@ai-workbench/remote-agent 0.8.2 → 0.8.10

package/dist/employee-location.js

@@ -0,0 +1,51 @@
+import { NeedError } from "./remote.js";
+import { isDeepStrictEqual } from 'node:util';
+const fail = (code) => new NeedError(code, '员工电脑的工作区或执行连接已变化，本轮没有继续执行。', '当前工作区绑定与员工端执行器');
+const absolute = (s) => typeof s === 'string' && s.startsWith('/') && !s.includes('\0');
+const uuid = (s) => typeof s === 'string' && /^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/i.test(s);
+const object = (x) => !!x && typeof x === 'object' && !Array.isArray(x);
+const same = isDeepStrictEqual;
+function endpointValue(value, local, settingsPath) {
+    if (!object(value) || value.version !== 1 || !same(value.local, local) || !object(value.endpoint) || !object(value.bridge))
+        throw fail('EMPLOYEE_ENDPOINT_INVALID');
+    const e = value.endpoint, b = value.bridge;
+    if (typeof e.deviceId !== 'string' || !/^[a-f0-9]{64}$/.test(e.deviceId) || !uuid(e.endpointInstanceId) || !uuid(e.executionContextId) || typeof e.remoteUser !== 'string' || !e.remoteUser || !Number.isInteger(e.remoteUid) || Number(e.remoteUid) < 1 || Number(e.remoteUid) > 4294967294 || !absolute(e.remoteHome) || e.endpointCwd !== e.remoteHome || !absolute(e.endpointShell) || b.protocolVersion !== 1 || b.command !== '/usr/local/aw-host/bin/aw-employee-bridge' || b.settingsPath !== settingsPath || !uuid(b.bridgeInstanceId) || !Number.isSafeInteger(b.generation) || Number(b.generation) < 1)
+        throw fail('EMPLOYEE_ENDPOINT_INVALID');
+    // Copy only the public target fields; never retain process/environment snapshots.
+    return { version: 1, local: structuredClone(local), endpoint: { deviceId: e.deviceId, endpointInstanceId: e.endpointInstanceId, executionContextId: e.executionContextId, remoteUser: e.remoteUser, remoteUid: Number(e.remoteUid), remoteHome: e.remoteHome, endpointCwd: e.endpointCwd, endpointShell: e.endpointShell }, bridge: { protocolVersion: 1, command: b.command, settingsPath, bridgeInstanceId: b.bridgeInstanceId, generation: Number(b.generation) } };
+}
+/** One admission binds source/canonical directory and real N/S execution identity. No host-path substitute. */
+export async function admitEmployeeLocation(options) {
+    const { api, network, workspace, connection, settingsPath } = options;
+    const read = async (signal) => {
+        signal?.throwIfAborted();
+        const state = api.getWorkspaceLocationState();
+        if (state.phase !== 'ready' || state.instanceId !== connection.instanceId || state.epoch !== connection.epoch)
+            throw fail('EMPLOYEE_CONTEXT_CHANGED');
+        const rows = state.items.filter(x => x.workspaceId === workspace.id), item = rows[0];
+        if (rows.length !== 1 || !item || item.source !== 'local' || item.status !== 'selected' || !item.bindingId)
+            throw fail('EMPLOYEE_CONTEXT_CHANGED');
+        const request = { instanceId: connection.instanceId, epoch: connection.epoch, workspaceId: workspace.id, expectedBindingId: item.bindingId };
+        const result = await api.getLocalWorkspaceContext(request);
+        signal?.throwIfAborted();
+        if (!result.ok)
+            throw new NeedError(result.error.code, result.error.message, result.error.requires);
+        const c = result.value;
+        if (c.version !== 1 || c.source !== 'local' || c.instanceId !== connection.instanceId || c.epoch !== connection.epoch || c.workspaceId !== workspace.id || c.bindingId !== item.bindingId || !absolute(c.directory?.path) || c.directory.path !== workspace.path || !Number.isSafeInteger(c.directory.device) || !Number.isSafeInteger(c.directory.inode))
+            throw fail('EMPLOYEE_CONTEXT_CHANGED');
+        const after = api.getWorkspaceLocationState();
+        if (after.instanceId !== connection.instanceId || after.epoch !== connection.epoch || after.phase !== 'ready' || !after.items.some(x => x.workspaceId === workspace.id && x.bindingId === item.bindingId && x.source === 'local' && x.status === 'selected'))
+            throw fail('EMPLOYEE_CONTEXT_CHANGED');
+        return { request, local: { instanceId: c.instanceId, epoch: c.epoch, workspaceId: c.workspaceId, bindingId: c.bindingId, directory: structuredClone(c.directory) } };
+    };
+    const initial = await read(options.signal);
+    if (options.expectedLocal && !same(initial.local, options.expectedLocal))
+        throw fail('EMPLOYEE_CONTEXT_CHANGED');
+    const prepare = async (signal) => { signal.throwIfAborted(); const before = await read(signal); if (!same(before, initial))
+        throw fail('EMPLOYEE_CONTEXT_CHANGED'); const result = await network.prepareEmployeeEndpoint(initial.request, signal); signal.throwIfAborted(); if (!result.ok)
+        throw new NeedError(result.error.code, result.error.message, result.error.needs); const fresh = endpointValue(result.value, initial.local, settingsPath); const after = await read(signal); if (!same(after, initial))
+        throw fail('EMPLOYEE_CONTEXT_CHANGED'); return fresh; };
+    const endpoint = await prepare(options.signal ?? new AbortController().signal);
+    return { cwd: initial.local.directory.path, bindingId: initial.local.bindingId, workspaceId: initial.local.workspaceId, endpoint, validate: async (signal) => { const fresh = await prepare(signal); if (!same(fresh, endpoint))
+            throw fail('EMPLOYEE_CONTEXT_CHANGED'); } };
+}

