@ai-workbench/remote-agent 0.8.5 → 0.8.10

package/dist/employee-mcp.js

@@ -0,0 +1,181 @@
+import { createServer } from 'node:net';
+import { mkdtemp, lstat, rm, access } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { CallToolRequestSchema, ListToolsRequestSchema, JSONRPCMessageSchema } from '@modelcontextprotocol/sdk/types.js';
+import { createEmployeeTools } from "./employee-tools.js";
+import { employeeRouting } from "./employee-relay.js";
+import { NeedError } from "./remote.js";
+const string = { type: 'string' }, integer = { type: 'integer' }, boolean = { type: 'boolean' };
+function schema(name, properties, required) { return { name, description: '在员工电脑所选工作区执行' + name + '；不在主机回退。', inputSchema: { type: 'object', properties, required, additionalProperties: false } }; }
+export const EMPLOYEE_MCP_TOOLS = [
+    schema('Read', { file_path: string, offset: integer, limit: integer, pages: string }, ['file_path']),
+    schema('Write', { file_path: string, content: string }, ['file_path', 'content']),
+    schema('Edit', { file_path: string, old_string: string, new_string: string, replace_all: boolean }, ['file_path', 'old_string', 'new_string']),
+    schema('Glob', { pattern: string, path: string }, ['pattern']),
+    schema('Grep', { pattern: string, path: string, glob: string, output_mode: string, '-B': integer, '-A': integer, '-C': integer, '-n': boolean, '-i': boolean, type: string, head_limit: integer, offset: integer, multiline: boolean }, ['pattern']),
+    schema('Bash', { command: string, timeout: integer, description: string, run_in_background: boolean, dangerouslyDisableSandbox: boolean }, ['command']),
+];
+/** Same newline-delimited MCP messages as stdio, over an employee-only Unix stream. */
+export class EmployeeSocketTransport {
+    socket;
+    maxBytes;
+    onclose;
+    onerror;
+    onmessage;
+    pending = Buffer.alloc(0);
+    ended = false;
+    failure;
+    get error() { return this.failure; }
+    lifetime = new AbortController();
+    signal = this.lifetime.signal;
+    constructor(socket, maxBytes) {
+        this.socket = socket;
+        this.maxBytes = maxBytes;
+    }
+    failed(error) { try {
+        this.onerror?.(error);
+    }
+    catch (observation) {
+        this.failure = observation instanceof Error ? observation : new Error('EMPLOYEE_MCP_OBSERVATION_FAILED');
+    }
+    finally {
+        void this.close();
+    } }
+    async start() {
+        this.socket.on('error', error => this.failed(error));
+        this.socket.on('close', () => void this.close());
+        this.socket.on('data', (bytes) => {
+            try {
+                let cursor = 0;
+                while (cursor < bytes.length) {
+                    const newline = bytes.indexOf(10, cursor), end = newline < 0 ? bytes.length : newline;
+                    if (this.pending.length + end - cursor > this.maxBytes)
+                        throw new NeedError('EMPLOYEE_MCP_MESSAGE_TOO_LARGE', '本机工具消息超过acpMaxMessageBytes，未截断。', '调整具名会话消息容量');
+                    this.pending = Buffer.concat([this.pending, bytes.subarray(cursor, end)]);
+                    cursor = newline < 0 ? bytes.length : newline + 1;
+                    if (newline >= 0) {
+                        const line = new TextDecoder('utf8', { fatal: true }).decode(this.pending);
+                        this.pending = Buffer.alloc(0);
+                        this.onmessage?.(JSONRPCMessageSchema.parse(JSON.parse(line)));
+                    }
+                }
+            }
+            catch (error) {
+                this.failed(error);
+            }
+        });
+    }
+    async send(message) {
+        if (this.ended)
+            throw new Error('EMPLOYEE_MCP_CLOSED');
+        const wire = Buffer.from(JSON.stringify(message) + '\n');
+        if (wire.length - 1 > this.maxBytes) {
+            await this.close();
+            throw new Error('EMPLOYEE_MCP_MESSAGE_TOO_LARGE');
+        }
+        await new Promise((yes, no) => this.socket.write(wire, error => error ? no(error) : yes()));
+    }
+    async close() { if (this.ended)
+        return; this.ended = true; this.lifetime.abort(); this.socket.destroy(); this.onclose?.(); }
+}
+export async function openEmployeeMcp(options) {
+    if (process.platform !== 'darwin')
+        throw new NeedError('EMPLOYEE_PLATFORM_UNSUPPORTED', '本机执行目前只支持Mac。', '已交Mac员工端合同');
+    if (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 1)
+        throw new NeedError('SETTINGS_REQUIRED', '本机工具消息容量无效。', 'acpMaxMessageBytes');
+    await access('/usr/bin/nc', constants.X_OK);
+    const tools = createEmployeeTools({ cwd: options.lease.target.local.directory.path, shell: options.lease.target.endpoint.endpointShell, uid: options.lease.target.endpoint.remoteUid, maxBytes: options.maxBytes, killGraceMs: options.killGraceMs, detail: observe, runShell: options.runShell, validate: signal => options.lease.validate(signal).then(() => { }) });
+    const root = await mkdtemp('/private/tmp/aw-x87-'), socketPath = root + '/mcp';
+    try {
+        const info = await lstat(root);
+        if ((info.mode & 0o077) !== 0 || info.uid !== process.getuid?.())
+            throw new NeedError('EMPLOYEE_MCP_STORAGE_INVALID', '本机工具私有通道不可用。', '当前员工的700私有Unix目录');
+    }
+    catch (error) {
+        await tools.close();
+        await rm(root, { recursive: true });
+        throw error;
+    }
+    const clients = new Set(), transports = new Set();
+    let closing, diagnosticFailure;
+    const failureLifetime = new AbortController();
+    const poison = (error) => {
+        diagnosticFailure ??= error;
+        failureLifetime.abort(error);
+        // Close is memoized synchronously: no fresh connection/call can pass the fence.
