@ai-workbench/remote-agent 0.8.29 → 0.9.0-toolbridge.3

package/README.md

@@ -1,10 +1,20 @@
-# AI Workbench 远程助手 · @ai-workbench/remote-agent@0.8.29 · 插件 → 添加插件
+# AI Workbench 远程助手 · @ai-workbench/remote-agent@0.9.0-toolbridge.3 · 插件 → 添加插件
+
+## 含工具桥预发布线
+
+本包为 `0.9.0-toolbridge.3`，在独立 `toolbridge` 分支开发；稳定 main/0.8.x 和原总包保持原样。员工安装由连接组件提供的「AI 写作工作台（含工具桥）」总包，与不含工具桥的版本二选一。预发布渠道为 `toolbridge`，本轮仅提供本地固定包，不发布 npm。
+
+选择本机文件夹后，Claude 和 Codex 可以把 DSH 已启用的 MCP、web、skill、ask_user、todo/present/goal 等工具交给 DSH 原生执行和审批。内置文件/命令、子代理/agent-team、run_code 不在桥接表；原有文件和命令执行方式保留。plan 不自动放行桥接权限；default 下 Claude 的桥接原生权限由插件单次应答，员工只在 DSH 审批实际工具。主机文件夹不开放工具桥。
+
+工具表按每次主机连接生成快照，新增/移除在下一次连接生效；不承诺 Codex 当前 MCP 会话热刷新。审批期间的插话等当前主机 prompt 结束后再发，停泊中切换助手会停止原轮次并明确提示。工具主动结束DSH轮次时，已提交结果仍交回原agent；确认原生工具收到后结束原prompt，下一条沿原线程继续，不在已关闭步骤追加模型回复。取消和主机结束等待后的结果不重放；工具已执行的副作用不能因取消而撤销，请按说明核对。图片结果由官方附件组件读取后交回。
+
+Codex 需要 S 后续安装的独立受保护命令 `/usr/local/aw-host/bin/codex-acp-toolbridge`（aw.8），不会替换原 codex-acp/aw.6；Claude命令不变。指定桥接 server 的等待为 owner 确认的 **1800 秒**、审批交 DSH；不改其他server的调用时限，不新增插件设置项。含桥的本机Codex会话按原生规则等各扩展现有启动时限结算后再捕获工具；启动失败会明确说明，文件和命令仍按原方式执行，本轮不自动重试。N0.4.9、L0.7.37沿既有公开合同；真实界面/员工验收由编排安排。完整合同和本轮启动修复证据见 `docs/contracts/codex-toolbridge.md`、`docs/evidence/2026-10-27-toolbridge-startup/REPORT.md`。
 
 通过官方 DSH 插件入口使用 Claude（远程主机）与 Codex（远程主机）。登录和工作区来源由“远程主机连接”组件提供；员工在原生工作区和模型菜单中选择文件夹与型号。
 
 文件和命令在所选的本机或主机目录执行，订阅凭据留在主机。插件不改写 DSH 的默认模型，不为员工创建同名主机目录，已有主机会话只提取一次原有主机来源并保存。
 
-需要远程主机连接组件 0.7.29 或更新的 0.7.x、联网助手 0.4.9，以及支持公开会话归属接口的主机组件 S0.4.26。主机来源保存于官方 storage.domain 的会话元数据表，每轮仅由连接组件检查一次主机目录，不检查本机占位目录。
+需要远程主机连接组件 0.7.37 或更新的 0.7.x、联网助手 0.4.9，以及支持公开会话归属接口的主机组件 S0.4.26。主机来源保存于官方 storage.domain 的会话元数据表，每轮仅由连接组件检查一次主机目录，不检查本机占位目录。
 
 Claude 本机 Bash 会单独消费员工桥代理的控制诊断，不把它交给模型当作命令输出；真实传输中断仍提示结果未知。命令自身的标准输出、标准错误与退出码照常返回。
 

package/dist/acp.d.ts

@@ -37,6 +37,7 @@ export interface EmployeeExecutionMeta {
     acpMaxMessageBytes: number;
 }
 export interface AcpStartContext {
+    toolBridgeServers?: EmployeeRouting['mcpServers'];
     systemPrompt?: string;
     codexNewSessionOnly?: true;
     employeeExecution?: EmployeeExecutionMeta;
@@ -95,6 +96,12 @@ export declare class AcpSession {
     private detail;
     private employeeNoticeNames;
     private employeeNoticeUnshown;
+    private employeeBridge;
+    private pendingBridgeStartupFailures;
+    private bridgeStartupFailed;
+    private bridgeStartupNoticeDelivered;
+    private confirmBridgeStartupFailure;
+    private flushBridgeStartupNotice;
     private employeeInfo;
     private need;
     constructor(transport: acp.Stream | acp.AgentApp | stable.AgentApp, hooks: AcpHooks);

package/dist/acp.js

@@ -226,7 +226,31 @@ export class AcpSession {
     }
     employeeNoticeNames = new Set();
     employeeNoticeUnshown = false;
+    employeeBridge = false;
+    pendingBridgeStartupFailures = new Set();
+    bridgeStartupFailed = false;
+    bridgeStartupNoticeDelivered = false;
+    confirmBridgeStartupFailure() {
+        if (!this.sessionId)
+            return;
+        const failed = this.pendingBridgeStartupFailures.has(this.sessionId);
+        this.pendingBridgeStartupFailures.clear();
+        if (failed && !this.bridgeStartupFailed) {
+            this.bridgeStartupFailed = true;
+            this.detail({ kind: 'extension', severity: 'warning', code: 'TOOLBRIDGE_STARTUP_FAILED', summary: '本轮DSH扩展工具桥启动失败；文件和命令继续使用原生路径，没有自动重试。', method: 'session/update', payload: { server: 'employee', status: 'failed', source: 'codex-acp/mcp-startup-report', nativeSessionId: this.sessionId } });
+        }
+        this.flushBridgeStartupNotice();
+    }
+    flushBridgeStartupNotice() {
+        if (!this.bridgeStartupFailed || this.bridgeStartupNoticeDelivered || !this.busy || this.closeRequested || this.turnSignal?.aborted || !this.hooks.onEmployeeNotice)
+            return;
+        this.hooks.onEmployeeNotice('本轮DSH里的扩展工具未能连接到Codex，暂时不可用。文件和命令仍按原方式执行；具体原因见技术详情。本轮不会自动重试。');
+        this.bridgeStartupNoticeDelivered = true;
+    }
     employeeInfo(value) {
+        const bridge = record(record(value)?.mcpBridge);
+        if (bridge)
+            this.detail({ kind: 'session', severity: 'info', code: 'TOOLBRIDGE_HOST_POLICY', summary: '主机回报本轮指定桥接server的等待与审批策略；不改变其他工具。', payload: { toolTimeoutSec: typeof bridge.toolTimeoutSec === 'number' && Number.isFinite(bridge.toolTimeoutSec) ? bridge.toolTimeoutSec : null, approval: bridge.approval === 'approve' ? 'approve' : 'UNKNOWN', source: bridge.source === 'owner-2026-10-26' ? bridge.source : 'UNKNOWN' } });
         const info = employeeExecutionInfo(value);
         if (!info)
             return;
@@ -260,6 +284,11 @@ export class AcpSession {
                 this.detail({ kind: 'session', severity: 'warning', code: 'ACP_FOREIGN_SESSION_UPDATE', summary: '收到不属于当前远端会话的通知，未作为正文处理', method: 'session/update', payload: notification });
                 return;
             }
+            const update = notification.update;
+            if (this.employeeBridge && !this.closeRequested && (update.sessionUpdate === 'tool_call' || update.sessionUpdate === 'tool_call_update') && update.status === 'failed' && update.title === 'mcp__employee__startup' && update.toolCallId.startsWith('mcp_startup.employee.') && update.toolCallId.length > 'mcp_startup.employee.'.length) {
+                this.pendingBridgeStartupFailures.add(notification.sessionId);
+                this.confirmBridgeStartupFailure();
+            }
             const meta = record(notification._meta);
             if (notification.update.sessionUpdate === 'current_mode_update') {
                 this.nativeModeId = notification.update.currentModeId;
@@ -479,20 +508,21 @@ export class AcpSession {
             throw new NeedError('SESSION_ALREADY_STARTED', '此连接已用于建立会话，不能转用工作区或身份', '新的独立远端连接');
         this.startAttempted = true;
         this.employeeMeta = context?.employeeExecution;
+        this.employeeBridge = !!this.employeeMeta && !!context?.toolBridgeServers;
         const abort = () => this.close({ layer: 'acp', initiator: 'acp.start-signal', reason: 'ABORTED', action: 'abort' }, new NeedError('ABORTED', '会话建立已取消', '重新连接主机'));
         signal?.throwIfAborted();
         signal?.addEventListener('abort', abort, { once: true });
         try {
             const hello = await this.stage('acp-initialize', () => this.connection.agent.request(acp.methods.agent.initialize, {
-                protocolVersion: acp.PROTOCOL_VERSION, clientInfo: { name: '@ai-workbench/remote-agent', version: '0.8.24' },
-                clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, terminal: false, session: { notices: {} }, ...(this.employeeMeta ? { _meta: { awEmployeeExecution: { version: 1, closeReason: 1 } } } : {}) },
+                protocolVersion: acp.PROTOCOL_VERSION, clientInfo: { name: '@ai-workbench/remote-agent', version: '0.9.0-toolbridge.3' },
+                clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, terminal: false, session: { notices: {} }, ...(this.employeeMeta ? { _meta: { awEmployeeExecution: { version: 1, closeReason: 1, ...(context?.toolBridgeServers ? { mcpBridge: 1 } : {}) } } } : {}) },
             }, { cancellationSignal: signal }));
             if (hello.protocolVersion !== acp.PROTOCOL_VERSION)
                 throw new NeedError('ACP_VERSION_MISMATCH', 'ACP 协议版本不兼容', '支持 ACP v1 的远端 agent');
             this.negotiated = hello.agentCapabilities ?? {};
             if (this.employeeMeta) {
                 const policy = record(hello._meta?.awEmployeeExecution);
-                if (!this.hooks.employeeExecution || !policy || Object.keys(policy).length !== 5 || policy.version !== 1 || policy.nativeCliVersion !== '0.160.1' || policy.native !== true || policy.perRpcGate !== true || policy.noHostFallback !== true)
+                if (!this.hooks.employeeExecution || !policy || Object.keys(policy).length !== (context?.toolBridgeServers ? 6 : 5) || context?.toolBridgeServers && policy.mcpBridge !== 1 || policy.version !== 1 || policy.nativeCliVersion !== '0.160.1' || policy.native !== true || policy.perRpcGate !== true || policy.noHostFallback !== true)
                     throw new NeedError('EMPLOYEE_EXECUTION_UNSUPPORTED', '当前主机尚不支持在你的电脑执行Codex原生工具，本轮没有执行。', 'Codex员工端原生执行适配器与明确能力声明');
                 this.employeeNegotiated = true;
                 this.detail({ kind: 'session', severity: 'info', code: 'EMPLOYEE_EXECUTION_SELECTED', summary: '文件和命令在员工电脑的选定目录执行；订阅凭据留在主机，本机扩展的忽略详情单独记录。', payload: { bindingId: this.employeeMeta.bindingId, workspaceId: this.employeeMeta.workspaceId, cwd: this.employeeMeta.cwd, nativeCliVersion: '0.160.1', noHostFallback: true, agentConfigSource: 'host CODEX_HOME', unsupportedLocalFeatures: ['http-mcp-execution', 'hooks', 'plugins', 'cold-resume', 'slash-commands', 'host-file-reports'] } });
@@ -503,7 +533,7 @@ export class AcpSession {
                 this.validatePrompt(prompt);
             const routing = context?.employeeRouting ? structuredClone(context.employeeRouting) : undefined;
             this.employeeRouting = routing;
-            const params = { cwd, mcpServers: routing ? structuredClone(routing.mcpServers) : [], ...((routing || this.employeeMeta) ? { _meta: { ...(this.employeeMeta ? { awEmployeeExecution: this.employeeMeta } : {}), ...(routing ? { claudeCode: { options: employeeClaudeOptions(routing) } } : {}) } } : {}), ...(systemPrompt && !(resumeId && this.codexNewSessionOnly) ? { systemPrompt: { mode: 'append', content: [{ type: 'text', text: systemPrompt }] } } : {}) };
+            const params = { cwd, mcpServers: context?.toolBridgeServers ? structuredClone(context.toolBridgeServers) : routing ? structuredClone(routing.mcpServers) : [], ...((routing || this.employeeMeta) ? { _meta: { ...(this.employeeMeta ? { awEmployeeExecution: this.employeeMeta } : {}), ...(routing ? { claudeCode: { options: employeeClaudeOptions(routing) } } : {}) } } : {}), ...(systemPrompt && !(resumeId && this.codexNewSessionOnly) ? { systemPrompt: { mode: 'append', content: [{ type: 'text', text: systemPrompt }] } } : {}) };
             const configRevision = this.resetConfiguration();
             const restore = async (operation) => {
                 try {
@@ -529,6 +559,8 @@ export class AcpSession {
                 this.sessionId = resumeId;
                 if (this.negotiated.sessionCapabilities?.resume) {
                     const result = await restore(() => this.stage('acp-session-resume', () => this.connection.agent.request(acp.methods.agent.session.resume, { ...params, sessionId: resumeId }, { cancellationSignal: signal })));
+                    if (this.employeeMeta)
+                        this.employeeInfo(result._meta?.awEmployeeExecutionInfo);
                     this.lifecycleConfiguration(result, configRevision);
                     this.method = acp.methods.agent.session.resume;
                 }
@@ -536,6 +568,8 @@ export class AcpSession {
                     if (!this.negotiated.loadSession)
                         throw new NeedError('RESUME_UNSUPPORTED', '远端未声明会话恢复或加载能力，不能恢复原会话', '支持 session/resume 或 session/load 的 agent');
                     const result = await restore(() => this.stage('acp-session-load', () => this.connection.agent.request(acp.methods.agent.session.load, { ...params, sessionId: resumeId }, { cancellationSignal: signal })));
+                    if (this.employeeMeta)
+                        this.employeeInfo(result._meta?.awEmployeeExecutionInfo);
                     this.lifecycleConfiguration(result, configRevision);
                     this.method = acp.methods.agent.session.load;
                 }
@@ -548,6 +582,7 @@ export class AcpSession {
                 this.lifecycleConfiguration(result, configRevision);
                 this.method = acp.methods.agent.session.new;
             }
+            this.confirmBridgeStartupFailure();
             await this.hooks.sessionOwnership?.bind(this.sessionId, signal);
             this.ready = true;
             this.cwd = cwd;
@@ -599,6 +634,7 @@ export class AcpSession {
         };
         signal?.addEventListener('abort', cancel, { once: true });
         try {
+            this.flushBridgeStartupNotice();
             const result = await this.stage('acp-prompt', () => {
                 this.promptPermissions.set(params, { current, native });
                 const request = this.connection.agent.request(acp.methods.agent.session.prompt, params, { cancellationSignal: signal });

