@ai-workbench/remote-agent 0.8.21 → 0.8.23

package/dist/acp.js

@@ -1,14 +1,14 @@
 import { employeeExecutionInfo, employeeMcpSummary, employeeHttpNotice } from "./employee-info.js";
 import { employeeAdapterCodes, employeeOpenCauseCodes } from "./employee-reasons.js";
-import { CloseDiagnostics, withFailureEvidence } from "./close-diagnostics.js";
+import { CloseDiagnostics, withFirstFailureEvidence } from "./close-diagnostics.js";
 import * as acp from '@agentclientprotocol/sdk/unstable';
 import { NeedError } from "./remote.js";
 import { employeeFailure } from "./presentation.js";
-import { StageTiming } from "./stage-timing.js";
 import { isolateRpcIds } from "./rpc-namespace.js";
-import { recoveryCapabilities, supportsCodexContextPolicy } from "./recovery.js";
 import { sanitizeObservation, sanitizeDisplayLabel } from "./conversation-details.js";
 import { ModelConfiguration, ModelConfigurationError } from "./model-configuration.js";
+function employeeClaudeOptions(routing) { return { tools: [], disallowedTools: ['Read', 'Write', 'Edit', 'Glob', 'Grep', 'Bash', 'Agent', 'Task', 'TaskOutput', 'TaskStop'], toolAliases: structuredClone(routing.toolAliases) }; }
+const permissionRanks = { claude: { plan: 0, default: 1, acceptEdits: 1, bypassPermissions: 2 }, codex: { 'read-only': 0, 'workspace-write': 1, agent: 1, 'agent-full-access': 2 } };
 /** ACP v1 with explicitly negotiated SDK 2.0 lifecycle/context extensions. */
 export class AcpSession {
     connection;
@@ -29,6 +29,7 @@ export class AcpSession {
     codexNewSessionOnly = false;
     creatingReplacement = false;
     employeeMeta;
+    employeeRouting;
     employeeNegotiated = false;
     configuration;
     configRevision = 0;
@@ -36,6 +37,29 @@ export class AcpSession {
     selecting = false;
     pendingConfigurations = new Map();
     dispatchedPrompts = 0;
+    // The fixed public SDK preserves request params in Stream messages. Keep a
+    // permit per object, including while its write is queued after caller abort.
+    // No protocol metadata, SDK counters or private connection state is used.
+    promptPermissions = new WeakMap();
+    nativeModeRevision = 0;
+    nativeModeId;
+    nativeModeSource;
+    selectedPermission;
+    validateNativePermission(expected, reported) {
+        const actual = this.nativeModeId;
+        if (!expected || !actual || actual === expected.mode)
+            return;
+        const ranks = permissionRanks[expected.brand], before = ranks[expected.mode], after = ranks[actual];
+        const wider = before !== undefined && after !== undefined && after > before;
+        if (!reported.has(actual)) {
+            reported.add(actual);
+            this.detail({ kind: 'session', severity: wider ? 'warning' : after === undefined ? 'warning' : 'info', code: wider ? 'PERMISSION_MODE_WIDENED' : 'PERMISSION_MODE_INFORMATION', summary: wider ? '远端权限已超出本会话选择，本次没有继续派发。' : '远端权限模式与原确认值不同，差异已保留，本轮继续。', payload: { brand: expected.brand, requested: expected.mode, actual, source: this.nativeModeSource ?? null } });
+            if (wider)
+                this.closeDiagnostics.record({ layer: 'acp', initiator: 'acp.native-permission-gate', reason: 'PERMISSION_MODE_CHANGED', operation: 'session/prompt', action: 'failure', changes: [{ field: 'native.permission-mode', before: expected.mode, after: actual }] });
+        }
+        if (wider)
+            throw new NeedError('PERMISSION_MODE_CHANGED', '远端权限已超出本会话选择，本次未发送；具体原因已保留在技术详情。', '当前已选择档位范围内的远端权限');
+    }
     get promptDispatchCount() { return this.dispatchedPrompts; }
     get modelConfiguration() { return this.configuration?.snapshot; }
     get models() { if (!this.configuration)
@@ -47,7 +71,6 @@ export class AcpSession {
         else
             this.configuration = new ModelConfiguration(options, async (configId, value) => {
                 const result = await this.connection.agent.request(acp.methods.agent.session.setConfigOption, { sessionId: this.sessionId, configId, value }, { cancellationSignal: this.turnSignal });
-                this.hooks.broker?.acknowledge(acp.methods.agent.session.setConfigOption);
                 return result;
             }, reason => this.detail({ kind: 'session', severity: 'info', code: 'MODEL_CONFIGURATION_INFORMATION', summary: ({ PICKER_INCOMPLETE: '远端菜单没有穷举当前或所选值；以本轮精确配置回执为准。', CONFIG_UI_METADATA_INVALID: '远端配置的显示资料不完整；没有改变本轮选择。', UNRELATED_CONFIG_IGNORED: '远端有未使用的界面配置；未把它当模型配置入口。', OPTIONAL_CATEGORY_OMITTED: '远端省略了显示类别；继续使用本会话已核实的配置入口。', SAME_SELECTION_UPDATE: '收到同值或无关配置更新，本轮真实配置回执仍有效。' })[reason], payload: { reason } }), routing);
     }
@@ -88,7 +111,6 @@ export class AcpSession {
         if (this.busy || this.updating || this.selecting)
             throw new ModelConfigurationError('上一项会话操作尚未完成');
         signal?.throwIfAborted();
-        this.checkReporting();
         this.selecting = true;
         this.selected = { model, ...(effort === undefined ? {} : { effort }) };
         this.turnSignal = signal;
@@ -97,7 +119,6 @@ export class AcpSession {
                 throw new ModelConfigurationError('远端没有提供完整配置列表');
             const state = await this.configuration.select(model, effort);
             signal?.throwIfAborted();
-            this.checkReporting();
             return state;
         }
         finally {
@@ -105,16 +126,87 @@ export class AcpSession {
             this.selecting = false;
         }
     }
-    assertModelSelection(model, effort) {
-        if (!this.configuration)
-            throw new ModelConfigurationError('远端没有提供完整配置列表');
-        this.configuration.assertSelection(model, effort);
+    /** The permission selector controls real privilege, independently of model UX.
