@ai-workbench/remote-agent 0.8.21 → 0.8.24

package/dist/index.js

@@ -1,59 +1,45 @@
 import { connectNeedMessage } from "./connect-need.js";
-import { CloseDiagnostics, withFailureEvidence, withFirstFailureEvidence, failureEvidenceSummary, closeCode, closeErrorCodes, closeFailure } from "./close-diagnostics.js";
-import { withPendingCleanupEvidence, withRemoteFailureEvidence } from "./failure-evidence.js";
-import { runCatalog } from "./catalog-ssh.js";
-import { createCatalogDiagnostics, CatalogDiagnosticsRemote } from "./catalog-diagnostics.js";
+import { CloseDiagnostics, withFirstFailureEvidence, failureEvidenceSummary, closeCode } from "./close-diagnostics.js";
+import { withRemoteFailureEvidence } from "./failure-evidence.js";
 import { SessionId } from '@deepseek-ai/dsh-session';
 import Schema from '@deepseek-ai/schemastery';
 import { LlmAdapter, LlmError } from '@deepseek-ai/dsh-llm';
-import { fileURLToPath } from 'node:url';
-import { createHash, randomUUID } from 'node:crypto';
-import { recoveryJournal, runtimeRecoveryKey, supportsCodexContextPolicy } from "./recovery.js";
+import { createHash } from 'node:crypto';
 import * as unstable from '@agentclientprotocol/sdk/unstable';
 import * as acp from '@agentclientprotocol/sdk';
 import { AcpSession } from "./acp.js";
-import { runOneShot } from "./oneshot.js";
 import { StreamMapper } from "./mapping.js";
 import { connectProvider } from "./provider.js";
 import { brokerFactory } from "./broker.js";
 import { AGENTS, CODEX_AGENT } from "./agents.js";
-import { prepareInput, prepareContinuation, projectHostWorkspaceInput } from "./input.js";
-import { createWorkspaceNoticeConsumer, isWorkspaceNoticeMessage } from "./workspace-notice.js";
+import { prepareInput, projectHostWorkspaceInput } from "./input.js";
 import { NeedError } from "./remote.js";
 import { employeeFailure } from "./presentation.js";
 import { createRemoteDetails } from "./remote-details.js";
-import { PROVIDER_NAMES, ProviderLocaleRemote } from "./provider-locale.js";
 import { approvalLabel } from "./approval-label.js";
-import { StageTiming } from "./stage-timing.js";
-import { verifyRecoveryCheckpoint, currentInputIds } from "./recovery-checkpoint.js";
 import { ModelCatalog, modelInfo } from "./model-catalog.js";
-import { ModelPresentation, unavailableModelInfo } from "./model-presentation.js";
-import { EMPLOYEE_EXECUTION_NOTICE, employeeNoticePreviouslyShown } from "./employee-presentation.js";
+import { ModelPresentation } from "./model-presentation.js";
+import { EMPLOYEE_EXECUTION_NOTICE } from "./employee-presentation.js";
 import { ModelConfigurationError } from "./model-configuration.js";
 import { officialEmployeeWorkspace } from "./employee-workspace.js";
-import { nativeWorkspaceSourceConfirmation } from "./workspace-source-confirmation.js";
 import { resolveEmployeeNative } from "./employee-native.js";
-import { createLocalUserTurnObserver } from "./local-user-turn.js";
 import { createClaudeLocalProvider } from "./claude-local.js";
 import { readLocalUserTurn } from "./local-user-turn.js";
 import { readEmployeeWorkspace } from "./employee-workspace.js";
-import { createModelDefaults, createDefaultSelectionWriter } from "./model-defaults.js";
 import { createPreflightDiagnostics } from "./preflight-diagnostic.js";
 import { installModelInputRetention, markModelPreparationFailure } from "./model-input-retention.js";
+import { dshPermissionSource, permissionMode } from "./permissions.js";
+export { readDshPermissions } from "./permissions.js";
 export const name = 'ai-workbench-remote-agent';
 export const settingsNamespace = 'ai-workbench-codex';
 // L can be installed/enabled after X; keeping X mounted lets it explain the prerequisite.
 export const inject = ['llm'];
 /** Owner-approved defaults; administrators may override through the existing settings. */
-export const DEFAULT_CONFIG = Object.freeze({ mode: 'session', acpMaxMessageBytes: 4194304, brokerMaxFrameBytes: 2097152, brokerControlMaxBytes: 1048576, oneShotSandbox: 'workspace-write', oneShotApproval: 'never', employeeShellKillGraceMs: 1000, employeeHttpMcpPolicy: 'ignore' });
+export const DEFAULT_CONFIG = Object.freeze({ acpMaxMessageBytes: 4194304, brokerMaxFrameBytes: 2097152, brokerControlMaxBytes: 1048576, employeeShellKillGraceMs: 1000 });
 export const Config = Schema.object({
-    employeeHttpMcpPolicy: Schema.union([Schema.const('reject').i18n({ zh: '拒绝本机 HTTP MCP', en: '拒绝本机 HTTP MCP' }), Schema.const('ignore').i18n({ zh: '忽略本机 HTTP MCP 后继续（默认）', en: '忽略本机 HTTP MCP 后继续（默认）' })]).i18n({ zh: '本机 HTTP MCP 策略；默认忽略；忽略仅剔除会话投影，不改员工配置。新连接生效，stdio 始终按原生规则忽略，名称仅在技术详情说明；HTTP 忽略在正文按扩展名称提示', en: '本机 HTTP MCP 策略；默认忽略；忽略仅剔除会话投影，不改员工配置。新连接生效，stdio 始终按原生规则忽略，名称仅在技术详情说明；HTTP 忽略在正文按扩展名称提示' }).default(DEFAULT_CONFIG.employeeHttpMcpPolicy).volatile(),
-    mode: Schema.union([Schema.const('session').i18n({ en: 'Session', zh: '会话模式' }), Schema.const('one-shot').i18n({ en: 'One-shot', zh: '单次模式' })]).i18n({ en: 'Run mode; start a new session after switching modes', zh: 'Codex运行模式；Claude固定会话模式；切换后请新建会话' }).default(DEFAULT_CONFIG.mode).volatile(),
     acpMaxMessageBytes: Schema.number().min(1).step(1).i18n({ en: 'Session message limit; default 4 MiB, adjustable by administrators', zh: '会话消息容量；默认4 MiB，管理员可调整' }).default(DEFAULT_CONFIG.acpMaxMessageBytes).volatile(),
     brokerMaxFrameBytes: Schema.number().min(1).step(1).i18n({ en: 'Host output chunk limit; default 2 MiB, adjustable by administrators', zh: '主机回传单段容量；默认2 MiB，管理员可调整' }).default(DEFAULT_CONFIG.brokerMaxFrameBytes).volatile(),
     brokerControlMaxBytes: Schema.number().min(1).step(1).i18n({ en: 'Host session control reply limit; default 1 MiB, adjustable by administrators', zh: '主机会话管理回复容量；默认1 MiB，管理员可调整' }).default(DEFAULT_CONFIG.brokerControlMaxBytes).volatile(),
-    oneShotSandbox: Schema.union(['read-only', 'workspace-write', 'danger-full-access']).i18n({ en: 'One-shot sandbox; workspace changes are allowed by default', zh: '单次任务沙箱；默认允许工作区内修改' }).default(DEFAULT_CONFIG.oneShotSandbox).volatile(),
-    oneShotApproval: Schema.const('never').i18n({ en: 'Non-interactive approval; permissions follow the launch policy, never automatic approval', zh: '单次模式无交互审批；权限由启动策略决定，不表示自动批准' }).default(DEFAULT_CONFIG.oneShotApproval).volatile(),
     employeeShellKillGraceMs: Schema.number().min(0).max(2147483647).step(1).i18n({ en: 'Local command SSH cleanup grace in milliseconds; cancellation keeps the remote result unknown', zh: '本机命令SSH取消后的清理宽限毫秒；默认1000，取消仍保留员工端结果未知' }).default(DEFAULT_CONFIG.employeeShellKillGraceMs).volatile(),
 });
 /** DSH volatile settings are handles; adapters freeze their values once per invocation. */
@@ -65,23 +51,16 @@ function modelResolutionLabel(configuration) {
         ? `型号：${configuration.resolvedModel}（来源：主机目录映射 ${configuration.selected.value}；会话未单独回报具体型号）`
         : `具体型号：${configuration.resolvedModel}`;
 }
-function validContextDigest(value) { return typeof value === 'string' && /^[a-fA-F0-9]{64}$/u.test(value); }
 function readPointer(options, agent) {
-    const last = options.messages.findLast(message => message.role === 'assistant' && !isWorkspaceNoticeMessage(message));
+    const last = options.messages.findLast(message => message.role === 'assistant');
     if (!last || last.role !== 'assistant')
         return;
     if (last.source.provider !== options.provider)
-        throw new NeedError('SESSION_STATE_MISSING', '已有对话属于其他模型通道，不能沿用其远端进程', '当前模型的远端恢复记录');
-    if (last.source.replayState === undefined)
         return;
     const envelope = last.source.replayState;
     const pointer = envelope?.response;
-    if (pointer?.version !== 2 || pointer.agent !== agent.id || (pointer.mode !== 'session' && pointer.mode !== 'one-shot') || ![pointer.identity, pointer.cwd, pointer.sessionId].every(value => typeof value === 'string' && value.length > 0))
-        throw new NeedError('SESSION_STATE_INVALID', '原对话缺少新版工作区/模型绑定，不能静默迁移，请新建会话', '有效的新一代远端会话恢复记录');
-    if (options.sessionId && pointer.dshSessionId !== options.sessionId)
-        throw new NeedError('SESSION_CONTEXT_MISMATCH', '此恢复记录属于另一会话，复制或分叉后不能沿用原远端进程，请新建会话', '当前DSH会话自己的远端恢复记录');
