@ai-workbench/remote-agent 0.8.28 → 0.9.0-toolbridge.2

package/README.md

@@ -1,10 +1,20 @@
-# AI Workbench 远程助手 · @ai-workbench/remote-agent@0.8.28 · 插件 → 添加插件
+# AI Workbench 远程助手 · @ai-workbench/remote-agent@0.9.0-toolbridge.2 · 插件 → 添加插件
+
+## 含工具桥预发布线
+
+本包为 `0.9.0-toolbridge.2`，在独立 `toolbridge` 分支开发；稳定 main/0.8.x 和原总包保持原样。员工安装由连接组件提供的「AI 写作工作台（含工具桥）」总包，与不含工具桥的版本二选一。预发布渠道为 `toolbridge`，本轮仅提供本地固定包，不发布 npm。
+
+选择本机文件夹后，Claude 和 Codex 可以把 DSH 已启用的 MCP、web、skill、ask_user、todo/present/goal 等工具交给 DSH 原生执行和审批。内置文件/命令、子代理/agent-team、run_code 不在桥接表；原有文件和命令执行方式保留。plan 不自动放行桥接权限；default 下 Claude 的桥接原生权限由插件单次应答，员工只在 DSH 审批实际工具。主机文件夹不开放工具桥。
+
+工具表按每次主机连接生成快照，新增/移除在下一次连接生效；不承诺 Codex 当前 MCP 会话热刷新。审批期间的插话等当前主机 prompt 结束后再发，停泊中切换助手会停止原轮次并明确提示。工具主动结束DSH轮次时，已提交结果仍交回原agent；确认原生工具收到后结束原prompt，下一条沿原线程继续，不在已关闭步骤追加模型回复。取消和主机结束等待后的结果不重放；工具已执行的副作用不能因取消而撤销，请按说明核对。图片结果由官方附件组件读取后交回。
+
+Codex 需要 S 后续安装的独立受保护命令 `/usr/local/aw-host/bin/codex-acp-toolbridge`（aw.7），不会替换原 codex-acp/aw.6；Claude命令不变。指定桥接 server 的等待为 owner 确认的 **1800 秒**、审批交 DSH；不改其他 server 或全局策略，不新增设置项。N0.4.9、L0.7.37沿既有公开合同；真实界面/员工验收由编排安排。完整合同和证据见 `docs/contracts/codex-toolbridge.md`、`docs/evidence/2026-10-26-toolbridge/REPORT.md`。
 
 通过官方 DSH 插件入口使用 Claude（远程主机）与 Codex（远程主机）。登录和工作区来源由“远程主机连接”组件提供；员工在原生工作区和模型菜单中选择文件夹与型号。
 
 文件和命令在所选的本机或主机目录执行，订阅凭据留在主机。插件不改写 DSH 的默认模型，不为员工创建同名主机目录，已有主机会话只提取一次原有主机来源并保存。
 
-需要远程主机连接组件 0.7.29 或更新的 0.7.x，以及联网助手 0.4.9。主机来源保存于官方 storage.domain 的会话元数据表，每轮仅由连接组件检查一次主机目录，不检查本机占位目录。
+需要远程主机连接组件 0.7.37 或更新的 0.7.x、联网助手 0.4.9，以及支持公开会话归属接口的主机组件 S0.4.26。主机来源保存于官方 storage.domain 的会话元数据表，每轮仅由连接组件检查一次主机目录，不检查本机占位目录。
 
 Claude 本机 Bash 会单独消费员工桥代理的控制诊断，不把它交给模型当作命令输出；真实传输中断仍提示结果未知。命令自身的标准输出、标准错误与退出码照常返回。
 
@@ -16,7 +26,7 @@ Claude 本机 Bash 会单独消费员工桥代理的控制诊断，不把它交
 
 同一 DSH 会话切换 Claude/Codex 时，切回会接本品牌最近的远端会话，并补充它尚未见过的可见对话；首次使用某品牌则带入全部可见历史。工具内部状态、推理和技术详情不转交。历史超出既有 `acpMaxMessageBytes` 容量时，只带能容纳的最近完整轮，并在技术详情说明省略数量；当前输入保持完整，超限仍明确失败。没有新增设置、重试或时限。
 