+     * Re-apply on every dispatch/restoration; a historical value is not an ACK.
+     * ACP permits a mode change while a prompt is active. */
+    async selectPermissionMode(mode, signal, brand) {
+        const failed = () => new NeedError('PERMISSION_MODE_UNCONFIRMED', '远程权限模式未能与本会话对齐，本次操作未继续。', '主机ACP的权限配置入口及同值回执');
+        if (!this.ready || !this.sessionId)
+            throw failed();
+        signal?.throwIfAborted();
+        if (brand === 'claude') {
+            const revision = this.nativeModeRevision;
+            let actual, confirmation;
+            try {
+                // This native setter's successful {} response acknowledges the requested
+                // mode. Claude 0.94.0 normally publishes config_option_update; its
+                // current_mode_update is conditional, so neither is a new hard gate.
+                await this.connection.agent.request(acp.methods.agent.session.setMode, { sessionId: this.sessionId, modeId: mode }, { cancellationSignal: signal });
+                signal?.throwIfAborted();
+                // Both notification kinds describe one mode. Their arrival order, not
+                // their kind, determines the latest native evidence during this setter.
+                if (this.nativeModeRevision > revision) {
+                    actual = this.nativeModeId;
+                    confirmation = this.nativeModeSource;
+                    if (actual !== mode)
+                        throw failed();
+                }
+                actual ??= mode;
+                confirmation ??= 'set_mode-response';
+                if (this.nativeModeRevision === revision) {
+                    this.nativeModeId = actual;
+                    this.nativeModeSource = 'set_mode-response';
+                    this.nativeModeRevision++;
+                }
+                this.selectedPermission = Object.freeze({ brand, mode });
+                this.detail({ kind: 'session', severity: 'info', code: 'PERMISSION_MODE_CONFIRMED', summary: '远程主机已确认本轮权限配置；下一次派发使用该档位，本机工具入口核验仍开启。', payload: { method: acp.methods.agent.session.setMode, requested: mode, actual, confirmation } });
+                return;
+            }
+            catch (error) {
+                const reasons = error instanceof acp.RequestError ? [error.message, record(error.data)?.details] : [];
+                const unavailable = mode === 'bypassPermissions' && reasons.some(reason => typeof reason === 'string' && reason.includes('bypassPermissions') && /not available|not allowed|disabled/i.test(reason));
+                const code = unavailable ? 'CLAUDE_BYPASS_UNAVAILABLE' : 'PERMISSION_MODE_UNCONFIRMED';
+                this.detail({ kind: 'session', severity: 'warning', code: 'PERMISSION_MODE_FAILED', summary: unavailable ? '主机没有开放完全权限，本轮没有降级到其它档位。' : '远程权限模式未能对齐，未假装放行。', payload: { method: acp.methods.agent.session.setMode, requested: mode, actual: actual ?? null, confirmation: confirmation ?? null, reason: signal?.aborted ? 'ABORTED' : code } });
+                if (signal?.aborted)
+                    signal.throwIfAborted();
+                if (unavailable)
+                    throw new NeedError(code, '主机没有为本会话开放完全权限，本轮未发送；我需要主机允许 bypassPermissions。', '主机本会话的 bypassPermissions 能力');
+                throw failed();
+            }
+        }
+        // Both protected native adapters contract the ID "mode". Category is
+        // optional picker metadata, so its omission is information, not authority.
+        const candidates = this.configuration?.snapshot.configOptions.filter(option => option.category === 'mode' || option.id === 'mode') ?? [];
+        if (candidates.length !== 1 || candidates[0].type !== 'select')
+            throw failed();
+        const configId = candidates[0].id;
+        if (candidates[0].category !== 'mode')
+            this.detail({ kind: 'session', severity: 'info', code: 'PERMISSION_MODE_INFORMATION', summary: '远端省略了权限菜单类别，继续使用原生合同中的权限配置入口。', payload: { reason: 'OPTIONAL_CATEGORY_OMITTED', configId } });
+        if (this.configuration.snapshot.configOptions.filter(option => option.id === configId).length !== 1)
+            throw failed();
+        try {
+            const result = await this.connection.agent.request(acp.methods.agent.session.setConfigOption, { sessionId: this.sessionId, configId, value: mode }, { cancellationSignal: signal });
+            this.receiveConfiguration(result.configOptions);
+            signal?.throwIfAborted();
+            const actual = this.configuration?.snapshot.configOptions.filter(option => option.id === configId);
+            if (actual?.length !== 1 || actual[0].type !== 'select' || actual[0].currentValue !== mode)
+                throw failed();
+            this.nativeModeId = actual[0].currentValue;
+            this.nativeModeSource = 'set_config_option-response';
+            this.nativeModeRevision++;
+            this.selectedPermission = Object.freeze({ brand, mode });
+            this.detail({ kind: 'session', severity: 'info', code: 'PERMISSION_MODE_CONFIRMED', summary: '本会话权限配置已同步到远程工具；下一次派发使用该档位，特殊安全审批仍按官方规则处理。', payload: { method: acp.methods.agent.session.setConfigOption, configId, requested: mode, actual: actual[0].currentValue, confirmation: 'set_config_option-response' } });