-    if (agent.loginProvider === 'codex' && (!validContextDigest(pointer.contextSha256) || (pointer.previousRemoteSessions !== undefined && (!Array.isArray(pointer.previousRemoteSessions) || !pointer.previousRemoteSessions.every(ref => ref && typeof ref.sessionId === 'string' && ref.sessionId.length > 0 && validContextDigest(ref.contextSha256))))))
-        throw new NeedError('SESSION_CONTEXT_DIGEST_INVALID', '原Codex会话的初建上下文摘要未知或无效，不能猜测是否相同，本轮未发送', '原会话合法的64位十六进制初建上下文摘要');
+    if (pointer?.version !== 2 || pointer.agent !== agent.id || pointer.dshSessionId !== options.sessionId || ![pointer.identity, pointer.cwd, pointer.sessionId].every(value => typeof value === 'string' && value.length > 0))
+        return;
     return pointer;
 }
 // A reporting failure can wrap the original admission error. Preserve its
@@ -110,17 +89,16 @@ export class CodexRemoteAdapter extends LlmAdapter {
     reportLoginFailure;
     directory;
     preflightDiagnostics;
+    permissions;
     config;
     sessions = new Map();
     turns = new Map();
     lifetime = new AbortController();
     shuttingDown = false;
     detached = new Set();
-    cleanups = new WeakMap();
-    preparationFailures = new Map();
     modelPresentation = new ModelPresentation();
     employeeNoticeSessions = new Set();
-    constructor(config, resolveRuntime, approve, providerName = () => PROVIDER_NAMES.en, agent = CODEX_AGENT, readImage, reportLoginFailure, directory, preflightDiagnostics) {
+    constructor(config, resolveRuntime, approve, providerName = () => CODEX_AGENT.name.zh, agent = CODEX_AGENT, readImage, reportLoginFailure, directory, preflightDiagnostics, permissions) {
         super();
         this.resolveRuntime = resolveRuntime;
         this.approve = approve;
@@ -130,6 +108,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
         this.reportLoginFailure = reportLoginFailure;
         this.directory = directory;
         this.preflightDiagnostics = preflightDiagnostics;
+        this.permissions = permissions;
         this.config = typeof config === 'function' ? config : () => config;
     }
     providerInfo(provider) { return { id: provider, name: this.providerName() }; }
@@ -142,112 +121,47 @@ export class CodexRemoteAdapter extends LlmAdapter {
     finally {
         catalog.release();
     } }
-    async resolveModel(provider, id, signal) { try {
-        signal?.throwIfAborted();
+    async resolveModel(provider, id, signal) {
         const displayed = this.modelPresentation.resolve(provider, id);
         if (displayed)
             return displayed;
-        const catalog = await this.catalog(signal);
+        const active = signal ? AbortSignal.any([signal, this.lifetime.signal]) : this.lifetime.signal;
+        const catalog = await this.catalog(active);
         try {
-            const model = catalog.models.find(model => model.id === id);
-            return model ? modelInfo(provider, model) : unavailableModelInfo(provider, id);
+            active.throwIfAborted();
+            this.modelPresentation.remember(catalog);
+            const resolved = this.modelPresentation.resolve(provider, id);
+            if (!resolved)
+                throw new LlmError('所选模型当前不可用，请打开模型菜单重新选择。', 'MODEL_CATALOG_UNAVAILABLE');
+            return resolved;
         }
         finally {
             catalog.release();
         }
     }
-    catch (error) {
-        markModelPreparationFailure(provider, error, signal);
-        throw error;
-    } }
     async prepareCall(provider, id, signal) {
         try {
-            const catalog = await this.catalog(signal);
-            try {
-                catalog.assertCurrent();
-                const selected = catalog.models.find(model => model.id === id);
-                if (!selected)
-                    throw new LlmError('所选模型已不在当前主机目录中，请在模型菜单重新选择后再发送；本次输入尚未发送。', 'MODEL_CATALOG_UNAVAILABLE');
-                return { model: modelInfo(provider, selected), stream: (options) => this.stream(options) };
-            }
-            finally {
-                catalog.release();
-            }
+            return { model: await this.resolveModel(provider, id, signal), stream: (options) => this.stream(options) };
         }
         catch (error) {
             markModelPreparationFailure(provider, error, signal);
             throw error;
         }
     }
-    observeModelInvalidation(fields, changes = []) { for (const live of this.sessions.values())
-        live.runtime.closeDiagnostics?.record({ layer: 'adapter', initiator: 'catalog.signature-change', reason: 'MODEL_CATALOG_SIGNATURE_CHANGED', action: 'invalidate', changedFields: fields, changes }); }
-    async invalidateModelState() { for (const [id, turn] of this.turns) {
-        this.sessions.get(id)?.runtime.closeDiagnostics?.record({ layer: 'adapter', initiator: 'adapter.model-invalidation', reason: 'MODEL_STATE_INVALIDATED', action: 'abort', changes: [{ field: 'adapter.turn-aborted', before: turn.signal.aborted, after: true }] });
-        turn.abort();
-    } await Promise.all([...this.sessions.keys()].map(id => this.disposeSession(id))); }
-    async invalidateEmployeeState() { for (const live of this.sessions.values())
-        if (live.runtime.employeeExecutionMeta || live.runtime.execution)
-            live.runtime.closeDiagnostics?.record({ layer: 'adapter', initiator: 'adapter.employee-invalidation', reason: 'EMPLOYEE_SERVICE_CHANGED', action: 'invalidate' }); await Promise.all([...this.sessions].filter(([, live]) => live.runtime.employeeExecutionMeta || live.runtime.execution).map(([id]) => this.disposeSession(id))); }
     providerRetryPolicy() { return { mode: 'normal', maxRetries: 0, retryableCodes: [], initialDelayMs: 0, maxDelayMs: 0, jitterRatio: 0 }; }
     cleanupRuntime(runtime, cause = { layer: 'adapter', initiator: 'adapter.cleanup-runtime', reason: 'RUNTIME_CLEANUP', action: 'dispose' }) {
         runtime.closeDiagnostics?.record(cause);
-        const existing = this.cleanups.get(runtime);
-        if (existing)
-            return existing;
-        const cleanup = Promise.resolve().then(() => runtime.dispose?.(cause)).catch(error => {
-            const codes = closeErrorCodes(error, 'REMOTE_CLEANUP_UNCONFIRMED');
-            const failure = closeFailure('REMOTE_CLEANUP_UNCONFIRMED', '原主机会话的清理结果未确认，不能继续或重开此会话', '管理员核对原主机会话；收尾代码 ' + codes.join(','), codes);
-            for (const live of this.sessions.values())
-                if (live.runtime === runtime) {
-                    live.cleanupFailure = failure;
-                    live.failure ??= { cause: failure };
-                }
-            throw failure;
-        });
-        this.cleanups.set(runtime, cleanup);
-        return cleanup;
-    }
-    /** Publish an already known failure without coupling the official stream to cleanup. */
-    finishFailedTurn(key, live, primary, code, firstReason) {
-        withPendingCleanupEvidence(primary, firstReason, code);
-        const runtime = live.runtime;
-        const disposal = this.cleanupRuntime(runtime).then(() => {
-            if (this.sessions.get(key) !== live || live.disposal !== disposal)
-                return;
-            live.disposal = undefined;
-            if (!live.failure) {
-                if (typeof runtime.dispose === 'function') {
-                    this.sessions.delete(key);
-                    this.preparationFailures.set(key, code);
-                }
-                else
-                    live.cleanupFailure = new NeedError('REMOTE_CLEANUP_UNCONFIRMED', '缺少原实例结束证明，不能重开或重发', '原实例的条件结束与list消失证明');
-            }
-        }, error => {
-            if (this.sessions.get(key) === live && live.disposal === disposal)
-                live.cleanupFailure = withFailureEvidence(primary, [error], 'cleanup', firstReason, code);
-            throw error;
-        });
-        live.disposal = disposal;
-        const report = (reason) => {
-            runtime.closeDiagnostics?.record({ layer: 'adapter', initiator: 'adapter.failed-turn-cleanup', reason, action: 'dispose' });
-            // State settles before reporting. A delayed D19 write is not another release gate.
