@ai-workbench/remote-agent 0.8.21 → 0.8.23

package/dist/employee-provider.js

@@ -7,22 +7,22 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     return path;
 };
 import { connectNeedError } from "./connect-need.js";
-import { CODEX_EMPLOYEE_SCOPE_NOTICE } from "./employee-presentation.js";
-import { CloseDiagnostics, withFailureEvidence, withFirstFailureEvidence, closeCode, closeErrorCodes } from "./close-diagnostics.js";
+import { EMPLOYEE_EXECUTION_NOTICE } from "./employee-presentation.js";
+import { CloseDiagnostics, withFirstFailureEvidence, closeCode } from "./close-diagnostics.js";
 import { createHash } from 'node:crypto';
 import { admitEmployeeLocation } from "./employee-location.js";
 import { EmployeeExecution } from "./employee-exec.js";
 import { createEmployeeSshTransport } from "./employee-ssh.js";
 import { sshIo } from "./broker.js";
 import { NeedError } from "./remote.js";
-const fail = (code) => new NeedError(code, code === 'EMPLOYEE_OPERATION_UNSUPPORTED' ? '当前本机工作区只支持正在连接的会话；单次运行和断线后的冷恢复暂不支持，请新建会话。' : '本机工作区的执行连接无法继续（' + code + '），本轮没有改用主机执行。', '当前 L 工作区绑定、N/S 员工执行端点与支持本机执行的会话适配器');
+const fail = (code) => new NeedError(code, '本机工作区的执行连接无法继续，本轮没有改用主机执行；恢复连接后可在原会话继续。', '当前 L 工作区绑定、N/S 员工执行端点与支持本机执行的会话适配器');
 const errorCode = (error) => error instanceof NeedError ? error.code : 'EMPLOYEE_EXEC_UNKNOWN';
 const asNeed = (error) => error instanceof NeedError ? error : fail('EMPLOYEE_EXEC_UNKNOWN');
 const digest = (value) => createHash('sha256').update(JSON.stringify(value)).digest('hex');
 const absolute = (value) => typeof value === 'string' && value.startsWith('/') && !value.includes('\0');
-const localApiCurrent = (api) => { const c = api.getContractInfo?.(); return c?.workspaceLocations === 1 && c.localWorkspaceContext === 1 && c.localUserTurnAcceptance === 1 && typeof api.getWorkspaceLocationState === 'function' && typeof api.getLocalWorkspaceContext === 'function' && typeof api.acceptLocalWorkspaceUserTurn === 'function'; };
-/** Read-only local classification and explicit acceptance precede even ensureReady's SSH status. */
-export async function acceptEmployeeUserTurn(get, employee, agent, api, request) {
+const localApiCurrent = (api) => { const c = api.getContractInfo?.(); return c?.workspaceLocations === 1 && c.localWorkspaceContext === 1 && typeof api.getWorkspaceLocationState === 'function' && typeof api.getLocalWorkspaceContext === 'function'; };
+/** Inspect the current local workspace once at turn start, before host readiness. */
+export async function inspectEmployeeWorkspace(get, employee, agent, api, request) {
     const info = api.getContractInfo?.();
     if (info?.workspaceLocations !== 1)
         return;
@@ -46,7 +46,7 @@ export async function acceptEmployeeUserTurn(get, employee, agent, api, request)
         throw fail('EMPLOYEE_CONTEXT_CHANGED');
     if (row.source !== 'local')
         return;
-    if (agent.id !== 'codex-remote' || agent.loginProvider !== 'codex' || state.phase !== 'ready' || row.status !== 'selected' || !row.bindingId || info.localWorkspaceContext !== 1 || info.localUserTurnAcceptance !== 1 || typeof api.getLocalWorkspaceContext !== 'function' || typeof api.acceptLocalWorkspaceUserTurn !== 'function' || typeof employee.currentUserTurn !== 'function')
+    if (agent.id !== 'codex-remote' || agent.loginProvider !== 'codex' || state.phase !== 'ready' || row.status !== 'selected' || !row.bindingId || info.localWorkspaceContext !== 1 || typeof api.getLocalWorkspaceContext !== 'function')
         throw fail('DEPENDENCY_REQUIRED');
     const connection = api.getConnectionState();
     const stable = () => { sourceStable(); const now = api.getConnectionState(), location = api.getWorkspaceLocationState(), matches = location.items.filter(x => x.workspaceId === workspace.id); if (get() !== api || now.phase !== 'connected' || now.instanceId !== connection.instanceId || now.epoch !== connection.epoch || location.phase !== 'ready' || location.instanceId !== connection.instanceId || location.epoch !== connection.epoch || matches.length !== 1 || matches[0].source !== 'local' || matches[0].status !== 'selected' || matches[0].bindingId !== row.bindingId)
@@ -59,40 +59,11 @@ export async function acceptEmployeeUserTurn(get, employee, agent, api, request)
     const c = context.value, d = { ...c.directory };
     if (c.version !== 1 || c.source !== 'local' || c.instanceId !== connection.instanceId || c.epoch !== connection.epoch || c.workspaceId !== workspace.id || c.bindingId !== row.bindingId || !absolute(d?.path) || d.path !== workspace.path || ![d.device, d.inode].every(n => Number.isSafeInteger(n) && n >= 0))
         throw fail('EMPLOYEE_CONTEXT_CHANGED');
-    const expected = { ...employee.currentUserTurn(request) };
-    if (!Number.isSafeInteger(expected.turn) || expected.turn < 0 || typeof expected.userMessageId !== 'string' || !expected.userMessageId.trim())
-        throw fail('LOCAL_USER_TURN_UNCONFIRMED');
-    const response = await api.acceptLocalWorkspaceUserTurn({ instanceId: connection.instanceId, epoch: connection.epoch, sessionId: request.sessionId, provider: agent.loginProvider, purpose: 'user-turn', workspaceId: workspace.id, expectedBindingId: row.bindingId, expectedDirectory: { device: d.device, inode: d.inode }, expectedUserTurn: { ...expected } });