+        }
+        catch (error) {
+            this.detail({ kind: 'session', severity: 'warning', code: 'PERMISSION_MODE_FAILED', summary: '远程权限模式未能对齐，未假装放行。', payload: { requested: mode, reason: signal?.aborted ? 'ABORTED' : 'PERMISSION_MODE_UNCONFIRMED' } });
+            if (signal?.aborted)
+                signal.throwIfAborted();
+            throw failed();
+        }
     }
     reports = [];
-    reportingFailure;
-    timing = new StageTiming();
     async stage(phase, operation) { this.closeDiagnostics.stage = phase; try {
-        return await this.closeDiagnostics.run(phase, () => (this.hooks.timing ?? this.timing).run(phase, operation));
+        return await this.closeDiagnostics.run(phase, operation);
     }
     catch (error) {
         if (['acp-session-new', 'acp-session-resume', 'acp-session-load', 'acp-initialize'].includes(phase))
@@ -128,11 +220,8 @@ export class AcpSession {
         try {
             hooks.onDetail?.(safe);
         }
-        catch (cause) {
-            const first = !this.reportingFailure;
-            this.reportingFailure ??= { cause };
-            if (first)
-                this.close({ layer: 'acp', initiator: 'acp.reporting-failure', reason: 'CONVERSATION_DETAILS_FAILED', action: 'close' });
+        catch {
+            console.warn('[remote-agent] 会话诊断未保存');
         }
     }
     employeeNoticeNames = new Set();
@@ -145,9 +234,9 @@ export class AcpSession {
         this.detail({ kind: 'session', severity: 'info', code: 'EMPLOYEE_MCP_INFORMATION', summary: summary || '本机MCP策略已应用：' + info.httpMcpPolicy, payload: info });
         const notice = employeeHttpNotice({ ...info, ignoredHttp: info.ignoredHttp.filter(name => !this.employeeNoticeNames.has(name)), ignoredNativeHttp: info.ignoredNativeHttp.filter(name => !this.employeeNoticeNames.has(name)), ignoredHttpUnshown: this.employeeNoticeUnshown ? 0 : info.ignoredHttpUnshown, ignoredNativeHttpUnshown: this.employeeNoticeUnshown ? 0 : info.ignoredNativeHttpUnshown }, sanitizeDisplayLabel, !this.employeeNoticeUnshown);
         if (notice) {
-            for (const name of [...(info.httpMcpPolicy === 'ignore' ? info.ignoredHttp : []), ...info.ignoredNativeHttp])
+            for (const name of [...info.ignoredHttp, ...info.ignoredNativeHttp])
                 this.employeeNoticeNames.add(name);
-            if ((info.httpMcpPolicy === 'ignore' && info.ignoredHttpUnshown) || info.ignoredNativeHttpUnshown || [...(info.httpMcpPolicy === 'ignore' ? info.ignoredHttp : []), ...info.ignoredNativeHttp].some(name => sanitizeDisplayLabel(name) !== name || name.includes('[已脱敏：')))
+            if (info.ignoredHttpUnshown || info.ignoredNativeHttpUnshown || [...info.ignoredHttp, ...info.ignoredNativeHttp].some(name => sanitizeDisplayLabel(name) !== name || name.includes('[已脱敏：')))
                 this.employeeNoticeUnshown = true;
             this.hooks.onEmployeeNotice?.(notice);
         }
@@ -156,12 +245,9 @@ export class AcpSession {
         this.detail({ kind: 'need', severity: 'action-required', code: need.code, summary: need.message, payload: { requires: need.requires } }, hooks);
         hooks.onNeed?.(need);
     }
-    checkReporting() { if (this.reportingFailure)
-        throw new NeedError('CONVERSATION_DETAILS_FAILED', '技术详情未能记录；本轮未继续发送', '可用的技术详情记录渠道'); }
     constructor(transport, hooks) {
         this.hooks = hooks;
         this.closeDiagnostics = hooks.closeDiagnostics ?? new CloseDiagnostics(event => this.detail(event));
-        this.timing.bind(detail => this.detail(detail));
         const app = acp.client({ name: '@ai-workbench/remote-agent' })
             .onNotification(acp.methods.client.session.update, ({ params: notification }) => {
             if (this.creatingReplacement) {
@@ -175,7 +261,18 @@ export class AcpSession {
                 return;
             }
             const meta = record(notification._meta);
+            if (notification.update.sessionUpdate === 'current_mode_update') {
+                this.nativeModeId = notification.update.currentModeId;
+                this.nativeModeSource = 'current_mode_update';
+                this.nativeModeRevision++;
+            }
             if (notification.update.sessionUpdate === 'config_option_update') {
+                const modes = notification.update.configOptions.filter(option => option.id === 'mode');
+                if (modes.length === 1 && modes[0].type === 'select') {
+                    this.nativeModeId = modes[0].currentValue;
+                    this.nativeModeSource = 'config_option_update';
+                    this.nativeModeRevision++;
+                }
                 if (!this.sessionId)
                     this.pendingConfiguration(notification.sessionId, notification.update.configOptions);
                 else
@@ -189,9 +286,6 @@ export class AcpSession {
             if (meta && Object.keys(meta).length)
                 this.detail({ kind: 'extension', severity: 'info', code: 'ACP_NOTIFICATION_META', summary: '远端通知扩展', method: 'session/update', payload: notification._meta });
             if (this.busy) {
-                // Only actual turn output acknowledges prompt acceptance.