-            void Promise.resolve().then(() => runtime.details?.flush()).catch(error => runtime.closeDiagnostics?.record({ layer: 'adapter', initiator: 'adapter.failed-turn-cleanup-report', reason: closeCode(error, 'CLOSE_FLUSH_FAILED'), action: 'failure' }));
-        };
-        void disposal.then(() => report(typeof runtime.dispose === 'function' ? 'RUNTIME_CLEANUP_CONFIRMED' : 'REMOTE_CLEANUP_UNCONFIRMED'), () => report('REMOTE_CLEANUP_UNCONFIRMED'));
+        void Promise.resolve().then(() => runtime.dispose?.(cause)).catch(() => console.warn('[remote-agent] 旧主机会话暂未清理，将由主机自动回收'));
+        return Promise.resolve();
     }
     async disposeSession(sessionId) {
-        this.sessions.get(sessionId)?.runtime.closeDiagnostics?.record({ layer: 'adapter', initiator: 'adapter.dispose-session', reason: 'SESSION_DISPOSED', action: 'abort' });
         this.turns.get(sessionId)?.abort();
         const current = this.sessions.get(sessionId);
         if (!current)
             return;
-        if (current.disposal)
-            return current.disposal;
+        this.sessions.delete(sessionId);
         current.session.close({ layer: 'adapter', initiator: 'adapter.dispose-session', reason: 'SESSION_DISPOSED', action: 'close' });
-        current.disposal = this.cleanupRuntime(current.runtime).then(() => { if (this.sessions.get(sessionId) === current)
-            this.sessions.delete(sessionId); });
-        return current.disposal;
+        await this.cleanupRuntime(current.runtime);
     }
     async detachSession(sessionId) {
         const current = this.sessions.get(sessionId), turn = this.turns.get(sessionId);
@@ -286,11 +200,11 @@ export class CodexRemoteAdapter extends LlmAdapter {
         }
         catch (error) {
             if (error instanceof ModelConfigurationError)
-                throw new LlmError(error.message + (failureEvidenceSummary(error) ? '；' + failureEvidenceSummary(error) : ''), error.code, { cause: error });
+                throw new LlmError(employeeFailure(error.code, this.agent.loginProvider), error.code, { cause: error });
             if (error instanceof NeedError) {
                 const rpc = /RPC 错误码 (-?\d+)/u.exec(error.requires)?.[1];
                 const evidence = failureEvidenceSummary(error);
-                const message = (connectNeedMessage(error) ?? employeeFailure(error.code, this.agent.loginProvider)) + (rpc ? `（技术详情：RPC 错误码 ${rpc}）` : '') + (evidence ? '；' + evidence : '');
+                const message = connectNeedMessage(error) ?? employeeFailure(error.code, this.agent.loginProvider);
                 const login = originalLoginFailure(error);
                 let diagnostic = login?.technical ? JSON.stringify(login.technical) : '';
                 if (login?.technical && this.reportLoginFailure) {
@@ -302,11 +216,9 @@ export class CodexRemoteAdapter extends LlmAdapter {
                         diagnostic += '；诊断保存失败：' + (failure instanceof NeedError ? failure.code : 'DIAGNOSTIC_WRITE_FAILED');
                     }
                 }
-                throw new LlmError(message, error.code, { cause: new Error(`诊断代码：${error.code}；${error.requires}` + (diagnostic ? '；' + diagnostic : '')) });
+                throw new LlmError(message, error.code, { cause: new Error(`诊断代码：${error.code}；${error.requires}` + (evidence ? '；' + evidence : '') + (diagnostic ? '；' + diagnostic : '')) });
             }
-            if (error instanceof LlmError && failureEvidenceSummary(error))
-                throw new LlmError(error.failure.message + '；' + failureEvidenceSummary(error), error.code, { cause: error });
-            throw error;
+            throw new LlmError(employeeFailure('TURN_FAILED', this.agent.loginProvider), 'TURN_FAILED', { cause: error });
         }
     }
     async *generate(original) {
@@ -322,7 +234,6 @@ export class CodexRemoteAdapter extends LlmAdapter {
             this.turns.set(key, turn);
         const signal = AbortSignal.any([this.lifetime.signal, turn.signal, ...(original.signal ? [original.signal] : [])]);
         const options = { ...original, signal };
-        const timing = new StageTiming();
         const abortOffs = [];
         let request;
         let earlyStage = 'input-prepare';
@@ -335,18 +246,19 @@ export class CodexRemoteAdapter extends LlmAdapter {
         let failureCode;
         let preserveRecoveredRuntime = false;
         let activeMapper;
-        let catalog;
         let selected;
         let modelConfiguration;
         let turnFailure;
         let employeeNoticeShown = false;
+        let permissionOff;
+        let permissionEpoch = new AbortController();
         const information = [];
-        const recordInformation = () => { timing.summarize(); if (runtime?.details)
+        const recordInformation = () => { if (runtime?.details)
             for (const entry of information.splice(0))
                 runtime.details.record(entry); };
         const config = this.config();
-        const mode = this.agent.oneShot ? config.mode : 'session';
-        request = { sessionId: options.sessionId, mode: mode ?? 'session', timing, signal };
+        const mode = 'session';
+        request = { sessionId: options.sessionId, mode: mode ?? 'session', signal };
         const observeAbort = (source, initiator, reason) => { if (!source)
             return; const record = () => { (request?.closeDiagnostics ?? runtime?.closeDiagnostics)?.record({ layer: 'adapter', initiator, reason, action: 'abort', changes: [{ field: 'adapter.turn-aborted', before: false, after: source.aborted }] }); }; source.addEventListener('abort', record, { once: true }); abortOffs.push(() => source.removeEventListener('abort', record)); };
         observeAbort(original.signal, 'signal.caller', 'CALLER_ABORTED');
@@ -356,93 +268,48 @@ export class CodexRemoteAdapter extends LlmAdapter {
         if (this.preflightDiagnostics)
             request.recordEarlyFailure = (error, stage) => this.preflightDiagnostics.failure(request, this.agent.loginProvider, error, stage);
         try {
-            if (!mode || (mode === 'session' && (!Number.isSafeInteger(config.acpMaxMessageBytes) || config.acpMaxMessageBytes < 1)))
-                throw new NeedError('SETTINGS_REQUIRED', '远程模型连接设置无效，请联系管理员检查', '有效的mode/acpMaxMessageBytes');
+            if (!Number.isSafeInteger(config.acpMaxMessageBytes) || config.acpMaxMessageBytes < 1)
+                throw new NeedError('SETTINGS_REQUIRED', '远程模型连接设置无效，请联系管理员检查', '有效的acpMaxMessageBytes');
             const previous = readPointer(options, this.agent);
-            employeeNoticeShown = !!key && this.employeeNoticeSessions.has(key) || employeeNoticePreviouslyShown(options);
+            employeeNoticeShown = !!key && this.employeeNoticeSessions.has(key) || false;
             if (employeeNoticeShown && key)
                 this.employeeNoticeSessions.add(key);
-            const last = options.messages.findLast(message => message.role === 'assistant' && !isWorkspaceNoticeMessage(message));
+            const last = options.messages.findLast(message => message.role === 'assistant');
             const missingPointer = !!last && !previous;
-            let requireFreshSession = missingPointer || !!key && this.preparationFailures.has(key);
-            if (previous && previous.mode !== mode)
-                throw new NeedError('SESSION_CONTEXT_MISMATCH', '运行模式与原会话不一致，请新建会话', '原会话模式');
-            if (previous && !previous.modelConfiguration)
-                information.push({ kind: 'session', severity: 'info', code: 'TURN_GATE_INFORMATION', summary: '历史回复没有模型配置资料；本轮会重新确认你当前选择的模型。', payload: { reason: 'HISTORICAL_MODEL_CONFIGURATION_ABSENT' } });
-            live = key ? this.sessions.get(key) : undefined;
-            if (live?.disposal || live?.cleanupFailure)
-                throw live.cleanupFailure ?? new NeedError('REMOTE_CLEANUP_UNCONFIRMED', '原主机会话正在结束，清理结果尚未确认，不能继续或重开此会话', '管理员核对原主机会话清理结果');
-            if (live?.failure)
-                throw new NeedError('INPUT_DELIVERY_UNCONFIRMED', '上一轮输入已经交给远端，但结果未确认，不能自动重发', '核对已发送输入及原主机会话状态');
-            if (live && !previous) {
-                if (typeof live.runtime.dispose !== 'function')
-                    throw new NeedError('REMOTE_CLEANUP_UNCONFIRMED', '原会话不能确认已安全结束，本轮尚未发送', '可确认结束原实例的通道');
-                live.session.close({ layer: 'adapter', initiator: 'adapter.missing-pointer', reason: 'PRIVATE_RECOVERY_POINTER_ABSENT', action: 'close' });
-                await this.cleanupRuntime(live.runtime, { layer: 'adapter', initiator: 'adapter.missing-pointer', reason: 'PRIVATE_RECOVERY_POINTER_ABSENT', action: 'dispose' });
-                if (key && this.sessions.get(key) === live)
-                    this.sessions.delete(key);
-                live = undefined;
-                requireFreshSession = true;
-            }
-            const configuration = JSON.stringify([mode, config.acpMaxMessageBytes, config.brokerMaxFrameBytes, config.brokerControlMaxBytes, config.employeeShellKillGraceMs]);
-            if (live && live.configuration !== configuration)
-                throw new NeedError('SESSION_CONTEXT_MISMATCH', '会话运行设置已改变，请新建会话', '原会话运行设置');
-            Object.assign(request, { timing, employeeHttpMcpPolicy: config.employeeHttpMcpPolicy ?? DEFAULT_CONFIG.employeeHttpMcpPolicy, acpMaxMessageBytes: config.acpMaxMessageBytes, resumeSessionId: previous?.sessionId, recoveryCheckpointId: previous?.recoveryCheckpointId, sessionId: options.sessionId, mode, cwd: previous?.cwd, identity: previous?.identity, bindingId: previous?.bindingId, workspaceId: previous?.workspaceId, agent: this.agent, retainProcess: !!key && mode === 'session', signal, brokerSettings: Object.freeze({ brokerMaxFrameBytes: config.brokerMaxFrameBytes, brokerControlMaxBytes: config.brokerControlMaxBytes }) });
-            if (requireFreshSession) {
-                request.requireFreshSession = true;
-                request.resumeSessionId = undefined;
-                request.recoveryCheckpointId = undefined;
-                information.push({ kind: 'session', severity: 'warning', code: 'TURN_GATE_INFORMATION', summary: '缺少可用的旧会话恢复资料，或上次在发送前已失败；将核对旧实例安全结束后，只处理本次接纳的输入。', payload: { reason: missingPointer ? 'PRIVATE_RECOVERY_POINTER_ABSENT' : 'PRIOR_PREPARATION_FAILED' } });
-            }
+            live = undefined;
+            const configuration = JSON.stringify([config.acpMaxMessageBytes, config.brokerMaxFrameBytes, config.brokerControlMaxBytes, config.employeeShellKillGraceMs]);
+            Object.assign(request, { acpMaxMessageBytes: config.acpMaxMessageBytes, resumeSessionId: previous?.sessionId, sessionId: options.sessionId, mode, cwd: previous?.cwd, identity: previous?.identity, bindingId: previous?.bindingId, workspaceId: previous?.workspaceId, agent: this.agent, signal, brokerSettings: Object.freeze({ brokerMaxFrameBytes: config.brokerMaxFrameBytes, brokerControlMaxBytes: config.brokerControlMaxBytes }) });
             request.previousContextSha256 = previous?.contextSha256;
-            const after = options.messages.findLastIndex(message => message.role === 'assistant' && !isWorkspaceNoticeMessage(message));
-            request.userInputIds = Object.freeze(options.messages.slice(after + 1).flatMap(message => message.role === 'user' && message.source?.kind === 'user' && typeof message.id === 'string' ? [message.id] : []));
+            const after = options.messages.findLastIndex(message => message.role === 'assistant');
+            const tail = options.messages.slice(after + 1);
+            const humanIds = tail.flatMap(message => message.role === 'user' && message.source?.kind === 'user' && typeof message.id === 'string' ? [message.id] : []);
+            // An official approval may continue the same native turn without another
+            // human message. This is a CAS candidate only: live turn/L proof must still
+            // bind it. The actual input delta remains prepareInput's unchanged tail.