-    if (!response.ok)
-        throw connectNeedError(response.error);
-    stable();
-    const a = response.value;
-    if (!a || a.version !== 1 || typeof a.acceptanceId !== 'string' || !a.acceptanceId.trim() || a.instanceId !== connection.instanceId || a.epoch !== connection.epoch || a.sessionId !== request.sessionId || a.provider !== agent.loginProvider || a.workspaceId !== workspace.id || a.bindingId !== row.bindingId || a.source !== 'local' || a.directory?.path !== d.path || a.directory?.device !== d.device || a.directory?.inode !== d.inode || a.userTurn?.turn !== expected.turn || a.userTurn?.userMessageId !== expected.userMessageId || ![a.userTurn?.startSequence, a.userTurn?.userMessageSequence].every(n => Number.isSafeInteger(n) && n >= 0) || a.userTurn.userMessageSequence <= a.userTurn.startSequence)
-        throw fail('LOCAL_USER_TURN_ACCEPTANCE_INVALID');
-    const accepted = Object.freeze({ ...a, directory: Object.freeze({ ...a.directory }), userTurn: Object.freeze({ ...a.userTurn }) });
-    request.localAdmissionCheck = () => { sourceStable(); const c = api.getConnectionState(); if (c.phase !== 'connected' || c.instanceId !== accepted.instanceId || c.epoch !== accepted.epoch)
-        throw fail('EMPLOYEE_CONTEXT_CHANGED'); const turn = employee.currentUserTurn(request); if (turn.turn !== accepted.userTurn.turn || turn.userMessageId !== accepted.userTurn.userMessageId)
-        throw new NeedError('LOCAL_USER_TURN_CHANGED', '本次输入已变化，本轮已停止。', '当前官方真实员工输入'); };
-    return accepted;
-}
-/** Recheck the admitted read-only facts after readiness awaits, before the catalog command. */
-export async function validateEmployeeUserTurn(get, employee, api, request, connection) {
-    const a = request.localAcceptance;
-    if (!a)
-        return;
-    const stable = () => { if (get() !== api || !localApiCurrent(api))
-        throw fail('EMPLOYEE_CONTEXT_CHANGED'); const c = api.getConnectionState(), state = api.getWorkspaceLocationState(), rows = state.items.filter(x => x.workspaceId === a.workspaceId); if (c.phase !== 'connected' || c.instanceId !== a.instanceId || c.epoch !== a.epoch || connection.instanceId !== a.instanceId || connection.epoch !== a.epoch || state.phase !== 'ready' || state.instanceId !== a.instanceId || state.epoch !== a.epoch || rows.length !== 1 || rows[0].source !== 'local' || rows[0].status !== 'selected' || rows[0].bindingId !== a.bindingId)
-        throw fail('EMPLOYEE_CONTEXT_CHANGED'); request.signal?.throwIfAborted(); };
-    stable();
-    const c = await api.getLocalWorkspaceContext({ instanceId: a.instanceId, epoch: a.epoch, workspaceId: a.workspaceId, expectedBindingId: a.bindingId });
-    stable();
-    if (!c.ok)
-        throw connectNeedError(c.error);
-    if (c.value.version !== 1 || c.value.source !== 'local' || c.value.instanceId !== a.instanceId || c.value.epoch !== a.epoch || c.value.workspaceId !== a.workspaceId || c.value.bindingId !== a.bindingId || c.value.directory.path !== a.directory.path || c.value.directory.device !== a.directory.device || c.value.directory.inode !== a.directory.inode)
-        throw fail('EMPLOYEE_CONTEXT_CHANGED');
-    const turn = employee.currentUserTurn(request);
-    if (turn.turn !== a.userTurn.turn || turn.userMessageId !== a.userTurn.userMessageId)
-        throw new NeedError('LOCAL_USER_TURN_CHANGED', '本次输入已变化，本轮已停止。', '当前官方真实员工输入');
+    // L0.7.27 provides a read-only context, not a per-turn context ledger.
+    const contextSnapshot = Object.freeze({ ...c, directory: Object.freeze(d) });
+    request.localAdmissionCheck = () => { sourceStable(); const now = api.getConnectionState(); if (now.phase !== 'connected' || now.instanceId !== c.instanceId || now.epoch !== c.epoch)
+        throw fail('EMPLOYEE_CONTEXT_CHANGED'); };
+    return contextSnapshot;
 }
 /** Source admission is separate from L's legacy host project resolver. */
 export function createEmployeeProvider(get, options, agent) {
@@ -100,15 +71,11 @@ export function createEmployeeProvider(get, options, agent) {
     return async (input) => {
         const { api, target, connection, request } = input, info = api.getContractInfo?.(), sessionId = request.sessionId;
         let prior = live.get(sessionId);
-        // A failed close remains a session tombstone. Source/endpoint changes cannot authorize a new host.
-        // Wait for an in-progress close before re-admission; its rejected result is intentionally sticky.
-        if (prior?.ended) {
-            await prior.closing;
-            prior = live.get(sessionId);
-        }
-        if (prior && (prior.current.api !== api || info?.workspaceLocations !== 1 || info?.localWorkspaceContext !== 1)) {
-            await prior.dispose(fail('EMPLOYEE_CONTEXT_CHANGED'), { layer: 'endpoint', initiator: 'provider.scope-change', reason: 'EMPLOYEE_CONTEXT_CHANGED', action: 'dispose' });
-            throw fail('EMPLOYEE_CONTEXT_CHANGED');
+        // Each round owns a fresh employee channel. Old cleanup never admits or blocks it.