+        void options.lease.close().catch(failure => { diagnosticFailure ??= failure; });
+        void close().catch(failure => { diagnosticFailure ??= failure; });
+    };
+    function observeUsing(event, sink) { if (diagnosticFailure)
+        throw diagnosticFailure; try {
+        sink(event);
+    }
+    catch (error) {
+        poison(error);
+        throw error;
+    } }
+    function observe(event) { observeUsing(event, options.detail); }
+    const server = createServer(socket => {
+        if (closing || failureLifetime.signal.aborted || options.lease.signal.aborted) {
+            socket.destroy();
+            return;
+        }
+        const mcp = new Server({ name: 'ai-workbench-employee', version: '0.8.10' }, { capabilities: { tools: {} } }), transport = new EmployeeSocketTransport(socket, options.maxBytes);
+        clients.add(mcp);
+        transports.add(transport);
+        mcp.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: EMPLOYEE_MCP_TOOLS }));
+        mcp.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
+            const active = options.activeSignal();
+            if (!active || active.aborted)
+                return { isError: true, content: [{ type: 'text', text: 'EMPLOYEE_NO_ACTIVE_TURN：当前没有已接纳的用户轮次，本机工具未执行。' }] };
+            const signal = AbortSignal.any([active, extra.signal, transport.signal, options.lease.signal, failureLifetime.signal]);
+            const sink = options.captureDetail?.() ?? options.detail;
+            return tools.call(request.params.name, request.params.arguments ?? {}, signal, event => observeUsing(event, sink));
+        });
+        mcp.onerror = () => { try {
+            observe({ kind: 'session', severity: 'warning', code: 'CLAUDE_EMPLOYEE_MCP_UNKNOWN', summary: '本机工具连接出现协议或传输错误；在途结果未知，没有重放' });
+        }
+        catch (error) {
+            poison(error);
+        } };
+        mcp.onclose = () => { clients.delete(mcp); transports.delete(transport); };
+        void mcp.connect(transport).catch(() => { socket.destroy(); });
+    });
+    const close = () => closing ??= Promise.resolve().then(async () => {
+        options.lease.signal.removeEventListener('abort', aborted);
+        const errors = [], clean = async (operation) => { try {
+            await operation();
+        }
+        catch (error) {
+            if (!errors.includes(error))
+                errors.push(error);
+        } };
+        for (const transport of transports)
+            await clean(() => transport.close());
+        await Promise.all([...clients].map(client => clean(() => client.close())));
+        await clean(() => tools.close());
+        await clean(() => options.lease.close());
+        if (server.listening)
+            await clean(() => new Promise((yes, no) => server.close(error => error ? no(error) : yes())));
+        await clean(() => rm(root, { recursive: true }));
+        if (diagnosticFailure && !errors.includes(diagnosticFailure))
+            errors.unshift(diagnosticFailure);
+        if (errors.length === 1)
+            throw errors[0];
+        if (errors.length)
+            throw new AggregateError(errors, 'EMPLOYEE_MCP_CLEANUP_FAILED');
+    });
+    const aborted = () => { void close().catch(error => { diagnosticFailure ??= error; failureLifetime.abort(error); }); };
+    try {
+        await new Promise((yes, no) => { server.once('error', no); server.listen(socketPath, () => { server.removeListener('error', no); yes(); }); });
+        options.lease.signal.addEventListener('abort', aborted, { once: true });
+        if (options.lease.signal.aborted)
+            throw options.lease.signal.reason;
+        return { routing: employeeRouting(options.lease.target, socketPath, options.maxBytes), signal: failureLifetime.signal, close };
+    }
+    catch (error) {
+        await close();
+        throw error;
+    }
+}

package/dist/employee-native.d.ts

@@ -0,0 +1,18 @@
+/** Fixed native input already proven by D18/D20; never resolve a PATH executable. */
+export declare const EMPLOYEE_NATIVE: Readonly<{
+    version: "0.160.1";
+    platform: "darwin";
+    arch: "arm64";
+    package: "@openai/codex-darwin-arm64";
+    packageVersion: "0.160.1-darwin-arm64";
+    triple: "aarch64-apple-darwin";
+    sha256: "09fa44fdc37a5fc70dc1ace31235f90468a2e193d0e85f7552eab068ea2582be";
+}>;
+export declare function resolveEmployeeNative(ports?: {
+    platform?: string;
+    arch?: string;
+    resolve?: (name: string) => string;
+}): Promise<{
+    path: string;
+    sha256: string;
+}>;

package/dist/employee-native.js

@@ -0,0 +1,38 @@
+import { createRequire } from 'node:module';