+            if (!humanIds.length && tail.some(message => message.role === 'user' && message.source?.kind === 'user-approval')) {
+                const original = options.messages.slice(0, after + 1).findLast(message => message.role === 'user' && message.source?.kind === 'user' && typeof message.id === 'string');
+                if (typeof original?.id === 'string')
+                    humanIds.push(original.id);
+            }
+            request.userInputIds = Object.freeze(humanIds);
             request.userMessageIds = request.userInputIds;
             earlyStage = 'source-context';
             await this.resolveRuntime.preflight?.(request);
             earlyStage = 'input-prepare';
-            let input = await timing.run('input-prepare', () => prepareInput(options, this.readImage));
+            let input = await prepareInput(options, this.readImage);
             const contextSha256 = createHash('sha256').update(input.systemPrompt ?? '').digest('hex');
             request.contextSha256 = contextSha256;
             const codex = this.agent.loginProvider === 'codex';
-            if (codex && live && previous && live.contextSha256 !== previous.contextSha256.toLowerCase())
-                throw new NeedError('SESSION_CONTEXT_DIGEST_INVALID', '持久上下文摘要与当前远端会话的初建摘要不一致，本轮未发送', '原会话一致的初建上下文摘要');
-            const contextChanged = !!previous && codex && previous.contextSha256.toLowerCase() !== contextSha256;
+            const contextChanged = !!previous && codex && (previous.contextSha256 ?? '').toLowerCase() !== contextSha256;
             // Only identical durable context can prove a legacy context-bound journal.
             // New Codex transport scopes are independent of the native context digest.
             if (contextChanged)
                 request.contextSha256 = undefined;
             const claudeContextChanged = !!previous && !codex && previous.contextSha256 !== contextSha256;
-            if (contextChanged)
-                input = await prepareContinuation(options, input, this.readImage);
-            if (live) {
-                if (contextChanged)
-                    live.session.validateNewSessionContext({ systemPrompt: input.systemPrompt });
-                else
-                    live.session.validateContext({ systemPrompt: input.systemPrompt });
-                live.session.validatePrompt(input.prompt);
-            }
-            if (mode === 'one-shot' && (input.systemPrompt || input.prompt.some(block => block.type !== 'text')))
-                throw new NeedError('ONESHOT_CONTEXT_REQUIRED', '首版单次模式不支持图片或系统/开发者上下文，请使用会话模式', 'Codex会话模式');
             if (mode === 'session' && Buffer.byteLength(JSON.stringify({ prompt: input.prompt, systemPrompt: input.systemPrompt }), 'utf8') > config.acpMaxMessageBytes)
                 throw new NeedError('ACP_MESSAGE_TOO_LARGE', '本轮输入超过已设置的会话消息容量，未截断或发送', '管理员调整acpMaxMessageBytes');
-            if (mode === 'one-shot')
-                throw new NeedError('MODEL_CONFIGURATION_UNSUPPORTED', '单次模式不支持确认当前模型与推理等级，请改用会话模式', '支持模型配置确认的会话模式');
-            request.localAdmissionCheck?.();
-            earlyStage = 'model-catalog';
-            catalog = await this.catalog(signal);
-            selected = catalog.models.find(model => model.id === options.model);
-            catalog.onInformation?.(entry => information.push(entry));
-            if (!selected)
-                throw new ModelConfigurationError('所选模型不在本次可信主机目录中，请重新选择模型');
-            if (options.reasoningEffort !== undefined && !selected.reasoning.options.some(option => option.value === options.reasoningEffort))
-                throw new ModelConfigurationError('所选推理等级不在本次模型目录中');
-            catalog.bindSelection?.(selected.id, options.reasoningEffort);
-            const observeSignal = (source, initiator, reason) => { const observed = () => { const diagnostic = request?.closeDiagnostics ?? runtime?.closeDiagnostics; if (diagnostic)
-                diagnostic.record({ layer: 'adapter', initiator, reason: catalog?.signal === source ? catalog.revocation?.()?.reason ?? reason : reason, action: 'abort', changedFields: catalog?.signal === source ? catalog.revocation?.()?.fields : undefined, changes: catalog?.signal === source ? catalog.revocation?.()?.changes ?? [{ field: 'adapter.turn-aborted', before: false, after: source.aborted }] : [{ field: 'adapter.turn-aborted', before: false, after: source.aborted }] }); }; source.addEventListener('abort', observed, { once: true }); abortOffs.push(() => source.removeEventListener('abort', observed)); };
-            observeSignal(catalog.signal, 'signal.model-catalog', 'MODEL_CATALOG_REVOKED');
-            observeSignal(signal, 'signal.turn-composite', 'ABORTED');
-            let modelSignal = AbortSignal.any([signal, catalog.signal]);
+            selected = this.modelPresentation.find(options.model) ?? { id: options.model, value: options.model, name: options.model, resolvedModel: null, reasoning: { options: [], defaultValue: null, defaultKnown: false }, source: null };
+            let modelSignal = signal;
             options.signal = modelSignal;
             request.signal = modelSignal;
             earlyStage = 'runtime-resolve';
@@ -450,8 +317,6 @@ export class CodexRemoteAdapter extends LlmAdapter {
             const closeSink = runtime.details;
             runtime.closeDiagnostics ??= new CloseDiagnostics(event => closeSink?.record(event));
             signal.throwIfAborted();
-            if (requireFreshSession && (!runtime.freshSessionConfirmed || !runtime.restartNotice))
-                throw new NeedError('REMOTE_CLEANUP_UNCONFIRMED', '未确认原实例安全结束或原位置为空，本轮没有发送', '同UUID条件结束与list消失证明，或原slot不存在证明');
             if (runtime.execution?.signal) {
                 modelSignal = AbortSignal.any([modelSignal, runtime.execution.signal]);
                 options.signal = modelSignal;
@@ -464,42 +329,17 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 request.signal = modelSignal;
                 modelSignal.throwIfAborted();
             }
-            catalog.assertCurrent();
-            if (runtime.connection && (runtime.connection.instanceId !== catalog.target.instanceId || runtime.connection.epoch !== catalog.target.epoch) || runtime.identity !== `${catalog.target.target.username}@${catalog.target.target.host}:${catalog.target.target.port}`)
-                throw new ModelConfigurationError('模型目录与当前会话可信员工主机不一致');
             if (previous && (previous.identity !== runtime.identity || previous.cwd !== runtime.cwd || previous.bindingId && previous.bindingId !== runtime.binding?.bindingId || previous.workspaceId && previous.workspaceId !== runtime.binding?.workspaceId))
                 throw new NeedError('SESSION_CONTEXT_MISMATCH', '原会话的员工主机或工作区已改变，请新建会话', '原会话的可信目标和工作区');
-            if (contextChanged && runtime.recoveredSession) {
-                const capabilities = runtime.recoveredSession.capabilities;
-                // A clean reattach has sent no ACP input. A known policy refusal must
-                // detach it, preserving the original native session and checkpoint.