+        if (prior) {
+            live.delete(sessionId);
+            void prior.dispose(undefined, { layer: 'runtime', initiator: 'provider.next-round', reason: 'NEXT_ROUND', action: 'dispose' }).catch(() => console.warn('EMPLOYEE_CLEANUP_FAILED'));
+            prior = undefined;
         }
         if (info?.workspaceLocations !== 1 && info?.localWorkspaceContext !== 1)
             return;
@@ -116,50 +83,56 @@ export function createEmployeeProvider(get, options, agent) {
             throw fail('DEPENDENCY_REQUIRED');
         const employee = options.employee;
         const workspace = await employee.workspace(request);
-        await input.stable(request.signal);
         if (!workspace.id || !absolute(workspace.path))
             throw fail('EMPLOYEE_CONTEXT_CHANGED');
         const state = api.getWorkspaceLocationState(), rows = state.items.filter(row => row.workspaceId === workspace.id), row = rows[0];
-        if (state.phase !== 'ready' || state.instanceId !== connection.instanceId || state.epoch !== connection.epoch || rows.length !== 1 || row?.status !== 'selected' || !row.bindingId || !['local', 'host', 'legacy-host'].includes(row.source ?? ''))
+        if (state.phase !== 'ready' || state.instanceId !== connection.instanceId || state.epoch !== connection.epoch || rows.length !== 1 || row?.status !== 'selected' || !row.bindingId || !['local', 'host'].includes(row.source ?? ''))
             throw fail('EMPLOYEE_CONTEXT_CHANGED');
         if (row.source !== 'local') {
-            if (prior)
-                await prior.dispose(fail('EMPLOYEE_CONTEXT_CHANGED'), { layer: 'endpoint', initiator: 'provider.scope-change', reason: 'EMPLOYEE_CONTEXT_CHANGED', action: 'dispose' });
-            if (request.localAcceptance)
+            if (request.localContext)
                 throw fail('EMPLOYEE_CONTEXT_CHANGED');
             return;
         }
         let details, closeDiagnostics;
+        let entry, candidate, opening;
+        const disposers = [], lifetime = new AbortController();
+        const roundSignal = AbortSignal.any([lifetime.signal, ...request.signal ? [request.signal] : []]);
         try {
-            const acceptance = request.localAcceptance;
-            if (!acceptance || acceptance.instanceId !== connection.instanceId || acceptance.epoch !== connection.epoch || acceptance.sessionId !== sessionId || acceptance.provider !== agent.loginProvider || acceptance.workspaceId !== workspace.id || acceptance.bindingId !== row.bindingId)
+            const context = request.localContext;
+            if (!context || context.instanceId !== connection.instanceId || context.epoch !== connection.epoch || context.workspaceId !== workspace.id || context.bindingId !== row.bindingId)
                 throw fail('LOCAL_USER_TURN_UNCONFIRMED');
+            if (typeof api.onWorkspaceLocationState !== 'function' || typeof api.onConnectionState !== 'function')
+                throw fail('DEPENDENCY_REQUIRED');
+            const network = employee.getNetwork();
+            if (!network || typeof network.prepareEmployeeEndpoint !== 'function' || typeof network.onState !== 'function')
+                throw fail('DEPENDENCY_REQUIRED');
+            if (network.getState().phase !== 'online')
+                throw fail('EMPLOYEE_ENDPOINT_UNAVAILABLE');
+            const revoke = (reason, initiator, changes) => { lifetime.abort(reason); if (candidate)
+                void candidate.dispose(reason, { layer: 'endpoint', initiator, reason: reason.code, action: 'invalidate', changes }).catch(() => { }); };
+            disposers.push(api.onWorkspaceLocationState(next => {
+                const matches = next.items.filter(item => item.workspaceId === context.workspaceId);
+                if (get() !== api || next.phase !== 'ready' || next.instanceId !== connection.instanceId || next.epoch !== connection.epoch || matches.length !== 1 || matches[0].bindingId !== context.bindingId || matches[0].source !== 'local' || matches[0].status !== 'selected')
+                    revoke(fail('EMPLOYEE_CONTEXT_CHANGED'), 'endpoint.workspace-change', [{ field: 'workspace.binding-id', before: context.bindingId, after: matches[0]?.bindingId ?? null }, { field: 'workspace.source', before: 'local', after: matches[0]?.source ?? null }, { field: 'workspace.status', before: 'selected', after: matches[0]?.status ?? null }, { field: 'workspace.match-count', before: 1, after: matches.length }]);
+            }), api.onConnectionState(next => { if (get() !== api || next.phase !== 'connected' || next.instanceId !== connection.instanceId || next.epoch !== connection.epoch)
+                revoke(fail('CONNECTION_LOST'), 'endpoint.connection-change', [{ field: 'connection.instance-id', before: connection.instanceId, after: next.instanceId }, { field: 'connection.epoch', before: connection.epoch, after: next.epoch }, { field: 'connection.phase', before: 'connected', after: next.phase }]); }), network.onState(event => { if (event.kind === 'lost' || employee.getNetwork() !== network)
+                revoke(fail('CONNECTION_LOST'), 'endpoint.network-loss', [{ field: 'network.phase', before: null, after: event.state.phase }]); }));
             details = await options.details?.(request, api, connection, target);
-            if (details)
-                request.timing?.bind(detail => details.record(detail));
             const sink = details;
-            closeDiagnostics = prior?.runtime.closeDiagnostics ?? new CloseDiagnostics(event => sink?.record(event));
+            closeDiagnostics = new CloseDiagnostics(event => sink?.record(event));
             closeDiagnostics.bind(event => sink?.record(event));
             request.closeDiagnostics = closeDiagnostics;
-            const unsupported = request.mode !== 'session' || agent.loginProvider !== 'codex' || !!request.recoveryCheckpointId || !!request.resumeSessionId && !prior;
+            const unsupported = agent.loginProvider !== 'codex';
             if (unsupported)
                 throw fail('EMPLOYEE_OPERATION_UNSUPPORTED');
             if (!Number.isSafeInteger(request.acpMaxMessageBytes) || request.acpMaxMessageBytes < 1)
                 throw fail('SETTINGS_REQUIRED');
-            if (typeof api.onWorkspaceLocationState !== 'function' || typeof api.onConnectionState !== 'function')
-                throw fail('DEPENDENCY_REQUIRED');
-            const network = employee.getNetwork();
-            if (!network || typeof network.prepareEmployeeEndpoint !== 'function' || typeof network.onState !== 'function')
-                throw fail('DEPENDENCY_REQUIRED');
-            if (prior && prior.network !== network) {
-                await prior.dispose(fail('EMPLOYEE_CONTEXT_CHANGED'), { layer: 'endpoint', initiator: 'provider.scope-change', reason: 'EMPLOYEE_CONTEXT_CHANGED', action: 'dispose' });
-                throw fail('EMPLOYEE_CONTEXT_CHANGED');
-            }
-            const admitted = await admitEmployeeLocation({ api: api, network, workspace, connection, expectedLocal: { instanceId: acceptance.instanceId, epoch: acceptance.epoch, workspaceId: acceptance.workspaceId, bindingId: acceptance.bindingId, directory: { ...acceptance.directory } }, settingsPath: target.session.settingsPath, signal: request.signal });
+            const admitted = await admitEmployeeLocation({ api: api, network, workspace, connection, expectedLocal: { instanceId: context.instanceId, epoch: context.epoch, workspaceId: context.workspaceId, bindingId: context.bindingId, directory: { ...context.directory } }, settingsPath: target.session.settingsPath, signal: roundSignal });
             if (request.cwd && request.cwd !== admitted.cwd || request.bindingId && request.bindingId !== admitted.bindingId || request.workspaceId && request.workspaceId !== admitted.workspaceId)
                 throw fail('SESSION_CONTEXT_MISMATCH');
             const native = await employee.native();
-            if (!absolute(native.path) || !/^[a-f0-9]{64}$/.test(native.sha256))
+            roundSignal.throwIfAborted();
+            if (!absolute(native.path))
                 throw fail('EMPLOYEE_BINARY_REQUIRED');
             // Only executable identity belongs in this scope. Diagnostic metadata and object key
             // insertion order cannot revoke a live binding; every public identity field stays bound.