+import { readFile, lstat, realpath, access } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { NeedError } from "./remote.js";
+const require = createRequire(import.meta.url);
+/** Fixed native input already proven by D18/D20; never resolve a PATH executable. */
+export const EMPLOYEE_NATIVE = Object.freeze({ version: '0.160.1', platform: 'darwin', arch: 'arm64', package: '@openai/codex-darwin-arm64', packageVersion: '0.160.1-darwin-arm64', triple: 'aarch64-apple-darwin', sha256: '09fa44fdc37a5fc70dc1ace31235f90468a2e193d0e85f7552eab068ea2582be' });
+export async function resolveEmployeeNative(ports = {}) {
+    if ((ports.platform ?? process.platform) !== EMPLOYEE_NATIVE.platform || (ports.arch ?? process.arch) !== EMPLOYEE_NATIVE.arch)
+        throw new NeedError('EMPLOYEE_PLATFORM_UNSUPPORTED', '当前版本的Codex本机执行仅验证了Apple芯片Mac，本轮没有执行。', '对应平台固定执行器及验证');
+    let manifest;
+    try {
+        manifest = (ports.resolve ?? require.resolve)(EMPLOYEE_NATIVE.package + '/package.json');
+    }
+    catch {
+        throw new NeedError('AW_EMPLOYEE_BINARY_MISSING', 'Codex本机执行组件没有装齐，本轮没有执行，请联系管理员。', '随插件安装的固定Codex0.160.1执行组件');
+    }
+    try {
+        const metadata = JSON.parse(await readFile(manifest, 'utf8'));
+        if (metadata.version !== EMPLOYEE_NATIVE.packageVersion)
+            throw new NeedError('AW_EMPLOYEE_BINARY_VERSION', 'Codex本机执行组件版本不匹配，本轮没有执行。', '固定Codex0.160.1组件');
+        const path = join(dirname(manifest), 'vendor', EMPLOYEE_NATIVE.triple, 'bin', 'codex');
+        const info = await lstat(path);
+        if (!info.isFile() || info.isSymbolicLink() || await realpath(path) !== path)
+            throw new NeedError('AW_EMPLOYEE_BINARY_INVALID', 'Codex本机执行组件位置无效，本轮没有执行。', '安装包内的固定原生执行器');
+        await access(path, constants.X_OK);
+        if (createHash('sha256').update(await readFile(path)).digest('hex') !== EMPLOYEE_NATIVE.sha256)
+            throw new NeedError('AW_EMPLOYEE_BINARY_HASH', 'Codex本机执行组件校验不一致，本轮没有执行。', '固定原生执行器SHA256');
+        return { path, sha256: EMPLOYEE_NATIVE.sha256 };
+    }
+    catch (error) {
+        if (error instanceof NeedError)
+            throw error;
+        throw new NeedError('AW_EMPLOYEE_BINARY_INVALID', 'Codex本机执行组件无法核验，本轮没有执行。', '完整安装包与固定执行器');
+    }
+}

package/dist/employee-provider.d.ts

@@ -0,0 +1,42 @@
+import type { NetworkApi } from '@ai-workbench/network/api';
+import type { AgentDefinition } from './agents.ts';
+import type { ConnectApi, ConnectTarget, ConnectionState, Project, Runtime, RuntimeRequest } from './provider.ts';
+import { type BrokerIo, type SshArgv } from './broker.ts';
+import type { DetailChannel } from './remote-details.ts';
+import type { LocalUserTurnAcceptance } from '@ai-workbench/connect/api';
+export interface EmployeeProviderOptions {
+    currentUserTurn(request: RuntimeRequest): {
+        turn: number;
+        userMessageId: string;
+    };
+    getNetwork(): NetworkApi | undefined;
+    workspace(request: RuntimeRequest): Promise<{
+        id: string;
+        path: string;
+    }>;
+    native(): Promise<{
+        path: string;
+        sha256: string;
+    }>;
+    argv?: SshArgv;
+    io?: BrokerIo;
+}
+interface Options {
+    employee?: EmployeeProviderOptions;
+    open?: (target: ConnectTarget, project: Project, request: RuntimeRequest) => Promise<Runtime>;
+    details?: (request: RuntimeRequest, api: ConnectApi, connection: ConnectionState, target: ConnectTarget) => Promise<DetailChannel>;
+}
+interface Admission {
+    api: ConnectApi;
+    target: ConnectTarget;
+    connection: ConnectionState;
+    request: RuntimeRequest;
+    stable: (signal?: AbortSignal) => Promise<unknown>;
+}
+/** Read-only local classification and explicit acceptance precede even ensureReady's SSH status. */
+export declare function acceptEmployeeUserTurn(get: () => ConnectApi | undefined, employee: EmployeeProviderOptions, agent: AgentDefinition, api: ConnectApi, request: RuntimeRequest): Promise<Readonly<LocalUserTurnAcceptance> | undefined>;
+/** Recheck the admitted read-only facts after readiness awaits, before the catalog command. */
+export declare function validateEmployeeUserTurn(get: () => ConnectApi | undefined, employee: EmployeeProviderOptions, api: ConnectApi, request: RuntimeRequest, connection: ConnectionState): Promise<void>;
+/** Source admission is separate from L's legacy host project resolver. */
+export declare function createEmployeeProvider(get: () => ConnectApi | undefined, options: Options, agent: AgentDefinition): (input: Admission) => Promise<Runtime | undefined>;
+export {};

package/dist/employee-provider.js

@@ -0,0 +1,326 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { createHash } from 'node:crypto';