-                if (!capabilities.sessionCapabilities?.systemPrompt || !supportsCodexContextPolicy(capabilities)) {
-                    preserveRecoveredRuntime = true;
-                    if (!capabilities.sessionCapabilities?.systemPrompt)
-                        throw new NeedError('SYSTEM_PROMPT_UNSUPPORTED', '远端未声明系统与开发者上下文能力，不能丢弃这些要求继续', '支持 systemPrompt 的公开 ACP 能力');
-                    throw new NeedError('SYSTEM_PROMPT_POLICY_UNSUPPORTED', '远端没有明确声明Codex上下文仅新建生效的兼容政策，本轮未发送', 'systemPrompt与精确的aiWorkbenchSystemPrompt新建政策');
-                }
-            }
-            if (runtime.restartNotice) {
-                const ids = runtime.restartInputIds;
-                if (!ids?.length || new Set(ids).size !== ids.length || ids.some(id => input.users.filter(u => u.id === id).length !== 1))
-                    throw new NeedError('CURRENT_INPUT_UNCONFIRMED', '无法核对本次输入，尚未发送给模型', '官方当前步骤的已接纳用户输入');
-                input = { ...input, prompt: ids.flatMap(id => input.users.find(u => u.id === id).prompt) };
-                if (contextChanged)
-                    input = await timing.run('input-prepare', () => prepareContinuation(options, input, this.readImage));
-            }
             input = projectHostWorkspaceInput(input, runtime.hostWorkspace);
             if (runtime.hostWorkspace && mode === 'session' && Buffer.byteLength(JSON.stringify({ prompt: input.prompt, systemPrompt: input.systemPrompt }), 'utf8') > config.acpMaxMessageBytes)
                 throw new NeedError('ACP_MESSAGE_TOO_LARGE', '本轮输入超过已设置的会话消息容量，未截断或发送', '管理员调整acpMaxMessageBytes');
-            const details = runtime.details;
-            if (!details)
-                throw new NeedError('TECHNICAL_DETAILS_UNAVAILABLE', '技术详情暂不可用，请更新远程主机连接组件。', 'L技术详情持久接收能力');
+            const details = runtime.details ?? await createRemoteDetails({ warn: line => console.warn(line) }).open({ sessionId: options.sessionId ?? 'unscoped', provider: this.agent.loginProvider, identity: runtime.identity, connection: runtime.connection });
             recordInformation();
-            timing.bind(detail => details.record(detail));
             request.recordEarlyFailure = undefined;
             if (runtime.hostWorkspace)
                 details.record({ kind: 'session', severity: 'info', code: 'HOST_WORKSPACE_CONTEXT', summary: '本轮模型工作区上下文及审批会话目录使用已确认的主机目录。', payload: { source: 'host', cwd: runtime.hostWorkspace.cwd } });
-            const mapper = new StreamMapper(mode === 'session' && !contextChanged ? (runtime.restartNotice ? undefined : live ? live.usageSnapshot : previous ? (previous.usageSnapshot ?? null) : undefined) : undefined, observation => details.record(observation));
+            const mapper = new StreamMapper(mode === 'session' && !contextChanged ? (previous ? (previous.usageSnapshot ?? null) : undefined) : undefined, observation => details.record(observation));
             activeMapper = mapper;
             let id;
             let stop;
@@ -518,17 +358,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 }
                 yield* mapper.flush();
             }
-            if (runtime.workspaceNotice) {
-                yield* mapper.text(runtime.workspaceNotice.text);
-                yield* mapper.flush();
-            }
-            if (runtime.restartNotice) {
-                yield* mapper.text(runtime.restartNotice + '\n\n');
-                yield* mapper.flush();
-            }
             if (mode === 'session') {
-                if (live && live.runtime !== runtime)
-                    throw new NeedError('SESSION_TRANSPORT_MISMATCH', '原会话的主机通道已更换，不能自动切换进程', '原主机会话通道');
                 if (!runtime.acpTransport)
                     throw new NeedError('DEPENDENCY_REQUIRED', '我需要该员工主机上的ACP通道', 'S提供的ACP命令与aw-session');
                 const queue = [];
@@ -536,7 +366,15 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 let done = false;
                 let failure;
                 const push = (chunks) => { queue.push(...chunks); wake?.(); wake = undefined; };
-                const hooks = { closeDiagnostics: runtime.closeDiagnostics, broker: runtime.broker, employeeExecution: runtime.employeeExecution, timing, approve: async (permission, approvalSignal) => {
+                let promptPermit;
+                const hooks = { closeDiagnostics: runtime.closeDiagnostics, broker: runtime.broker, employeeExecution: runtime.employeeExecution, ...this.permissions ? { promptGuard: () => {
+                            if (!promptPermit)
+                                throw new NeedError('PERMISSION_POLICY_CHANGED', '当前权限没有保持确认，本次没有继续派发。', '当前权限代次和同值回执');
+                            return promptPermit;
+                        }, approvalGuard: () => {
+                            const source = this.permissions, epoch = permissionEpoch, policy = JSON.stringify(source.read(options.sessionId));
+                            return { signal: epoch.signal, isCurrent: () => !epoch.signal.aborted && JSON.stringify(source.read(options.sessionId)) === policy };
+                        } } : {}, approve: async (permission, approvalSignal) => {
                         const execution = runtime.execution;
                         const toolName = permission.toolCall.name ?? permission.toolCall._meta?.claudeCode?.toolName;
                         if (execution) {
@@ -545,11 +383,8 @@ export class CodexRemoteAdapter extends LlmAdapter {
                                 push(mapper.text('\n这类操作尚不支持在本机执行，已取消本次审批，没有在主机代跑。\n'));
                                 return 'cancelled';
                             }
-                            await execution.validate(approvalSignal);
                         }
                         const answer = await this.approve?.(permission, approvalSignal, options, execution && toolName?.startsWith('mcp__employee__') ? 'employee-local' : undefined, runtime.hostWorkspace) ?? 'unavailable';
-                        if (execution && answer === 'allowed-once')
-                            await execution.validate(approvalSignal);
                         return answer;
                     }, onEmployeeNotice: notice => push(mapper.text(notice + '\n\n')), onUpdate: notification => { try {
                         push(mapper.acp(notification.update));
@@ -558,86 +393,110 @@ export class CodexRemoteAdapter extends LlmAdapter {
                         failure = error;
                         session?.close({ layer: 'adapter', initiator: 'adapter.mapper-failure', reason: closeCode(error, 'MAPPING_FAILED'), action: 'close' });
                     } }, onResponse: response => push(mapper.acpResponse(response)), onDetail: detail => details.record(detail) };
-                const fresh = !live;
-                if (fresh) {
-                    const transport = runtime.acpTransport instanceof acp.AgentApp || runtime.acpTransport instanceof unstable.AgentApp ? runtime.acpTransport : acp.ndJsonStream(runtime.acpTransport.writable, runtime.acpTransport.readable, { maxMessageBytes: config.acpMaxMessageBytes });
-                    session = new AcpSession(transport, hooks);
-                    live = { session, runtime, configuration, contextSha256, usageSnapshot: mapper.usageSnapshot };
-                    if (key)
-                        this.sessions.set(key, live);
-                }
-                else {
-                    session = live.session;
-                    session.setHooks(hooks);
-                    if (previous?.sessionId !== session.id)
-                        throw new NeedError('SESSION_STATE_INVALID', '持久会话标识与当前进程不一致', '原会话的恢复标识');
-                }
+                const transport = runtime.acpTransport instanceof acp.AgentApp || runtime.acpTransport instanceof unstable.AgentApp ? runtime.acpTransport : acp.ndJsonStream(runtime.acpTransport.writable, runtime.acpTransport.readable, { maxMessageBytes: config.acpMaxMessageBytes });
+                session = new AcpSession(transport, hooks);
+                live = { session, runtime, configuration, contextSha256, usageSnapshot: mapper.usageSnapshot };
+                if (key)
+                    this.sessions.set(key, live);
                 promptBaseline = session.promptDispatchCount;
+                let permissionTail = Promise.resolve(), permissionKey, observedPermissionKey, permissionQueued = false;
+                const permissionFailed = (error) => {
+                    failure ??= error;
+                    runtime.closeDiagnostics?.record({ layer: 'adapter', initiator: 'adapter.permission-sync.failure', reason: closeCode(error, 'PERMISSION_MODE_UNCONFIRMED'), action: 'close' });
+                    session.close({ layer: 'adapter', initiator: 'adapter.permission-sync.failure', reason: closeCode(error, 'PERMISSION_MODE_UNCONFIRMED'), action: 'close' });
+                    wake?.();
+                };
+                const syncPermissions = () => {
+                    if (!this.permissions)
+                        return Promise.resolve(); // Explicit component-test port; production always supplies the official source.
+                    return permissionTail = permissionTail.then(async () => {
+                        const policy = this.permissions.read(options.sessionId), next = JSON.stringify(policy);
+                        if (next === permissionKey)
+                            return;
+                        const remoteMode = permissionMode(this.agent.loginProvider, policy);
+                        details.record({ kind: 'session', severity: 'info', code: 'DSH_PERMISSION_POLICY', summary: '按DSH当前会话权限同步远程工具；不会把关闭审批提示解释为自动批准。', payload: { ...policy, remoteMode } });
+                        await session.selectPermissionMode(remoteMode, modelSignal, this.agent.loginProvider);
+                        permissionKey = next;
+                    });
+                };
+                const dispatchPrompt = async () => {
+                    if (!this.permissions)
+                        return session.prompt(input.prompt, modelSignal);
+                    // New official policy events can append work while an ACK is awaited.
+                    // Setters for those distinct policy changes are not retries. Dispatch
+                    // only from one synchronous, stable epoch/ACK boundary.
+                    for (;;) {
+                        const barrier = syncPermissions();
+                        await barrier;
+                        if (barrier !== permissionTail || permissionQueued)
+                            continue;
+                        const source = this.permissions, policy = JSON.stringify(source.read(options.sessionId));
+                        if (policy !== permissionKey)
+                            continue;
+                        const epoch = permissionEpoch;
+                        promptPermit = { signal: epoch.signal, isCurrent: () => !epoch.signal.aborted && permissionKey === policy && JSON.stringify(source.read(options.sessionId)) === policy };
+                        return session.prompt(input.prompt, modelSignal);
+                    }
+                };
                 const task = (async () => {
                     remoteAttempted = true;
                     try {
-                        if (fresh && runtime.recoveredSession) {
-                            if (previous && runtime.recoveredSession.sessionId !== previous.sessionId)
-                                throw new NeedError('SESSION_STATE_INVALID', '已接回的会话与持久标识不一致，本轮未发送', '原会话的恢复标识');
-                            session.restore(runtime.execution?.hostCwd ?? runtime.cwd, runtime.recoveredSession, { systemPrompt: input.systemPrompt, ...(runtime.execution ? { employeeRouting: runtime.execution.routing } : {}), ...(codex ? { codexNewSessionOnly: true } : {}) }, codex && !!previous && !contextChanged);
-                            session.validatePrompt(input.prompt);
-                            if (contextChanged)
-                                await session.newContextSession({ systemPrompt: input.systemPrompt }, modelSignal);
-                            else if (claudeContextChanged)
-                                await session.updateContext({ systemPrompt: input.systemPrompt }, modelSignal, true);
-                        }
-                        else if (fresh)
-                            await session.start(runtime.execution?.hostCwd ?? runtime.cwd, contextChanged || runtime.restartNotice ? undefined : previous?.sessionId, modelSignal, { systemPrompt: contextChanged ? (input.systemPrompt ?? '') : input.systemPrompt, ...(runtime.execution ? { employeeRouting: runtime.execution.routing } : {}), ...(codex ? { codexNewSessionOnly: true } : {}), ...(runtime.employeeExecutionMeta ? { employeeExecution: runtime.employeeExecutionMeta } : {}) }, input.prompt);
-                        else if (contextChanged)
-                            await session.newContextSession({ systemPrompt: input.systemPrompt }, modelSignal);
-                        else {
-                            await session.updateContext({ systemPrompt: input.systemPrompt }, modelSignal);
-                        }
-                        if (fresh && claudeContextChanged && !runtime.recoveredSession && !runtime.restartNotice)
-                            details.record({ kind: 'session', severity: 'warning', code: 'SYSTEM_PROMPT_UPDATE_DEFERRED', summary: '新要求已通过原会话恢复接口传送；官方仅承诺下次上下文整理后生效，本轮不能保证已立即采用。', payload: { reason: 'OFFICIAL_CONTEXT_UPDATE_DEFERRED' } });
-                        if (!codex)
-                            live.contextSha256 = contextSha256;
-                        if (contextChanged) {
-                            if (session.id === previous.sessionId)
-                                throw new NeedError('SESSION_STATE_INVALID', '新会话标识与原会话相同，无法确认独立承接，本轮未发送', '独立的新远端会话标识');
-                            live.contextSha256 = contextSha256;
-                            live.usageSnapshot = mapper.usageSnapshot;
-                            details.record({ kind: 'session', severity: 'info', code: 'CODEX_CONTEXT_SESSION_REPLACED', summary: 'Codex要求仅在新建生效，已保留原会话；新会话承接可见用户及助手正文，内部推理不转发', payload: { reason: 'system-context-changed', oldSessionId: previous.sessionId, newSessionId: session.id, oldContextSha256: previous.contextSha256, newContextSha256: contextSha256, history: input.historyTransfer } });
-                        }
-                        catalog.assertCurrent();
+                        await session.start(runtime.execution?.hostCwd ?? runtime.cwd, previous?.sessionId, modelSignal, { systemPrompt: input.systemPrompt, ...(runtime.execution ? { employeeRouting: runtime.execution.routing } : {}), ...(codex ? { codexNewSessionOnly: true } : {}), ...(runtime.employeeExecutionMeta ? { employeeExecution: runtime.employeeExecutionMeta } : {}) }, input.prompt);
                         const actual = await session.selectModel(selected.value, options.reasoningEffort, modelSignal);
-                        catalog.assertCurrent();
-                        session.assertModelSelection(selected.value, options.reasoningEffort);
                         // This lease is tied to the trusted host-user and instance/epoch.