@@ -171,33 +144,9 @@ export function createEmployeeProvider(get, options, agent) {
                     local: { instanceId: local.instanceId, epoch: local.epoch, workspaceId: local.workspaceId, bindingId: local.bindingId, directory: { path: local.directory.path, device: local.directory.device, inode: local.directory.inode } },
                     endpoint: { deviceId: account.deviceId, endpointInstanceId: account.endpointInstanceId, executionContextId: account.executionContextId, remoteUser: account.remoteUser, remoteUid: account.remoteUid, remoteHome: account.remoteHome, endpointCwd: account.endpointCwd, endpointShell: account.endpointShell },
                     bridge: { protocolVersion: bridge.protocolVersion, command: bridge.command, settingsPath: bridge.settingsPath, bridgeInstanceId: bridge.bridgeInstanceId, generation: bridge.generation } },
-                native: { path: native.path, sha256: native.sha256 },
+                native: { path: native.path },
             });
-            if (prior && (prior.scope !== scope || prior.ended))
-                await prior.dispose(fail('EMPLOYEE_CONTEXT_CHANGED'), { layer: 'endpoint', initiator: 'provider.scope-change', reason: 'EMPLOYEE_CONTEXT_CHANGED', action: 'dispose' });
-            let entry = prior && prior.scope === scope && !prior.ended ? prior : undefined;
-            let candidate = entry;
-            // Admission still verifies the real directory and N generation. Per-RPC gates below
-            // reuse the subscribed connection/location/network facts, without another SSH.
-            await admitted.validate(request.signal ?? new AbortController().signal);
-            details?.record({ kind: 'session', severity: 'info', code: 'EMPLOYEE_EXECUTION_VALIDATION_POLICY', summary: '本机执行核验不可关闭：L接纳核对实际目录与N端点；同代执行通道仅在open时核对一次主机target与固定执行器。之后每条消息只核对内存中的连接、工作区绑定和已接纳输入，撤销沿现有连接/位置/N网络事件及执行SSH关闭处理；不重复SSH，不改用主机执行。' });
-            if (entry)
-                entry.current = input;
-            const base = async (signal) => {
-                signal.throwIfAborted();
-                if (get() !== api || employee.getNetwork() !== network)
-                    throw fail('EMPLOYEE_CONTEXT_CHANGED');
-                if (candidate?.ended)
-                    throw candidate.reason ?? fail('EMPLOYEE_EXEC_CLOSED');
-                const current = candidate?.current ?? input;
-                current.request.localAdmissionCheck?.();
-                await current.stable(signal);
-                if (get() !== api || employee.getNetwork() !== network)
-                    throw fail('EMPLOYEE_CONTEXT_CHANGED');
-                current.request.localAdmissionCheck?.();
-                await current.stable(signal);
-                signal.throwIfAborted();
-            };
+            details?.record({ kind: 'session', severity: 'info', code: 'EMPLOYEE_EXECUTION_VALIDATION_POLICY', summary: '每轮开始核验本机所选目录、当前网络及端点，并重新prepare一次；本轮执行通道open时核验主机目标。之后不逐消息、审批或原生RPC重复核验。已有连接、位置、网络事件和通道关闭只终止本轮，不回退主机，下一轮重新核验。' });
             let argv = employee.argv;
             if (!argv && !employee.io) {
                 const name = '@ai-workbench/connect';
@@ -214,98 +163,33 @@ export function createEmployeeProvider(get, options, agent) {
                         void candidate.dispose(fail('EMPLOYEE_EXEC_UNKNOWN'), { layer: 'runtime', initiator: 'provider.child-close', reason: 'EMPLOYEE_EXEC_UNKNOWN', action: 'dispose' }).catch(() => { }); });
                     return child;
                 } };
-            const ssh = { closeDiagnostics, target, endpoint: admitted.endpoint, employeeBinary: native.path, binarySha256: native.sha256, acpMaxMessageBytes: request.acpMaxMessageBytes, argv: argv ?? (() => []), validate: base, io: scopedIo };
-            const validate = async (signal) => { try {
-                await base(signal);
-            }
-            catch (error) {
-                if (candidate && errorCode(error) !== 'ABORTED')
-                    void candidate.dispose(asNeed(error), { layer: 'endpoint', initiator: 'provider.validation-failure', reason: closeCode(error), action: 'invalidate' }).catch(cleanup => closeDiagnostics.record({ layer: 'runtime', initiator: 'provider.validation-cleanup', reason: closeCode(cleanup, 'REMOTE_CLEANUP_UNCONFIRMED'), action: 'failure' }));
-                throw error;
-            } };
-            await validate(request.signal ?? new AbortController().signal);
+            const ssh = { closeDiagnostics, target, endpoint: admitted.endpoint, employeeBinary: native.path, acpMaxMessageBytes: request.acpMaxMessageBytes, argv: argv ?? (() => []), io: scopedIo };
             if (!options.open)
                 throw fail('RUNTIME_REQUIRED');
             // Host cwd is only the protected agent bootstrap/config directory. Native tools use admitted.cwd.
-            const host = await options.open(target, { name: 'employee', path: target.projectRoot }, { ...request, agent, employeeScope: scope, bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, bindingRevision: state.revision, closeDiagnostics, detailChannel: details, validateContext: async (ignore = false) => {
-                    // Disposal addresses only the already-owned host broker instance through its frozen IO/CAS.
-                    // A withdrawn local source must prevent dispatch, but cannot forbid that instance's exact kill.