+import { admitEmployeeLocation } from "./employee-location.js";
+import { EmployeeExecution } from "./employee-exec.js";
+import { createEmployeeSshTransport, validateEmployeeSshTarget } from "./employee-ssh.js";
+import { sshIo } from "./broker.js";
+import { NeedError } from "./remote.js";
+const fail = (code) => new NeedError(code, code === 'EMPLOYEE_OPERATION_UNSUPPORTED' ? '当前本机工作区只支持正在连接的会话；单次运行和断线后的冷恢复暂不支持，请新建会话。' : '本机工作区的执行连接无法继续（' + code + '），本轮没有改用主机执行。', '当前 L 工作区绑定、N/S 员工执行端点与支持本机执行的会话适配器');
+const errorCode = (error) => error instanceof NeedError ? error.code : 'EMPLOYEE_EXEC_UNKNOWN';
+const asNeed = (error) => error instanceof NeedError ? error : fail('EMPLOYEE_EXEC_UNKNOWN');
+const digest = (value) => createHash('sha256').update(JSON.stringify(value)).digest('hex');
+const absolute = (value) => typeof value === 'string' && value.startsWith('/') && !value.includes('\0');
+const localApiCurrent = (api) => { const c = api.getContractInfo?.(); return c?.workspaceLocations === 1 && c.localWorkspaceContext === 1 && c.localUserTurnAcceptance === 1 && typeof api.getWorkspaceLocationState === 'function' && typeof api.getLocalWorkspaceContext === 'function' && typeof api.acceptLocalWorkspaceUserTurn === 'function'; };
+/** Read-only local classification and explicit acceptance precede even ensureReady's SSH status. */
+export async function acceptEmployeeUserTurn(get, employee, agent, api, request) {
+    const info = api.getContractInfo?.();
+    if (info?.workspaceLocations !== 1)
+        return;
+    if (typeof api.getWorkspaceLocationState !== 'function')
+        throw fail('DEPENDENCY_REQUIRED');
+    const state = api.getWorkspaceLocationState();
+    if (!state.items.length) {
+        request.localAdmissionCheck = () => { if (get() !== api || typeof api.getWorkspaceLocationState !== 'function' || api.getContractInfo?.().workspaceLocations !== 1 || api.getWorkspaceLocationState().items.length)
+            throw fail('EMPLOYEE_CONTEXT_CHANGED'); };
+        return;
+    }
+    const workspace = { ...await employee.workspace(request) };
+    request.signal?.throwIfAborted();
+    const rows = state.items.filter(row => row.workspaceId === workspace.id), row = rows[0];
+    const stamp = (s) => JSON.stringify([s.instanceId, s.epoch, s.phase, s.items.filter(x => x.workspaceId === workspace.id).map(x => [x.bindingId, x.source, x.status])]);
+    const captured = stamp(state), sourceStable = () => { if (get() !== api || typeof api.getWorkspaceLocationState !== 'function' || api.getContractInfo?.().workspaceLocations !== 1 || row?.source === 'local' && !localApiCurrent(api) || stamp(api.getWorkspaceLocationState()) !== captured)
+        throw fail('EMPLOYEE_CONTEXT_CHANGED'); request.signal?.throwIfAborted(); };
+    request.localAdmissionCheck = sourceStable;
+    sourceStable();
+    if (rows.length !== 1)
+        throw fail('EMPLOYEE_CONTEXT_CHANGED');
+    if (row.source !== 'local')
+        return;
+    if (agent.id !== 'codex-remote' || agent.loginProvider !== 'codex' || state.phase !== 'ready' || row.status !== 'selected' || !row.bindingId || info.localWorkspaceContext !== 1 || info.localUserTurnAcceptance !== 1 || typeof api.getLocalWorkspaceContext !== 'function' || typeof api.acceptLocalWorkspaceUserTurn !== 'function' || typeof employee.currentUserTurn !== 'function')
+        throw fail('DEPENDENCY_REQUIRED');
+    const connection = api.getConnectionState();
+    const stable = () => { sourceStable(); const now = api.getConnectionState(), location = api.getWorkspaceLocationState(), matches = location.items.filter(x => x.workspaceId === workspace.id); if (get() !== api || now.phase !== 'connected' || now.instanceId !== connection.instanceId || now.epoch !== connection.epoch || location.phase !== 'ready' || location.instanceId !== connection.instanceId || location.epoch !== connection.epoch || matches.length !== 1 || matches[0].source !== 'local' || matches[0].status !== 'selected' || matches[0].bindingId !== row.bindingId)
+        throw fail('EMPLOYEE_CONTEXT_CHANGED'); request.signal?.throwIfAborted(); };
+    stable();
+    const context = await api.getLocalWorkspaceContext({ instanceId: connection.instanceId, epoch: connection.epoch, workspaceId: workspace.id, expectedBindingId: row.bindingId });
+    if (!context.ok)
+        throw new NeedError(context.error.code, '无法核验本机工作区，本轮已停止。', '当前本机工作区');
+    stable();
+    const c = context.value, d = { ...c.directory };
+    if (c.version !== 1 || c.source !== 'local' || c.instanceId !== connection.instanceId || c.epoch !== connection.epoch || c.workspaceId !== workspace.id || c.bindingId !== row.bindingId || !absolute(d?.path) || d.path !== workspace.path || ![d.device, d.inode].every(n => Number.isSafeInteger(n) && n >= 0))