-                if (['agent_message_chunk', 'agent_thought_chunk', 'tool_call', 'tool_call_update'].includes(notification.update.sessionUpdate))
-                    this.hooks.broker?.acknowledge(acp.methods.agent.session.prompt);
                 this.hooks.onUpdate?.(notification);
             }
             else
@@ -201,7 +295,6 @@ export class AcpSession {
             const hooks = this.hooks, detail = (value) => this.detail(value, hooks), need = (value) => this.need(value, hooks);
             if (request.sessionId !== this.sessionId || !this.busy || this.turnSignal?.aborted)
                 return { outcome: { outcome: 'cancelled' } };
-            hooks.broker?.acknowledge(acp.methods.agent.session.prompt);
             const toolName = request.toolCall.name ?? record(request.toolCall._meta?.claudeCode)?.toolName;
             detail({ kind: 'tool', severity: 'info', code: 'ACP_PERMISSION_REQUEST', summary: '远端工具审批标识', method: 'session/request_permission', payload: { sessionId: request.sessionId, toolCall: { toolCallId: request.toolCall.toolCallId, ...(typeof toolName === 'string' ? { name: toolName } : {}) } } });
             if (toolName === 'AskUserQuestion') {
@@ -224,29 +317,26 @@ export class AcpSession {
             const token = this.turnToken;
             const id = this.sessionId;
             let outcome = 'unavailable';
-            const approvalSignal = this.turnSignal ? AbortSignal.any([this.turnSignal, rpcSignal]) : rpcSignal;
+            const policy = hooks.approvalGuard?.();
+            const approvalSignal = AbortSignal.any([rpcSignal, ...this.turnSignal ? [this.turnSignal] : [], ...policy ? [policy.signal] : []]);
             const broker = hooks.broker;
             let generation;
-            // A transport disconnect withdraws only the UI question, not the ACP RPC.
-            // Late UI answers lose their lease; a fresh online attachment asks again.
+            // One question per RPC. A disconnect ends this turn; it is never asked again.
             try {
-                while (!approvalSignal.aborted) {
-                    await broker?.waitOnline(approvalSignal);
-                    generation = broker?.generation;
-                    const lease = broker?.signal;
-                    const signal = lease ? AbortSignal.any([approvalSignal, lease]) : approvalSignal;
-                    const interrupted = Promise.withResolvers();
-                    const abort = () => interrupted.resolve('cancelled');
-                    signal.addEventListener('abort', abort, { once: true });
-                    try {
+                generation = broker?.generation;
+                const lease = broker?.signal;
+                const signal = lease ? AbortSignal.any([approvalSignal, lease]) : approvalSignal;
+                const interrupted = Promise.withResolvers();
+                const abort = () => interrupted.resolve('cancelled');
+                signal.addEventListener('abort', abort, { once: true });
+                try {
+                    if (!signal.aborted)
                         outcome = await Promise.race([hooks.approve?.(presented, signal) ?? Promise.resolve('unavailable'), interrupted.promise]);
-                    }
-                    finally {
-                        signal.removeEventListener('abort', abort);
-                    }
-                    if (broker && !approvalSignal.aborted && (generation !== broker.generation || lease?.aborted))
-                        continue;
-                    break;
+                    else
+                        outcome = 'cancelled';
+                }
+                finally {
+                    signal.removeEventListener('abort', abort);
                 }
             }
             catch {
@@ -254,9 +344,26 @@ export class AcpSession {
             }
             const kind = outcome === 'allowed-once' ? 'allow_once' : outcome === 'rejected' ? 'reject_once' : undefined;
             const option = kind && eligible.find(item => item.kind === kind);
-            if (this.busy && token === this.turnToken && id === this.sessionId && !approvalSignal.aborted && option && (!broker || (broker.online && generation === broker.generation))) {
-                if (broker)
-                    broker.authorizeResponse(requestId, generation);
+            const current = () => {
+                if (approvalSignal.aborted)
+                    return false;
+                try {
+                    return !policy || policy.isCurrent();
+                }
+                catch {
+                    detail({ kind: 'tool', severity: 'warning', code: 'APPROVAL_POLICY_CHANGED', summary: '当前权限无法重新核对，原审批没有继续授权。', method: 'session/request_permission', payload: { reason: 'PERMISSION_POLICY_UNAVAILABLE' } });
+                    return false;
+                }
+            };
+            if (policy && !current())
+                detail({ kind: 'tool', severity: 'warning', code: 'APPROVAL_POLICY_CHANGED', summary: '本会话权限已变化，原审批不再授权本次动作。', method: 'session/request_permission', payload: { reason: 'PERMISSION_GENERATION_CHANGED' } });
+            if (this.busy && token === this.turnToken && id === this.sessionId && current() && option && (!broker || (broker.online && generation === broker.generation))) {
+                if (broker) {
+                    if (policy)
+                        broker.authorizeResponse(requestId, generation, current);
+                    else
+                        broker.authorizeResponse(requestId, generation);
+                }
                 return { outcome: { outcome: 'selected', optionId: option.optionId } };
             }
             need({ code: outcome === 'allowed-once' ? 'APPROVAL_OPTION_UNSUPPORTED' : 'APPROVAL_UNAVAILABLE',
@@ -312,8 +419,28 @@ export class AcpSession {
     }
     /** A rejected request on an already-closed SDK never reaches this write.