-断线会结束本轮；已派发的操作可能已部分执行，请先检查文件。恢复连接后可在原会话继续。旧进程清理和技术详情记录尽力而为，不阻止发起下一轮；如果上一轮仍占用原生线程，续接会明确失败并说明本轮输入未发送，不新建替代线程。自动定位、清理同一会话/线程的已断开旧进程仍需 S 提供公开能力，当前不会自动杀旧进程或冒称已恢复。原生本机会话恢复的兼容性及实际设备结果见本轮交付证据，未验证项不作为已通过。
+断线会结束本轮；已派发的操作可能已部分执行，请先检查文件。恢复连接后可在原会话继续。旧进程清理和技术详情记录尽力而为，不阻止发起下一轮。续接明确遇到原线程被占用时，使用 S0.4.26 的会话归属和原子结束接口：只有唯一匹配的旧进程确实已断开、主机明确确认退出后，才接回同一线程一次；不会新建替代线程、重发用户输入或抢占活跃会话。旧版无归属进程不能安全清理，需等待主机按现有策略回收；失败或释放结果未知则说明本轮输入未发送。原生本机会话恢复的兼容性及实际设备结果见本轮交付证据，未验证项不作为已通过。
 
 DSH 启动和打开模型菜单时读取一次主机型号列表。发送时不再查询目录或预核所选型号；所选型号不可用时，请在模型菜单重新选择。
 

package/dist/acp.d.ts

@@ -6,6 +6,7 @@ import type { BrokerTransport } from './broker.ts';
 import { type SanitizedObservation } from './conversation-details.ts';
 import { type ModelConfigurationSnapshot } from './model-configuration.ts';
 import type { EmployeeRouting } from './employee-relay.ts';
+import type { SessionOwnership } from './broker-ownership.ts';
 export type ApprovalOutcome = 'allowed-once' | 'rejected' | 'cancelled' | 'unavailable';
 export interface AcpHooks {
     closeDiagnostics?: CloseDiagnostics;
@@ -25,6 +26,7 @@ export interface AcpHooks {
     onEmployeeNotice?: (notice: string) => void;
     onDetail?: (detail: Readonly<SanitizedObservation>) => void;
     broker?: BrokerTransport;
+    sessionOwnership?: SessionOwnership;
     employeeExecution?: (params: unknown, signal?: AbortSignal) => Promise<Record<string, unknown>>;
 }
 export interface EmployeeExecutionMeta {
@@ -35,6 +37,7 @@ export interface EmployeeExecutionMeta {
     acpMaxMessageBytes: number;
 }
 export interface AcpStartContext {
+    toolBridgeServers?: EmployeeRouting['mcpServers'];
     systemPrompt?: string;
     codexNewSessionOnly?: true;
     employeeExecution?: EmployeeExecutionMeta;