+        throw fail('EMPLOYEE_CONTEXT_CHANGED');
+    const expected = { ...employee.currentUserTurn(request) };
+    if (!Number.isSafeInteger(expected.turn) || expected.turn < 0 || typeof expected.userMessageId !== 'string' || !expected.userMessageId.trim())
+        throw fail('LOCAL_USER_TURN_UNCONFIRMED');
+    const response = await api.acceptLocalWorkspaceUserTurn({ instanceId: connection.instanceId, epoch: connection.epoch, sessionId: request.sessionId, provider: agent.loginProvider, purpose: 'user-turn', workspaceId: workspace.id, expectedBindingId: row.bindingId, expectedDirectory: { device: d.device, inode: d.inode }, expectedUserTurn: { ...expected } });
+    if (!response.ok)
+        throw new NeedError(response.error.code, '本次员工输入或工作区无法核验，本轮已停止。', 'L 本地真实输入接纳');
+    stable();
+    const a = response.value;
+    if (!a || a.version !== 1 || typeof a.acceptanceId !== 'string' || !a.acceptanceId.trim() || a.instanceId !== connection.instanceId || a.epoch !== connection.epoch || a.sessionId !== request.sessionId || a.provider !== agent.loginProvider || a.workspaceId !== workspace.id || a.bindingId !== row.bindingId || a.source !== 'local' || a.directory?.path !== d.path || a.directory?.device !== d.device || a.directory?.inode !== d.inode || a.userTurn?.turn !== expected.turn || a.userTurn?.userMessageId !== expected.userMessageId || ![a.userTurn?.startSequence, a.userTurn?.userMessageSequence].every(n => Number.isSafeInteger(n) && n >= 0) || a.userTurn.userMessageSequence <= a.userTurn.startSequence)
+        throw fail('LOCAL_USER_TURN_ACCEPTANCE_INVALID');
+    const accepted = Object.freeze({ ...a, directory: Object.freeze({ ...a.directory }), userTurn: Object.freeze({ ...a.userTurn }) });
+    request.localAdmissionCheck = () => { sourceStable(); const c = api.getConnectionState(); if (c.phase !== 'connected' || c.instanceId !== accepted.instanceId || c.epoch !== accepted.epoch)
+        throw fail('EMPLOYEE_CONTEXT_CHANGED'); const turn = employee.currentUserTurn(request); if (turn.turn !== accepted.userTurn.turn || turn.userMessageId !== accepted.userTurn.userMessageId)
+        throw new NeedError('LOCAL_USER_TURN_CHANGED', '本次输入已变化，本轮已停止。', '当前官方真实员工输入'); };
+    return accepted;
+}
+/** Recheck the admitted read-only facts after readiness awaits, before the catalog command. */
+export async function validateEmployeeUserTurn(get, employee, api, request, connection) {
+    const a = request.localAcceptance;
+    if (!a)
+        return;
+    const stable = () => { if (get() !== api || !localApiCurrent(api))
+        throw fail('EMPLOYEE_CONTEXT_CHANGED'); const c = api.getConnectionState(), state = api.getWorkspaceLocationState(), rows = state.items.filter(x => x.workspaceId === a.workspaceId); if (c.phase !== 'connected' || c.instanceId !== a.instanceId || c.epoch !== a.epoch || connection.instanceId !== a.instanceId || connection.epoch !== a.epoch || state.phase !== 'ready' || state.instanceId !== a.instanceId || state.epoch !== a.epoch || rows.length !== 1 || rows[0].source !== 'local' || rows[0].status !== 'selected' || rows[0].bindingId !== a.bindingId)
+        throw fail('EMPLOYEE_CONTEXT_CHANGED'); request.signal?.throwIfAborted(); };
+    stable();
+    const c = await api.getLocalWorkspaceContext({ instanceId: a.instanceId, epoch: a.epoch, workspaceId: a.workspaceId, expectedBindingId: a.bindingId });
+    stable();
+    if (!c.ok)
+        throw new NeedError(c.error.code, '无法核验本机工作区，本轮已停止。', '当前本机工作区');
+    if (c.value.version !== 1 || c.value.source !== 'local' || c.value.instanceId !== a.instanceId || c.value.epoch !== a.epoch || c.value.workspaceId !== a.workspaceId || c.value.bindingId !== a.bindingId || c.value.directory.path !== a.directory.path || c.value.directory.device !== a.directory.device || c.value.directory.inode !== a.directory.inode)
+        throw fail('EMPLOYEE_CONTEXT_CHANGED');
+    const turn = employee.currentUserTurn(request);
+    if (turn.turn !== a.userTurn.turn || turn.userMessageId !== a.userTurn.userMessageId)
+        throw new NeedError('LOCAL_USER_TURN_CHANGED', '本次输入已变化，本轮已停止。', '当前官方真实员工输入');
+}
+/** Source admission is separate from L's legacy host project resolver. */
+export function createEmployeeProvider(get, options, agent) {
+    const live = new Map();
+    return async (input) => {
+        const { api, target, connection, request } = input, info = api.getContractInfo?.(), sessionId = request.sessionId;
+        let prior = live.get(sessionId);
+        // A failed close remains a session tombstone. Source/endpoint changes cannot authorize a new host.