package/dist/agents.js

@@ -1,4 +1,4 @@
-export const CODEX_AGENT = Object.freeze({ id: 'codex-remote', name: Object.freeze({ zh: 'Codex（远程主机）', en: 'Codex (Remote Host)' }), command: '/usr/local/aw-host/bin/codex-acp', loginProvider: 'codex' });
+export const CODEX_AGENT = Object.freeze({ id: 'codex-remote', name: Object.freeze({ zh: 'Codex（远程主机）', en: 'Codex (Remote Host)' }), command: '/usr/local/aw-host/bin/codex-acp-toolbridge', loginProvider: 'codex' });
 export const CLAUDE_AGENT = Object.freeze({ id: 'claude-code-workbench', name: Object.freeze({ zh: 'Claude（远程主机）', en: 'Claude (Remote Host)' }), command: '/usr/local/aw-host/bin/claude-agent-acp', loginProvider: 'claude' });
 export const AGENTS = Object.freeze([CODEX_AGENT, CLAUDE_AGENT]);
 export function agentForProvider(id) { return AGENTS.find(agent => agent.id === id); }

package/dist/claude-local.js

@@ -115,7 +115,8 @@ export function createClaudeLocalProvider(options) {
             const network = options.getNetwork();
             lease = await (options.ports?.lease ?? openEmployeeLease)({ closeDiagnostics, getConnect: () => options.getConnect(), getNetwork: options.getNetwork, readWorkspace: () => options.readWorkspace(request.sessionId), host: target, sessionId: request.sessionId, control: async (_target, command, signal) => (await transport()).run(command, signal), detail: unscoped }, request.signal);
             const shell = (options.ports?.shell ?? createEmployeeShell)({ closeDiagnostics, target: lease.target, sshArgs: lease.sshArgs, maxBytes: maximum, killGraceMs: grace, attach: async (spec) => (await transport()).attach([spec.command, ...spec.args].map(shellQuote).join(' ')) });
-            mcp = await (options.ports?.mcp ?? openEmployeeMcp)({ closeDiagnostics, lease, maxBytes: maximum, killGraceMs: grace, runShell: shell, activeSignal: () => entry?.active?.signal, captureDetail: () => { const sink = entry?.active?.details; if (!sink)
+            request.toolBridge?.enable(event => details.record(event));
+            mcp = await (options.ports?.mcp ?? openEmployeeMcp)({ bridge: request.toolBridge, closeDiagnostics, lease, maxBytes: maximum, killGraceMs: grace, runShell: shell, activeSignal: () => entry?.active?.signal, captureDetail: () => { const sink = entry?.active?.details; if (!sink)
                     throw failure('EMPLOYEE_NO_ACTIVE_TURN'); return observation => sink.record(observation); }, detail: unscoped });
             entry = { runtime: undefined, scope, lease, details, request };
             const row = entry;

package/dist/employee-mcp.d.ts

@@ -1,3 +1,4 @@
+import type { ToolBridge } from './toolbridge.ts';
 import { type CloseCause, type CloseDiagnostics, type CloseObserver } from './close-diagnostics.ts';
 import { type Socket } from 'node:net';
 import { type JSONRPCMessage, type Tool } from '@modelcontextprotocol/sdk/types.js';
@@ -28,6 +29,7 @@ export declare class EmployeeSocketTransport implements Transport {
     close(cause?: CloseCause): Promise<void>;
 }
 export interface EmployeeMcpOptions {
+    bridge?: ToolBridge;
     closeDiagnostics?: CloseDiagnostics;
     lease: EmployeeLease;
     maxBytes: number;

package/dist/employee-mcp.js

@@ -136,12 +136,14 @@ export async function openEmployeeMcp(options) {
         const mcp = new Server({ name: 'ai-workbench-employee', version: '0.8.14' }, { capabilities: { tools: {} } }), transport = new EmployeeSocketTransport(socket, options.maxBytes, observeConnection);
         clients.add(mcp);
         transports.add(transport);
-        mcp.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: EMPLOYEE_MCP_TOOLS }));
+        mcp.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: [...EMPLOYEE_MCP_TOOLS, ...options.bridge?.tools ?? []] }));
         mcp.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
             const active = options.activeSignal();
             if (!active || active.aborted)
                 return { isError: true, content: [{ type: 'text', text: 'EMPLOYEE_NO_ACTIVE_TURN：当前没有已接纳的用户轮次，本机工具未执行。' }] };
             const signal = AbortSignal.any([active, extra.signal, transport.signal, options.lease.signal]);
+            if (options.bridge?.isBridge(request.params.name))
+                return options.bridge.call(request.params.name, request.params.arguments ?? {}, signal);
             let sink;
             try {
                 sink = options.captureDetail?.() ?? options.detail;