      * Once a transport write starts, failure remains delivery-unknown. */
-    observeDispatch(message) { if (record(message)?.method === 'session/prompt' && Object.hasOwn(message, 'id'))
-        this.dispatchedPrompts++; }
+    observeDispatch(message) {
+        if (record(message)?.method !== 'session/prompt' || !Object.hasOwn(message, 'id'))
+            return;
+        const params = record(record(message)?.params), current = params ? this.promptPermissions.get(params) : undefined;
+        if (params)
+            this.promptPermissions.delete(params);
+        if (!current || !current.current()) {
+            this.closeDiagnostics.record({ layer: 'acp', initiator: 'acp.permission-dispatch-gate', reason: 'PERMISSION_POLICY_CHANGED', operation: 'session/prompt', action: 'failure' });
+            throw new NeedError('PERMISSION_POLICY_CHANGED', '当前权限已变化或无法核对，这次派发已停止；原输入没有重放。', '当前权限代次与远端同值回执');
+        }
+        current.native();
+        this.hooks.broker?.authorizePrompt(() => { try {
+            if (!current.current())
+                return false;
+            current.native();
+            return true;
+        }
+        catch {
+            return false;
+        } });
+        this.dispatchedPrompts++;
+    }
     observe(stream) {
         // Observe already-parsed public Stream messages: no NDJSON parsing, second
         // byte buffer, message-size policy, or transport fallback is introduced.
@@ -322,13 +449,6 @@ export class AcpSession {
                 const raw = record(message);
                 const params = record(raw?.params);
                 const update = record(params?.update);
-                if (raw)
-                    this.hooks.broker?.processedMessage(raw);
-                if (typeof raw?.method === 'string' && Object.hasOwn(raw, 'id') && this.hooks.broker && !this.hooks.broker.promptInFlight && !(raw.method === '_aw/employee-exec' && this.hooks.employeeExecution && this.employeeMeta)) {
-                    const error = new NeedError('RECOVERY_UNSAFE_OUTPUT', '主机会话有不属于当前输入的旧审批，未自动回答', '安全结束旧会话并新建');
-                    this.hooks.broker.fail(error);
-                    throw error;
-                }
                 if (raw?.method === acp.methods.client.session.update && typeof update?.sessionUpdate === 'string' && !knownUpdates.has(update.sessionUpdate)) {
                     this.detail({ kind: 'extension', severity: 'warning', code: 'ACP_UNKNOWN_UPDATE', summary: '收到未知远端会话事件，已保留结构', method: 'session/update', payload: params });
                     return;
@@ -340,55 +460,12 @@ export class AcpSession {
     get id() { return this.sessionId; }
     get capabilities() { return this.negotiated; }
     get startMethod() { return this.method; }
-    get checkpoint() { return this.ready && !this.busy && !this.updating && !this.selecting && this.sessionId ? { sessionId: this.sessionId, capabilities: recoveryCapabilities(this.negotiated), ...(this.configuration ? { modelConfiguration: { configOptions: JSON.parse(JSON.stringify(this.configuration.snapshot.configOptions)), selectorRoles: { model: this.configuration.snapshot.modelConfigId, effort: this.configuration.snapshot.effortConfigId } } } : {}) } : undefined; }
-    restore(cwd, saved, context, verifiedSameContext = false) {
-        if (context.employeeRouting)
-            throw new NeedError('EMPLOYEE_CHECKPOINT_STALE', '本机工具通道需要重新建立，旧审批没有代答。', '按原主机实例安全结束后新建本机会话');
-        if (this.startAttempted)
-            throw new NeedError('SESSION_ALREADY_STARTED', '此客户端已建立会话', '新的客户端连接');
-        this.startAttempted = true;
-        this.sessionId = saved.sessionId;
-        this.negotiated = recoveryCapabilities(saved.capabilities);
-        this.cwd = cwd;
-        this.systemPrompt = context.systemPrompt ?? '';
-        this.codexNewSessionOnly = !!context.codexNewSessionOnly;
-        // A verified same-context reattach does not create or update native context.
-        // Old journals may lack new-only metadata; never manufacture it for them.
-        if (this.codexNewSessionOnly && !verifiedSameContext)
-            this.validateNewContext(this.systemPrompt, context.systemPrompt !== undefined);
-        // Legacy currentModelId/resolvedEvidence is not a per-turn setter ACK and
-        // never proves the concrete model. Only restore selectable config options.
-        if (saved.modelConfiguration) {
-            this.receiveConfiguration(saved.modelConfiguration.configOptions, saved.modelConfiguration.selectorRoles);
-            for (const update of saved.configUpdates ?? [])
-                this.receiveConfiguration(update);
-        }
-        this.hooks.broker?.finishRecovery();
-        this.detail({ kind: 'need', severity: 'info', code: 'ACP_CLIENT_REATTACHED', summary: '已接回原模型会话', payload: { sessionId: saved.sessionId } });
-        this.checkReporting();
-        this.ready = true;
-    }
     validatePrompt(prompt) {
         const capability = this.negotiated.promptCapabilities;
         for (const block of prompt)
             if ((block.type === 'image' && !capability?.image) || (block.type === 'audio' && !capability?.audio) || (block.type === 'resource' && !capability?.embeddedContext))
                 throw new NeedError('PROMPT_CONTENT_UNSUPPORTED', `远端未声明此输入内容能力：${block.type}；本轮未发送`, '对应内容类型的公开 ACP 输入能力');
     }
-    validateContext(context) {