-                    if (ignore)
-                        await (candidate?.current ?? input).stable();
-                    else
-                        await validate(request.signal ?? new AbortController().signal);
-                }, resumeSessionId: undefined, recoveryCheckpointId: undefined, verifyRecovery: undefined });
-            if (entry) {
-                entry.current = input;
-                entry.details = details;
-                try {
-                    await validate(request.signal ?? new AbortController().signal);
-                }
-                catch (error) {
-                    await entry.dispose(asNeed(error), { layer: 'endpoint', initiator: 'provider.final-validation', reason: closeCode(error), action: 'dispose' });
-                    throw error;
-                }
-                entry.runtime.details = details;
-                entry.runtime.connection = { ...connection };
-                entry.runtime.binding = { bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, revision: state.revision };
-                entry.runtime.restartNotice = host.restartNotice;
-                entry.runtime.restartInputIds = host.restartInputIds;
-                entry.runtime.freshSessionConfirmed = host.freshSessionConfirmed;
-                return entry.runtime;
-            }
-            const disposers = [];
-            const execution = new EmployeeExecution({ closeDiagnostics, bindingId: admitted.bindingId, acpMaxMessageBytes: request.acpMaxMessageBytes, validate, transport: signal => createEmployeeSshTransport(ssh, signal) });
-            const runtime = { ...host, closeDiagnostics, cwd: admitted.cwd, details, connection: { ...connection }, binding: { bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, revision: state.revision }, saveCheckpoint: undefined, recoveredSession: undefined, employeeExecutionMeta: { version: 1, bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, cwd: admitted.cwd, acpMaxMessageBytes: request.acpMaxMessageBytes, httpMcpPolicy: request.employeeHttpMcpPolicy ?? 'ignore' }, employeePresentation: CODEX_EMPLOYEE_SCOPE_NOTICE };
+            const host = opening = await options.open(target, { name: 'employee', path: target.projectRoot }, { ...request, signal: roundSignal, agent, employeeScope: scope, bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, bindingRevision: state.revision, closeDiagnostics, detailChannel: details, resumeSessionId: request.resumeSessionId });
+            roundSignal.throwIfAborted();
+            // The old per-RPC identity check belongs once at the end of this round's opening.
+            if (get() !== api || employee.getNetwork() !== network)
+                throw fail('EMPLOYEE_CONTEXT_CHANGED');
+            const execution = new EmployeeExecution({ closeDiagnostics, bindingId: admitted.bindingId, acpMaxMessageBytes: request.acpMaxMessageBytes, transport: signal => createEmployeeSshTransport(ssh, signal) });
+            const runtime = { ...host, closeDiagnostics, cwd: admitted.cwd, details, connection: { ...connection }, binding: { bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, revision: state.revision }, employeeExecutionMeta: { version: 1, bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, cwd: admitted.cwd, acpMaxMessageBytes: request.acpMaxMessageBytes }, employeePresentation: EMPLOYEE_EXECUTION_NOTICE };
             runtime.employeeRemoteCloseReason = () => execution.remoteClose?.reason;
             entry = { scope, runtime, current: input, details, execution, network, ended: false, dispose: (reason, cause = { layer: 'runtime', initiator: 'provider.dispose', reason: reason?.code ?? 'EMPLOYEE_EXEC_CLOSED', action: 'dispose' }) => {
                     closeDiagnostics.record({ ...cause, changes: cause.changes ?? [{ field: 'provider.ended', before: entry.ended, after: true }] });
-                    if (entry.closing)
-                        return entry.closing;
+                    if (entry.ended)
+                        return Promise.resolve();
                     entry.ended = true;
                     entry.reason = reason;
+                    if (live.get(sessionId) === entry)
+                        live.delete(sessionId);
                     execution.invalidate(reason ?? fail('EMPLOYEE_EXEC_CLOSED'), { layer: 'executor', initiator: 'provider.invalidate-executor', reason: reason?.code ?? 'EMPLOYEE_EXEC_CLOSED', action: 'invalidate' });
                     for (const off of disposers)
                         off();
                     host.broker?.fail(reason ?? fail('EMPLOYEE_EXEC_CLOSED'));
-                    entry.closing = (async () => {
-                        const cleanup = [], reporting = [];
-                        try {
-                            await execution.dispose({ layer: 'executor', initiator: 'provider.cleanup-executor', reason: 'RUNTIME_CLEANUP', action: 'dispose' });
-                        }
-                        catch (error) {
-                            cleanup.push(...closeErrorCodes(error, 'EXECUTOR_CLEANUP_FAILED'));
-                        }
-                        try {
-                            await host.dispose?.({ layer: 'broker', initiator: 'provider.cleanup-host', reason: 'RUNTIME_CLEANUP', action: 'dispose' });
-                        }
-                        catch (error) {
-                            cleanup.push(...closeErrorCodes(error, 'HOST_CLEANUP_FAILED'));
-                        }
-                        const firstReason = String(closeDiagnostics.first?.reason ?? reason?.code ?? 'EMPLOYEE_EXEC_CLOSED');
-                        try {
-                            entry.details?.record({ kind: 'need', severity: 'warning', code: cleanup.length ? 'REMOTE_CLEANUP_UNCONFIRMED' : 'EMPLOYEE_EXEC_UNKNOWN', summary: '员工执行通道已关闭，命令结果 UNKNOWN', payload: { bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, result: 'UNKNOWN', reason: reason?.code ?? 'EMPLOYEE_EXEC_CLOSED', firstReason, cleanup: cleanup.length ? 'unconfirmed' : 'closed', cleanupCodes: cleanup } });
