@ai-workbench/remote-agent 0.8.5 → 0.8.10

package/dist/local-user-turn.js

@@ -0,0 +1,103 @@
+import { SessionId } from '@deepseek-ai/dsh-session';
+import { isDeepStrictEqual } from 'node:util';
+import { NeedError } from "./remote.js";
+const failure = (code = 'REMOTE_DETAIL_SCOPE_INVALID') => new NeedError(code, '本轮输入无法核对，已停止本次处理。', '官方当前员工输入与所选远程品牌');
+/** CAS expectation only. L independently establishes live human-turn/brand evidence. */
+export async function readLocalUserTurn(ctx, request) {
+    request = structuredClone(request);
+    const id = SessionId(request.sessionId), sessions = ctx.get('sessions'), session = sessions?.get(id);
+    const persistence = ctx.get('sessionPersistence');
+    if (!session || typeof sessions?.flush !== 'function' || !persistence?.identity || typeof persistence.open !== 'function' || !request.userMessageIds.length)
+        throw failure();
+    const watermark = session.seq, header = structuredClone(session.header), persistenceIdentity = persistence.identity;
+    const assertCurrent = () => { if (ctx.get('sessions')?.get(id) !== session || ctx.get('sessionPersistence')?.identity !== persistenceIdentity || session.seq !== watermark || !isDeepStrictEqual(session.header, header))
+        throw failure('LOCAL_USER_TURN_CHANGED'); };
+    assertCurrent();
+    if (!await sessions.flush(session))
+        throw failure();
+    assertCurrent();
+    const handle = await persistence.open(id, 'read');
+    let proof, firstFailure;
+    try {
+        assertCurrent();
+        if (handle.id !== id || handle.access !== 'read' || !isDeepStrictEqual(handle.header, header) || handle.inheritedEventCount !== session.inheritedEventCount)
+            throw failure();
+        const { events } = await handle.read();
+        assertCurrent();
+        if (!Array.isArray(events) || events.length !== watermark)
+            throw failure();
+        let turn, step, input, route, routeContext;
+        for (let i = 0; i < events.length; i++) {
+            const e = events[i];
+            if (e.seq !== i)
+                throw failure();
+            if (e.type === 'turn/start') {
+                turn = e;
+                step = undefined;
+                input = undefined;
+            }
+            else if (e.type === 'turn/end') {
+                turn = undefined;
+                step = undefined;
+                input = undefined;
+            }
+            else if (e.type === 'step/start') {
+                step = e;
+                input = undefined;
+            }
+            else if (e.type === 'step/end') {
+                step = undefined;
+                input = undefined;
+            }
+            else if (e.type === 'user/message' && step && e.data.source.kind === 'user')
+                input = e;
+            else if (e.type === 'request/header')
+                route = e.data.header.config.provider;
+            else if (e.type === 'request/context')
+                routeContext = e.data.provider;
+        }