+        // Wait for an in-progress close before re-admission; its rejected result is intentionally sticky.
+        if (prior?.ended) {
+            await prior.closing;
+            prior = live.get(sessionId);
+        }
+        if (prior && (prior.current.api !== api || info?.workspaceLocations !== 1 || info?.localWorkspaceContext !== 1)) {
+            await prior.dispose(fail('EMPLOYEE_CONTEXT_CHANGED'));
+            throw fail('EMPLOYEE_CONTEXT_CHANGED');
+        }
+        if (info?.workspaceLocations !== 1 && info?.localWorkspaceContext !== 1)
+            return;
+        if (info.workspaceLocations !== 1 || info.localWorkspaceContext !== 1 || typeof api.getWorkspaceLocationState !== 'function' || typeof api.getLocalWorkspaceContext !== 'function' || !options.employee)
+            throw fail('DEPENDENCY_REQUIRED');
+        const employee = options.employee;
+        const workspace = await employee.workspace(request);
+        await input.stable(request.signal);
+        if (!workspace.id || !absolute(workspace.path))
+            throw fail('EMPLOYEE_CONTEXT_CHANGED');
+        const state = api.getWorkspaceLocationState(), rows = state.items.filter(row => row.workspaceId === workspace.id), row = rows[0];
+        if (state.phase !== 'ready' || state.instanceId !== connection.instanceId || state.epoch !== connection.epoch || rows.length !== 1 || row?.status !== 'selected' || !row.bindingId || !['local', 'host', 'legacy-host'].includes(row.source ?? ''))
+            throw fail('EMPLOYEE_CONTEXT_CHANGED');
+        if (row.source !== 'local') {
+            if (prior)
+                await prior.dispose(fail('EMPLOYEE_CONTEXT_CHANGED'));
+            if (request.localAcceptance)
+                throw fail('EMPLOYEE_CONTEXT_CHANGED');
+            return;
+        }
+        let details;
+        try {
+            const acceptance = request.localAcceptance;
+            if (!acceptance || acceptance.instanceId !== connection.instanceId || acceptance.epoch !== connection.epoch || acceptance.sessionId !== sessionId || acceptance.provider !== agent.loginProvider || acceptance.workspaceId !== workspace.id || acceptance.bindingId !== row.bindingId)
+                throw fail('LOCAL_USER_TURN_UNCONFIRMED');
+            details = await options.details?.(request, api, connection, target);
+            if (details)
+                request.timing?.bind(detail => details.record(detail));
+            const unsupported = request.mode !== 'session' || agent.loginProvider !== 'codex' || !!request.recoveryCheckpointId || !!request.resumeSessionId && !prior;
+            if (unsupported)
+                throw fail('EMPLOYEE_OPERATION_UNSUPPORTED');
+            if (!Number.isSafeInteger(request.acpMaxMessageBytes) || request.acpMaxMessageBytes < 1)
+                throw fail('SETTINGS_REQUIRED');
+            if (typeof api.onWorkspaceLocationState !== 'function' || typeof api.onConnectionState !== 'function')
+                throw fail('DEPENDENCY_REQUIRED');
+            const network = employee.getNetwork();
+            if (!network || typeof network.prepareEmployeeEndpoint !== 'function' || typeof network.onState !== 'function')
+                throw fail('DEPENDENCY_REQUIRED');
+            if (prior && prior.network !== network) {
+                await prior.dispose(fail('EMPLOYEE_CONTEXT_CHANGED'));
+                throw fail('EMPLOYEE_CONTEXT_CHANGED');
+            }
+            const admitted = await admitEmployeeLocation({ api: api, network, workspace, connection, expectedLocal: { instanceId: acceptance.instanceId, epoch: acceptance.epoch, workspaceId: acceptance.workspaceId, bindingId: acceptance.bindingId, directory: { ...acceptance.directory } }, settingsPath: target.session.settingsPath, signal: request.signal });
+            if (request.cwd && request.cwd !== admitted.cwd || request.bindingId && request.bindingId !== admitted.bindingId || request.workspaceId && request.workspaceId !== admitted.workspaceId)
+                throw fail('SESSION_CONTEXT_MISMATCH');
+            const native = await employee.native();
+            if (!absolute(native.path) || !/^[a-f0-9]{64}$/.test(native.sha256))
+                throw fail('EMPLOYEE_BINARY_REQUIRED');
+            // Only executable identity belongs in this scope. Diagnostic metadata and object key
+            // insertion order cannot revoke a live binding; every public identity field stays bound.