package/dist/acp.js

@@ -1,6 +1,6 @@
 import { employeeExecutionInfo, employeeMcpSummary, employeeHttpNotice } from "./employee-info.js";
 import { employeeAdapterCodes, employeeOpenCauseCodes } from "./employee-reasons.js";
-import { CloseDiagnostics, withFirstFailureEvidence } from "./close-diagnostics.js";
+import { CloseDiagnostics, closeCode, withFirstFailureEvidence } from "./close-diagnostics.js";
 import * as acp from '@agentclientprotocol/sdk/unstable';
 import { NeedError } from "./remote.js";
 import { employeeFailure } from "./presentation.js";
@@ -227,6 +227,9 @@ export class AcpSession {
     employeeNoticeNames = new Set();
     employeeNoticeUnshown = false;
     employeeInfo(value) {
+        const bridge = record(record(value)?.mcpBridge);
+        if (bridge)
+            this.detail({ kind: 'session', severity: 'info', code: 'TOOLBRIDGE_HOST_POLICY', summary: '主机回报本轮指定桥接server的等待与审批策略；不改变其他工具。', payload: { toolTimeoutSec: typeof bridge.toolTimeoutSec === 'number' && Number.isFinite(bridge.toolTimeoutSec) ? bridge.toolTimeoutSec : null, approval: bridge.approval === 'approve' ? 'approve' : 'UNKNOWN', source: bridge.source === 'owner-2026-10-26' ? bridge.source : 'UNKNOWN' } });
         const info = employeeExecutionInfo(value);
         if (!info)
             return;
@@ -484,15 +487,15 @@ export class AcpSession {
         signal?.addEventListener('abort', abort, { once: true });
         try {
             const hello = await this.stage('acp-initialize', () => this.connection.agent.request(acp.methods.agent.initialize, {
-                protocolVersion: acp.PROTOCOL_VERSION, clientInfo: { name: '@ai-workbench/remote-agent', version: '0.8.24' },
-                clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, terminal: false, session: { notices: {} }, ...(this.employeeMeta ? { _meta: { awEmployeeExecution: { version: 1, closeReason: 1 } } } : {}) },
+                protocolVersion: acp.PROTOCOL_VERSION, clientInfo: { name: '@ai-workbench/remote-agent', version: '0.9.0-toolbridge.2' },
+                clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, terminal: false, session: { notices: {} }, ...(this.employeeMeta ? { _meta: { awEmployeeExecution: { version: 1, closeReason: 1, ...(context?.toolBridgeServers ? { mcpBridge: 1 } : {}) } } } : {}) },
             }, { cancellationSignal: signal }));
             if (hello.protocolVersion !== acp.PROTOCOL_VERSION)
                 throw new NeedError('ACP_VERSION_MISMATCH', 'ACP 协议版本不兼容', '支持 ACP v1 的远端 agent');
             this.negotiated = hello.agentCapabilities ?? {};
             if (this.employeeMeta) {
                 const policy = record(hello._meta?.awEmployeeExecution);
-                if (!this.hooks.employeeExecution || !policy || Object.keys(policy).length !== 5 || policy.version !== 1 || policy.nativeCliVersion !== '0.160.1' || policy.native !== true || policy.perRpcGate !== true || policy.noHostFallback !== true)
+                if (!this.hooks.employeeExecution || !policy || Object.keys(policy).length !== (context?.toolBridgeServers ? 6 : 5) || context?.toolBridgeServers && policy.mcpBridge !== 1 || policy.version !== 1 || policy.nativeCliVersion !== '0.160.1' || policy.native !== true || policy.perRpcGate !== true || policy.noHostFallback !== true)
                     throw new NeedError('EMPLOYEE_EXECUTION_UNSUPPORTED', '当前主机尚不支持在你的电脑执行Codex原生工具，本轮没有执行。', 'Codex员工端原生执行适配器与明确能力声明');
                 this.employeeNegotiated = true;
                 this.detail({ kind: 'session', severity: 'info', code: 'EMPLOYEE_EXECUTION_SELECTED', summary: '文件和命令在员工电脑的选定目录执行；订阅凭据留在主机，本机扩展的忽略详情单独记录。', payload: { bindingId: this.employeeMeta.bindingId, workspaceId: this.employeeMeta.workspaceId, cwd: this.employeeMeta.cwd, nativeCliVersion: '0.160.1', noHostFallback: true, agentConfigSource: 'host CODEX_HOME', unsupportedLocalFeatures: ['http-mcp-execution', 'hooks', 'plugins', 'cold-resume', 'slash-commands', 'host-file-reports'] } });
@@ -503,19 +506,43 @@ export class AcpSession {
                 this.validatePrompt(prompt);
             const routing = context?.employeeRouting ? structuredClone(context.employeeRouting) : undefined;
             this.employeeRouting = routing;