-        if ((context.systemPrompt ?? '') === this.systemPrompt)
-            return;
-        if (this.codexNewSessionOnly)
-            throw new NeedError('SYSTEM_PROMPT_NEW_SESSION_REQUIRED', 'Codex会话要求已变化，需要保留原会话并新建会话承接', '新会话及完整公开历史承接');
-        if (!this.negotiated.sessionCapabilities?.systemPrompt)
-            throw new NeedError('SYSTEM_PROMPT_UNSUPPORTED', '远端未声明系统与开发者上下文更新能力，不能丢弃这些要求继续', '支持 systemPrompt 的公开 ACP 能力');
-        if (!this.negotiated.sessionCapabilities?.resume && !this.negotiated.loadSession)
-            throw new NeedError('SYSTEM_PROMPT_UPDATE_UNSUPPORTED', '远端没有可更新原会话上下文的恢复或加载能力', '支持带 systemPrompt 的 session/resume 或 session/load');
-    }
-    validateNewSessionContext(context) {
-        if (!this.codexNewSessionOnly)
-            throw new NeedError('SYSTEM_PROMPT_POLICY_UNSUPPORTED', '此会话没有使用Codex新建政策', 'Codex新建政策');
-        this.validateNewContext(context.systemPrompt ?? '', true);
-    }
     setHooks(hooks) {
         if (this.busy || this.updating || this.selecting)
             throw new NeedError('TURN_BUSY', '上一轮或配置更新结束前不能更换会话钩子', '上一轮结束');
@@ -397,14 +474,6 @@ export class AcpSession {
         this.employeeNoticeUnshown = false;
     }
     get closed() { return this.connection.closed; }
-    validateNewContext(text, requirePolicy = false) {
-        if ((text || requirePolicy) && !this.negotiated.sessionCapabilities?.systemPrompt)
-            throw new NeedError('SYSTEM_PROMPT_UNSUPPORTED', '远端未声明系统与开发者上下文能力，不能丢弃这些要求继续', '支持 systemPrompt 的公开 ACP 能力');
-        if (this.codexNewSessionOnly && (text || requirePolicy)) {
-            if (!supportsCodexContextPolicy(this.negotiated))
-                throw new NeedError('SYSTEM_PROMPT_POLICY_UNSUPPORTED', '远端没有明确声明Codex上下文仅新建生效的兼容政策，本轮未发送', 'systemPrompt与精确的aiWorkbenchSystemPrompt新建政策');
-        }
-    }
     async start(cwd, resumeId, signal, context, prompt) {
         if (this.startAttempted)
             throw new NeedError('SESSION_ALREADY_STARTED', '此连接已用于建立会话，不能转用工作区或身份', '新的独立远端连接');
@@ -415,30 +484,26 @@ export class AcpSession {
         signal?.addEventListener('abort', abort, { once: true });
         try {
             const hello = await this.stage('acp-initialize', () => this.connection.agent.request(acp.methods.agent.initialize, {
-                protocolVersion: acp.PROTOCOL_VERSION, clientInfo: { name: '@ai-workbench/remote-agent', version: '0.8.21' },
+                protocolVersion: acp.PROTOCOL_VERSION, clientInfo: { name: '@ai-workbench/remote-agent', version: '0.8.23' },
                 clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, terminal: false, session: { notices: {} }, ...(this.employeeMeta ? { _meta: { awEmployeeExecution: { version: 1, closeReason: 1 } } } : {}) },
             }, { cancellationSignal: signal }));
-            this.hooks.broker?.acknowledge(acp.methods.agent.initialize);
             if (hello.protocolVersion !== acp.PROTOCOL_VERSION)
                 throw new NeedError('ACP_VERSION_MISMATCH', 'ACP 协议版本不兼容', '支持 ACP v1 的远端 agent');
-            this.checkReporting();
             this.negotiated = hello.agentCapabilities ?? {};
             if (this.employeeMeta) {
                 const policy = record(hello._meta?.awEmployeeExecution);
                 if (!this.hooks.employeeExecution || !policy || Object.keys(policy).length !== 5 || policy.version !== 1 || policy.nativeCliVersion !== '0.160.1' || policy.native !== true || policy.perRpcGate !== true || policy.noHostFallback !== true)
                     throw new NeedError('EMPLOYEE_EXECUTION_UNSUPPORTED', '当前主机尚不支持在你的电脑执行Codex原生工具，本轮没有执行。', 'Codex员工端原生执行适配器与明确能力声明');
                 this.employeeNegotiated = true;
-                this.detail({ kind: 'session', severity: 'info', code: 'EMPLOYEE_EXECUTION_SELECTED', summary: '文件和命令在员工电脑的选定目录执行，Git使用本机仓库；模型、登录和全局助手要求仍在主机。本机stdio MCP按原生规则忽略；HTTP MCP按管理员设置拒绝或忽略。本机hooks、plugins、冷恢复、快捷命令和主机文件报告尚不支持。外层ACP冷恢复已拒绝；原生子代理回收/缺少存活父会话时的恢复仅做源码检查，未实测。', payload: { bindingId: this.employeeMeta.bindingId, workspaceId: this.employeeMeta.workspaceId, cwd: this.employeeMeta.cwd, nativeCliVersion: '0.160.1', noHostFallback: true, agentConfigSource: 'host CODEX_HOME', unsupportedLocalFeatures: ['http-mcp-execution', 'hooks', 'plugins', 'cold-resume', 'slash-commands', 'host-file-reports'] } });
+                this.detail({ kind: 'session', severity: 'info', code: 'EMPLOYEE_EXECUTION_SELECTED', summary: '文件和命令在员工电脑的选定目录执行；订阅凭据留在主机，本机扩展的忽略详情单独记录。', payload: { bindingId: this.employeeMeta.bindingId, workspaceId: this.employeeMeta.workspaceId, cwd: this.employeeMeta.cwd, nativeCliVersion: '0.160.1', noHostFallback: true, agentConfigSource: 'host CODEX_HOME', unsupportedLocalFeatures: ['http-mcp-execution', 'hooks', 'plugins', 'cold-resume', 'slash-commands', 'host-file-reports'] } });
             }
             const systemPrompt = context?.systemPrompt;
             this.codexNewSessionOnly = !!context?.codexNewSessionOnly;
-            this.validateNewContext(systemPrompt ?? '', this.codexNewSessionOnly && systemPrompt !== undefined);
             if (prompt)
                 this.validatePrompt(prompt);
-            if (context?.employeeRouting && resumeId)
-                throw new NeedError('EMPLOYEE_CHECKPOINT_STALE', '本机工具连接已变化，不能沿用旧会话。', '安全结束原主机实例并重新建立本机工具通道');
-            const routing = context?.employeeRouting;