+            const endpoint = admitted.endpoint, local = endpoint.local, account = endpoint.endpoint, bridge = endpoint.bridge;
+            const scope = digest({
+                target: { host: target.host, username: target.username, port: target.port, proxyCommand: target.proxyCommand, knownHostsFile: target.knownHostsFile, projectRoot: target.projectRoot,
+                    session: { command: target.session.command, root: target.session.root, settingsPath: target.session.settingsPath, protocolVersion: target.session.protocolVersion } },
+                endpoint: { version: endpoint.version,
+                    local: { instanceId: local.instanceId, epoch: local.epoch, workspaceId: local.workspaceId, bindingId: local.bindingId, directory: { path: local.directory.path, device: local.directory.device, inode: local.directory.inode } },
+                    endpoint: { deviceId: account.deviceId, endpointInstanceId: account.endpointInstanceId, executionContextId: account.executionContextId, remoteUser: account.remoteUser, remoteUid: account.remoteUid, remoteHome: account.remoteHome, endpointCwd: account.endpointCwd, endpointShell: account.endpointShell },
+                    bridge: { protocolVersion: bridge.protocolVersion, command: bridge.command, settingsPath: bridge.settingsPath, bridgeInstanceId: bridge.bridgeInstanceId, generation: bridge.generation } },
+                native: { path: native.path, sha256: native.sha256 },
+            });
+            if (prior && (prior.scope !== scope || prior.ended))
+                await prior.dispose(fail('EMPLOYEE_CONTEXT_CHANGED'));
+            let entry = prior && prior.scope === scope && !prior.ended ? prior : undefined;
+            let candidate = entry;
+            const base = async (signal) => {
+                signal.throwIfAborted();
+                if (get() !== api || employee.getNetwork() !== network)
+                    throw fail('EMPLOYEE_CONTEXT_CHANGED');
+                if (candidate?.ended)
+                    throw candidate.reason ?? fail('EMPLOYEE_EXEC_CLOSED');
+                await (candidate?.current ?? input).stable(signal);
+                await admitted.validate(signal);
+                if (get() !== api || employee.getNetwork() !== network)
+                    throw fail('EMPLOYEE_CONTEXT_CHANGED');
+                await (candidate?.current ?? input).stable(signal);
+                signal.throwIfAborted();
+            };
+            let argv = employee.argv;
+            if (!argv && !employee.io) {
+                const name = '@ai-workbench/connect';
+                const supplied = await import(__rewriteRelativeImportExtension(name));
+                if (typeof supplied.sshArgs !== 'function')
+                    throw fail('DEPENDENCY_REQUIRED');
+                argv = supplied.sshArgs;
+            }
+            const io = employee.io ?? sshIo(target, argv, request.acpMaxMessageBytes);
+            const scopedIo = { run: (command, signal) => io.run(command, signal), attach: async (command) => {
+                    const child = await io.attach(command);
+                    child.once('close', () => { if (candidate && !candidate.ended)
+                        void candidate.dispose(fail('EMPLOYEE_EXEC_UNKNOWN')).catch(() => { }); });
+                    return child;
+                } };
+            const ssh = { target, endpoint: admitted.endpoint, employeeBinary: native.path, binarySha256: native.sha256, acpMaxMessageBytes: request.acpMaxMessageBytes, argv: argv ?? (() => []), validate: base, io: scopedIo };
+            const validate = async (signal) => { try {
+                await validateEmployeeSshTarget(ssh, signal);
+            }
+            catch (error) {
+                if (candidate && errorCode(error) !== 'ABORTED')
+                    await candidate.dispose(asNeed(error));
+                throw error;
+            } };
+            await validate(request.signal ?? new AbortController().signal);
+            if (!options.open)
+                throw fail('RUNTIME_REQUIRED');
+            // Host cwd is only the protected agent bootstrap/config directory. Native tools use admitted.cwd.
+            const host = await options.open(target, { name: 'employee', path: target.projectRoot }, { ...request, agent, employeeScope: scope, bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, bindingRevision: state.revision, detailChannel: details, validateContext: async (ignore = false) => {
+                    // Disposal addresses only the already-owned host broker instance through its frozen IO/CAS.
+                    // A withdrawn local source must prevent dispatch, but cannot forbid that instance's exact kill.