+        if (!turn || !step || step.data.turn !== turn.data.turn || !input || route !== request.route || routeContext !== undefined && routeContext !== request.route || !session.isOwnSeq(turn.seq) || !session.isOwnSeq(step.seq) || !session.isOwnSeq(input.seq) || !request.userMessageIds.includes(input.data.id))
+            throw failure();
+        proof = { expectedUserTurn: { turn: turn.data.turn, userMessageId: input.data.id }, startSequence: turn.seq, userMessageSequence: input.seq };
+    }
+    catch (error) {
+        firstFailure = error;
+    }
+    try {
+        await handle.close();
+    }
+    catch (error) {
+        if (firstFailure instanceof NeedError)
+            throw Object.assign(new NeedError(firstFailure.code, firstFailure.message, firstFailure.requires + '；持久句柄关闭失败'), { cause: new AggregateError([firstFailure, error], 'LOCAL_TURN_READ_AND_CLOSE_FAILED') });
+        if (firstFailure !== undefined)
+            throw new AggregateError([firstFailure, error], 'LOCAL_TURN_READ_AND_CLOSE_FAILED');
+        throw error;
+    }
+    if (firstFailure !== undefined)
+        throw firstFailure;
+    assertCurrent();
+    return { ...proof, assertCurrent };
+}
+/** Only metadata observed live since this plugin mounted; never seed or persisted tails. */
+export function createLocalUserTurnObserver(ctx) {
+    const current = new WeakMap();
+    ctx.on('session/event', (session, event) => {
+        if (event.type === 'turn/start')
+            current.set(session, { turn: event.data.turn });
+        else if (event.type === 'turn/end')
+            current.delete(session);
+        else if (event.type === 'user/message' && event.data.source.kind === 'user') {
+            const turn = current.get(session);
+            if (turn)
+                turn.userMessageId = event.data.id;
+        }
+    });
+    ctx.on('session/disposed', session => current.delete(session));
+    return { current(request) {
+            const session = request.sessionId ? ctx.get('sessions')?.get(SessionId(request.sessionId)) : undefined;
+            const metadata = session ? current.get(session) : undefined;
+            if (!metadata || !Number.isSafeInteger(metadata.turn) || metadata.turn < 0 || !metadata.userMessageId || !request.userInputIds?.includes(metadata.userMessageId))
+                throw new NeedError('LOCAL_USER_TURN_UNCONFIRMED', '无法核对本次员工输入，本轮已停止。', '本插件启用后观察到的官方真实员工输入');
+            return { turn: metadata.turn, userMessageId: metadata.userMessageId };
+        } };
+}

package/dist/presentation.d.ts

@@ -3,4 +3,4 @@ export declare const REMOTE_CODEX_NAME = "Codex\uFF08\u8FDC\u7A0B\u4E3B\u673A\uF
 export declare const CONNECTION_REQUIRED = "\u8FDC\u7A0B\u4E3B\u673A\u8FDE\u63A5\u7EC4\u4EF6\u6CA1\u6709\u88C5\u597D\uFF0C\u8BF7\u8054\u7CFB\u7BA1\u7406\u5458\u3002";
 export declare const TEST_HOST_NOTICE = "\u8FDC\u7A0B\u4E3B\u673A\u6B63\u5728\u4F7F\u7528\u6D4B\u8BD5\u914D\u7F6E\uFF0C\u9047\u5230\u95EE\u9898\u8BF7\u8054\u7CFB\u7BA1\u7406\u5458\u3002";
 /** Employee failures use business language; diagnostic codes remain separately available. */
-export declare function employeeFailure(code: string): string;
+export declare function employeeFailure(code: string, brand?: 'codex' | 'claude'): string;