-            const params = { cwd, mcpServers: routing ? structuredClone(routing.mcpServers) : [], ...((routing || this.employeeMeta) ? { _meta: { ...(this.employeeMeta ? { awEmployeeExecution: this.employeeMeta } : {}), ...(routing ? { claudeCode: { options: employeeClaudeOptions(routing) } } : {}) } } : {}), ...(systemPrompt && !(resumeId && this.codexNewSessionOnly) ? { systemPrompt: { mode: 'append', content: [{ type: 'text', text: systemPrompt }] } } : {}) };
+            const params = { cwd, mcpServers: context?.toolBridgeServers ? structuredClone(context.toolBridgeServers) : routing ? structuredClone(routing.mcpServers) : [], ...((routing || this.employeeMeta) ? { _meta: { ...(this.employeeMeta ? { awEmployeeExecution: this.employeeMeta } : {}), ...(routing ? { claudeCode: { options: employeeClaudeOptions(routing) } } : {}) } } : {}), ...(systemPrompt && !(resumeId && this.codexNewSessionOnly) ? { systemPrompt: { mode: 'append', content: [{ type: 'text', text: systemPrompt }] } } : {}) };
             const configRevision = this.resetConfiguration();
+            const restore = async (operation) => {
+                try {
+                    return await operation();
+                }
+                catch (error) {
+                    if (!resumeId || acpNeed(error).code !== 'REMOTE_SESSION_BUSY' || !this.hooks.sessionOwnership)
+                        throw error;
+                    this.detail({ kind: 'session', severity: 'info', code: 'REMOTE_SESSION_BUSY', summary: '原远端会话被占用，正在核对同一会话与线程的已断开旧进程；尚未发送用户输入。' });
+                    try {
+                        await this.hooks.sessionOwnership.stopDetached(resumeId, signal);
+                        signal?.throwIfAborted();
+                    }
+                    catch (failure) {
+                        this.detail({ kind: 'session', severity: 'warning', code: 'REMOTE_SESSION_RELEASE_UNCONFIRMED', summary: '旧会话释放未获确认，本轮没有再次接续或发送用户输入。', payload: { reason: failure instanceof NeedError ? failure.requires : closeCode(failure, 'BROKER_CONTROL_FAILED') } });
+                        throw failure;
+                    }
+                    this.detail({ kind: 'session', severity: 'info', code: 'REMOTE_SESSION_RELEASE_CONFIRMED', summary: '主机已确认原会话的已断开旧进程退出，继续接回同一远端会话一次。' });
+                    return operation(); // Exactly one continuation, only after the explicit release receipt.
+                }
+            };
             if (resumeId) {
                 this.sessionId = resumeId;
                 if (this.negotiated.sessionCapabilities?.resume) {
-                    const result = await this.stage('acp-session-resume', () => this.connection.agent.request(acp.methods.agent.session.resume, { ...params, sessionId: resumeId }, { cancellationSignal: signal }));
+                    const result = await restore(() => this.stage('acp-session-resume', () => this.connection.agent.request(acp.methods.agent.session.resume, { ...params, sessionId: resumeId }, { cancellationSignal: signal })));
+                    if (this.employeeMeta)
+                        this.employeeInfo(result._meta?.awEmployeeExecutionInfo);
                     this.lifecycleConfiguration(result, configRevision);
                     this.method = acp.methods.agent.session.resume;
                 }
                 else {
                     if (!this.negotiated.loadSession)
                         throw new NeedError('RESUME_UNSUPPORTED', '远端未声明会话恢复或加载能力，不能恢复原会话', '支持 session/resume 或 session/load 的 agent');
-                    const result = await this.stage('acp-session-load', () => this.connection.agent.request(acp.methods.agent.session.load, { ...params, sessionId: resumeId }, { cancellationSignal: signal }));
+                    const result = await restore(() => this.stage('acp-session-load', () => this.connection.agent.request(acp.methods.agent.session.load, { ...params, sessionId: resumeId }, { cancellationSignal: signal })));
+                    if (this.employeeMeta)
+                        this.employeeInfo(result._meta?.awEmployeeExecutionInfo);
                     this.lifecycleConfiguration(result, configRevision);
                     this.method = acp.methods.agent.session.load;
                 }
@@ -528,6 +555,7 @@ export class AcpSession {
                 this.lifecycleConfiguration(result, configRevision);
                 this.method = acp.methods.agent.session.new;
             }
+            await this.hooks.sessionOwnership?.bind(this.sessionId, signal);
             this.ready = true;
             this.cwd = cwd;
             this.systemPrompt = systemPrompt ?? '';