package/dist/employee-mcp.d.ts

@@ -0,0 +1,42 @@
+import { type Socket } from 'node:net';
+import { type JSONRPCMessage, type Tool } from '@modelcontextprotocol/sdk/types.js';
+import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
+import type { EmployeeLease } from './employee-endpoint.ts';
+import { employeeRouting } from './employee-relay.ts';
+import type { DetailObservation } from './conversation-details.ts';
+import type { EmployeeShell } from './employee-shell.ts';
+export declare const EMPLOYEE_MCP_TOOLS: Tool[];
+/** Same newline-delimited MCP messages as stdio, over an employee-only Unix stream. */
+export declare class EmployeeSocketTransport implements Transport {
+    private socket;
+    private maxBytes;
+    onclose?: () => void;
+    onerror?: (error: Error) => void;
+    onmessage?: (message: JSONRPCMessage) => void;
+    private pending;
+    private ended;
+    private failure?;
+    get error(): Error | undefined;
+    private readonly lifetime;
+    readonly signal: AbortSignal;
+    constructor(socket: Socket, maxBytes: number);
+    private failed;
+    start(): Promise<void>;
+    send(message: JSONRPCMessage): Promise<void>;
+    close(): Promise<void>;
+}
+export interface EmployeeMcpOptions {
+    lease: EmployeeLease;
+    maxBytes: number;
+    killGraceMs: number;
+    activeSignal: () => AbortSignal | undefined;
+    detail: (event: DetailObservation) => void;
+    captureDetail?: () => ((event: DetailObservation) => void);
+    runShell?: EmployeeShell;
+}
+export interface EmployeeMcp {
+    routing: ReturnType<typeof employeeRouting>;
+    signal: AbortSignal;
+    close(): Promise<void>;
+}
+export declare function openEmployeeMcp(options: EmployeeMcpOptions): Promise<EmployeeMcp>;