package/dist/presentation.js

@@ -3,11 +3,19 @@ export const REMOTE_CODEX_NAME = 'Codex（远程主机）';
 export const CONNECTION_REQUIRED = '远程主机连接组件没有装好，请联系管理员。';
 export const TEST_HOST_NOTICE = '远程主机正在使用测试配置，遇到问题请联系管理员。';
 /** Employee failures use business language; diagnostic codes remain separately available. */
-export function employeeFailure(code) {
+export function employeeFailure(code, brand = 'codex') {
     const messages = {
+        LOCAL_USER_TURN_CHANGED: '本次输入已变化，本轮已停止，请确认对话后重新发送。',
+        LOCAL_USER_TURN_UNCONFIRMED: '无法核对本次员工输入，本轮已停止；请在当前会话重新发送。',
+        LOCAL_USER_TURN_ACCEPTANCE_INVALID: '本次输入的核验回执不一致，本轮已停止，请联系管理员。',
         TECHNICAL_DETAILS_UNAVAILABLE: '技术详情暂不可用，请更新远程主机连接组件。',
         REMOTE_DETAIL_STORAGE_FAILED: '技术详情保存失败，本轮已停止，请联系管理员检查。',
         REMOTE_DETAIL_DELIVERY_UNKNOWN: '技术详情的持久结果无法核对，本轮已停止。',
+        REMOTE_DETAIL_SCOPE_INVALID: '无法核对当前会话的技术详情，本轮已停止；我需要更新后的远程主机连接组件。',
+        EMPLOYEE_CONTEXT_UNAVAILABLE: '我需要远程主机连接组件提供当前本机工作区，本轮未执行。',
+        EMPLOYEE_ENDPOINT_UNAVAILABLE: '我需要员工电脑的执行连接就绪，本轮未执行；请联系管理员检查连接组件。',
+        EMPLOYEE_CONTEXT_CHANGED: '本机文件夹或连接已改变，原工具已停止；请在当前工作区重新开始。',
+        EMPLOYEE_WORKSPACE_INVALID: '无法核对这条对话所属的本机文件夹，本轮未执行；请在工作区中重新打开对话。',
         REMOTE_DETAIL_TOO_LARGE: '技术详情超过已配置的单事件容量，本轮已停止；请联系管理员调整conversationDetails.maxEventBytes。',
         DEPENDENCY_REQUIRED: CONNECTION_REQUIRED,
         LOGIN_REQUIRED: '需要登录，请到设置 → 远程主机连接 点登录',
@@ -33,6 +41,12 @@ export function employeeFailure(code) {
         CONTENT_UNSUPPORTED: '远程 Codex 暂不支持这类附件，请联系管理员。',
         SYSTEM_PROMPT_UPDATE_PENDING: 'Claude原会话无法保证立即应用已变化的系统或开发者要求，本轮未发送；请新建会话应用新要求。',
         SYSTEM_PROMPT_UNSUPPORTED: '远端没有声明系统与开发者上下文能力，本轮未发送；需要管理员提供支持该能力的远端适配器。',
+        SYSTEM_CONTEXT_TYPE_UNSUPPORTED: '系统或开发者要求包含暂不支持的非文本内容，本轮未新建或发送；请使用文本要求或联系管理员。',
+        RECOVERY_CONTEXT_POLICY_UNSUPPORTED: '旧版会话恢复记录仍绑定模型要求，无法安全接回；本轮未发送，请联系管理员核对原会话。',
+        SYSTEM_PROMPT_POLICY_UNSUPPORTED: '远端还不支持保留原会话并按新要求继续，请联系管理员更新远端适配器；本轮未发送。',
+        SYSTEM_PROMPT_NEW_SESSION_REQUIRED: '会话要求已变化，需要新建 Codex 会话并承接历史后继续；本轮未发送。',
+        SESSION_CONTEXT_DIGEST_INVALID: '原会话的要求记录无法核对，本轮未发送；请联系管理员核对原会话。',
+        HISTORY_CONTENT_UNSUPPORTED: '此前对话含有暂时无法完整承接的内容，本轮未新建或发送；请联系管理员检查历史内容类型。',
         SYSTEM_PROMPT_UPDATE_UNSUPPORTED: '远端不能更新原会话的系统与开发者要求，本轮未发送；请新建会话。',
         PROMPT_CONTENT_UNSUPPORTED: '远端没有声明这类输入能力，本轮未发送；请使用受支持的内容或联系管理员。',
         ATTACHMENT_REQUIRED: '我需要官方附件组件读取这张图片，请联系管理员检查组件。',
@@ -45,5 +59,35 @@ export function employeeFailure(code) {
         MODEL_RESOLUTION_UNCONFIRMED: '所选模型的具体型号尚未获得当前会话确认，本轮未发送；请重新选择模型或联系管理员。',
         REMOTE_CLEANUP_UNCONFIRMED: '原主机会话的清理结果尚未确认，已阻断继续发送；请联系管理员核对，不能自动重开。',
     };
-    return messages[code] ?? `远程主机暂时无法完成这次操作，请联系管理员。技术详情：诊断代码 ${code}`;
+    if (messages[code])
+        return messages[code];
+    if (code === 'EMPLOYEE_OPERATION_UNSUPPORTED')
+        return '当前本机工作区暂不支持单次运行和断开后的冷恢复；请使用会话模式新建会话，原记录保留可查。';
+    if (code === 'AW_EMPLOYEE_COLD_RESUME_UNSUPPORTED' || code === 'EMPLOYEE_RECOVERY_UNSUPPORTED')
+        return '当前版本暂不支持恢复已关闭的本机执行会话；请新建会话，原记录保留可查。';
+    if (code === 'AW_EMPLOYEE_HOST_AUXILIARY_CONFIG_UNSUPPORTED')