package/dist/index.d.ts

@@ -57,6 +57,7 @@ export declare class CodexRemoteAdapter extends LlmAdapter {
     private readonly directory?;
     private readonly preflightDiagnostics?;
     private readonly permissions?;
+    private bridgeLoop;
     private config;
     private sessions;
     private turns;
@@ -65,7 +66,8 @@ export declare class CodexRemoteAdapter extends LlmAdapter {
     private detached;
     private modelPresentation;
     private employeeNoticeSessions;
-    constructor(config: PluginConfig | (() => PluginConfig), resolveRuntime: RuntimeProvider, approve?: InvocationApproval | undefined, providerName?: () => string, agent?: AgentDefinition, readImage?: ImageReader | undefined, reportLoginFailure?: LoginFailureReporter | undefined, directory?: ModelDirectory | undefined, preflightDiagnostics?: PreflightDiagnostics | undefined, permissions?: PermissionSource | undefined);
+    private pendingEmployeeNotices;
+    constructor(config: PluginConfig | (() => PluginConfig), resolveRuntime: RuntimeProvider, approve?: InvocationApproval | undefined, providerName?: () => string, agent?: AgentDefinition, readImage?: ImageReader | undefined, reportLoginFailure?: LoginFailureReporter | undefined, directory?: ModelDirectory | undefined, preflightDiagnostics?: PreflightDiagnostics | undefined, permissions?: PermissionSource | undefined, bridgeStopped?: (sessionId: string, notice: string) => void);
     providerInfo(provider: string): {
         id: string;
         name: string;
@@ -88,6 +90,8 @@ export declare class CodexRemoteAdapter extends LlmAdapter {
         jitterRatio: number;
     };
     private cleanupRuntime;
+    completeDshTurn(sessionId: string, messages: GenerateOptions['messages']): Promise<void>;
+    hasBridgeSession(sessionId: string): boolean;
     disposeSession(sessionId: string): Promise<void>;
     detachSession(sessionId: string): Promise<void>;
     dispose(): Promise<void>;
@@ -97,7 +101,7 @@ export declare class CodexRemoteAdapter extends LlmAdapter {
 /** One official registration owns both routes, preserving opaque replay ownership. */
 export declare class RemoteAgentsAdapter extends LlmAdapter {
     private adapters;
-    constructor(config: () => PluginConfig, makeRuntime: (agent: AgentDefinition) => RuntimeProvider, approve: InvocationApproval, nameFor: (agent: AgentDefinition) => string, readImage?: ImageReader, reportLoginFailure?: LoginFailureReporter, directory?: ModelDirectory, preflightDiagnostics?: PreflightDiagnostics, permissions?: PermissionSource);
+    constructor(config: () => PluginConfig, makeRuntime: (agent: AgentDefinition) => RuntimeProvider, approve: InvocationApproval, nameFor: (agent: AgentDefinition) => string, readImage?: ImageReader, reportLoginFailure?: LoginFailureReporter, directory?: ModelDirectory, preflightDiagnostics?: PreflightDiagnostics, permissions?: PermissionSource, bridgeStopped?: (sessionId: string, notice: string) => void);
     private adapter;
     providerInfo(provider: string): {
         id: string;
@@ -108,8 +112,8 @@ export declare class RemoteAgentsAdapter extends LlmAdapter {
     })[]>;
     resolveModel(provider: string, model: string, signal?: AbortSignal): Promise<LlmResolvedModelInfo>;
     prepareCall(provider: string, model: string, signal?: AbortSignal): Promise<{
-        model: LlmResolvedModelInfo;
         stream: (options: GenerateOptions) => AsyncGenerator<StreamChunk, any, any>;
+        model: LlmResolvedModelInfo;
     }>;
     providerRetryPolicy(): {
         mode: "normal";
@@ -120,6 +124,7 @@ export declare class RemoteAgentsAdapter extends LlmAdapter {
         jitterRatio: number;
     };
     stream(options: GenerateOptions): AsyncGenerator<StreamChunk, any, any>;
+    completeDshTurn(sessionId: string, messages: GenerateOptions['messages']): Promise<void>;
     disposeSession(sessionId: string): Promise<void>;
     detachSession(sessionId: string): Promise<void>;
     dispose(): Promise<void>;

