabel(observation.summary),
-        ...(observation.method === undefined ? {} : { method: safeLabel(observation.method) }),
+        code: sanitizeDisplayLabel(observation.code), summary: sanitizeDisplayLabel(observation.summary),
+        ...(observation.method === undefined ? {} : { method: sanitizeDisplayLabel(observation.method) }),
         payload: !protectModelMaterial ? payload
-            : observation.kind === 'commands' ? catalogStructure(payload)
-                : observation.kind === 'usage' ? usageStructure(payload)
-                    : observation.kind === 'need' ? payload
-                        : observation.kind === 'tool' || ['SDK_ITEM', 'SDK_TOOL', 'ACP_SESSION_UPDATE', 'ACP_IDLE_UPDATE'].includes(observation.code) ? toolStructure(payload)
-                            : opaqueStructure(payload),
+            : observation.kind === 'session' && observation.code === 'CODEX_CONTEXT_SESSION_REPLACED' ? contextTransitionStructure(payload)
+                : observation.kind === 'session' && ['MODEL_CONFIGURATION_CONFIRMED', 'MODEL_CONFIGURATION_FAILED'].includes(observation.code) ? modelConfigurationStructure(payload)
+                    : observation.kind === 'commands' ? catalogStructure(payload)
+                        : observation.kind === 'usage' ? usageStructure(payload)
+                            : observation.kind === 'session' && observation.code === 'REMOTE_STAGE_TIMING' ? timingStructure(payload)
+                                : observation.kind === 'session' && ['CLAUDE_EMPLOYEE_OPERATION', 'CLAUDE_EMPLOYEE_PROCESS', 'CLAUDE_EMPLOYEE_REVOKED', 'CLAUDE_EMPLOYEE_SCOPE'].includes(observation.code) ? employeeStructure(payload)
+                                    : observation.kind === 'need' ? payload
+                                        : observation.kind === 'tool' || ['SDK_ITEM', 'SDK_TOOL', 'ACP_SESSION_UPDATE', 'ACP_IDLE_UPDATE'].includes(observation.code) ? toolStructure(payload)
+                                            : opaqueStructure(payload),
     });
 }
 function validatedScope(scope) {

package/dist/employee-endpoint.d.ts

@@ -0,0 +1,91 @@
+import type { ConnectApi as LApi, LocalWorkspaceContextRequest } from '@ai-workbench/connect/api';
+import type { ConnectTarget } from './provider.ts';
+import type { DetailObservation } from './conversation-details.ts';
+/** Exact consumer subset of N0.4.4 employee-endpoint v1; no new provider fields. */
+export interface EmployeeEndpointTarget {
+    version: 1;
+    local: {
+        instanceId: string;
+        epoch: number;
+        workspaceId: string;
+        bindingId: string;
+        directory: {
+            path: string;
+            device: number;
+            inode: number;
+        };
+    };
+    endpoint: {
+        deviceId: string;
+        endpointInstanceId: string;
+        executionContextId: string;
+        remoteUser: string;
+        remoteUid: number;
+        remoteHome: string;
+        endpointCwd: string;
+        endpointShell: string;
+    };
+    bridge: {
+        protocolVersion: 1;
+        command: '/usr/local/aw-host/bin/aw-employee-bridge';
+        settingsPath: string;
+        bridgeInstanceId: string;
+        generation: number;
+    };
+}
+export interface EmployeeNetworkApi {
+    prepareEmployeeEndpoint(request: LocalWorkspaceContextRequest, signal: AbortSignal): Promise<{
+        ok: true;
+        value: EmployeeEndpointTarget;
+    } | {
+        ok: false;
+        error: {
+            code: string;
+            needs: string;
+            message: string;
+            actor: string;
+        };
+    }>;
+    getState(): {
+        phase: 'starting' | 'online' | 'blocked' | 'stopped';
+    };
+    onState(listener: (event: {
+        kind: 'lost' | 'restored';
+        state: {
+            phase: 'starting' | 'online' | 'blocked' | 'stopped';
+        };
+    }) => void): () => void;
+}
+export type EmployeeConnectApi = Pick<LApi, 'getContractInfo' | 'getConnectionState' | 'onConnectionState' | 'getSshTarget' | 'getLocalWorkspaceContext' | 'getWorkspaceLocationState' | 'onWorkspaceLocationState'>;
+export interface EmployeeWorkspace {
+    workspaceId: string;
+    directory: {
+        path: string;
+        device: number;
+        inode: number;
+    };
+}
+export interface EmployeeLeaseOptions {
+    getConnect: () => EmployeeConnectApi | undefined;
+    getNetwork: () => EmployeeNetworkApi | undefined;
+    readWorkspace: () => Promise<EmployeeWorkspace>;
+    host: ConnectTarget;
+    sessionId: string;
+    control: (host: ConnectTarget, command: string, signal?: AbortSignal) => Promise<string>;
+    detail: (detail: DetailObservation) => void;
+}
+export declare function endpointArguments(target: EmployeeEndpointTarget): string[];
+export declare function endpointCommand(target: EmployeeEndpointTarget): string;
+export declare function verifyEmployeeTarget(target: EmployeeEndpointTarget, request: LocalWorkspaceContextRequest, directory: EmployeeWorkspace['directory'], host: ConnectTarget): void;
+export declare function verifyBridgeTarget(value: unknown, expected: EmployeeEndpointTarget): {
+    sshArgs: string[];
+};
+/** Holds only this workspace's dispatch fence. N continues to own the shared device service. */
+export interface EmployeeLease {
+    target: EmployeeEndpointTarget;
+    request: Readonly<LocalWorkspaceContextRequest>;
+    signal: AbortSignal;
+    validate(callerSignal?: AbortSignal): Promise<EmployeeEndpointTarget>;
+    close(): Promise<void>;
+}
+export declare function openEmployeeLease(options: EmployeeLeaseOptions, initialSignal?: AbortSignal): Promise<EmployeeLease>;