+        return '当前主机启用的MCP、hooks或插件尚未支持改到员工电脑，本轮没有执行，请联系管理员。';
+    if (code === 'AW_EMPLOYEE_HOST_PROJECT_CONFIG_UNSUPPORTED')
+        return '主机上存在与本机工作区路径重合的项目配置，当前版本无法安全应用，本轮没有执行，请联系管理员。';
+    if (code === 'AW_EMPLOYEE_EXECUTOR_MCP_UNSUPPORTED')
+        return '本机工作区配置了附加MCP工具，当前版本尚不支持这类工具，本轮没有继续执行。';
+    if (['AW_EMPLOYEE_CONFIG_ADMISSION_INVALID', 'AW_EMPLOYEE_CONFIG_ADMISSION_FAILED', 'AW_EMPLOYEE_EXECUTOR_CONFIG_PROTOCOL_INVALID', 'AW_EMPLOYEE_EXECUTOR_CONFIG_READ_FAILED'].includes(code))
+        return '无法核验这次本机工作区的助手配置，本轮没有继续执行，请联系管理员查看技术详情。';
+    if (code === 'AW_EMPLOYEE_MCP_UNSUPPORTED')
+        return '当前版本尚不支持把附加MCP工具改到员工电脑，本轮没有执行。';
+    if (code === 'AW_EMPLOYEE_HOST_AUXILIARY_UNSUPPORTED')
+        return '这项辅助操作尚未支持在员工电脑执行，本轮没有执行。';
+    if (code === 'AW_EMPLOYEE_SLASH_COMMAND_UNSUPPORTED')
+        return '这项快捷命令暂不支持本机执行，请直接描述任务。';
+    if (code === 'AW_EMPLOYEE_HOST_FILE_REPORT_UNSUPPORTED')
+        return '这项文件报告暂不支持本机工作区；请查看对话和技术详情中的已有执行记录。';
+    if (code === 'AW_EMPLOYEE_CONFIG_DISCOVERY_OVERRIDE_UNSUPPORTED')
+        return '当前助手的项目配置覆盖与本机执行不兼容，本轮没有执行，请联系管理员。';
+    if (code === 'EMPLOYEE_PLATFORM_UNSUPPORTED')
+        return brand === 'claude' ? '本机执行目前只支持Mac；当前设备尚不支持，本轮未执行。' : '当前版本的Codex本机执行仅验证了Apple芯片Mac，本轮没有执行。';
+    if (code.startsWith('AW_EMPLOYEE_BINARY_'))
+        return 'Codex本机执行组件缺失或校验失败，本轮没有执行，请联系管理员。';
+    if (code.startsWith('AW_EMPLOYEE_') || code.startsWith('EMPLOYEE_'))
+        return '员工电脑的执行连接不可用或工作区已变化，本轮已停止；在途操作结果尚待确认，请查看技术详情。';
+    return `远程主机暂时无法完成这次操作，请联系管理员。技术详情：诊断代码 ${code}`;
 }

package/dist/provider.d.ts

@@ -11,9 +11,23 @@ import type { DetailChannel } from './remote-details.ts';
 import type { WorkspaceNoticePresentation } from './workspace-notice.ts';
 import { StageTiming } from './stage-timing.ts';
 import type { RecoveryJournal, AcpRecovery } from './recovery.ts';
+import type { EmployeeProviderOptions } from './employee-provider.ts';
+import type { LocalUserTurnAcceptance } from '@ai-workbench/connect/api';
+import type { EmployeeRouting } from './employee-relay.ts';
+export interface EmployeeExecution {
+    hostCwd: string;
+    routing: EmployeeRouting;
+    notice: string;
+    scope: Record<string, unknown>;
+    signal?: AbortSignal;
+    beginTurn(signal: AbortSignal): Promise<void>;
+    endTurn(): void;
+    validate(signal?: AbortSignal): Promise<void>;
+}
 export interface Runtime {
     identity: string;
     cwd: string;
+    execution?: EmployeeExecution;
     acpTransport?: {
         writable: WritableStream<Uint8Array>;
         readable: ReadableStream<Uint8Array>;
@@ -39,13 +53,28 @@ export interface Runtime {
         turn: string | number | null;
         step: string | number | null;
     };
+    employeeExecutionMeta?: {
+        version: 1;
+        bindingId: string;
+        workspaceId: string;
+        cwd: string;
+        acpMaxMessageBytes: number;
+    };
+    employeeExecution?: (params: unknown, signal?: AbortSignal) => Promise<Record<string, unknown>>;
+    employeePresentation?: string;
 }
 export interface RuntimeRequest extends Invocation {
+    userInputIds?: readonly string[];