package/dist/agents.js

@@ -1,4 +1,4 @@
-export const CODEX_AGENT = Object.freeze({ id: 'codex-remote', name: Object.freeze({ zh: 'Codex（远程主机）', en: 'Codex (Remote Host)' }), command: '/usr/local/aw-host/bin/codex-acp', loginProvider: 'codex' });
+export const CODEX_AGENT = Object.freeze({ id: 'codex-remote', name: Object.freeze({ zh: 'Codex（远程主机）', en: 'Codex (Remote Host)' }), command: '/usr/local/aw-host/bin/codex-acp-toolbridge', loginProvider: 'codex' });
 export const CLAUDE_AGENT = Object.freeze({ id: 'claude-code-workbench', name: Object.freeze({ zh: 'Claude（远程主机）', en: 'Claude (Remote Host)' }), command: '/usr/local/aw-host/bin/claude-agent-acp', loginProvider: 'claude' });
 export const AGENTS = Object.freeze([CODEX_AGENT, CLAUDE_AGENT]);
 export function agentForProvider(id) { return AGENTS.find(agent => agent.id === id); }

package/dist/broker-ownership.d.ts

@@ -0,0 +1,10 @@
+import { type BrokerIo } from './broker.ts';
+export interface SessionOwnership {
+    bind(remoteSessionId: string, signal?: AbortSignal): Promise<void>;
+    stopDetached(remoteSessionId: string, signal?: AbortSignal): Promise<void>;
+}
+/** S0426 public control only: no process/lock scans or client ownership journal. */
+export declare function brokerOwnership(io: BrokerIo, command: (args: string[]) => string, started: {
+    id: string;
+    instanceId: string;
+}, receipt: unknown, dshSessionId: string, provider: 'codex' | 'claude'): SessionOwnership;

package/dist/broker-ownership.js

@@ -0,0 +1,59 @@
+import { controlJson } from "./broker.js";
+import { NeedError } from "./remote.js";
+import { closeCode } from "./close-diagnostics.js";
+const record = (v) => v !== null && typeof v === 'object' && !Array.isArray(v) ? v : undefined;
+const line = (v) => typeof v === 'string' && v.length > 0 && !/[\r\n\0]/.test(v);
+const same = (value, expected) => { const row = record(value); return row?.dshSessionId === expected.dshSessionId && row.provider === expected.provider && row.remoteSessionId === expected.remoteSessionId; };
+const busy = (reason) => new NeedError('REMOTE_SESSION_BUSY', '原会话仍被上一轮占用，本轮输入未发送。', '已断开旧会话的安全释放尚未确认；' + reason + (reason === 'OWNERSHIP_NOT_FOUND_OR_LEGACY' ? '；没有可证明归属的旧会话，不结束任何旧进程，请等待主机按现有策略回收。' : ''));
+/** S0426 public control only: no process/lock scans or client ownership journal. */
+export function brokerOwnership(io, command, started, receipt, dshSessionId, provider) {
+    let owner = { dshSessionId, provider, remoteSessionId: null };
+    const initial = record(receipt);
+    if (!line(dshSessionId) || initial?.ownershipProtocolVersion !== 1 || !same(initial.ownership, owner))
+        throw new NeedError('BROKER_OWNERSHIP_UNAVAILABLE', '主机会话缺少归属能力，本轮输入未发送；请联系管理员更新主机组件。', 'S >=0.4.26 / ownershipProtocolVersion:1');
+    const flags = (value) => ['--dsh-session-id', value.dshSessionId, '--provider', value.provider, '--remote-session-id', value.remoteSessionId];
+    const confirmed = (value, id, instanceId, expected) => value?.id === id && value.instanceId === instanceId && value.ownershipProtocolVersion === 1 && same(value.ownership, expected);
+    return {
+        async bind(remoteSessionId, signal) {
+            signal?.throwIfAborted();
+            if (!line(remoteSessionId))
+                throw new NeedError('BROKER_OWNERSHIP_INVALID', '远端会话编号无法绑定，本轮输入未发送。', 'S0426单行原生会话编号');
+            const next = { ...owner, remoteSessionId };
+            const value = record(controlJson(await io.run(command(['bind', started.id, '--if-instance', started.instanceId, ...flags(next), ...(owner.remoteSessionId === null ? [] : ['--if-remote-session-id', owner.remoteSessionId])]), signal)));
+            signal?.throwIfAborted();
+            if (value?.type !== 'bound' || !confirmed(value, started.id, started.instanceId, next))
+                throw new NeedError('BROKER_OWNERSHIP_UNCONFIRMED', '主机未确认会话归属，本轮输入未发送。', 'S0426精确归属绑定回执');
+            owner = next;
+        },
+        async stopDetached(remoteSessionId, signal) {
+            try {
+                signal?.throwIfAborted();
+                if (!line(remoteSessionId))
+                    throw busy('OWNERSHIP_INVALID');
+                const wanted = { ...owner, remoteSessionId };
+                const entries = controlJson(await io.run(command(['list']), signal));
+                signal?.throwIfAborted();
+                if (!Array.isArray(entries) || entries.some(row => !record(row)))
+                    throw busy('OWNERSHIP_LIST_INVALID');
+                const matches = entries.map(record).filter(row => same(row?.ownership, wanted));
+                if (matches.length !== 1)
+                    throw busy(matches.length ? 'OWNERSHIP_AMBIGUOUS' : 'OWNERSHIP_NOT_FOUND_OR_LEGACY');
+                const row = matches[0];
+                if (row.id === started.id || !line(row.id) || !line(row.instanceId) || row.ownershipProtocolVersion !== 1)
+                    throw busy('OWNERSHIP_UNAVAILABLE');
+                const lifecycle = record(row.lifecycle);
+                if (!['running', 'exited'].includes(row.state) || lifecycle?.attached !== false || !line(lifecycle.detachedAt))
+                    throw busy('SESSION_NOT_DETACHED');
+                const value = record(controlJson(await io.run(command(['stop-detached', row.id, '--if-instance', row.instanceId, ...flags(wanted)]), signal)));
+                signal?.throwIfAborted();
+                if (value?.type !== 'killed' || !confirmed(value, row.id, row.instanceId, wanted) || value.agentExited !== true || value.processGroupExited !== true)
+                    throw busy('STOP_UNCONFIRMED');
+            }
+            catch (error) {
+                if (error instanceof NeedError && error.code === 'REMOTE_SESSION_BUSY')
+                    throw error;
+                throw busy(closeCode(error, 'BROKER_CONTROL_FAILED'));
+            }
+        },
+    };
+}