                         // Its mapping and this turn's exact setter ACK are different facts.
-                        const mapping = catalog.models.filter(model => model.value === selected.value);
-                        if (mapping.length !== 1 || mapping[0].id !== selected.id)
-                            throw new NeedError('MODEL_RESOLUTION_UNCONFIRMED', '所选模型在当前主机目录中没有唯一对应型号，本轮未发送', 'CATALOG_VALUE_MAPPING_NOT_UNIQUE');
-                        const resolved = mapping[0].resolvedModel;
-                        if (typeof resolved !== 'string' || !resolved.trim())
-                            throw new NeedError('MODEL_RESOLUTION_UNCONFIRMED', '主机目录没有提供所选模型的具体型号，本轮未发送', 'CATALOG_RESOLVED_MODEL_MISSING');
-                        modelConfiguration = { selected: { ...mapping[0], ...(options.reasoningEffort === undefined ? {} : { effort: options.reasoningEffort }) }, configured: actual, resolvedModel: resolved, status: 'remote-configured', ...(this.agent.loginProvider === 'claude' ? { resolvedModelSource: 'host-user-catalog', sessionModelReported: false } : {}) };
-                        details.record({ kind: 'session', severity: 'info', code: 'MODEL_CONFIGURATION_CONFIRMED', summary: '本轮选择已由远端配置回执确认；' + modelResolutionLabel(modelConfiguration) + '；不代表推理效果已验证', payload: modelConfiguration });
+                        modelConfiguration = { selected: { ...selected, ...(options.reasoningEffort === undefined ? {} : { effort: options.reasoningEffort }) }, configured: actual, resolvedModel: selected.resolvedModel ?? selected.value, status: 'remote-configured', ...(this.agent.loginProvider === 'claude' ? { resolvedModelSource: 'host-user-catalog', sessionModelReported: false } : {}) };
+                        details.record({ kind: 'session', severity: 'info', code: 'MODEL_CONFIGURATION_CONFIRMED', summary: '本轮模型设置回应；' + modelResolutionLabel(modelConfiguration) + '；不代表推理效果已验证', payload: modelConfiguration });
                     }
                     catch (error) {
                         details.record({ kind: 'session', severity: 'action-required', code: 'MODEL_CONFIGURATION_FAILED', summary: '本轮模型配置未获完整确认，未发送用户输入', payload: { selected, requestedEffort: options.reasoningEffort ?? null, actual: session.modelConfiguration ?? null, reason: error instanceof NeedError ? (error.code === 'MODEL_RESOLUTION_UNCONFIRMED' ? error.requires : error.code) : error instanceof ModelConfigurationError ? error.message : 'MODEL_CONFIGURATION_FAILED' } });
                         throw error;
                     }
-                    await timing.run('details-flush', () => details.flush());
+                    if (this.permissions && options.sessionId) {
+                        observedPermissionKey = JSON.stringify(this.permissions.read(options.sessionId));
+                        permissionOff = this.permissions.subscribe(options.sessionId, () => {
+                            let next;
+                            try {
+                                next = JSON.stringify(this.permissions.read(options.sessionId));
+                            }
+                            catch (error) {
+                                permissionEpoch.abort();
+                                permissionFailed(error);
+                                return;
+                            }
+                            if (next === observedPermissionKey) {
+                                details.record({ kind: 'session', severity: 'info', code: 'DSH_PERMISSION_EVENT_UNCHANGED', summary: '设置事件没有改变有效权限，原审批与执行许可保持有效。' });
+                                return;
+                            }
+                            // Compare observed values, not the possibly lagging remote ACK.
+                            // A real A→B→A still revokes the original permit twice.
+                            observedPermissionKey = next;
+                            permissionEpoch.abort();
+                            permissionEpoch = new AbortController();
+                            // One official preset writes identity and two knobs synchronously.
+                            // Read the complete committed bundle after that append stack.
+                            if (permissionQueued)
+                                return;
+                            permissionQueued = true;
+                            queueMicrotask(() => { permissionQueued = false; if (!permissionOff)
+                                return; void syncPermissions().catch(permissionFailed); });
+                        });
+                        await syncPermissions();
+                    }
                     recordInformation();
-                    await details.flush();
                     details.beginTurn(runtime.detailContext?.() ?? { turn: null, step: null });
-                    catalog.assertCurrent();
-                    session.assertModelSelection(selected.value, options.reasoningEffort);
                     await runtime.execution?.beginTurn(modelSignal);
                     id = session.id;
                     try {
-                        const result = await session.prompt(input.prompt, modelSignal);
-                        if (contextChanged)
-                            push(mapper.text(runtime.restartNotice ? '\n\n会话要求已变化，已把此前可见对话带入新 Codex 会话继续处理。' : '\n\n会话要求已变化，已新建 Codex 会话继续处理，原会话仍保留。'));
+                        const result = await dispatchPrompt();
+                        permissionOff?.();
+                        permissionOff = undefined;
+                        await permissionTail;
                         return result;
                     }
                     finally {
+                        permissionOff?.();
+                        permissionOff = undefined;
                         runtime.execution?.endTurn();
                         details.endTurn();
                     }
@@ -657,23 +516,9 @@ export class CodexRemoteAdapter extends LlmAdapter {
                     for (const chunk of mapper.text('\n[远端拒绝] 此请求未执行。\n'))
                         yield chunk;
             }
-            else {
-                if (!runtime.oneShot)
-                    throw new NeedError('DEPENDENCY_REQUIRED', '我需要主机单次运行助手', 'S安装的aw-codex-once');
-                details.beginTurn(runtime.detailContext?.() ?? { turn: null, step: null });
-                const text = input.prompt.map(block => block.type === 'text' ? block.text : '').join('\n');
-                for await (const event of runOneShot(runtime.oneShot, { wrapperPath: fileURLToPath(new URL('./sdk-ssh-wrapper.js', import.meta.url)), sandboxMode: config.oneShotSandbox, approvalPolicy: config.oneShotApproval }, text, previous?.sessionId, signal)) {
-                    if (event.type === 'thread.started')
-                        id = event.thread_id;
-                    for (const chunk of mapper.sdk(event))
-                        yield chunk;
-                }
-            }
             mapper.flushMetadata();
             recordInformation();
             details.endTurn();
-            await timing.run('details-flush', () => details.flush());
-            await details.flush(); // The timing record is a new ordered write, not a retry.