package/dist/employee-mcp.js

@@ -0,0 +1,181 @@
+import { createServer } from 'node:net';
+import { mkdtemp, lstat, rm, access } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { CallToolRequestSchema, ListToolsRequestSchema, JSONRPCMessageSchema } from '@modelcontextprotocol/sdk/types.js';
+import { createEmployeeTools } from "./employee-tools.js";
+import { employeeRouting } from "./employee-relay.js";
+import { NeedError } from "./remote.js";
+const string = { type: 'string' }, integer = { type: 'integer' }, boolean = { type: 'boolean' };
+function schema(name, properties, required) { return { name, description: '在员工电脑所选工作区执行' + name + '；不在主机回退。', inputSchema: { type: 'object', properties, required, additionalProperties: false } }; }
+export const EMPLOYEE_MCP_TOOLS = [
+    schema('Read', { file_path: string, offset: integer, limit: integer, pages: string }, ['file_path']),
+    schema('Write', { file_path: string, content: string }, ['file_path', 'content']),
+    schema('Edit', { file_path: string, old_string: string, new_string: string, replace_all: boolean }, ['file_path', 'old_string', 'new_string']),
+    schema('Glob', { pattern: string, path: string }, ['pattern']),
+    schema('Grep', { pattern: string, path: string, glob: string, output_mode: string, '-B': integer, '-A': integer, '-C': integer, '-n': boolean, '-i': boolean, type: string, head_limit: integer, offset: integer, multiline: boolean }, ['pattern']),
+    schema('Bash', { command: string, timeout: integer, description: string, run_in_background: boolean, dangerouslyDisableSandbox: boolean }, ['command']),
+];
+/** Same newline-delimited MCP messages as stdio, over an employee-only Unix stream. */
+export class EmployeeSocketTransport {
+    socket;
+    maxBytes;
+    onclose;
+    onerror;
+    onmessage;
+    pending = Buffer.alloc(0);
+    ended = false;
+    failure;
+    get error() { return this.failure; }
+    lifetime = new AbortController();
+    signal = this.lifetime.signal;
+    constructor(socket, maxBytes) {
+        this.socket = socket;
+        this.maxBytes = maxBytes;
+    }
+    failed(error) { try {
+        this.onerror?.(error);
+    }
+    catch (observation) {
+        this.failure = observation instanceof Error ? observation : new Error('EMPLOYEE_MCP_OBSERVATION_FAILED');
+    }
+    finally {
+        void this.close();
+    } }
+    async start() {
+        this.socket.on('error', error => this.failed(error));
+        this.socket.on('close', () => void this.close());
+        this.socket.on('data', (bytes) => {
+            try {
+                let cursor = 0;
+                while (cursor < bytes.length) {
+                    const newline = bytes.indexOf(10, cursor), end = newline < 0 ? bytes.length : newline;
+                    if (this.pending.length + end - cursor > this.maxBytes)
+                        throw new NeedError('EMPLOYEE_MCP_MESSAGE_TOO_LARGE', '本机工具消息超过acpMaxMessageBytes，未截断。', '调整具名会话消息容量');
+                    this.pending = Buffer.concat([this.pending, bytes.subarray(cursor, end)]);
+                    cursor = newline < 0 ? bytes.length : newline + 1;
+                    if (newline >= 0) {
+                        const line = new TextDecoder('utf8', { fatal: true }).decode(this.pending);
+                        this.pending = Buffer.alloc(0);
+                        this.onmessage?.(JSONRPCMessageSchema.parse(JSON.parse(line)));
+                    }
+                }
+            }
+            catch (error) {
+                this.failed(error);
+            }
+        });
+    }
+    async send(message) {
+        if (this.ended)
+            throw new Error('EMPLOYEE_MCP_CLOSED');
+        const wire = Buffer.from(JSON.stringify(message) + '\n');
+        if (wire.length - 1 > this.maxBytes) {
+            await this.close();
+            throw new Error('EMPLOYEE_MCP_MESSAGE_TOO_LARGE');
+        }
+        await new Promise((yes, no) => this.socket.write(wire, error => error ? no(error) : yes()));
+    }
+    async close() { if (this.ended)
+        return; this.ended = true; this.lifetime.abort(); this.socket.destroy(); this.onclose?.(); }
+}
+export async function openEmployeeMcp(options) {
+    if (process.platform !== 'darwin')
+        throw new NeedError('EMPLOYEE_PLATFORM_UNSUPPORTED', '本机执行目前只支持Mac。', '已交Mac员工端合同');
+    if (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 1)
+        throw new NeedError('SETTINGS_REQUIRED', '本机工具消息容量无效。', 'acpMaxMessageBytes');
+    await access('/usr/bin/nc', constants.X_OK);
+    const tools = createEmployeeTools({ cwd: options.lease.target.local.directory.path, shell: options.lease.target.endpoint.endpointShell, uid: options.lease.target.endpoint.remoteUid, maxBytes: options.maxBytes, killGraceMs: options.killGraceMs, detail: observe, runShell: options.runShell, validate: signal => options.lease.validate(signal).then(() => { }) });