package/dist/broker-runtime.js

@@ -12,6 +12,7 @@ import { BrokerTransport, brokerCommand, brokerId, sshIo, controlJson } from "./
 import { CODEX_AGENT } from "./agents.js";
 import { NeedError } from "./remote.js";
 import { identity } from "./provider.js";
+import { brokerOwnership } from "./broker-ownership.js";
 /** Each invocation owns a new agent. Context resumes by native session ID, never by reattaching a broker. */
 export function brokerFactory(_get, _ask, configuration, provided) {
     return async (target, project, request) => {
@@ -25,7 +26,7 @@ export function brokerFactory(_get, _ask, configuration, provided) {
         const command = (args) => brokerCommand(target, args);
         const diagnostics = request.closeDiagnostics ?? new CloseDiagnostics(detail => request.detailChannel?.record(detail));
         const id = brokerId(request.sessionId + '/' + randomUUID(), agent.id);
-        const startCommand = command(['start', id, '--cwd', project.path, '--settings', target.session.settingsPath, '--', agent.command]);
+        const startCommand = command(['start', id, '--cwd', project.path, '--settings', target.session.settingsPath, '--dsh-session-id', request.sessionId, '--provider', agent.loginProvider, '--', agent.command]);
         // environments.toml overrides CODEX_EXEC_SERVER_URL. Refuse that host default rather
         // than allowing a local-workspace resume to select a host executor.
         const employeeStart = request.employeeScope && agent.loginProvider === 'codex';
@@ -47,7 +48,9 @@ export function brokerFactory(_get, _ask, configuration, provided) {
         };
         const aborted = () => channel.fail(new NeedError('ABORTED', '本轮已取消。', '确认主机状态'), { layer: 'broker', initiator: 'broker.open-signal', reason: 'ABORTED', action: 'abort' });
         request.signal?.addEventListener('abort', aborted, { once: true });
+        let sessionOwnership;
         try {
+            sessionOwnership = brokerOwnership(io, command, { id, instanceId: started.instanceId }, started, request.sessionId, agent.loginProvider);
             request.signal?.throwIfAborted();
             await channel.connect();
         }
@@ -58,6 +61,6 @@ export function brokerFactory(_get, _ask, configuration, provided) {
         finally {
             request.signal?.removeEventListener('abort', aborted);
         }
-        return { identity: identity(target), cwd: project.path, closeDiagnostics: diagnostics, broker: channel, acpTransport: channel, dispose, detach: dispose };
+        return { identity: identity(target), cwd: project.path, closeDiagnostics: diagnostics, broker: channel, sessionOwnership, acpTransport: channel, dispose, detach: dispose };
     };
 }