+                    if (ignore)
+                        await (candidate?.current ?? input).stable();
+                    else
+                        await validate(request.signal ?? new AbortController().signal);
+                }, resumeSessionId: undefined, recoveryCheckpointId: undefined, verifyRecovery: undefined });
+            if (entry) {
+                entry.current = input;
+                entry.details = details;
+                try {
+                    await validate(request.signal ?? new AbortController().signal);
+                }
+                catch (error) {
+                    await entry.dispose(asNeed(error));
+                    throw error;
+                }
+                entry.runtime.details = details;
+                entry.runtime.connection = { ...connection };
+                entry.runtime.binding = { bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, revision: state.revision };
+                return entry.runtime;
+            }
+            const disposers = [];
+            const execution = new EmployeeExecution({ bindingId: admitted.bindingId, acpMaxMessageBytes: request.acpMaxMessageBytes, validate, transport: signal => createEmployeeSshTransport(ssh, signal) });
+            const runtime = { ...host, cwd: admitted.cwd, details, connection: { ...connection }, binding: { bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, revision: state.revision }, saveCheckpoint: undefined, recoveredSession: undefined, restartNotice: undefined, restartInputIds: undefined, employeeExecutionMeta: { version: 1, bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, cwd: admitted.cwd, acpMaxMessageBytes: request.acpMaxMessageBytes }, employeePresentation: '文件与命令在本机选定目录运行，Git 使用本机仓库；模型、登录和全局助手要求仍在远程主机。本机自定义的附加工具、自动动作、插件及断开后的会话恢复暂不支持。子任务被系统回收后能否继续，尚未验证。' };
+            entry = { scope, runtime, current: input, details, execution, network, ended: false, dispose: reason => {
+                    if (entry.closing)
+                        return entry.closing;
+                    entry.ended = true;
+                    entry.reason = reason;
+                    execution.invalidate(reason ?? fail('EMPLOYEE_EXEC_CLOSED'));
+                    for (const off of disposers)
+                        off();
+                    host.broker?.fail(reason ?? fail('EMPLOYEE_EXEC_CLOSED'));
+                    entry.closing = (async () => {
+                        let cleanup;
+                        try {
+                            await execution.dispose();
+                        }
+                        catch (error) {
+                            cleanup = error;
+                        }
+                        try {
+                            await host.dispose?.();
+                        }
+                        catch (error) {
+                            cleanup = error;
+                        }
+                        try {
+                            entry.details?.record({ kind: 'need', severity: 'warning', code: cleanup ? 'REMOTE_CLEANUP_UNCONFIRMED' : 'EMPLOYEE_EXEC_UNKNOWN', summary: '员工执行通道已关闭，命令结果 UNKNOWN', payload: { bindingId: admitted.bindingId, workspaceId: admitted.workspaceId, result: 'UNKNOWN', reason: reason?.code ?? 'EMPLOYEE_EXEC_CLOSED', cleanup: cleanup ? 'unconfirmed' : 'closed' } });
+                            await entry.details?.flush();
+                        }
+                        catch {
+                            throw fail('CONVERSATION_DETAILS_FAILED');
+                        }
+                        if (cleanup)
+                            throw fail('REMOTE_CLEANUP_UNCONFIRMED');
+                        if (live.get(sessionId) === entry)
+                            live.delete(sessionId);
+                    })();
+                    return entry.closing;
+                } };
+            candidate = entry;
+            runtime.employeeExecution = async (params, signal) => {
+                try {
+                    const result = await execution.handle(params, signal);
+                    if (result.closed)
+                        await entry.dispose();
+                    return { ...result };
+                }
+                catch (error) {
+                    // EmployeeExecution reserves ABORTED for an unconsumed read wait. Lost responses are UNKNOWN.
+                    if (!(params && typeof params === 'object' && 'operation' in params && params.operation === 'read' && errorCode(error) === 'ABORTED'))
+                        await entry.dispose(asNeed(error));
+                    throw error;
+                }
+            };
+            runtime.dispose = () => entry.dispose();
+            runtime.detach = runtime.dispose;
+            const revoke = (reason) => { void entry.dispose(reason).catch(() => { }); };
+            disposers.push(api.onWorkspaceLocationState(next => {
+                const matches = next.items.filter(item => item.workspaceId === admitted.workspaceId);
+                if (get() !== api || next.phase !== 'ready' || next.instanceId !== connection.instanceId || next.epoch !== connection.epoch || matches.length !== 1 || matches[0].bindingId !== admitted.bindingId || matches[0].source !== 'local' || matches[0].status !== 'selected')
+                    revoke(fail('EMPLOYEE_CONTEXT_CHANGED'));
+            }), api.onConnectionState(next => { if (get() !== api || next.phase !== 'connected' || next.instanceId !== connection.instanceId || next.epoch !== connection.epoch)
+                revoke(fail('CONNECTION_LOST')); }), network.onState(event => { if (event.kind === 'lost' || employee.getNetwork() !== network)
+                revoke(fail('CONNECTION_LOST')); }));
+            if (host.broker)
+                disposers.push(host.broker.onChange(() => { if (!host.broker.online)
+                    revoke(fail('EMPLOYEE_EXEC_UNKNOWN')); }));
+            live.set(sessionId, entry);
+            try {
+                await validate(request.signal ?? new AbortController().signal);
+            }
+            catch (error) {
+                await entry.dispose(asNeed(error));
+                throw error;
+            }
+            return runtime;
+        }
+        catch (error) {
+            details?.record({ kind: 'need', severity: 'action-required', code: errorCode(error), summary: asNeed(error).message, payload: { result: 'UNKNOWN' } });
+            try {
+                await details?.flush();
+            }
+            catch {
+                throw fail('CONVERSATION_DETAILS_FAILED');
+            }
+            throw error;
+        }
+    };
+}

package/dist/employee-relay.d.ts

@@ -0,0 +1,18 @@
+import type { EmployeeEndpointTarget } from './employee-endpoint.ts';
+/** Runs on the host. Only target discovery and SSH stdio forwarding; never user tools. */
+export declare const EMPLOYEE_TARGET_PYTHON: string;
+export declare const EMPLOYEE_PYTHON_ERRORS: string;
+export declare const EMPLOYEE_RELAY_PYTHON: string;
+export interface EmployeeRouting {
+    mcpServers: {
+        name: string;
+        command: string;
+        args: string[];
+        env: {
+            name: string;
+            value: string;
+        }[];
+    }[];
+    toolAliases: Record<string, string>;
+}
+export declare function employeeRouting(target: EmployeeEndpointTarget, socketPath: string, maxBytes: number): EmployeeRouting;