+    const root = await mkdtemp('/private/tmp/aw-x87-'), socketPath = root + '/mcp';
+    try {
+        const info = await lstat(root);
+        if ((info.mode & 0o077) !== 0 || info.uid !== process.getuid?.())
+            throw new NeedError('EMPLOYEE_MCP_STORAGE_INVALID', '本机工具私有通道不可用。', '当前员工的700私有Unix目录');
+    }
+    catch (error) {
+        await tools.close();
+        await rm(root, { recursive: true });
+        throw error;
+    }
+    const clients = new Set(), transports = new Set();
+    let closing, diagnosticFailure;
+    const failureLifetime = new AbortController();
+    const poison = (error) => {
+        diagnosticFailure ??= error;
+        failureLifetime.abort(error);
+        // Close is memoized synchronously: no fresh connection/call can pass the fence.
+        void options.lease.close().catch(failure => { diagnosticFailure ??= failure; });
+        void close().catch(failure => { diagnosticFailure ??= failure; });
+    };
+    function observeUsing(event, sink) { if (diagnosticFailure)
+        throw diagnosticFailure; try {
+        sink(event);
+    }
+    catch (error) {
+        poison(error);
+        throw error;
+    } }
+    function observe(event) { observeUsing(event, options.detail); }
+    const server = createServer(socket => {
+        if (closing || failureLifetime.signal.aborted || options.lease.signal.aborted) {
+            socket.destroy();
+            return;
+        }
+        const mcp = new Server({ name: 'ai-workbench-employee', version: '0.8.10' }, { capabilities: { tools: {} } }), transport = new EmployeeSocketTransport(socket, options.maxBytes);
+        clients.add(mcp);
+        transports.add(transport);
+        mcp.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: EMPLOYEE_MCP_TOOLS }));
+        mcp.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
+            const active = options.activeSignal();
+            if (!active || active.aborted)
+                return { isError: true, content: [{ type: 'text', text: 'EMPLOYEE_NO_ACTIVE_TURN：当前没有已接纳的用户轮次，本机工具未执行。' }] };
+            const signal = AbortSignal.any([active, extra.signal, transport.signal, options.lease.signal, failureLifetime.signal]);
+            const sink = options.captureDetail?.() ?? options.detail;
+            return tools.call(request.params.name, request.params.arguments ?? {}, signal, event => observeUsing(event, sink));
+        });
+        mcp.onerror = () => { try {
+            observe({ kind: 'session', severity: 'warning', code: 'CLAUDE_EMPLOYEE_MCP_UNKNOWN', summary: '本机工具连接出现协议或传输错误；在途结果未知，没有重放' });
+        }
+        catch (error) {
+            poison(error);
+        } };
+        mcp.onclose = () => { clients.delete(mcp); transports.delete(transport); };
+        void mcp.connect(transport).catch(() => { socket.destroy(); });
+    });
+    const close = () => closing ??= Promise.resolve().then(async () => {
+        options.lease.signal.removeEventListener('abort', aborted);
+        const errors = [], clean = async (operation) => { try {
+            await operation();
+        }
+        catch (error) {
+            if (!errors.includes(error))
+                errors.push(error);
+        } };
+        for (const transport of transports)
+            await clean(() => transport.close());
+        await Promise.all([...clients].map(client => clean(() => client.close())));
+        await clean(() => tools.close());
+        await clean(() => options.lease.close());
+        if (server.listening)
+            await clean(() => new Promise((yes, no) => server.close(error => error ? no(error) : yes())));
+        await clean(() => rm(root, { recursive: true }));
+        if (diagnosticFailure && !errors.includes(diagnosticFailure))
+            errors.unshift(diagnosticFailure);
+        if (errors.length === 1)
+            throw errors[0];
+        if (errors.length)
+            throw new AggregateError(errors, 'EMPLOYEE_MCP_CLEANUP_FAILED');
+    });
+    const aborted = () => { void close().catch(error => { diagnosticFailure ??= error; failureLifetime.abort(error); }); };
+    try {
+        await new Promise((yes, no) => { server.once('error', no); server.listen(socketPath, () => { server.removeListener('error', no); yes(); }); });
+        options.lease.signal.addEventListener('abort', aborted, { once: true });
+        if (options.lease.signal.aborted)
+            throw options.lease.signal.reason;
+        return { routing: employeeRouting(options.lease.target, socketPath, options.maxBytes), signal: failureLifetime.signal, close };
+    }
+    catch (error) {
+        await close();
+        throw error;
+    }
+}