-            const params = { cwd, mcpServers: routing ? structuredClone(routing.mcpServers) : [], ...((routing || this.employeeMeta) ? { _meta: { ...(this.employeeMeta ? { awEmployeeExecution: this.employeeMeta } : {}), ...(routing ? { claudeCode: { options: { toolAliases: structuredClone(routing.toolAliases) } } } : {}) } } : {}), ...(systemPrompt && !(resumeId && this.codexNewSessionOnly) ? { systemPrompt: { mode: 'append', content: [{ type: 'text', text: systemPrompt }] } } : {}) };
+            const routing = context?.employeeRouting ? structuredClone(context.employeeRouting) : undefined;
+            this.employeeRouting = routing;
+            const params = { cwd, mcpServers: routing ? structuredClone(routing.mcpServers) : [], ...((routing || this.employeeMeta) ? { _meta: { ...(this.employeeMeta ? { awEmployeeExecution: this.employeeMeta } : {}), ...(routing ? { claudeCode: { options: employeeClaudeOptions(routing) } } : {}) } } : {}), ...(systemPrompt && !(resumeId && this.codexNewSessionOnly) ? { systemPrompt: { mode: 'append', content: [{ type: 'text', text: systemPrompt }] } } : {}) };
             const configRevision = this.resetConfiguration();
             if (resumeId) {
                 this.sessionId = resumeId;
@@ -463,8 +528,6 @@ export class AcpSession {
                 this.lifecycleConfiguration(result, configRevision);
                 this.method = acp.methods.agent.session.new;
             }
-            this.hooks.broker?.acknowledge(this.method);
-            this.checkReporting();
             this.ready = true;
             this.cwd = cwd;
             this.systemPrompt = systemPrompt ?? '';
@@ -474,10 +537,8 @@ export class AcpSession {
             if (signal?.aborted)
                 throw new NeedError('ABORTED', '会话建立已取消；尚无本轮输出', '重新连接主机');
             if (error instanceof ModelConfigurationError) {
-                this.checkReporting();
                 throw error;
             }
-            this.checkReporting();
             throw acpNeed(error);
         }
         finally {
@@ -485,98 +546,6 @@ export class AcpSession {
         }
     }
     /** Codex context is immutable after creation; keep the old remote session intact. */
-    async newContextSession(context, signal) {
-        this.checkReporting();
-        if (!this.ready || !this.sessionId || !this.cwd)
-            throw new NeedError('SESSION_REQUIRED', '我需要先建立远端会话', 'ACP 会话');
-        if (!this.codexNewSessionOnly)
-            throw new NeedError('SYSTEM_PROMPT_POLICY_UNSUPPORTED', '此会话没有使用Codex新建政策', 'Codex新建政策');
-        if (this.busy || this.updating || this.selecting)
-            throw new NeedError('TURN_BUSY', '上一项会话操作尚未完成', '上一项操作结束');
-        const text = context.systemPrompt ?? '';
-        this.validateNewSessionContext(context);
-        signal?.throwIfAborted();
-        const oldId = this.sessionId;
-        this.updating = true;
-        this.ready = false;
-        this.creatingReplacement = true;
-        this.pendingConfigurations.clear();
-        const abort = () => this.close({ layer: 'acp', initiator: 'acp.new-context-signal', reason: 'ABORTED', action: 'abort' }, new NeedError('ABORTED', '新会话建立已取消，远端状态需确认', '管理员核对远端状态'));
-        signal?.addEventListener('abort', abort, { once: true });
-        try {
-            const revision = this.resetConfiguration();
-            const result = await this.stage('acp-session-new', () => this.connection.agent.request(acp.methods.agent.session.new, { cwd: this.cwd, mcpServers: [], ...(this.employeeMeta ? { _meta: { awEmployeeExecution: this.employeeMeta } } : {}), ...(text ? { systemPrompt: { mode: 'append', content: [{ type: 'text', text }] } } : {}) }, { cancellationSignal: signal }));
-            if (!result.sessionId || result.sessionId === oldId)
-                throw new NeedError('SESSION_STATE_INVALID', '新会话没有返回独立的远端标识，原会话状态需确认', '独立的新远端会话标识');
-            this.sessionId = result.sessionId;
-            if (this.employeeMeta)
-                this.employeeInfo(result._meta?.awEmployeeExecutionInfo);
-            this.lifecycleConfiguration(result, revision);
-            this.hooks.broker?.acknowledge(acp.methods.agent.session.new);
-            this.checkReporting();
-            this.systemPrompt = text;
-            this.method = acp.methods.agent.session.new;
-            this.ready = true;
-            return this.sessionId;
-        }
-        catch (error) {
-            this.checkReporting();
-            if (error instanceof ModelConfigurationError)
-                throw error;
-            throw acpNeed(error);
-        }
-        finally {
-            this.creatingReplacement = false;
-            this.updating = false;
-            signal?.removeEventListener('abort', abort);
-        }
-    }
-    async updateContext(context, signal, force = false) {
-        this.checkReporting();
-        if (!this.ready || !this.sessionId || !this.cwd)
-            throw new NeedError('SESSION_REQUIRED', '我需要先建立远端会话', 'ACP 会话');
-        if (this.busy || this.updating || this.selecting)
-            throw new NeedError('TURN_BUSY', '此远端会话正在处理上一轮或更新配置', '上一轮结束');
-        const text = context.systemPrompt ?? '';
-        if (!force && text === this.systemPrompt)
-            return undefined;
-        this.validateContext(context);
-        if (force && (!this.negotiated.sessionCapabilities?.systemPrompt || !this.negotiated.sessionCapabilities?.resume && !this.negotiated.loadSession))