package/dist/index.js

@@ -1,7 +1,10 @@
+import { ToolBridgeLoop } from "./toolbridge-loop.js";
+import { openToolBridgeMcp, TOOLBRIDGE_NOTICE } from "./toolbridge.js";
 import { connectNeedMessage } from "./connect-need.js";
 import { CloseDiagnostics, withFirstFailureEvidence, failureEvidenceSummary, closeCode } from "./close-diagnostics.js";
 import { withRemoteFailureEvidence } from "./failure-evidence.js";
 import { SessionId } from '@deepseek-ai/dsh-session';
+import { createAssistantMessage } from '@deepseek-ai/dsh-llm';
 import Schema from '@deepseek-ai/schemastery';
 import { LlmAdapter, LlmError } from '@deepseek-ai/dsh-llm';
 import { createHash } from 'node:crypto';
@@ -91,6 +94,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
     directory;
     preflightDiagnostics;
     permissions;
+    bridgeLoop;
     config;
     sessions = new Map();
     turns = new Map();
@@ -99,7 +103,8 @@ export class CodexRemoteAdapter extends LlmAdapter {
     detached = new Set();
     modelPresentation = new ModelPresentation();
     employeeNoticeSessions = new Set();
-    constructor(config, resolveRuntime, approve, providerName = () => CODEX_AGENT.name.zh, agent = CODEX_AGENT, readImage, reportLoginFailure, directory, preflightDiagnostics, permissions) {
+    pendingEmployeeNotices = new Set();
+    constructor(config, resolveRuntime, approve, providerName = () => CODEX_AGENT.name.zh, agent = CODEX_AGENT, readImage, reportLoginFailure, directory, preflightDiagnostics, permissions, bridgeStopped) {
         super();
         this.resolveRuntime = resolveRuntime;
         this.approve = approve;
@@ -110,6 +115,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
         this.directory = directory;
         this.preflightDiagnostics = preflightDiagnostics;
         this.permissions = permissions;
+        this.bridgeLoop = new ToolBridgeLoop(readImage, bridgeStopped);
         this.config = typeof config === 'function' ? config : () => config;
     }
     providerInfo(provider) { return { id: provider, name: this.providerName() }; }
@@ -156,7 +162,10 @@ export class CodexRemoteAdapter extends LlmAdapter {
         void Promise.resolve().then(() => runtime.dispose?.(cause)).catch(() => console.warn('[remote-agent] 旧主机会话暂未清理，将由主机自动回收'));
         return Promise.resolve();
     }
+    completeDshTurn(sessionId, messages) { this.sessions.get(sessionId)?.runtime.execution?.endTurn(); return this.bridgeLoop.conclude(sessionId, messages); }
+    hasBridgeSession(sessionId) { return this.bridgeLoop.active(sessionId); }
     async disposeSession(sessionId) {
+        await this.bridgeLoop.cancel(sessionId);
         this.turns.get(sessionId)?.abort();
         const current = this.sessions.get(sessionId);
         if (!current)
@@ -166,6 +175,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
         await this.cleanupRuntime(current.runtime);
     }
     async detachSession(sessionId) {
+        await this.bridgeLoop.cancel(sessionId);
         const current = this.sessions.get(sessionId), turn = this.turns.get(sessionId);
         if (!current && !turn)
             return;
@@ -188,8 +198,10 @@ export class CodexRemoteAdapter extends LlmAdapter {
         for (const live of this.sessions.values())
             live.runtime.closeDiagnostics?.record({ layer: 'adapter', initiator: 'adapter.dispose', reason: 'PLUGIN_DISPOSED', action: 'dispose', changes: [{ field: 'adapter.shutting-down', before: this.shuttingDown, after: true }] });
         this.shuttingDown = true;
+        await this.bridgeLoop.dispose();
         this.modelPresentation.clear();
         this.employeeNoticeSessions.clear();
+        this.pendingEmployeeNotices.clear();
         const results = await Promise.allSettled([...new Set([...this.sessions.keys(), ...this.turns.keys()])].map(id => this.detachSession(id)));
         this.lifetime.abort();
         const failure = results.find(result => result.status === 'rejected');
@@ -197,9 +209,15 @@ export class CodexRemoteAdapter extends LlmAdapter {
             throw failure.reason;
     }
     async *stream(options) {
-        let promptDispatched = false;
+        let promptDispatched = !!options.sessionId && (this.sessions.get(options.sessionId)?.session.promptDispatchCount ?? 0) > 0;
         try {
-            yield* this.generate(options, () => { promptDispatched = true; });
+            for await (const chunk of this.bridgeLoop.stream(options, (o, b) => this.generate(o, () => { promptDispatched = true; }, b))) {
+                if (options.sessionId && this.pendingEmployeeNotices.has(options.sessionId) && chunk.type === 'text-delta' && chunk.text.startsWith(EMPLOYEE_EXECUTION_NOTICE)) {
+                    this.employeeNoticeSessions.add(options.sessionId);
+                    this.pendingEmployeeNotices.delete(options.sessionId);
+                }
+                yield chunk;
+            }
         }
         catch (error) {
             if (error instanceof ModelConfigurationError)
@@ -223,8 +241,12 @@ export class CodexRemoteAdapter extends LlmAdapter {
             }
             throw new LlmError(employeeFailure('TURN_FAILED', this.agent.loginProvider, promptDispatched), 'TURN_FAILED', { cause: error });
         }
+        finally {
+            if (options.sessionId)
+                this.pendingEmployeeNotices.delete(options.sessionId);
+        }
     }
-    async *generate(original, onPromptDispatched) {
+    async *generate(original, onPromptDispatched, bridge) {
         if (original.purpose)
             throw new NeedError('PURPOSE_UNSUPPORTED', '此远程模型不处理后台标题或上下文整理请求，未发送模型请求', '独立的后台请求能力');
         if (this.lifetime.signal.aborted)
@@ -238,6 +260,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
         const signal = AbortSignal.any([this.lifetime.signal, turn.signal, ...(original.signal ? [original.signal] : [])]);
         const options = { ...original, signal };
         const abortOffs = [];
+        let bridgeMcp;
         let request;
         let earlyStage = 'input-prepare';
         let runtime;
@@ -261,7 +284,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 runtime.details.record(entry); };
         const config = this.config();
         const mode = 'session';
-        request = { sessionId: options.sessionId, mode: mode ?? 'session', signal };
+        request = { sessionId: options.sessionId, mode: mode ?? 'session', signal, toolBridge: bridge };
         const observeAbort = (source, initiator, reason) => { if (!source)
             return; const record = () => { (request?.closeDiagnostics ?? runtime?.closeDiagnostics)?.record({ layer: 'adapter', initiator, reason, action: 'abort', changes: [{ field: 'adapter.turn-aborted', before: false, after: source.aborted }] }); }; source.addEventListener('abort', record, { once: true }); abortOffs.push(() => source.removeEventListener('abort', record)); };
         observeAbort(original.signal, 'signal.caller', 'CALLER_ABORTED');
@@ -329,6 +352,10 @@ export class CodexRemoteAdapter extends LlmAdapter {
             if (runtime.hostWorkspace && mode === 'session' && Buffer.byteLength(JSON.stringify({ prompt: input.prompt, systemPrompt: input.systemPrompt }), 'utf8') > config.acpMaxMessageBytes)
                 throw new NeedError('ACP_MESSAGE_TOO_LARGE', '本轮输入超过已设置的会话消息容量，未截断或发送', '管理员调整acpMaxMessageBytes');
             const details = runtime.details ?? await createRemoteDetails({ warn: line => console.warn(line) }).open({ sessionId: options.sessionId ?? 'unscoped', provider: this.agent.loginProvider, identity: runtime.identity, connection: runtime.connection });
+            if (bridge && runtime.employeeExecutionMeta && !runtime.hostWorkspace && bridge.table.size) {
+                bridge.enable(event => details.record(event));
+                bridgeMcp = await openToolBridgeMcp(bridge, config.acpMaxMessageBytes);
+            }
             recordInformation();
             request.recordEarlyFailure = undefined;
             if (input.historyTransfer)
@@ -339,16 +366,22 @@ export class CodexRemoteAdapter extends LlmAdapter {
             activeMapper = mapper;
             let id;
             let stop;
+            const pointerRuntime = runtime;
+            const makePointer = (nativeId) => ({ ...(pointerRuntime.hostSource ? { hostSource: pointerRuntime.hostSource } : {}), ...(modelConfiguration ? { modelConfiguration } : {}), version: 2, agent: this.agent.id, contextSha256, ...(mode === 'session' ? { usageSnapshot: mapper.usageSnapshot } : {}), ...(options.sessionId ? { dshSessionId: options.sessionId } : {}), identity: pointerRuntime.identity, cwd: pointerRuntime.cwd, sessionId: nativeId, ...(pointerRuntime.binding ? { bindingId: pointerRuntime.binding.bindingId, workspaceId: pointerRuntime.binding.workspaceId } : {}) });
             if (runtime.employeePresentation)
                 details.record({ kind: 'session', severity: 'warning', code: 'EMPLOYEE_EXECUTION_SCOPE', summary: runtime.employeePresentation, payload: { source: 'local' } });
             if (runtime.execution)
                 details.record({ kind: 'session', severity: 'warning', code: 'CLAUDE_EMPLOYEE_SCOPE', summary: runtime.execution.notice, payload: runtime.execution.scope });
             if ((runtime.employeePresentation || runtime.execution) && !employeeNoticeShown) {
-                for (const chunk of mapper.text(EMPLOYEE_EXECUTION_NOTICE + '\n\n')) {
+                for (const chunk of mapper.text(EMPLOYEE_EXECUTION_NOTICE + (bridge?.enabled ? '\n\n' + TOOLBRIDGE_NOTICE : '') + '\n\n')) {
                     if (chunk.type === 'text-delta') {
                         employeeNoticeShown = true;
-                        if (key)
-                            this.employeeNoticeSessions.add(key);
+                        if (key) {
+                            if (bridge)
+                                this.pendingEmployeeNotices.add(key);
+                            else
+                                this.employeeNoticeSessions.add(key);
+                        }
                     }
                     yield chunk;
                 }
@@ -363,6 +396,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 let failure;
                 const push = (chunks) => { queue.push(...chunks); wake?.(); wake = undefined; };
                 let promptPermit;
+                let confirmedNativeMode;
                 const hooks = { closeDiagnostics: runtime.closeDiagnostics, broker: runtime.broker, sessionOwnership: runtime.sessionOwnership, employeeExecution: runtime.employeeExecution, ...this.permissions ? { promptGuard: () => {
                             if (!promptPermit)
                                 throw new NeedError('PERMISSION_POLICY_CHANGED', '当前权限没有保持确认，本次没有继续派发。', '当前权限代次和同值回执');
@@ -373,6 +407,17 @@ export class CodexRemoteAdapter extends LlmAdapter {
                         } } : {}, approve: async (permission, approvalSignal) => {
                         const execution = runtime.execution;
                         const toolName = permission.toolCall.name ?? permission.toolCall._meta?.claudeCode?.toolName;
+                        if (execution && bridge?.enabled && bridge.isBridge(toolName)) {
+                            const current = this.permissions ? permissionMode('claude', this.permissions.read(options.sessionId)) : undefined;
+                            if (current === 'plan') {
+                                details.record({ kind: 'tool', severity: 'info', code: 'TOOLBRIDGE_PLAN_PERMISSION_REJECTED', summary: '本轮为plan档，桥接原生权限请求未放行。' });
+                                return 'rejected';
+                            }
+                            if (current === 'default' && confirmedNativeMode === 'default') {
+                                details.record({ kind: 'tool', severity: 'info', code: 'TOOLBRIDGE_NATIVE_PERMISSION_ANSWERED', summary: '已确认桥接工具仅在DSH审批，原生请求自动答复一次。', payload: { tool: toolName } });
+                                return 'allowed-once';
+                            }
+                        }
                         if (execution) {
                             if (toolName && ['Agent', 'Task', 'TaskOutput', 'TaskStop', 'Read', 'Write', 'Edit', 'Glob', 'Grep', 'Bash'].includes(toolName)) {
                                 details.record({ kind: 'need', severity: 'warning', code: 'CLAUDE_HOST_TOOL_UNSUPPORTED', summary: '这类原生调用没有经过员工端别名，本机来源不支持；本次审批已取消', payload: { operation: toolName } });
@@ -383,6 +428,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
                         const answer = await this.approve?.(permission, approvalSignal, options, execution && toolName?.startsWith('mcp__employee__') ? 'employee-local' : undefined, runtime.hostWorkspace) ?? 'unavailable';
                         return answer;
                     }, onEmployeeNotice: notice => push(mapper.text(notice + '\n\n')), onUpdate: notification => { try {
+                        bridge?.observe(notification.update);
                         push(mapper.acp(notification.update));
                     }
                     catch (error) {
@@ -412,6 +458,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
                         const remoteMode = permissionMode(this.agent.loginProvider, policy);
                         details.record({ kind: 'session', severity: 'info', code: 'DSH_PERMISSION_POLICY', summary: '按DSH当前会话权限同步远程工具；不会把关闭审批提示解释为自动批准。', payload: { ...policy, remoteMode } });
                         await session.selectPermissionMode(remoteMode, modelSignal, this.agent.loginProvider);
+                        confirmedNativeMode = remoteMode;
                         permissionKey = next;
                     });
                 };
@@ -437,7 +484,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 const task = (async () => {
                     remoteAttempted = true;
                     try {
-                        await session.start(runtime.execution?.hostCwd ?? runtime.cwd, previous?.sessionId, modelSignal, { systemPrompt: input.systemPrompt, ...(runtime.execution ? { employeeRouting: runtime.execution.routing } : {}), ...(codex ? { codexNewSessionOnly: true } : {}), ...(runtime.employeeExecutionMeta ? { employeeExecution: runtime.employeeExecutionMeta } : {}) }, input.prompt);
+                        await session.start(runtime.execution?.hostCwd ?? runtime.cwd, previous?.sessionId, modelSignal, { systemPrompt: input.systemPrompt, ...(bridgeMcp ? { toolBridgeServers: bridgeMcp.mcpServers } : {}), ...(runtime.execution ? { employeeRouting: runtime.execution.routing } : {}), ...(codex ? { codexNewSessionOnly: true } : {}), ...(runtime.employeeExecutionMeta ? { employeeExecution: runtime.employeeExecutionMeta } : {}) }, input.prompt);
                     }
                     catch (error) {
                         details.record({ kind: 'session', severity: 'action-required', code: 'SESSION_START_FAILED', summary: '远端会话建立或恢复失败，本轮用户输入未发送。', payload: { operation: previous ? 'resume-or-load' : 'new', reason: closeCode(error, 'ACP_FAILED'), promptDispatched: false } });
@@ -488,9 +535,14 @@ export class CodexRemoteAdapter extends LlmAdapter {
                     recordInformation();
                     details.beginTurn(runtime.detailContext?.() ?? { turn: null, step: null });
                     await runtime.execution?.beginTurn(modelSignal);
+                    if (bridge?.enabled)
+                        bridge.replayState = { response: makePointer(session.id) };
+                    bridge?.begin(modelSignal);
                     id = session.id;
                     try {
                         const result = await dispatchPrompt();
+                        if (bridge?.unsettled)
+                            bridge.abandon('HOST_PROMPT_ENDED_WITH_PENDING_CALL');
                         permissionOff?.();
                         permissionOff = undefined;
                         await permissionTail;
@@ -499,6 +551,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
                     finally {
                         permissionOff?.();
                         permissionOff = undefined;
+                        bridge?.end();
                         runtime.execution?.endTurn();
                         details.endTurn();
                     }
@@ -533,13 +586,15 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 }
             }
             yield* mapper.flush();
-            const pointer = { ...(runtime.hostSource ? { hostSource: runtime.hostSource } : {}), ...(modelConfiguration ? { modelConfiguration } : {}), version: 2, agent: this.agent.id, contextSha256, ...(mode === 'session' ? { usageSnapshot: mapper.usageSnapshot } : {}), ...(options.sessionId ? { dshSessionId: options.sessionId } : {}), identity: runtime.identity, cwd: runtime.cwd, sessionId: id, ...(runtime.binding ? { bindingId: runtime.binding.bindingId, workspaceId: runtime.binding.workspaceId } : {}) };
+            const pointer = makePointer(id);
             succeeded = true;
             yield { type: 'finish', reason: { kind: stop === 'max_tokens' || stop === 'max_turn_requests' ? 'max-tokens' : 'stop' }, replayState: { response: pointer } };
         }
         catch (error) {
             if (session && session.promptDispatchCount > promptBaseline)
                 onPromptDispatched();
+            if (bridge?.unsettled && !signal.aborted)
+                bridge.abandon('HOST_PROMPT_FAILED');
             turnFailure = error;
             runtime?.closeDiagnostics?.record({ layer: 'adapter', initiator: 'adapter.turn-failure', reason: closeCode(error, signal.aborted ? 'ABORTED' : 'TURN_FAILED'), action: 'failure' });
             recordInformation();
@@ -559,6 +614,8 @@ export class CodexRemoteAdapter extends LlmAdapter {
             for (const off of abortOffs)
                 off();
             runtime?.execution?.endTurn();
+            if (bridgeMcp)
+                await bridgeMcp.close();
             if (runtime) {
                 session?.close({ layer: 'adapter', initiator: 'adapter.turn-finally', reason: succeeded ? 'TURN_FINISHED' : 'TURN_FAILED', action: 'close' });
                 if (key && this.sessions.get(key) === live)
@@ -575,16 +632,25 @@ export class CodexRemoteAdapter extends LlmAdapter {
 /** One official registration owns both routes, preserving opaque replay ownership. */
 export class RemoteAgentsAdapter extends LlmAdapter {
     adapters = new Map();
-    constructor(config, makeRuntime, approve, nameFor, readImage, reportLoginFailure, directory, preflightDiagnostics, permissions) { super(); for (const agent of AGENTS)
-        this.adapters.set(agent.id, new CodexRemoteAdapter(config, makeRuntime(agent), approve, () => nameFor(agent), agent, readImage, reportLoginFailure, directory, preflightDiagnostics, permissions)); }
+    constructor(config, makeRuntime, approve, nameFor, readImage, reportLoginFailure, directory, preflightDiagnostics, permissions, bridgeStopped) { super(); for (const agent of AGENTS)
+        this.adapters.set(agent.id, new CodexRemoteAdapter(config, makeRuntime(agent), approve, () => nameFor(agent), agent, readImage, reportLoginFailure, directory, preflightDiagnostics, permissions, bridgeStopped)); }
     adapter(provider) { const adapter = this.adapters.get(provider); if (!adapter)
         throw new LlmError('远程模型未注册', 'PROVIDER_NOT_FOUND'); return adapter; }
     providerInfo(provider) { return this.adapter(provider).providerInfo(provider); }
     listModels(provider) { return this.adapter(provider).listModels(provider); }
     resolveModel(provider, model, signal) { return this.adapter(provider).resolveModel(provider, model, signal); }
-    prepareCall(provider, model, signal) { return this.adapter(provider).prepareCall(provider, model, signal); }
+    async prepareCall(provider, model, signal) { const prepared = await this.adapter(provider).prepareCall(provider, model, signal); return { ...prepared, stream: (options) => this.stream(options) }; }
     providerRetryPolicy() { return { mode: 'normal', maxRetries: 0, retryableCodes: [], initialDelayMs: 0, maxDelayMs: 0, jitterRatio: 0 }; }
-    stream(options) { return this.adapter(options.provider).stream(options); }
+    stream(options) {
+        if (options.sessionId)
+            for (const [provider, adapter] of this.adapters)
+                if (provider !== options.provider && adapter.hasBridgeSession(options.sessionId)) {
+                    void adapter.disposeSession(options.sessionId);
+                    throw new LlmError('原主机还在等待DSH工具结果，切换助手已停止原轮次；请核对已执行的工具后重新发送，结果不会重放。', 'TOOLBRIDGE_ROUTE_CHANGED');
+                }
+        return this.adapter(options.provider).stream(options);
+    }
+    async completeDshTurn(sessionId, messages) { await Promise.all([...this.adapters.values()].map(adapter => adapter.completeDshTurn(sessionId, messages))); }
     async disposeSession(sessionId) { await Promise.all([...this.adapters.values()].map(adapter => adapter.disposeSession(sessionId))); }
     async detachSession(sessionId) { await Promise.all([...this.adapters.values()].map(adapter => adapter.detachSession(sessionId))); }
     async dispose() { await Promise.all([...this.adapters.values()].map(adapter => adapter.dispose())); }
@@ -688,7 +754,33 @@ export function apply(ctx, live) {
                 step = null;
         }
         return managerForProfile().recordLoginFailure({ sessionId, code, diagnostic, context: { turn, step } });
-    }, modelDirectory, preflightDiagnostics, dshPermissionSource(ctx));
+    }, modelDirectory, preflightDiagnostics, dshPermissionSource(ctx), (sessionId, notice) => {
+        const agent = ctx.get('agents')?.get(SessionId(sessionId));
+        if (!agent)
+            return;
+        let turn = null, step = null;
+        for (const e of agent.session.snapshotEvents()) {
+            if (e.type === 'turn/start') {
+                turn = e.data.turn;
+                step = null;
+            }
+            else if (e.type === 'turn/end') {
+                turn = null;
+                step = null;
+            }
+            else if (e.type === 'step/start')
+                step = e.data.step;
+            else if (e.type === 'step/end')
+                step = null;
+        }
+        if (turn !== null && step !== null)
+            agent.session.append('assistant/message', { turn, step, message: createAssistantMessage({ content: [{ type: 'text', text: notice }], source: { provider: 'ai-workbench-toolbridge', model: 'notice' } }), stream: [] }, { surfaceOp: 'append' });
+        agent.cancel({ kind: 'hook', reason: 'DSH_BRIDGE_CALL_ABANDONED_BY_HOST' }, { keepInbox: true });
+    });
+    ctx.on('session/event', (session, event) => { if (event.type === 'turn/end') {
+        const operation = event.data.reason.kind === 'completed' ? adapter.completeDshTurn(session.id, session.deriveMessages()) : adapter.disposeSession(session.id);
+        void operation.catch(() => ctx.logger('remote-agent').warn('TOOLBRIDGE_RESULT_DELIVERY_UNCONFIRMED'));
+    } });
     const ids = AGENTS.map(agent => agent.id);
     const entries = () => AGENTS.map(agent => ({ provider: agent.id, displayName: agent.name[language], settingsNs: actualSettingsNamespace ?? settingsNamespace, settingsPath: [] }));
     const directory = ctx.llm.registerConfigurableProviders(entries());