package/dist/employee-native.d.ts

@@ -0,0 +1,18 @@
+/** Fixed native input already proven by D18/D20; never resolve a PATH executable. */
+export declare const EMPLOYEE_NATIVE: Readonly<{
+    version: "0.160.1";
+    platform: "darwin";
+    arch: "arm64";
+    package: "@openai/codex-darwin-arm64";
+    packageVersion: "0.160.1-darwin-arm64";
+    triple: "aarch64-apple-darwin";
+    sha256: "09fa44fdc37a5fc70dc1ace31235f90468a2e193d0e85f7552eab068ea2582be";
+}>;
+export declare function resolveEmployeeNative(ports?: {
+    platform?: string;
+    arch?: string;
+    resolve?: (name: string) => string;
+}): Promise<{
+    path: string;
+    sha256: string;
+}>;

package/dist/employee-native.js

@@ -0,0 +1,38 @@
+import { createRequire } from 'node:module';
+import { readFile, lstat, realpath, access } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { NeedError } from "./remote.js";
+const require = createRequire(import.meta.url);
+/** Fixed native input already proven by D18/D20; never resolve a PATH executable. */
+export const EMPLOYEE_NATIVE = Object.freeze({ version: '0.160.1', platform: 'darwin', arch: 'arm64', package: '@openai/codex-darwin-arm64', packageVersion: '0.160.1-darwin-arm64', triple: 'aarch64-apple-darwin', sha256: '09fa44fdc37a5fc70dc1ace31235f90468a2e193d0e85f7552eab068ea2582be' });
+export async function resolveEmployeeNative(ports = {}) {
+    if ((ports.platform ?? process.platform) !== EMPLOYEE_NATIVE.platform || (ports.arch ?? process.arch) !== EMPLOYEE_NATIVE.arch)
+        throw new NeedError('EMPLOYEE_PLATFORM_UNSUPPORTED', '当前版本的Codex本机执行仅验证了Apple芯片Mac，本轮没有执行。', '对应平台固定执行器及验证');
+    let manifest;
+    try {
+        manifest = (ports.resolve ?? require.resolve)(EMPLOYEE_NATIVE.package + '/package.json');
+    }
+    catch {
+        throw new NeedError('AW_EMPLOYEE_BINARY_MISSING', 'Codex本机执行组件没有装齐，本轮没有执行，请联系管理员。', '随插件安装的固定Codex0.160.1执行组件');
+    }
+    try {
+        const metadata = JSON.parse(await readFile(manifest, 'utf8'));
+        if (metadata.version !== EMPLOYEE_NATIVE.packageVersion)
+            throw new NeedError('AW_EMPLOYEE_BINARY_VERSION', 'Codex本机执行组件版本不匹配，本轮没有执行。', '固定Codex0.160.1组件');
+        const path = join(dirname(manifest), 'vendor', EMPLOYEE_NATIVE.triple, 'bin', 'codex');
+        const info = await lstat(path);
+        if (!info.isFile() || info.isSymbolicLink() || await realpath(path) !== path)
+            throw new NeedError('AW_EMPLOYEE_BINARY_INVALID', 'Codex本机执行组件位置无效，本轮没有执行。', '安装包内的固定原生执行器');
+        await access(path, constants.X_OK);
+        if (createHash('sha256').update(await readFile(path)).digest('hex') !== EMPLOYEE_NATIVE.sha256)
+            throw new NeedError('AW_EMPLOYEE_BINARY_HASH', 'Codex本机执行组件校验不一致，本轮没有执行。', '固定原生执行器SHA256');
+        return { path, sha256: EMPLOYEE_NATIVE.sha256 };
+    }
+    catch (error) {
+        if (error instanceof NeedError)
+            throw error;
+        throw new NeedError('AW_EMPLOYEE_BINARY_INVALID', 'Codex本机执行组件无法核验，本轮没有执行。', '完整安装包与固定执行器');
+    }
+}