+    localAcceptance?: Readonly<LocalUserTurnAcceptance>;
+    localAdmissionCheck?: () => void;
+    readonly localAcceptanceId?: string;
+    userMessageIds?: readonly string[];
     recoveryJournal?: RecoveryJournal;
     detailChannel?: DetailChannel;
     validateContext?: (ignoreCancellation?: boolean) => Promise<void>;
     verifyRecovery?: () => Promise<boolean>;
     acpMaxMessageBytes?: number;
+    employeeScope?: string;
     contextSha256?: string;
     resumeSessionId?: string;
     recoveryCheckpointId?: string;
@@ -106,7 +135,7 @@ type Result<T> = {
     } & Pick<ConnectNeed, 'officialReason'>;
 };
 /** 消费正式connect-api 0.7公开子集；X不响应L登录票据、不直接调用登录。 */
-export interface ConnectApi extends Pick<LConnectApi, 'getConnectionState' | 'getLoginPromptState' | 'requestLoginPrompt' | 'refreshLoginPrompts'>, Partial<NativeWorkspaceApi>, Partial<Pick<LConnectApi, 'getWorkspaceBindingState' | 'getModelCatalogTarget' | 'onConnectionState' | 'onLoginPromptState' | 'appendRemoteConversationDetail' | 'getRemoteConversationDetailReceipt' | 'listRemoteConversationDetails'>> {
+export interface ConnectApi extends Pick<LConnectApi, 'getConnectionState' | 'getLoginPromptState' | 'requestLoginPrompt' | 'refreshLoginPrompts'>, Partial<NativeWorkspaceApi>, Partial<Pick<LConnectApi, 'getWorkspaceBindingState' | 'getModelCatalogTarget' | 'onConnectionState' | 'onLoginPromptState' | 'appendRemoteConversationDetail' | 'getRemoteConversationDetailReceipt' | 'listRemoteConversationDetails' | 'getWorkspaceLocationState' | 'getLocalWorkspaceContext' | 'onWorkspaceLocationState' | 'acceptLocalWorkspaceUserTurn'>> {
     getState?(): ConnectState;
     getSshTarget(): Promise<Result<ConnectTarget>>;
     checkLogin(provider: LoginProvider): Promise<Result<{
@@ -130,7 +159,7 @@ export declare function requireLoginCoordinator(api: ConnectApi): void;
 export declare function requireLoginState(state: LoginPromptState): void;
 declare module '@deepseek-ai/cordis' {
     interface Context {
-        aiWorkbenchConnect: ConnectApi;
+        aiWorkbenchConnect: LConnectApi;
     }
     interface Events {
         'ai-workbench/connection-state': (state: ConnectionState) => void;
@@ -152,11 +181,16 @@ export interface NoticeConsumer {
     reconcile(request: RuntimeRequest, api: ConnectApi): Promise<void>;
     deliver(notice: WorkspaceNotice, resolved: SessionProjectTarget, request: RuntimeRequest, api: ConnectApi): Promise<WorkspaceNoticePresentation | void>;
 }
+export type LocalRuntimeProvider = ((request: RuntimeRequest, api: ConnectApi, connection: ConnectionState, target: ConnectTarget) => Promise<Runtime | undefined>) & {
+    admit?: (request: RuntimeRequest, api: ConnectApi, connection: ConnectionState, target: ConnectTarget) => Promise<void>;
+};
 export declare function sameTarget(a: ConnectTarget, b: ConnectTarget): boolean;
 export declare function connectProvider(get: () => ConnectApi | undefined, options?: {
     agent?: AgentDefinition;
     ask?: Interaction;
     notice?: NoticeConsumer;
+    employee?: EmployeeProviderOptions;
+    local?: LocalRuntimeProvider;