package/dist/provider.d.ts

@@ -1,3 +1,4 @@
+import type { ToolBridge } from './toolbridge.ts';
 import { type SessionSource } from './host-workspace.ts';
 import type { CloseCause, CloseDiagnostics } from './close-diagnostics.ts';
 import type { AgentApp } from '@agentclientprotocol/sdk';
@@ -66,6 +67,7 @@ export interface Runtime {
     closeDiagnostics?: CloseDiagnostics;
 }
 export interface RuntimeRequest extends Invocation {
+    toolBridge?: ToolBridge;
     workspaceSource?: SessionSource;
     hostSource?: Extract<SessionSource, {
         source: 'host';

package/dist/toolbridge-loop.d.ts

@@ -0,0 +1,19 @@
+import { type GenerateOptions, type StreamChunk } from '@deepseek-ai/dsh-llm';
+import { ToolBridge } from './toolbridge.ts';
+import type { ImageReader } from './input.ts';
+type Producer = (options: GenerateOptions, bridge: ToolBridge) => AsyncGenerator<StreamChunk>;
+/** Owns the original prompt across official generate/tool/generate steps. No tool execution. */
+export declare class ToolBridgeLoop {
+    private readImage?;
+    private stopped?;
+    private runs;
+    private concluding;
+    constructor(readImage?: ImageReader | undefined, stopped?: ((sessionId: string, notice: string) => void) | undefined);
+    private launch;
+    conclude(id: string, messages: GenerateOptions['messages']): Promise<void>;
+    active(id: string): boolean;
+    cancel(id: string): void;
+    dispose(): Promise<void>;
+    stream(options: GenerateOptions, producer: Producer): AsyncGenerator<StreamChunk>;
+}
+export {};