-                        }
-                        catch (error) {
-                            reporting.push(closeCode(error, 'CLOSE_RECORD_FAILED'));
-                        }
-                        try {
-                            await entry.details?.flush();
-                        }
-                        catch (error) {
-                            reporting.push(...closeErrorCodes(error, 'CLOSE_FLUSH_FAILED'));
-                        }
-                        try {
-                            closeDiagnostics.assertRecorded();
-                        }
-                        catch (error) {
-                            reporting.push(closeDiagnostics.recordingFailureCode ?? closeCode(error, 'CLOSE_RECORD_FAILED'));
-                        }
-                        if (cleanup.length || reporting.length)
-                            throw Object.assign(new NeedError(reporting.length ? 'CONVERSATION_DETAILS_FAILED' : 'REMOTE_CLEANUP_UNCONFIRMED', '执行连接已关闭；首次原因 ' + firstReason + '，清理或诊断保存未确认。', '首次关闭 ' + firstReason + '；清理 ' + (cleanup.join(',') || 'closed') + '；保存 ' + (reporting.join(',') || 'recorded')), { cause: new AggregateError([firstReason, ...cleanup, ...reporting].map(code => new NeedError(code, '关闭收尾代码 ' + code, '技术详情中的固定代码')), 'EMPLOYEE_CLOSE_AND_DIAGNOSTIC_FAILURES') });
-                        if (live.get(sessionId) === entry)
-                            live.delete(sessionId);
-                    })();
-                    return entry.closing;
+                    void Promise.allSettled([execution.dispose({ layer: 'executor', initiator: 'provider.cleanup-executor', reason: 'RUNTIME_CLEANUP', action: 'dispose' }), host.dispose?.({ layer: 'broker', initiator: 'provider.cleanup-host', reason: 'RUNTIME_CLEANUP', action: 'dispose' })]).then(results => { if (results.some(result => result.status === 'rejected'))
+                        console.warn('[remote-agent] 员工执行通道的旧资源将由主机回收'); });
+                    return Promise.resolve();
                 } };
             candidate = entry;
             runtime.employeeExecution = async (params, signal) => {
@@ -324,43 +208,23 @@ export function createEmployeeProvider(get, options, agent) {
             };
             runtime.dispose = cause => entry.dispose(undefined, cause ?? { layer: 'runtime', initiator: 'runtime.dispose', reason: 'RUNTIME_DISPOSE', action: 'dispose' });
             runtime.detach = cause => entry.dispose(undefined, cause ?? { layer: 'runtime', initiator: 'runtime.detach', reason: 'RUNTIME_DETACH', action: 'detach' });
-            const revoke = (reason, initiator, changes) => { void entry.dispose(reason, { layer: 'endpoint', initiator, reason: reason.code, action: 'invalidate', changes }).catch(() => { }); };
-            disposers.push(api.onWorkspaceLocationState(next => {
-                const matches = next.items.filter(item => item.workspaceId === admitted.workspaceId);
-                if (get() !== api || next.phase !== 'ready' || next.instanceId !== connection.instanceId || next.epoch !== connection.epoch || matches.length !== 1 || matches[0].bindingId !== admitted.bindingId || matches[0].source !== 'local' || matches[0].status !== 'selected')
-                    revoke(fail('EMPLOYEE_CONTEXT_CHANGED'), 'endpoint.workspace-change', [{ field: 'workspace.binding-id', before: admitted.bindingId, after: matches[0]?.bindingId ?? null }, { field: 'workspace.source', before: 'local', after: matches[0]?.source ?? null }, { field: 'workspace.status', before: 'selected', after: matches[0]?.status ?? null }, { field: 'workspace.match-count', before: 1, after: matches.length }]);
-            }), api.onConnectionState(next => { if (get() !== api || next.phase !== 'connected' || next.instanceId !== connection.instanceId || next.epoch !== connection.epoch)
-                revoke(fail('CONNECTION_LOST'), 'endpoint.connection-change', [{ field: 'connection.instance-id', before: connection.instanceId, after: next.instanceId }, { field: 'connection.epoch', before: connection.epoch, after: next.epoch }, { field: 'connection.phase', before: 'connected', after: next.phase }]); }), network.onState(event => { if (event.kind === 'lost' || employee.getNetwork() !== network)
-                revoke(fail('CONNECTION_LOST'), 'endpoint.network-loss', [{ field: 'network.phase', before: null, after: event.state.phase }]); }));
             if (host.broker)
                 disposers.push(host.broker.onChange(() => { if (!host.broker.online)
                     revoke(fail('EMPLOYEE_EXEC_UNKNOWN'), 'endpoint.broker-offline'); }));
             live.set(sessionId, entry);
-            try {
-                await validate(request.signal ?? new AbortController().signal);
-            }
-            catch (error) {
-                await entry.dispose(asNeed(error), { layer: 'endpoint', initiator: 'provider.final-validation', reason: closeCode(error), action: 'dispose' });
-                throw error;
-            }
             return runtime;
         }
         catch (error) {
-            const reporting = [];
-            try {
-                details?.record({ kind: 'need', severity: 'action-required', code: errorCode(error), summary: asNeed(error).message, payload: { result: 'UNKNOWN' } });
-            }
-            catch (failure) {
-                reporting.push(failure);
-            }
+            for (const off of disposers)
+                off();
+            if (opening && !candidate)
+                void opening.dispose?.({ layer: 'runtime', initiator: 'provider.open-failure', reason: closeCode(error), action: 'dispose' }).catch(() => console.warn('EMPLOYEE_CLEANUP_FAILED'));
             try {
-                await details?.flush();
+                details?.record({ kind: 'need', severity: 'warning', code: errorCode(error), summary: '本轮执行连接中断，恢复后可在原会话继续。', payload: { reason: errorCode(error) } });
             }
-            catch (failure) {