package/dist/claude-local.js

@@ -115,7 +115,8 @@ export function createClaudeLocalProvider(options) {
             const network = options.getNetwork();
             lease = await (options.ports?.lease ?? openEmployeeLease)({ closeDiagnostics, getConnect: () => options.getConnect(), getNetwork: options.getNetwork, readWorkspace: () => options.readWorkspace(request.sessionId), host: target, sessionId: request.sessionId, control: async (_target, command, signal) => (await transport()).run(command, signal), detail: unscoped }, request.signal);
             const shell = (options.ports?.shell ?? createEmployeeShell)({ closeDiagnostics, target: lease.target, sshArgs: lease.sshArgs, maxBytes: maximum, killGraceMs: grace, attach: async (spec) => (await transport()).attach([spec.command, ...spec.args].map(shellQuote).join(' ')) });
-            mcp = await (options.ports?.mcp ?? openEmployeeMcp)({ closeDiagnostics, lease, maxBytes: maximum, killGraceMs: grace, runShell: shell, activeSignal: () => entry?.active?.signal, captureDetail: () => { const sink = entry?.active?.details; if (!sink)
+            request.toolBridge?.enable(event => details.record(event));
+            mcp = await (options.ports?.mcp ?? openEmployeeMcp)({ bridge: request.toolBridge, closeDiagnostics, lease, maxBytes: maximum, killGraceMs: grace, runShell: shell, activeSignal: () => entry?.active?.signal, captureDetail: () => { const sink = entry?.active?.details; if (!sink)
                     throw failure('EMPLOYEE_NO_ACTIVE_TURN'); return observation => sink.record(observation); }, detail: unscoped });
             entry = { runtime: undefined, scope, lease, details, request };
             const row = entry;

package/dist/employee-mcp.d.ts

@@ -1,3 +1,4 @@
+import type { ToolBridge } from './toolbridge.ts';
 import { type CloseCause, type CloseDiagnostics, type CloseObserver } from './close-diagnostics.ts';
 import { type Socket } from 'node:net';
 import { type JSONRPCMessage, type Tool } from '@modelcontextprotocol/sdk/types.js';
@@ -28,6 +29,7 @@ export declare class EmployeeSocketTransport implements Transport {
     close(cause?: CloseCause): Promise<void>;
 }
 export interface EmployeeMcpOptions {
+    bridge?: ToolBridge;
     closeDiagnostics?: CloseDiagnostics;
     lease: EmployeeLease;
     maxBytes: number;

package/dist/employee-mcp.js

@@ -136,12 +136,14 @@ export async function openEmployeeMcp(options) {
         const mcp = new Server({ name: 'ai-workbench-employee', version: '0.8.14' }, { capabilities: { tools: {} } }), transport = new EmployeeSocketTransport(socket, options.maxBytes, observeConnection);
         clients.add(mcp);
         transports.add(transport);
-        mcp.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: EMPLOYEE_MCP_TOOLS }));
+        mcp.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: [...EMPLOYEE_MCP_TOOLS, ...options.bridge?.tools ?? []] }));
         mcp.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
             const active = options.activeSignal();
             if (!active || active.aborted)
                 return { isError: true, content: [{ type: 'text', text: 'EMPLOYEE_NO_ACTIVE_TURN：当前没有已接纳的用户轮次，本机工具未执行。' }] };
             const signal = AbortSignal.any([active, extra.signal, transport.signal, options.lease.signal]);
+            if (options.bridge?.isBridge(request.params.name))
+                return options.bridge.call(request.params.name, request.params.arguments ?? {}, signal);
             let sink;
             try {
                 sink = options.captureDetail?.() ?? options.detail;