package/dist/toolbridge-loop.js

@@ -0,0 +1,251 @@
+import { createAssistantMessage } from '@deepseek-ai/dsh-llm';
+import { ToolBridge } from "./toolbridge.js";
+import { NeedError } from "./remote.js";
+/** Rebase native text blocks at each DSH step; a parked stream must end all open blocks. */
+class Projection {
+    blocks = new Map();
+    next = 0;
+    chunks(chunk) {
+        if (chunk.type === 'block-start') {
+            if (chunk.blockType !== 'text' && chunk.blockType !== 'reasoning')
+                throw Error('TOOLBRIDGE_NATIVE_BLOCK_UNSUPPORTED');
+            this.blocks.set(chunk.index, { type: chunk.blockType, text: '' });
+            return [];
+        }
+        if (chunk.type === 'text-delta' || chunk.type === 'reasoning-delta') {
+            const block = this.blocks.get(chunk.index);
+            if (!block)
+                throw Error('TOOLBRIDGE_NATIVE_BLOCK_MISSING');
+            const result = [];
+            if (block.index === undefined) {
+                block.index = this.next++;
+                result.push({ type: 'block-start', index: block.index, blockType: block.type });
+            }
+            const text = chunk.type === 'text-delta' ? chunk.text : chunk.text;
+            block.text += text;
+            result.push({ ...chunk, index: block.index });
+            return result;
+        }
+        if (chunk.type === 'block-end') {
+            const block = this.blocks.get(chunk.index);
+            this.blocks.delete(chunk.index);
+            return block?.index === undefined ? [] : [{ type: 'block-end', index: block.index, block: { type: block.type, text: block.text } }];
+        }
+        return [chunk];
+    }
+    park() { const chunks = []; for (const block of this.blocks.values())
+        if (block.index !== undefined) {
+            chunks.push({ type: 'block-end', index: block.index, block: { type: block.type, text: block.text } });
+            block.index = undefined;
+            block.text = '';
+        } return chunks; }
+}
+/** Owns the original prompt across official generate/tool/generate steps. No tool execution. */
+export class ToolBridgeLoop {
+    readImage;
+    stopped;
+    runs = new Map();
+    concluding = new Map();
+    constructor(readImage, stopped) {
+        this.readImage = readImage;
+        this.stopped = stopped;
+    }
+    launch(options, producer) {
+        const controller = new AbortController(), bridge = new ToolBridge(options, this.readImage);
+        const run = { bridge, controller, options, latest: options, queue: [], wake: Promise.withResolvers(), done: false, task: undefined, seen: new Set(options.messages.flatMap(m => 'id' in m && typeof m.id === 'string' ? [m.id] : [])), deferred: [], text: '', reading: false, projection: new Projection(), off: () => { } };
+        const signal = AbortSignal.any([controller.signal, ...options.signal ? [options.signal] : []]);
+        const changed = () => { run.wake.resolve(); };
+        bridge.changed = changed;
+        bridge.onAbandon = notice => { controller.abort(); if (options.sessionId)
+            this.stopped?.(options.sessionId, notice); };
+        const abort = () => { bridge.close(); changed(); };
+        signal.addEventListener('abort', abort, { once: true });
+        run.off = () => signal.removeEventListener('abort', abort);
+        run.task = (async () => {
+            try {
+                for await (const chunk of producer({ ...options, signal }, bridge)) {
+                    if (chunk.type === 'finish') {
+                        run.finish = chunk;
+                        continue;
+                    }
+                    if (chunk.type === 'text-delta')
+                        run.text += chunk.text;
+                    run.queue.push(chunk);
+                    changed();
+                }
+                if (bridge.unsettled)
+                    bridge.abandon('HOST_PROMPT_ENDED_WITH_PENDING_CALL');
+            }
+            catch (error) {
+                run.error = error;
+                if (bridge.unsettled)
+                    bridge.abandon('HOST_PROMPT_FAILED');
+            }
+            finally {
+                run.done = true;
+                changed();
+            }
+        })();
+        return run;
+    }
+    async conclude(id, messages) {
+        const existing = this.concluding.get(id);
+        if (existing)
+            return existing.flight;
+        const run = this.runs.get(id);
+        if (!run || !run.bridge.enabled || !run.bridge.unsettled) {
+            this.cancel(id);
+            return;
+        }
+        this.runs.delete(id);
+        run.bridge.beginConclude();
+        run.bridge.onConcludeAcknowledged = () => run.controller.abort();
+        const flight = (async () => {
+            try {
+                await run.bridge.results({ ...run.latest, messages, signal: run.controller.signal });
+                await run.task;
+                if (run.error && !run.bridge.concludeAcknowledged)
+                    throw run.error;
+            }
+            catch (error) {
+                run.bridge.close();
+                run.controller.abort();
+                throw error;
+            }
+            finally {
+                run.off();
+            }
+        })();
+        this.concluding.set(id, { run, flight });
+        void flight.then(() => { if (this.concluding.get(id)?.flight === flight)
+            this.concluding.delete(id); }, () => { });
+        await flight;
+    }
+    active(id) { return (this.runs.get(id)?.bridge.enabled ?? false) || this.concluding.has(id); }
+    cancel(id) {
+        const closing = this.concluding.get(id);
+        if (closing) {
+            this.concluding.delete(id);
+            closing.run.bridge.close();
+            closing.run.controller.abort();
+            closing.run.off();
+        }
+        const run = this.runs.get(id);
+        if (!run)
+            return;
+        this.runs.delete(id);
+        run.bridge.close();
+        run.controller.abort();
+        run.off();
+    }
+    async dispose() { for (const id of new Set([...this.runs.keys(), ...this.concluding.keys()]))
+        this.cancel(id); }
+    async *stream(options, producer) {
+        const key = options.sessionId ?? '';
+        const closing = this.concluding.get(key);
+        if (closing) {
+            let aborted;
+            try {
+                await Promise.race([closing.flight, ...(options.signal ? [new Promise((_r, reject) => { aborted = () => reject(new NeedError('ABORTED', '本轮等待已取消，尚未发送新输入。', '原主机prompt收尾')); options.signal.addEventListener('abort', aborted, { once: true }); if (options.signal.aborted)
+                            aborted(); })] : [])]);
+            }
+            catch (error) {
+                if (this.concluding.get(key) === closing)
+                    this.cancel(key);
+                else {
+                    closing.run.bridge.close();
+                    closing.run.controller.abort();
+                    closing.run.off();
+                }
+                throw error;
+            }
+            finally {
+                if (aborted)
+                    options.signal?.removeEventListener('abort', aborted);
+                if (this.concluding.get(key) === closing)
+                    this.concluding.delete(key);
+            }
+        }
+        let run = this.runs.get(key), boundary = false;
+        if (run?.reading)
+            throw new NeedError('TURN_BUSY', '工具桥仍在处理当前生成步骤。', '等待当前步骤结束');
+        if (!run) {
+            run = this.launch(options, producer);
+            if (key)
+                this.runs.set(key, run);
+        }
+        run.reading = true;
+        run.projection.next = 0;
+        try {
+            if (options.signal?.aborted)
+                throw new NeedError('ABORTED', '本轮已取消，工具结果没有重放。', '确认主机取消状态');
+            if (run.latest !== options) {
+                for (const m of options.messages)
+                    if (m.role === 'user' && 'source' in m && m.source?.kind === 'user' && 'id' in m && typeof m.id === 'string' && !run.seen.has(m.id)) {
+                        run.seen.add(m.id);
+                        run.deferred.push(m);
+                    }
+                run.latest = options;
+                await run.bridge.results(options);
+            }
+            for (;;) {
+                const wake = run.wake;
+                run.wake = Promise.withResolvers();
+                while (run.queue.length)
+                    yield* run.projection.chunks(run.queue.shift());
+                if (run.error)
+                    throw run.error;
+                if (run.bridge.pending.length && !run.done) {
+                    yield* run.projection.park();
+                    for (const p of run.bridge.pending) {
+                        p.exported = true;
+                        const index = run.projection.next++;
+                        yield { type: 'block-start', index, blockType: 'tool-call' };
+                        yield { type: 'tool-call-delta', index, id: p.block.id, name: p.block.name, argumentsDelta: p.block.arguments };
+                        yield { type: 'block-end', index, block: p.block };
+                    }
+                    boundary = true;
+                    yield { type: 'finish', reason: { kind: 'tool-calls' }, ...(run.bridge.replayState ? { replayState: run.bridge.replayState } : {}) };
+                    return;
+                }
+                if (run.done) {
+                    yield* run.projection.park();
+                    run.off();
+                    if (run.deferred.length) {
+                        const deferred = run.deferred, ids = new Set(deferred.flatMap(m => 'id' in m ? [m.id] : []));
+                        const last = createAssistantMessage({ content: run.text ? [{ type: 'text', text: run.text }] : [], source: { provider: run.options.provider, model: run.options.model, ...(run.finish?.replayState ? { replayState: { response: run.finish.replayState.response } } : {}) } });
+                        const next = { ...options, messages: [...run.latest.messages.filter(m => !('id' in m && ids.has(m.id))), last, ...deferred] };
+                        const nextIndex = run.projection.next;
+                        run.bridge.close();
+                        run = this.launch(next, producer);
+                        run.projection.next = nextIndex;
+                        run.reading = true;
+                        if (key)
+                            this.runs.set(key, run);
+                        continue;
+                    }
+                    if (key)
+                        this.runs.delete(key);
+                    run.bridge.close();
+                    boundary = true;
+                    yield run.finish ?? { type: 'finish', reason: { kind: 'stop' } };
+                    return;
+                }
+                if (options.signal?.aborted)
+                    throw new NeedError('ABORTED', '本轮已取消，工具结果没有重放。', '确认主机取消状态');
+                await Promise.race([wake.promise, run.wake.promise]);
+            }
+        }
+        finally {
+            run.reading = false;
+            if (!boundary || options.signal?.aborted) {
+                run.bridge.close();
+                run.controller.abort();
+                run.off();
+                if (key && this.runs.get(key) === run)
+                    this.runs.delete(key);
+                await run.task;
+            }
+        }
+    }
+}

package/dist/toolbridge-table.d.ts

@@ -0,0 +1,10 @@
+import type { ToolSchema } from '@deepseek-ai/dsh-llm';
+import type { Tool } from '@modelcontextprotocol/sdk/types.js';
+/** Fixed official tool names; no description heuristics or plugin-name branches. */
+export declare const TOOLBRIDGE_EXCLUDED: readonly ["read", "write", "edit", "read_image", "glob", "grep", "bash", "pwsh", "str_replace_editor", "job_output", "job_list", "job_kill", "load_workspace_dependencies", "terminal_open", "terminal_send", "terminal_read", "terminal_signal", "terminal_close", "terminal_list", "subagent", "list_subagent_models", "send_message", "interrupt_agent", "spawn_teammate", "list_agents", "wait_agent", "team_task_create", "team_task_list", "team_task_get", "team_task_update", "run_code"];
+export interface BridgeTool {
+    alias: string;
+    schema: ToolSchema;
+    wire: Tool;
+}
+export declare function bridgeTable(tools?: readonly ToolSchema[]): ReadonlyMap<string, BridgeTool>;