-                reporting.push(failure);
+            catch {
+                console.warn('[remote-agent] 执行诊断未保存');
             }
-            if (reporting.length)
-                throw withFailureEvidence(error, reporting, 'diagnostic', closeDiagnostics?.first?.reason);
             throw error;
         }
     };

package/dist/employee-reasons.js

@@ -7,7 +7,6 @@ export const employeeAdapterCodes = new Set([
     "AW_EMPLOYEE_CONFIG_ADMISSION_INVALID",
     "AW_EMPLOYEE_CONFIG_ADMISSION_FAILED",
     "AW_EMPLOYEE_HOST_PROJECT_CONFIG_UNSUPPORTED",
-    "AW_EMPLOYEE_EXECUTOR_MCP_UNSUPPORTED",
     "AW_EMPLOYEE_EXECUTOR_CONFIG_PROTOCOL_INVALID",
     "AW_EMPLOYEE_EXECUTOR_CONFIG_READ_FAILED",
     "AW_EMPLOYEE_AGENT_CONFIG_UNAVAILABLE",
@@ -21,6 +20,7 @@ export const employeeAdapterCodes = new Set([
     "AW_EMPLOYEE_ENVIRONMENT_REGISTRATION_FAILED",
     "AW_EMPLOYEE_ENVIRONMENT_REQUIRED",
     "AW_EMPLOYEE_EXECUTION_CLOSED",
+    "AW_EMPLOYEE_NATIVE_CLOSED_BEFORE_INITIALIZE_REPLY",
     "AW_EMPLOYEE_EXECUTION_ID_REQUIRED",
     "AW_EMPLOYEE_HOST_AUXILIARY_CONFIG_UNSUPPORTED",
     "AW_EMPLOYEE_HOST_AUXILIARY_UNSUPPORTED",
@@ -40,10 +40,6 @@ export const employeeAdapterCodes = new Set([
 ]);
 export const employeeOpenCauseCodes = new Set([
     "AW_EMPLOYEE_BINARY_UNAVAILABLE",
-    "AW_EMPLOYEE_BINARY_HASH_FAILED",
-    "AW_EMPLOYEE_BINARY_HASH_MISMATCH",
-    "AW_EMPLOYEE_BINARY_VERSION_FAILED",
-    "AW_EMPLOYEE_BINARY_VERSION_MISMATCH",
     "EMPLOYEE_CONTEXT_CHANGED",
     "EMPLOYEE_ENDPOINT_INVALID",
     "EMPLOYEE_BINARY_REQUIRED",

package/dist/employee-shell.d.ts

@@ -16,6 +16,7 @@ export type EmployeeShell = (request: {
 interface Options {
     closeDiagnostics?: CloseDiagnostics;
     target: EmployeeEndpointTarget;
+    sshArgs: readonly string[];
     maxBytes: number;
     killGraceMs: number;
     attach: (spec: {
@@ -23,6 +24,6 @@ interface Options {
         args: string[];
     }) => Promise<ChildProcessWithoutNullStreams>;
 }
-/** Every invocation re-discovers the exact S target. Cancellation cannot prove remote exit. */
+/** Use only the target verified at this round lease opening. Cancellation cannot prove remote exit. */
 export declare function createEmployeeShell(options: Options): EmployeeShell;
 export {};

package/dist/employee-shell.js

@@ -1,24 +1,28 @@
 import { closeCode } from "./close-diagnostics.js";
 import { randomUUID } from 'node:crypto';
-import { EMPLOYEE_TARGET_PYTHON, EMPLOYEE_PYTHON_ERRORS } from "./employee-relay.js";
+import { EMPLOYEE_PYTHON_ERRORS } from "./employee-relay.js";
 import { NeedError } from "./remote.js";
-const SHELL_PYTHON = EMPLOYEE_TARGET_PYTHON + String.raw `
- cwd=x["directory"]["path"];device=x["directory"]["device"];inode=x["directory"]["inode"]
+const SHELL_PYTHON = String.raw `
+import sys,json,subprocess,shlex
+def fail(code):
+ sys.stderr.write(json.dumps({"code":code})+"\n");sys.exit(254)
+try:
+ x=json.loads(sys.argv[1]);e=x["endpoint"];args=x["sshArgs"];cwd=x["cwd"]
  # User source is stdin, never argv. The sentinel preserves trailing newlines.
- wrapper="cd -- "+shlex.quote(cwd)+" || exit 254; "+'test "$(/usr/bin/stat -f '+shlex.quote('%d %i')+' .)" = '+shlex.quote(str(device)+' '+str(inode))+" || exit 254; "+'test "$(/usr/bin/id -u)" = '+shlex.quote(str(e['remoteUid']))+" || exit 254; "+"printf '%s\\n' "+shlex.quote('AW_EMPLOYEE_SHELL_STARTED '+x['executionId'])+" >&2; "+'aw_x_source=$(/bin/cat; printf x); aw_x_source='+chr(36)+'{aw_x_source%?}; eval "'+chr(36)+'aw_x_source"'
+ wrapper="cd -- "+shlex.quote(cwd)+" || exit 254; "+"printf '%s\\n' "+shlex.quote('AW_EMPLOYEE_SHELL_STARTED '+x['executionId'])+" >&2; "+'aw_x_source=$(/bin/cat; printf x); aw_x_source='+chr(36)+'{aw_x_source%?}; eval "'+chr(36)+'aw_x_source"'
  command=shlex.join([e["endpointShell"],"-c",wrapper])
  sys.stderr.write("AW_EMPLOYEE_SHELL_READY "+x["executionId"]+"\n");sys.stderr.flush()
  p=subprocess.Popen(["/usr/bin/ssh","-T"]+args+[command],stdin=sys.stdin,stdout=sys.stdout,stderr=sys.stderr)
  code=p.wait();sys.exit(code if code>=0 else 255)
 ` + EMPLOYEE_PYTHON_ERRORS;
 const unknown = (code) => new NeedError(code, '本机命令结果未知；没有重放，也未改在主机执行。', '员工端真实退出回执');
-/** Every invocation re-discovers the exact S target. Cancellation cannot prove remote exit. */
+/** Use only the target verified at this round lease opening. Cancellation cannot prove remote exit. */
 export function createEmployeeShell(options) {
     return async ({ command, timeout, signal }) => {
         signal.throwIfAborted();
         const diagnostics = options.closeDiagnostics?.child();
         const executionId = randomUUID(), target = options.target;
-        const child = await options.attach({ command: '/usr/bin/python3', args: ['-c', SHELL_PYTHON, JSON.stringify({ endpoint: target.endpoint, bridge: target.bridge, directory: target.local.directory, maxBytes: options.maxBytes, executionId })] });
+        const child = await options.attach({ command: '/usr/bin/python3', args: ['-c', SHELL_PYTHON, JSON.stringify({ endpoint: target.endpoint, sshArgs: options.sshArgs, cwd: target.local.directory.path, executionId })] });
         return new Promise((yes, no) => {
             let settled = false, bytes = 0, stdout = [], stderr = [], reason, grace, timer;
             const finish = (error, code) => {
@@ -65,13 +69,6 @@ export function createEmployeeShell(options) {
                     no(unknown('EMPLOYEE_EXIT_UNKNOWN'));
                     return;
                 }
-                try {
-                    diagnostics?.assertRecorded();
-                }
-                catch (failure) {
-                    no(failure);
-                    return;
-                }
                 yes({ stdout: out, stderr: err.slice(header.length, start) + err.slice(start + started.length), stderrSource: 'combined-ssh-and-command', exitCode: code, signal: null });
             };