-            throw new NeedError('SYSTEM_PROMPT_UPDATE_UNSUPPORTED', '远端没有可传送更新要求的公开恢复能力', 'session/resume 或 session/load 的 systemPrompt 能力');
-        const resume = !!this.negotiated.sessionCapabilities?.resume;
-        signal?.throwIfAborted();
-        this.updating = true;
-        this.ready = false;
-        const abort = () => this.close({ layer: 'acp', initiator: 'acp.update-context-signal', reason: 'ABORTED', action: 'abort' }, new NeedError('ABORTED', '上下文更新已取消，原会话状态需确认', '重新连接原会话'));
-        signal?.addEventListener('abort', abort, { once: true });
-        try {
-            const method = resume ? acp.methods.agent.session.resume : acp.methods.agent.session.load;
-            const params = { sessionId: this.sessionId, cwd: this.cwd, mcpServers: [], systemPrompt: { mode: 'append', content: [{ type: 'text', text }] } };
-            const configRevision = this.resetConfiguration(false);
-            const result = await this.stage(resume ? 'acp-session-resume' : 'acp-session-load', () => this.connection.agent.request(method, params, { cancellationSignal: signal }));
-            this.lifecycleConfiguration(result, configRevision);
-            this.hooks.broker?.acknowledge(method);
-            this.systemPrompt = text;
-            this.ready = true;
-            this.detail({ kind: 'session', severity: 'warning', code: 'SYSTEM_PROMPT_UPDATE_DEFERRED', summary: '系统与开发者要求已通过原会话恢复接口传送；新要求在下次上下文整理后生效，本轮不能保证已立即采用。', payload: { reason: 'OFFICIAL_CONTEXT_UPDATE_DEFERRED' } });
-            this.checkReporting();
-            return method;
-        }
-        catch (error) {
-            if (signal?.aborted)
-                throw new NeedError('ABORTED', '上下文更新已取消；原会话状态需确认', '重新连接原会话');
-            if (error instanceof ModelConfigurationError) {
-                this.checkReporting();
-                throw error;
-            }
-            this.checkReporting();
-            throw acpNeed(error);
-        }
-        finally {
-            this.updating = false;
-            signal?.removeEventListener('abort', abort);
-        }
-    }
     async prompt(input, signal) {
         if (!this.ready || !this.sessionId)
             throw new NeedError('SESSION_REQUIRED', '我需要先建立远端会话', 'ACP 会话');
@@ -585,9 +554,16 @@ export class AcpSession {
         signal?.throwIfAborted();
         const prompt = typeof input === 'string' ? [{ type: 'text', text: input }] : input;
         this.validatePrompt(prompt);
-        this.checkReporting();
-        if (this.selected)
-            this.assertModelSelection(this.selected.model, this.selected.effort);
+        const permit = this.hooks.promptGuard?.();
+        const params = { sessionId: this.sessionId, prompt };
+        const current = () => { try {
+            return !signal?.aborted && !this.closeRequested && (!permit || !permit.signal.aborted && permit.isCurrent());
+        }
+        catch {
+            return false;
+        } };
+        const expectedPermission = this.selectedPermission, reportedModes = new Set();
+        const native = () => this.validateNativePermission(expectedPermission, reportedModes);
         this.busy = true;
         this.turnSignal = signal;
         this.turnToken = Symbol('turn');
@@ -603,20 +579,17 @@ export class AcpSession {
         signal?.addEventListener('abort', cancel, { once: true });
         try {
             const result = await this.stage('acp-prompt', () => {
-                const request = this.connection.agent.request(acp.methods.agent.session.prompt, { sessionId: this.sessionId, prompt }, { cancellationSignal: signal });
+                this.promptPermissions.set(params, { current, native });
+                const request = this.connection.agent.request(acp.methods.agent.session.prompt, params, { cancellationSignal: signal });
                 return signal ? Promise.race([request, interrupted]) : request;
             });
-            this.hooks.broker?.acknowledge(acp.methods.agent.session.prompt);
             signal?.throwIfAborted();
-            this.hooks.broker?.completePrompt();
-            this.checkReporting();
             this.hooks.onResponse?.(result);
             return result.stopReason;
         }
         catch (error) {
             if (signal?.aborted)
                 throw new NeedError('ABORTED', '本轮已取消；已请求主机停止', '确认主机取消状态');
-            this.checkReporting();
             throw acpNeed(error);
         }
         finally {
@@ -643,8 +616,8 @@ export function acpNeed(error) {
                 if (code === 'AW_EMPLOYEE_ENVIRONMENT_REGISTRATION_FAILED' && value.startsWith(code + ': ')) {
                     const reason = value.slice(code.length + 2);
                     if (employeeAdapterCodes.has(reason) || employeeOpenCauseCodes.has(reason)) {
-                        const retained = withFailureEvidence(Object.assign(failure, { cause: new NeedError(reason, '员工执行通道开通失败', '核对固定开通原因') }), [], 'diagnostic');
-                        retained.requires += `；RPC 错误码 ${error.code}`;
+                        const retained = withFirstFailureEvidence(Object.assign(failure, { cause: new NeedError(reason, '员工执行通道开通失败', '核对固定开通原因') }), reason, code);
+                        retained.requires += `；开通原因 ${reason}；RPC 错误码 ${error.code}`;
                         return retained;
                     }
                 }