package/dist/index.d.ts

@@ -57,6 +57,7 @@ export declare class CodexRemoteAdapter extends LlmAdapter {
     private readonly directory?;
     private readonly preflightDiagnostics?;
     private readonly permissions?;
+    private bridgeLoop;
     private config;
     private sessions;
     private turns;
@@ -65,7 +66,8 @@ export declare class CodexRemoteAdapter extends LlmAdapter {
     private detached;
     private modelPresentation;
     private employeeNoticeSessions;
-    constructor(config: PluginConfig | (() => PluginConfig), resolveRuntime: RuntimeProvider, approve?: InvocationApproval | undefined, providerName?: () => string, agent?: AgentDefinition, readImage?: ImageReader | undefined, reportLoginFailure?: LoginFailureReporter | undefined, directory?: ModelDirectory | undefined, preflightDiagnostics?: PreflightDiagnostics | undefined, permissions?: PermissionSource | undefined);
+    private pendingEmployeeNotices;
+    constructor(config: PluginConfig | (() => PluginConfig), resolveRuntime: RuntimeProvider, approve?: InvocationApproval | undefined, providerName?: () => string, agent?: AgentDefinition, readImage?: ImageReader | undefined, reportLoginFailure?: LoginFailureReporter | undefined, directory?: ModelDirectory | undefined, preflightDiagnostics?: PreflightDiagnostics | undefined, permissions?: PermissionSource | undefined, bridgeStopped?: (sessionId: string, notice: string) => void);
     providerInfo(provider: string): {
         id: string;
         name: string;
@@ -88,6 +90,8 @@ export declare class CodexRemoteAdapter extends LlmAdapter {
         jitterRatio: number;
     };
     private cleanupRuntime;
+    completeDshTurn(sessionId: string, messages: GenerateOptions['messages']): Promise<void>;
+    hasBridgeSession(sessionId: string): boolean;
     disposeSession(sessionId: string): Promise<void>;
     detachSession(sessionId: string): Promise<void>;
     dispose(): Promise<void>;
@@ -97,7 +101,7 @@ export declare class CodexRemoteAdapter extends LlmAdapter {
 /** One official registration owns both routes, preserving opaque replay ownership. */
 export declare class RemoteAgentsAdapter extends LlmAdapter {
     private adapters;
-    constructor(config: () => PluginConfig, makeRuntime: (agent: AgentDefinition) => RuntimeProvider, approve: InvocationApproval, nameFor: (agent: AgentDefinition) => string, readImage?: ImageReader, reportLoginFailure?: LoginFailureReporter, directory?: ModelDirectory, preflightDiagnostics?: PreflightDiagnostics, permissions?: PermissionSource);
+    constructor(config: () => PluginConfig, makeRuntime: (agent: AgentDefinition) => RuntimeProvider, approve: InvocationApproval, nameFor: (agent: AgentDefinition) => string, readImage?: ImageReader, reportLoginFailure?: LoginFailureReporter, directory?: ModelDirectory, preflightDiagnostics?: PreflightDiagnostics, permissions?: PermissionSource, bridgeStopped?: (sessionId: string, notice: string) => void);
     private adapter;
     providerInfo(provider: string): {
         id: string;
@@ -108,8 +112,8 @@ export declare class RemoteAgentsAdapter extends LlmAdapter {
     })[]>;
     resolveModel(provider: string, model: string, signal?: AbortSignal): Promise<LlmResolvedModelInfo>;
     prepareCall(provider: string, model: string, signal?: AbortSignal): Promise<{
-        model: LlmResolvedModelInfo;
         stream: (options: GenerateOptions) => AsyncGenerator<StreamChunk, any, any>;
+        model: LlmResolvedModelInfo;
     }>;
     providerRetryPolicy(): {
         mode: "normal";
@@ -120,6 +124,7 @@ export declare class RemoteAgentsAdapter extends LlmAdapter {
         jitterRatio: number;
     };
     stream(options: GenerateOptions): AsyncGenerator<StreamChunk, any, any>;
+    completeDshTurn(sessionId: string, messages: GenerateOptions['messages']): Promise<void>;
     disposeSession(sessionId: string): Promise<void>;
     detachSession(sessionId: string): Promise<void>;
     dispose(): Promise<void>;