             const stop = (code) => { diagnostics?.record({ layer: 'executor', initiator: 'shell.stop', reason: code, action: 'terminate', changes: [{ field: 'shell.stop-code', before: reason?.code ?? null, after: settled || reason ? reason?.code ?? null : code }] }); if (settled || reason)

package/dist/employee-ssh.d.ts

@@ -9,15 +9,13 @@ export interface EmployeeSshOptions {
     closeDiagnostics?: CloseDiagnostics;
     /** Automatically discovered package binary path on this same employee device. */
     employeeBinary: string;
-    binarySha256: string;
     acpMaxMessageBytes: number;
     argv: SshArgv;
-    validate(signal: AbortSignal): Promise<void>;
     /** Fixture seam only. Production uses L's exported argv through sshIo. */
     io?: BrokerIo;
 }
 /** Fixed bootstrap only; cwd for every native operation remains in its original RPC. */
-export declare function employeeExecServerCommand(binary: string, binarySha256: string): string;
+export declare function employeeExecServerCommand(binary: string, readyMarker: string): string;
 /** Explicit read-only probe; production dispatch verifies S once in transport open. */
 export declare function validateEmployeeSshTarget(options: EmployeeSshOptions, signal?: AbortSignal): Promise<void>;
 /** Outer L-authenticated host SSH, then S-authenticated employee SSH; no host execution fallback. */

package/dist/employee-ssh.js

@@ -1,3 +1,4 @@
+import { randomUUID } from 'node:crypto';
 import { closeCode } from "./close-diagnostics.js";
 import { sshIo } from "./broker.js";
 import { createEmployeeProcessTransport } from "./employee-exec.js";
@@ -70,17 +71,10 @@ function readTarget(raw, expected, maxBytes) {
     return args;
 }
 /** Fixed bootstrap only; cwd for every native operation remains in its original RPC. */
-export function employeeExecServerCommand(binary, binarySha256) {
-    if (!absolute(binary) || !hash(binarySha256))
+export function employeeExecServerCommand(binary, readyMarker) {
+    if (!absolute(binary))
         throw fail('EMPLOYEE_BINARY_REQUIRED');
-    const file = shellQuote(binary), digest = shellQuote(binarySha256);
-    const stop = (code) => `{ printf '%s\\n' '${code}' >&2; exit 126; }`;
-    return `if [ ! -f ${file} ] || [ ! -x ${file} ]; then ${stop('AW_EMPLOYEE_BINARY_UNAVAILABLE')}; fi; ` +
-        `aw_employee_digest=$(/usr/bin/shasum -a 256 < ${file} 2>/dev/null) || ${stop('AW_EMPLOYEE_BINARY_HASH_FAILED')}; ` +
-        `aw_employee_digest=\${aw_employee_digest%% *}; [ "$aw_employee_digest" = ${digest} ] || ${stop('AW_EMPLOYEE_BINARY_HASH_MISMATCH')}; ` +
-        `aw_employee_version=$(${file} --version 2>/dev/null) || ${stop('AW_EMPLOYEE_BINARY_VERSION_FAILED')}; ` +
-        `[ "$aw_employee_version" = 'codex-cli 0.160.1' ] || ${stop('AW_EMPLOYEE_BINARY_VERSION_MISMATCH')}; ` +
-        `exec ${file} exec-server --listen stdio`;
+    return `printf '%s\n' ${shellQuote(readyMarker)} >&2; exec ${shellQuote(binary)} exec-server --listen stdio`;
 }
 async function currentTarget(options, signal) {
     checkSignal(signal);
@@ -89,14 +83,14 @@ async function currentTarget(options, signal) {
     const endpoint = structuredClone(options.endpoint), target = structuredClone(options.target);
     checkEndpoint(endpoint, target);
     const io = options.io ?? sshIo(target, options.argv, options.acpMaxMessageBytes);
-    const gate = async () => { checkSignal(signal); await awaitSignal(options.validate(signal), signal); checkSignal(signal); };
-    await gate();
+    const gate = () => checkSignal(signal);
+    gate();
     const b = endpoint.bridge, e = endpoint.endpoint;
     const command = [b.command, 'target', '--settings', b.settingsPath, '--device', e.deviceId, '--if-instance', b.bridgeInstanceId, '--if-generation', String(b.generation), '--if-endpoint', e.endpointInstanceId, '--if-context', e.executionContextId].map(shellQuote).join(' ');
     const run = () => awaitSignal(io.run(command, signal), signal);
     const raw = await (options.closeDiagnostics ? options.closeDiagnostics.run('endpoint.target', run) : run());
     const args = readTarget(raw, endpoint, options.acpMaxMessageBytes);
-    await gate();
+    gate();
     return { io, args, gate };
 }
 /** Explicit read-only probe; production dispatch verifies S once in transport open. */
@@ -104,18 +98,21 @@ export async function validateEmployeeSshTarget(options, signal = new AbortContr
 /** Outer L-authenticated host SSH, then S-authenticated employee SSH; no host execution fallback. */
 export async function createEmployeeSshTransport(options, signal = new AbortController().signal) {
     checkSignal(signal);
-    const remote = employeeExecServerCommand(options.employeeBinary, options.binarySha256);
+    const readyMarker = 'AW_EMPLOYEE_EXEC_SERVER_READY_' + randomUUID().replaceAll('-', '');
+    const remote = employeeExecServerCommand(options.employeeBinary, readyMarker);
     const { io, args, gate } = await currentTarget(options, signal);
     checkSignal(signal);
     // EmployeeExecution races the user's open wait; this factory retains any late child cleanup.
     const child = await io.attach('exec ' + ['/usr/bin/ssh', ...args, remote].map(shellQuote).join(' '));
-    const transport = createEmployeeProcessTransport(child, options.acpMaxMessageBytes, ['AW_EMPLOYEE_BINARY_UNAVAILABLE', 'AW_EMPLOYEE_BINARY_HASH_FAILED', 'AW_EMPLOYEE_BINARY_HASH_MISMATCH', 'AW_EMPLOYEE_BINARY_VERSION_FAILED', 'AW_EMPLOYEE_BINARY_VERSION_MISMATCH'], options.closeDiagnostics?.capture());
+    const transport = createEmployeeProcessTransport(child, options.acpMaxMessageBytes, [], options.closeDiagnostics?.capture(), readyMarker);
     if (signal.aborted) {
         await transport.close({ layer: 'endpoint', initiator: 'ssh.open-abort', reason: 'ABORTED', operation: 'open', action: 'abort' });
         throw fail('ABORTED');
     }
     try {
-        await gate();
+        const wait = () => awaitSignal(transport.ready, signal);
+        await (options.closeDiagnostics ? options.closeDiagnostics.run('employee-executor-ready', wait) : wait());
+        gate();
         return transport;
     }
     catch (error) {