             if (!id)
                 throw new NeedError('SESSION_ID_MISSING', '远端没有返回会话标识', '有效的远端会话标识');
             if (live)
@@ -681,22 +526,12 @@ export class CodexRemoteAdapter extends LlmAdapter {
             if (modelConfiguration) {
                 const actual = session.modelConfiguration;
                 const changed = !actual?.confirmed || actual.model !== modelConfiguration.configured.model || actual.effort !== modelConfiguration.configured.effort;
-                catalog.assertCurrent();
                 if (changed) {
                     details.record({ kind: 'session', severity: 'warning', code: 'MODEL_CONFIGURATION_CHANGED_DURING_TURN', summary: '本轮回复已经完成，期间远端配置发生变化；保留真实回复，具体执行型号未单独回报。', payload: { reason: 'POST_PROMPT_CONFIGURATION_CHANGED', configured: modelConfiguration.configured, actual: actual ?? null } });
-                    await details.flush();
                 }
             }
             yield* mapper.flush();
-            let recoveryCheckpointId;
-            if (session?.checkpoint && runtime.saveCheckpoint) {
-                const id = randomUUID();
-                if (await runtime.saveCheckpoint(id, session.checkpoint))
-                    recoveryCheckpointId = id;
-            }
-            const previousRemoteSessions = [...(previous?.previousRemoteSessions ?? []), ...(contextChanged ? [{ sessionId: previous.sessionId, contextSha256: previous.contextSha256 }] : [])];
-            const presentation = { ...(runtime.workspaceNotice ? { workspaceNotice: runtime.workspaceNotice } : {}), ...(employeeNoticeShown ? { employeeExecutionNotice: 'local-v1' } : {}) };
-            const pointer = { ...(previousRemoteSessions.length ? { previousRemoteSessions } : {}), ...(modelConfiguration ? { modelConfiguration } : {}), ...(recoveryCheckpointId ? { recoveryCheckpointId } : {}), ...(Object.keys(presentation).length ? { presentation } : {}), version: 2, agent: this.agent.id, contextSha256, ...(mode === 'session' ? { usageSnapshot: mapper.usageSnapshot } : {}), ...(options.sessionId ? { dshSessionId: options.sessionId } : {}), mode, identity: runtime.identity, cwd: runtime.cwd, sessionId: id, ...(runtime.binding ? { bindingId: runtime.binding.bindingId, workspaceId: runtime.binding.workspaceId } : {}) };
+            const pointer = { ...(modelConfiguration ? { modelConfiguration } : {}), version: 2, agent: this.agent.id, contextSha256, ...(mode === 'session' ? { usageSnapshot: mapper.usageSnapshot } : {}), ...(options.sessionId ? { dshSessionId: options.sessionId } : {}), identity: runtime.identity, cwd: runtime.cwd, sessionId: id, ...(runtime.binding ? { bindingId: runtime.binding.bindingId, workspaceId: runtime.binding.workspaceId } : {}) };
             succeeded = true;
             yield { type: 'finish', reason: { kind: stop === 'max_tokens' || stop === 'max_turn_requests' ? 'max-tokens' : 'stop' }, replayState: { response: pointer } };
         }
@@ -712,110 +547,44 @@ export class CodexRemoteAdapter extends LlmAdapter {
             recordInformation();
             failureCode = error instanceof NeedError || error instanceof ModelConfigurationError ? error.code : error instanceof LlmError ? error.code : 'TURN_PREPARATION_FAILED';
             withRemoteFailureEvidence(error, runtime?.employeeRemoteCloseReason?.(), failureCode);
-            if (live && session && session.promptDispatchCount > promptBaseline)
-                live.failure = { cause: error };
-            const reporting = [];
-            try {
-                activeMapper?.flushMetadata();
-            }
-            catch (failure) {
-                reporting.push(failure);
-            }
-            const reportFailure = async () => {
-                if (request?.recordEarlyFailure) {
-                    const record = request.recordEarlyFailure;
-                    request.recordEarlyFailure = undefined;
-                    try {
-                        await record(Object.assign(new NeedError(failureCode ?? 'TURN_PREPARATION_FAILED', '本轮在执行前失败。', '白名单阶段与错误代码'), { cause: error }), earlyStage);
-                    }
-                    catch (failure) {
-                        reporting.push(failure);
-                    }
-                }
-                try {
-                    await runtime?.details?.flush();
-                }
-                catch (failure) {
-                    reporting.push(failure);
-                }
-            };
-            if (runtime && key && live && live.runtime === runtime && this.sessions.get(key) === live) {
-                const captured = runtime;
-                void reportFailure().then(() => { for (const failure of reporting)
-                    for (const code of closeErrorCodes(failure, 'DIAGNOSTIC_WRITE_FAILED'))
-                        captured.closeDiagnostics?.record({ layer: 'adapter', initiator: 'adapter.failed-turn-details', reason: code, action: 'failure' }); }, failure => captured.closeDiagnostics?.record({ layer: 'adapter', initiator: 'adapter.failed-turn-details', reason: closeCode(failure, 'DIAGNOSTIC_WRITE_FAILED'), action: 'failure' }));
-            }
-            else
-                await reportFailure();
+            activeMapper?.flushMetadata();
+            if (request?.recordEarlyFailure)
+                void request.recordEarlyFailure(error, earlyStage).catch(() => console.warn('[remote-agent] 预检诊断未保存'));
             if (activeMapper)
                 yield* activeMapper.flush();
-            const firstReason = request?.closeDiagnostics?.first?.reason ?? runtime?.closeDiagnostics?.first?.reason;
-            if (reporting.length) {
-                turnFailure = withFailureEvidence(error, reporting, 'diagnostic', firstReason, failureCode);
-                throw turnFailure;
-            }
-            turnFailure = firstReason && !(error instanceof NeedError || error instanceof ModelConfigurationError || error instanceof LlmError) ? withFailureEvidence(error, [], 'diagnostic', firstReason, failureCode) : withFirstFailureEvidence(error, firstReason, failureCode);
-            throw turnFailure;
+            throw withFirstFailureEvidence(error, runtime?.closeDiagnostics?.first?.reason, failureCode);
         }
         finally {
+            permissionOff?.();
+            permissionOff = undefined;
+            permissionEpoch.abort();
             for (const off of abortOffs)
                 off();
             runtime?.execution?.endTurn();
-            catalog?.release();
-            try {
-                if (preserveRecoveredRuntime || this.shuttingDown || key && this.detached.has(key)) {
-                    session?.close({ layer: 'adapter', initiator: 'adapter.turn-detach', reason: 'TURN_DETACHED', action: 'close' });
-                    await runtime?.detach?.({ layer: 'adapter', initiator: 'adapter.turn-detach', reason: 'TURN_DETACHED', action: 'detach' });
-                }
-                else if (!succeeded || !key || mode !== 'session') {
-                    session?.close({ layer: 'adapter', initiator: 'adapter.turn-finally', reason: succeeded ? 'TURN_FINISHED' : 'TURN_FAILED', action: 'close' });
-                    if (runtime) {
-                        if (!succeeded && turnFailure && key && live && live.runtime === runtime && this.sessions.get(key) === live)
-                            this.finishFailedTurn(key, live, turnFailure, failureCode ?? 'TURN_PREPARATION_FAILED', request?.closeDiagnostics?.first?.reason ?? runtime.closeDiagnostics?.first?.reason);
-                        else {
-                            await this.cleanupRuntime(runtime);
-                            if (key && live && !live.failure && this.sessions.get(key) === live) {
-                                if (typeof runtime.dispose === 'function') {
-                                    this.sessions.delete(key);
-                                    if (!succeeded)
-                                        this.preparationFailures.set(key, failureCode ?? 'TURN_PREPARATION_FAILED');
-                                }
-                                else
-                                    live.cleanupFailure = new NeedError('REMOTE_CLEANUP_UNCONFIRMED', '缺少原实例结束证明，不能重开或重发', '原实例的条件结束与list消失证明');
-                            }
-                        }
-                    }
-                }
-                if (succeeded && key)
-                    this.preparationFailures.delete(key);
-            }
-            catch (cleanup) {
-                throw withFailureEvidence(turnFailure ?? cleanup, [cleanup], 'cleanup', request?.closeDiagnostics?.first?.reason ?? runtime?.closeDiagnostics?.first?.reason, failureCode);
-            }
-            finally {
-                if (key && this.turns.get(key) === turn)
-                    this.turns.delete(key);
-                if (key)
-                    this.detached.delete(key);
+            if (runtime) {
+                session?.close({ layer: 'adapter', initiator: 'adapter.turn-finally', reason: succeeded ? 'TURN_FINISHED' : 'TURN_FAILED', action: 'close' });
+                if (key && this.sessions.get(key) === live)
+                    this.sessions.delete(key);
+                void this.cleanupRuntime(runtime);
             }
+            if (key && this.turns.get(key) === turn)
+                this.turns.delete(key);
+            if (key)
+                this.detached.delete(key);
         }
     }
 }
 /** One official registration owns both routes, preserving opaque replay ownership. */
 export class RemoteAgentsAdapter extends LlmAdapter {
     adapters = new Map();
-    constructor(config, makeRuntime, approve, nameFor, readImage, reportLoginFailure, directory, preflightDiagnostics) { super(); for (const agent of AGENTS)
-        this.adapters.set(agent.id, new CodexRemoteAdapter(config, makeRuntime(agent), approve, () => nameFor(agent), agent, readImage, reportLoginFailure, directory, preflightDiagnostics)); }
+    constructor(config, makeRuntime, approve, nameFor, readImage, reportLoginFailure, directory, preflightDiagnostics, permissions) { super(); for (const agent of AGENTS)
+        this.adapters.set(agent.id, new CodexRemoteAdapter(config, makeRuntime(agent), approve, () => nameFor(agent), agent, readImage, reportLoginFailure, directory, preflightDiagnostics, permissions)); }
     adapter(provider) { const adapter = this.adapters.get(provider); if (!adapter)
         throw new LlmError('远程模型未注册', 'PROVIDER_NOT_FOUND'); return adapter; }
     providerInfo(provider) { return this.adapter(provider).providerInfo(provider); }
     listModels(provider) { return this.adapter(provider).listModels(provider); }
     resolveModel(provider, model, signal) { return this.adapter(provider).resolveModel(provider, model, signal); }
     prepareCall(provider, model, signal) { return this.adapter(provider).prepareCall(provider, model, signal); }
-    observeModelInvalidation(fields, changes = []) { for (const adapter of this.adapters.values())
-        adapter.observeModelInvalidation(fields, changes); }
-    async invalidateModelState() { await Promise.all([...this.adapters.values()].map(adapter => adapter.invalidateModelState())); }
-    async invalidateEmployeeState() { await Promise.all([...this.adapters.values()].map(adapter => adapter.invalidateEmployeeState())); }
     providerRetryPolicy() { return { mode: 'normal', maxRetries: 0, retryableCodes: [], initialDelayMs: 0, maxDelayMs: 0, jitterRatio: 0 }; }
     stream(options) { return this.adapter(options.provider).stream(options); }
     async disposeSession(sessionId) { await Promise.all([...this.adapters.values()].map(adapter => adapter.disposeSession(sessionId))); }
@@ -825,7 +594,7 @@ export class RemoteAgentsAdapter extends LlmAdapter {
 export function apply(ctx, live) {
     const config = () => readConfig(live);
     const get = () => ctx.get('aiWorkbenchConnect');
-    let language = 'en';
+    const language = 'zh';
     const readImage = async (ref, signal) => {
         const attachments = ctx.get('attachments');
         if (typeof attachments?.readImage !== 'function')
@@ -833,22 +602,19 @@ export function apply(ctx, live) {
         return attachments.readImage(ref, signal);
     };
     const openByAgent = new Map(AGENTS.map(agent => [agent.id, brokerFactory(get, undefined, config)]));
-    const localTurns = createLocalUserTurnObserver(ctx);
     const detailManagers = new Map();
     const managerForProfile = () => {
         const profile = ctx.get('profileContext');
-        if (typeof profile?.dir !== 'string')
-            throw new NeedError('TECHNICAL_DETAILS_UNAVAILABLE', '技术详情暂不可用：缺少官方profile目录。', '官方profileContext.dir');
-        let manager = detailManagers.get(profile.dir);
+        const profileDir = typeof profile?.dir === 'string' ? profile.dir : undefined;
+        let manager = detailManagers.get(profileDir ?? '');
         if (!manager) {
-            manager = createRemoteDetails({ profileDir: profile.dir, getApi: get });
-            detailManagers.set(profile.dir, manager);
+            manager = createRemoteDetails({ profileDir, warn: line => ctx.logger('remote-agent').warn(line) });
+            detailManagers.set(profileDir ?? '', manager);
         }
         return manager;
     };
+    ctx.provide('aiWorkbenchRemoteDiagnostics', { read: (query) => managerForProfile().read(query) });
     const preflightDiagnostics = createPreflightDiagnostics({ ctx, getApi: get, manager: managerForProfile });
-    let changed = () => { };
-    let observeCatalogRevocation = () => { };
     const diagnostics = new Map();
     const diagnostic = (scope, provider, message) => {
         let entry = diagnostics.get(provider);
@@ -863,25 +629,14 @@ export function apply(ctx, live) {
         else
             entry.set(scope, message);
     };
-    let defaults;
-    const catalogDiagnostics = createCatalogDiagnostics(() => { const profile = ctx.get('profileContext'); return profile?.dir; });
     // Public Loader Entry.options.id; optional when mounted without Loader.