package/dist/toolbridge-table.js

@@ -0,0 +1,27 @@
+import { createHash } from 'node:crypto';
+import { NeedError } from "./remote.js";
+/** Fixed official tool names; no description heuristics or plugin-name branches. */
+export const TOOLBRIDGE_EXCLUDED = Object.freeze([
+    'read', 'write', 'edit', 'read_image', 'glob', 'grep', 'bash', 'pwsh', 'str_replace_editor',
+    'job_output', 'job_list', 'job_kill', 'load_workspace_dependencies',
+    'terminal_open', 'terminal_send', 'terminal_read', 'terminal_signal', 'terminal_close', 'terminal_list',
+    'subagent', 'list_subagent_models', 'send_message', 'interrupt_agent', 'spawn_teammate', 'list_agents', 'wait_agent',
+    'team_task_create', 'team_task_list', 'team_task_get', 'team_task_update', 'run_code',
+]);
+const excluded = new Set(TOOLBRIDGE_EXCLUDED);
+export function bridgeTable(tools = []) {
+    const table = new Map(), names = new Set();
+    for (const tool of tools) {
+        if (excluded.has(tool.name))
+            continue;
+        if (names.has(tool.name))
+            throw new NeedError('TOOLBRIDGE_TOOL_DUPLICATE', '当前工具表存在重名，工具桥未开始。', '官方唯一工具名称');
+        names.add(tool.name);
+        const alias = 'dsh_' + createHash('sha256').update(tool.name).digest('hex').slice(0, 32);
+        if (table.has(alias))
+            throw new NeedError('TOOLBRIDGE_NAME_COLLISION', '工具桥名称冲突，未执行。', '唯一工具桥名称');
+        const schema = structuredClone(tool);
+        table.set(alias, { alias, schema, wire: { name: alias, description: 'DSH工具 ' + schema.name + '：' + schema.description, inputSchema: structuredClone(schema.parameters) } });
+    }
+    return table;
+}

package/dist/toolbridge.d.ts

@@ -0,0 +1,114 @@
+import { type CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import type { GenerateOptions, ToolCallBlock } from '@deepseek-ai/dsh-llm';
+import type { SessionUpdate } from '@agentclientprotocol/sdk/unstable';
+import { type BridgeTool } from './toolbridge-table.ts';
+import type { ImageReader } from './input.ts';
+import type { DetailObservation } from './conversation-details.ts';
+export declare const TOOLBRIDGE_TIMEOUT_SECONDS = 1800;
+export declare const TOOLBRIDGE_NOTICE = "\u542B\u5DE5\u5177\u6865\uFF1A\u672C\u673A\u6587\u4EF6\u5939\u7684\u6269\u5C55\u5DE5\u5177\u7531DSH\u6267\u884C\u5E76\u6309\u5F53\u524D\u6743\u9650\u5BA1\u6279\uFF1B\u6587\u4EF6\u548C\u547D\u4EE4\u4FDD\u6301\u539F\u6267\u884C\u65B9\u5F0F\u3002\u5DE5\u5177\u8868\u5728\u65B0\u4E00\u8F6E\u4E3B\u673A\u8FDE\u63A5\u65F6\u66F4\u65B0\u3002";
+export declare const TOOLBRIDGE_ENDED = "\u4E3B\u673A\u5DF2\u7ED3\u675F\u8FD9\u6B21\u5DE5\u5177\u7B49\u5F85\uFF1B\u672C\u8F6E\u5DF2\u505C\u6B62\uFF0C\u8FDF\u5230\u7ED3\u679C\u4E0D\u4F1A\u4EA4\u56DE\uFF0C\u4E5F\u4E0D\u4F1A\u91CD\u65B0\u6267\u884C\u3002\u8BF7\u6838\u5BF9\u5DF2\u53D1\u751F\u7684\u64CD\u4F5C\u3002";
+interface Pending {
+    block: ToolCallBlock;
+    alias: string;
+    reply: ReturnType<typeof Promise.withResolvers<CallToolResult>>;
+    exported: boolean;
+    settled: boolean;
+    off(): void;
+}
+/** Only a protocol queue. Tool execution and authorization belong to DSH. */
+export declare class ToolBridge {
+    private options;
+    private readImage?;
+    readonly controller: AbortController;
+    private snapshot?;
+    get table(): ReadonlyMap<string, BridgeTool>;
+    readonly calls: Map<string, Pending>;
+    enabled: boolean;
+    ended: boolean;
+    notice?: string;
+    replayState?: {
+        response: unknown;
+    };
+    localTurnEnded: boolean;
+    concludeAcknowledged: boolean;
+    onConcludeAcknowledged: () => void;
+    private nativeCompleted;
+    private nativeTerminated;
+    private concludeNative;
+    beginConclude(): void;
+    private active?;
+    begin(signal: AbortSignal): void;
+    end(): void;
+    changed: () => void;
+    record: (event: DetailObservation) => void;
+    onAbandon: (notice: string) => void;
+    private nativeBridgeIds;
+    constructor(options: GenerateOptions, readImage?: ImageReader | undefined);
+    enable(record: (event: DetailObservation) => void): void;
+    get tools(): {
+        inputSchema: {
+            [x: string]: unknown;
+            type: "object";
+            properties?: {
+                [x: string]: object;
+            } | undefined;
+            required?: string[] | undefined;
+        };
+        name: string;
+        description?: string | undefined;
+        outputSchema?: {
+            [x: string]: unknown;
+            type: "object";
+            properties?: {
+                [x: string]: object;
+            } | undefined;
+            required?: string[] | undefined;
+        } | undefined;
+        annotations?: {
+            title?: string | undefined;
+            readOnlyHint?: boolean | undefined;
+            destructiveHint?: boolean | undefined;
+            idempotentHint?: boolean | undefined;
+            openWorldHint?: boolean | undefined;
+        } | undefined;
+        execution?: {
+            taskSupport?: "optional" | "required" | "forbidden" | undefined;
+        } | undefined;
+        _meta?: {
+            [x: string]: unknown;
+        } | undefined;
+        icons?: {
+            src: string;
+            mimeType?: string | undefined;
+            sizes?: string[] | undefined;
+            theme?: "light" | "dark" | undefined;
+        }[] | undefined;
+        title?: string | undefined;
+    }[];
+    isBridge(name: unknown): boolean;
+    call(alias: string, args: Record<string, unknown>, signal: AbortSignal): Promise<CallToolResult>;
+    get pending(): Pending[];
+    get unsettled(): boolean;
+    get waiting(): boolean;
+    results(options: GenerateOptions): Promise<void>;
+    private mapResult;
+    private concludeAck;
+    observe(update: SessionUpdate): void;
+    /** A failed native bridge cancels the entire parked round; never guess between parallel identical calls. */
+    abandon(reason: string): void;
+    close(): void;
+}
+/** Codex executes nc in its existing employee environment, never on the host. */
+export declare function openToolBridgeMcp(bridge: ToolBridge, maxBytes: number): Promise<{
+    mcpServers: {
+        name: string;
+        command: string;
+        args: string[];
+        env: {
+            name: string;
+            value: string;
+        }[];
+    }[];
+    close: () => Promise<void>;
+}>;
+export {};