package/dist/employee-provider.d.ts

@@ -0,0 +1,42 @@
+import type { NetworkApi } from '@ai-workbench/network/api';
+import type { AgentDefinition } from './agents.ts';
+import type { ConnectApi, ConnectTarget, ConnectionState, Project, Runtime, RuntimeRequest } from './provider.ts';
+import { type BrokerIo, type SshArgv } from './broker.ts';
+import type { DetailChannel } from './remote-details.ts';
+import type { LocalUserTurnAcceptance } from '@ai-workbench/connect/api';
+export interface EmployeeProviderOptions {
+    currentUserTurn(request: RuntimeRequest): {
+        turn: number;
+        userMessageId: string;
+    };
+    getNetwork(): NetworkApi | undefined;
+    workspace(request: RuntimeRequest): Promise<{
+        id: string;
+        path: string;
+    }>;
+    native(): Promise<{
+        path: string;
+        sha256: string;
+    }>;
+    argv?: SshArgv;
+    io?: BrokerIo;
+}
+interface Options {
+    employee?: EmployeeProviderOptions;
+    open?: (target: ConnectTarget, project: Project, request: RuntimeRequest) => Promise<Runtime>;
+    details?: (request: RuntimeRequest, api: ConnectApi, connection: ConnectionState, target: ConnectTarget) => Promise<DetailChannel>;
+}
+interface Admission {
+    api: ConnectApi;
+    target: ConnectTarget;
+    connection: ConnectionState;
+    request: RuntimeRequest;
+    stable: (signal?: AbortSignal) => Promise<unknown>;
+}
+/** Read-only local classification and explicit acceptance precede even ensureReady's SSH status. */
+export declare function acceptEmployeeUserTurn(get: () => ConnectApi | undefined, employee: EmployeeProviderOptions, agent: AgentDefinition, api: ConnectApi, request: RuntimeRequest): Promise<Readonly<LocalUserTurnAcceptance> | undefined>;
+/** Recheck the admitted read-only facts after readiness awaits, before the catalog command. */
+export declare function validateEmployeeUserTurn(get: () => ConnectApi | undefined, employee: EmployeeProviderOptions, api: ConnectApi, request: RuntimeRequest, connection: ConnectionState): Promise<void>;
+/** Source admission is separate from L's legacy host project resolver. */
+export declare function createEmployeeProvider(get: () => ConnectApi | undefined, options: Options, agent: AgentDefinition): (input: Admission) => Promise<Runtime | undefined>;
+export {};