     const actualSettingsNamespace = ctx.fiber.entry?.options.id;
-    new CatalogDiagnosticsRemote(ctx, async () => ({ ...await catalogDiagnostics.snapshot(), settingsNamespace: actualSettingsNamespace ?? null, providers: AGENTS.map(agent => ({ provider: agent.id, name: agent.name[language], messages: [...(diagnostics.get(agent.id)?.values() ?? [])] })) }));
-    const modelDirectory = new ModelCatalog(get, () => config().acpMaxMessageBytes, (...args) => { const state = get()?.getConnectionState(); const connection = state ? { instanceId: state.instanceId, epoch: state.epoch, phase: state.phase } : null; return runCatalog(...args, event => catalogDiagnostics.record({ ...event, connection })); }, () => changed(), (brand, message) => {
-        diagnostic('catalog', AGENTS.find(agent => agent.loginProvider === brand).id, message);
-    }, (agent, models, assertCurrent) => defaults?.observe(agent, models, assertCurrent), (fields, changes) => observeCatalogRevocation(fields, changes));
+    const modelDirectory = new ModelCatalog(get, () => config().acpMaxMessageBytes);
     const adapter = new RemoteAgentsAdapter(config, agent => {
         const details = async (request, api, connection, target) => {
-            return managerForProfile().open({ sessionId: request.sessionId, provider: agent.loginProvider, identity: `${target.username}@${target.host}:${target.port}`, connection, localAcceptanceId: request.localAcceptanceId ?? request.localAcceptance?.acceptanceId });
+            return managerForProfile().open({ sessionId: request.sessionId, provider: agent.loginProvider, identity: `${target.username}@${target.host}:${target.port}`, connection });
         };
         const open = async (...args) => {
-            const profile = ctx.get('profileContext');
-            if (!profile?.dir)
-                throw new NeedError('RECOVERY_STORAGE_REQUIRED', '会话恢复需要官方profile目录', '官方profileContext.dir');
-            args[2].recoveryJournal = recoveryJournal(profile.dir, runtimeRecoveryKey(`${args[0].username}@${args[0].host}:${args[0].port}`, agent.id, args[2].sessionId, args[2].employeeScope));
-            args[2].verifyRecovery = () => verifyRecoveryCheckpoint(ctx, args[2], agent.id);
-            args[2].currentInputIds = await currentInputIds(ctx, args[2]);
             const runtime = await openByAgent.get(agent.id)(...args);
             runtime.detailContext = () => {
                 const events = args[2].sessionId ? ctx.get('agents')?.get(SessionId(args[2].sessionId))?.session.snapshotEvents() : undefined;
@@ -911,14 +666,11 @@ export function apply(ctx, live) {
             const sessions = services.get('sessions');
             return officialEmployeeWorkspace(request.sessionId, registry, sessions?.get(request.sessionId)?.header);
         };
-        return connectProvider(get, { agent, workspaceSource: {
-                workspace, currentUserTurn: request => localTurns.current(request), confirm: nativeWorkspaceSourceConfirmation(ctx),
-                record: (request, observation) => preflightDiagnostics.record(request, agent.loginProvider, observation),
-            }, ...(agent.loginProvider === 'codex' ? { employee: {
-                    currentUserTurn: request => localTurns.current(request),
+        const provider = connectProvider(get, { agent, workspace, ...(agent.loginProvider === 'codex' ? { employee: {
                     getNetwork: () => ctx.get('aiWorkbenchNetwork'),
                     workspace, native: () => resolveEmployeeNative(),
-                } } : {}), notice: createWorkspaceNoticeConsumer(ctx, agent), details, open, local });
+                } } : {}), details, open, local });
+        return provider;
     }, dshApproval(ctx), agent => agent.name[language], readImage, (sessionId, code, diagnostic) => {
         const events = sessionId ? ctx.get('agents')?.get(SessionId(sessionId))?.session.snapshotEvents() : undefined;
         let turn = null, step = null;
@@ -937,50 +689,30 @@ export function apply(ctx, live) {
                 step = null;
         }
         return managerForProfile().recordLoginFailure({ sessionId, code, diagnostic, context: { turn, step } });
-    }, modelDirectory, preflightDiagnostics);
+    }, modelDirectory, preflightDiagnostics, dshPermissionSource(ctx));
     const ids = AGENTS.map(agent => agent.id);
     const entries = () => AGENTS.map(agent => ({ provider: agent.id, displayName: agent.name[language], settingsNs: actualSettingsNamespace ?? settingsNamespace, settingsPath: [] }));
     const directory = ctx.llm.registerConfigurableProviders(entries());
     const registration = ctx.llm.registerAdapter(ids, adapter);
-    installModelInputRetention(ctx, { isOurProvider: provider => ids.includes(provider), diagnosticForAttempt: position => preflightDiagnostics.forPreparation(position.sessionId, position), preflightDiagnostic: (provider, message) => diagnostic('preflight', provider, message), diagnostic: (provider, message) => diagnostic('input', provider, message) });
-    const serviceValue = (name) => ctx.get(name);
-    const refreshDefault = () => {
-        const service = serviceValue('agentDefaultModel');
-        const selected = service?.currentSelection();
-        const agent = AGENTS.find(agent => agent.id === selected?.provider);
-        if (!defaults || !agent)
-            return;
-        // Read through the same trusted, fresh catalog. Failures are already recorded there.
-        void modelDirectory.read(agent).then(lease => lease.release(), () => { });
-    };
-    ctx.inject(['agentDefaultModel'], child => {
-        const service = child.get('agentDefaultModel');
-        const current = createModelDefaults(service, (provider, message) => diagnostic('default', provider, message), createDefaultSelectionWriter(service, () => serviceValue('configEditor')));
-        defaults = current;
-        refreshDefault();
-        child.effect(() => () => { current.dispose(); if (defaults === current)
-            defaults = undefined; });
+    let connection;
+    ctx.on('ai-workbench/connection-state', state => {
+        const previous = connection;
+        connection = state;
+        // Official replacement invalidates the browser's shared catalog and loads it.
+        if (state.phase === 'connected' && (previous?.phase !== 'connected' || previous.instanceId !== state.instanceId || previous.epoch !== state.epoch))
+            registration.replace(ids);
     });
-    observeCatalogRevocation = (fields, changes) => adapter.observeModelInvalidation(fields, changes);
-    changed = () => { registration.replace(ids); refreshDefault(); void adapter.invalidateModelState().catch(() => { ctx.logger('remote-agent').warn('原会话清理结果未确认，已阻断继续发送；请联系管理员核对。'); }); };
-    let employeeConnect = serviceValue('aiWorkbenchConnect'), employeeNetwork = serviceValue('aiWorkbenchNetwork');
-    ctx.on('internal/service', service => {
-        if (service === 'aiWorkbenchConnect')
-            modelDirectory.refresh();
-        if (service !== 'aiWorkbenchConnect' && service !== 'aiWorkbenchNetwork')
-            return;
-        const nextConnect = serviceValue('aiWorkbenchConnect'), nextNetwork = serviceValue('aiWorkbenchNetwork');
-        if (nextConnect === employeeConnect && nextNetwork === employeeNetwork)
-            return;
-        employeeConnect = nextConnect;
-        employeeNetwork = nextNetwork;
-        void adapter.invalidateEmployeeState().catch(() => { ctx.logger('remote-agent').warn('本机执行连接的清理结果未确认，已阻断继续发送；请联系管理员核对。'); });
-    });
-    new ProviderLocaleRemote(ctx, next => { language = next; directory.replace(entries()); registration.replace(ids); });
-    const cleanup = (id) => adapter.detachSession(id);
+    installModelInputRetention(ctx, { isOurProvider: provider => ids.includes(provider), diagnosticForAttempt: position => preflightDiagnostics.forPreparation(position.sessionId, position), preflightDiagnostic: (provider, message) => diagnostic('preflight', provider, message), diagnostic: (provider, message) => diagnostic('input', provider, message) });
+    const cleanup = async (id) => { try {
+        await adapter.detachSession(id);
+    }
+    finally {
+        for (const manager of detailManagers.values())
+            manager.releaseSession(id);
+    } };
     ctx.on('agent/disposed', ({ agent }) => cleanup(agent.session.id));
     ctx.on('session/disposed', session => cleanup(session.id));
-    ctx.effect(() => () => { modelDirectory.dispose(); return adapter.dispose(); });
+    ctx.effect(() => async () => { modelDirectory.dispose(); await adapter.dispose(); await Promise.all([...detailManagers.values()].map(manager => manager.dispose())); });
 }
 export function dshApproval(ctx) {
     return async (request, signal, options, context, hostWorkspace) => {