package/dist/toolbridge.js

@@ -0,0 +1,205 @@
+import { randomUUID } from 'node:crypto';
+import { createServer } from 'node:net';
+import { mkdtemp, lstat, rm } from 'node:fs/promises';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+import { EmployeeSocketTransport } from "./employee-mcp.js";
+import { bridgeTable } from "./toolbridge-table.js";
+import { NeedError } from "./remote.js";
+export const TOOLBRIDGE_TIMEOUT_SECONDS = 1800;
+export const TOOLBRIDGE_NOTICE = '含工具桥：本机文件夹的扩展工具由DSH执行并按当前权限审批；文件和命令保持原执行方式。工具表在新一轮主机连接时更新。';
+export const TOOLBRIDGE_ENDED = '主机已结束这次工具等待；本轮已停止，迟到结果不会交回，也不会重新执行。请核对已发生的操作。';
+const errorResult = (text) => ({ isError: true, content: [{ type: 'text', text }] });
+/** Only a protocol queue. Tool execution and authorization belong to DSH. */
+export class ToolBridge {
+    options;
+    readImage;
+    controller = new AbortController();
+    snapshot;
+    get table() { return this.snapshot ??= bridgeTable(this.options.tools); }
+    calls = new Map();
+    enabled = false;
+    ended = false;
+    notice;
+    replayState;
+    localTurnEnded = false;
+    concludeAcknowledged = false;
+    onConcludeAcknowledged = () => { };
+    nativeCompleted = new Set();
+    nativeTerminated = new Set();
+    concludeNative = new Set();
+    beginConclude() { this.localTurnEnded = true; this.concludeNative = new Set([...this.nativeBridgeIds].filter(id => !this.nativeTerminated.has(id))); }
+    active;
+    begin(signal) { this.active = signal; }
+    end() { this.active = undefined; }
+    changed = () => { };
+    record = () => { };
+    onAbandon = () => { };
+    nativeBridgeIds = new Set();
+    constructor(options, readImage) {
+        this.options = options;
+        this.readImage = readImage;
+    }
+    enable(record) { if (!this.table.size)
+        return; this.enabled = true; this.record = record; record({ kind: 'session', severity: 'info', code: 'TOOLBRIDGE_SELECTED', summary: TOOLBRIDGE_NOTICE, payload: { toolCount: this.table.size, toolTimeoutSec: TOOLBRIDGE_TIMEOUT_SECONDS, timeoutSource: 'owner-2026-10-26', snapshot: 'native-session-open', excluded: 'official-file-command-subagent-team-run_code' } }); }
+    get tools() { return [...this.table.values()].map(t => t.wire); }
+    isBridge(name) { return typeof name === 'string' && this.table.has(name.replace(/^mcp__employee__/, '')); }
+    async call(alias, args, signal) {
+        const tool = this.table.get(alias);
+        if (!this.enabled || this.ended || this.localTurnEnded || !this.active || this.active.aborted || !tool || signal.aborted)
+            return errorResult('工具桥当前不可用，未执行。');
+        const id = ('awb-' + randomUUID());
+        const abort = () => this.abandon('MCP_REQUEST_CANCELLED');
+        const pending = { block: { type: 'tool-call', id, name: tool.schema.name, arguments: JSON.stringify(args) }, alias, reply: Promise.withResolvers(), exported: false, settled: false, off: () => signal.removeEventListener('abort', abort) };
+        this.calls.set(id, pending);
+        signal.addEventListener('abort', abort, { once: true });
+        this.record({ kind: 'tool', severity: 'info', code: 'TOOLBRIDGE_CALL_PARKED', summary: '主机工具调用交给DSH执行与审批，原prompt继续等待。', payload: { callId: id, tool: tool.schema.name } });
+        this.changed();
+        if (signal.aborted)
+            abort();
+        return pending.reply.promise;
+    }
+    get pending() { return [...this.calls.values()].filter(p => !p.settled && !p.exported); }
+    get unsettled() { return [...this.calls.values()].some(p => !p.settled); }
+    get waiting() { return [...this.calls.values()].some(p => p.exported && !p.settled); }
+    async results(options) {
+        const batch = [];
+        for (const p of this.calls.values()) {
+            if (!p.exported || p.settled)
+                continue;
+            const matches = options.messages.filter((m) => m.role === 'tool' && m.toolCallId === p.block.id);
+            if (matches.length !== 1)
+                throw new NeedError('TOOLBRIDGE_RESULT_MISSING', '工具桥没有收到唯一匹配的DSH结果，本轮已停止；不会重跑。', '原toolCallId对应的官方tool结果');
+            batch.push({ pending: p, result: await this.mapResult(matches[0], options.signal) });
+        }
+        // Map the whole DSH batch before releasing any native Promise. A normal MCP
+        // isError must not race an unfinished image mapping from this same batch.
+        if (this.ended) {
+            for (const { pending: p } of batch)
+                this.record({ kind: 'tool', severity: 'warning', code: 'DSH_BRIDGE_LATE_RESULT_DROPPED', summary: TOOLBRIDGE_ENDED, payload: { callId: p.block.id } });
+            return;
+        }
+        if (this.localTurnEnded)
+            for (const p of this.calls.values())
+                if (!p.exported && !p.settled) {
+                    batch.push({ pending: p, result: errorResult('DSH工具已结束本轮，这个尚未派发的调用没有执行。') });
+                    this.record({ kind: 'tool', severity: 'info', code: 'TOOLBRIDGE_CONCLUDED_UNDISPATCHED', summary: 'DSH工具结束了本轮，尚未交给DSH的调用没有执行。', payload: { callId: p.block.id } });
+                }
+        const ready = batch.filter(row => !row.pending.settled);
+        for (const { pending: p } of ready) {
+            p.settled = true;
+            p.off();
+        }
+        for (const { pending: p, result } of ready)
+            p.reply.resolve(result);
+        this.concludeAck();
+    }
+    async mapResult(message, signal) {
+        const content = [];
+        for (const block of message.content) {
+            if (block.type === 'text') {
+                content.push({ type: 'text', text: block.text });
+                continue;
+            }
+            if (block.type === 'image') {
+                if (block.offloaded)
+                    return errorResult('这张图片已按DSH策略移出上下文，工具桥未将占位内容冒充图片结果。');
+                if (!this.readImage)
+                    throw new NeedError('ATTACHMENT_REQUIRED', '我需要官方附件组件读取工具返回的图片。', 'attachments.readImage');
+                const image = await this.readImage(block.attachment, signal);
+                signal?.throwIfAborted();
+                if (image.ref.attachmentId !== block.attachment.attachmentId || image.ref.bytes !== image.data.byteLength || !['image/png', 'image/jpeg', 'image/webp', 'image/gif'].includes(image.ref.mediaType))
+                    throw new NeedError('ATTACHMENT_INVALID', '工具图片的附件内容无法核对，本轮没有交回。', '官方核验的图片字节与媒体类型');
+                content.push({ type: 'image', mimeType: image.ref.mediaType, data: Buffer.from(image.data).toString('base64') });
+                continue;
+            }
+            return errorResult('工具返回了本版工具桥尚不支持的内容类型：' + block.type + '；没有静默丢弃或重新执行。');
+        }
+        return { content, isError: !!message.isError };
+    }
+    concludeAck() {
+        if (this.localTurnEnded && !this.unsettled && !this.concludeAcknowledged && this.concludeNative.size && [...this.concludeNative].every(id => this.nativeCompleted.has(id))) {
+            this.concludeAcknowledged = true;
+            this.record({ kind: 'tool', severity: 'info', code: 'TOOLBRIDGE_CONCLUDED_RESULT_DELIVERED', summary: 'DSH工具结束了本轮，原生工具已确认收到结果；结束原prompt，不再派发新工具。' });
+            this.onConcludeAcknowledged();
+        }
+    }
+    observe(update) {
+        if (!this.enabled || this.ended)
+            return;
+        if (update.sessionUpdate !== 'tool_call' && update.sessionUpdate !== 'tool_call_update')
+            return;
+        const u = update;
+        const raw = u.rawInput;
+        const name = u.name ?? u._meta?.claudeCode?.toolName;
+        if (this.isBridge(name) || raw?.server === 'employee' && this.isBridge(raw.tool) || this.isBridge(u.title))
+            this.nativeBridgeIds.add(u.toolCallId);
+        if ((u.status === 'completed' || u.status === 'failed') && this.nativeBridgeIds.has(u.toolCallId))
+            this.nativeTerminated.add(u.toolCallId);
+        if (u.status === 'failed' && this.nativeBridgeIds.has(u.toolCallId) && !this.unsettled && u.rawOutput?.result?.isError === true && Array.isArray(u.rawOutput.result.content)) {
+            this.nativeCompleted.add(u.toolCallId);
+            this.concludeAck();
+        }
+        if (u.status === 'completed' && this.nativeBridgeIds.has(u.toolCallId)) {
+            this.nativeCompleted.add(u.toolCallId);
+            this.concludeAck();
+        }
+        if (u.status === 'failed' && this.nativeBridgeIds.has(u.toolCallId) && (!this.localTurnEnded || this.concludeNative.has(u.toolCallId)) && this.unsettled)
+            this.abandon('HOST_TOOL_FAILED');
+    }
+    /** A failed native bridge cancels the entire parked round; never guess between parallel identical calls. */
+    abandon(reason) {
+        if (this.ended)
+            return;
+        this.notice = TOOLBRIDGE_ENDED;
+        this.record({ kind: 'tool', severity: 'warning', code: 'DSH_BRIDGE_CALL_ABANDONED_BY_HOST', summary: this.notice, payload: { reason, toolTimeoutSec: TOOLBRIDGE_TIMEOUT_SECONDS, fixedTimeoutReasonAvailable: false, scope: 'entire-parked-round', replayed: false } });
+        this.close();
+        this.onAbandon(this.notice);
+    }
+    close() {
+        if (this.ended)
+            return;
+        this.ended = true;
+        this.controller.abort();
+        for (const p of this.calls.values())
+            if (!p.settled) {
+                p.settled = true;
+                p.off();
+                p.reply.resolve(errorResult('本轮工具等待已结束；结果不重放。'));
+            }
+        this.changed();
+    }
+}
+/** Codex executes nc in its existing employee environment, never on the host. */
+export async function openToolBridgeMcp(bridge, maxBytes) {
+    const root = await mkdtemp('/private/tmp/aw-tb-'), socketPath = root + '/mcp';
+    const clients = new Set();
+    let closed = false;
+    const listener = createServer(socket => {
+        if (closed) {
+            socket.destroy();
+            return;
+        }
+        const server = new Server({ name: 'ai-workbench-toolbridge', version: '0.9.0' }, { capabilities: { tools: {} } });
+        clients.add(server);
+        server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: bridge.tools }));
+        server.setRequestHandler(CallToolRequestSchema, (r, extra) => bridge.call(r.params.name, r.params.arguments ?? {}, extra.signal));
+        server.onclose = () => clients.delete(server);
+        server.onerror = () => bridge.abandon('MCP_TRANSPORT_FAILED');
+        void server.connect(new EmployeeSocketTransport(socket, maxBytes)).catch(() => { socket.destroy(); bridge.abandon('MCP_CONNECT_FAILED'); });
+    });
+    const close = async () => { if (closed)
+        return; closed = true; bridge.close(); await Promise.allSettled([...clients].map(c => c.close())); if (listener.listening)
+        await new Promise(r => listener.close(() => r())); await rm(root, { recursive: true }); };
+    try {
+        const stat = await lstat(root);
+        if (stat.uid !== process.getuid?.() || (stat.mode & 0o077) !== 0)
+            throw Error('TOOLBRIDGE_PRIVATE_DIRECTORY_REQUIRED');
+        await new Promise((yes, no) => { listener.once('error', no); listener.listen(socketPath, () => { listener.removeListener('error', no); yes(); }); });
+        return { mcpServers: [{ name: 'employee', command: '/usr/bin/nc', args: ['-U', socketPath], env: [] }], close };
+    }
+    catch (error) {
+        await close();
+        throw error;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-workbench/remote-agent",
-  "version": "0.8.29",
+  "version": "0.9.0-toolbridge.3",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -36,7 +36,7 @@
     "zod": "4.6.7"
   },
   "devDependencies": {
-    "@ai-workbench/connect": "file:test/fixtures/ai-workbench-connect-0.7.29.tgz",
+    "@ai-workbench/connect": "file:test/fixtures/ai-workbench-connect-0.7.37.tgz",
     "@ai-workbench/network": "file:test/fixtures/ai-workbench-network-0.4.9.tgz",
     "@deepseek-ai/cordis": "4.0.4",
     "@deepseek-ai/cordis-plugin-group": "1.0.4",
@@ -67,7 +67,7 @@
     "@deepseek-ai/dsh-storage-domain": "0.2.0-rc.2"
   },
   "peerDependencies": {
-    "@ai-workbench/connect": "~0.7.29",
+    "@ai-workbench/connect": "~0.7.37",
     "@ai-workbench/network": "~0.4.9",
     "@deepseek-ai/cordis": "4.0.4",
     "@deepseek-ai/dsh-agent": "0.2.0-rc.2",
@@ -102,10 +102,11 @@
       "optional": true
     }
   },
-  "description": "通过远程主机运行Claude与Codex会话。",
+  "description": "AI 写作工作台（含工具桥）：远程Claude与Codex，本机目录工具由DSH执行与审批。",
   "publishConfig": {
     "access": "public",
-    "registry": "https://registry.npmjs.org/"
+    "registry": "https://registry.npmjs.org/",
+    "tag": "toolbridge"
   },
   "keywords": [
     "dsh",