     details?: (request: RuntimeRequest, api: ConnectApi, connection: ConnectionState, target: ConnectTarget) => Promise<DetailChannel>;
     open?: (target: ConnectTarget, project: Project, request: RuntimeRequest) => Promise<Runtime>;
 }): RuntimeProvider;

package/dist/provider.js

@@ -154,6 +154,9 @@ export function sameTarget(a, b) {
 }
 export function connectProvider(get, options = {}) {
     const agent = options.agent ?? CODEX_AGENT;
+    // Keep the legacy source SDK wrapper's strip-only import graph free of broker runtime syntax.
+    // Cache the initialization promise so concurrent sessions share this provider's binding lifetimes.
+    let employee;
     const admissions = new WeakMap();
     const preflight = async (request) => {
         request.timing ??= new StageTiming();
@@ -165,7 +168,12 @@ export function connectProvider(get, options = {}) {
         requireLoginCoordinator(api);
         if (request.mode === 'one-shot' && !agent.oneShot)
             throw new NeedError('MODE_UNSUPPORTED', '此远程模型仅支持会话模式', '使用会话模式');
+        if (options.employee) {
+            const module = await import("./employee-provider.js");
+            request.localAcceptance = await module.acceptEmployeeUserTurn(get, options.employee, agent, api, request);
+        }
         const { target, connection } = await request.timing.run('login-ready', async () => {
+            request.localAdmissionCheck?.();
             const before = api.getConnectionState();
             const target = await ensureReady(api, agent.loginProvider, request.signal);
             validateTarget(target);
@@ -177,7 +185,11 @@ export function connectProvider(get, options = {}) {
         });
         if (request.identity && request.identity !== identity(target))
             throw new NeedError('SESSION_CONTEXT_MISMATCH', '员工主机与原会话不一致，请新建会话', '原员工主机');
+        if (options.employee && request.localAcceptance)
+            await (await import("./employee-provider.js")).validateEmployeeUserTurn(get, options.employee, api, request, connection);
+        request.localAdmissionCheck?.();
         admissions.set(request, { api, target, connection });
+        await options.local?.admit?.(request, api, connection, target);
     };
     const resolve = async (request) => {
         if (!admissions.has(request))
@@ -189,6 +201,27 @@ export function connectProvider(get, options = {}) {
         await stable();
         if (!request.sessionId)
             throw new NeedError('PROJECT_BINDING_REQUIRED', '我需要当前会话和已选择的工作区，请使用原生工作区入口', 'DSH会话与原生工作区');
+        if (options.employee) {
+            employee ??= import("./employee-provider.js").then(module => module.createEmployeeProvider(get, options, agent));
+            const local = await (await employee)({ api, target, connection, request, stable: signal => request.timing.run('connection-confirm', () => waitForLogin(api, agent.loginProvider, connection, get, signal)) });
+            if (local) {
+                local.loginRequired = () => offerLogin(api, request, get, agent);
+                return local;
+            }
+        }
+        if (agent.loginProvider === 'claude' && options.local) {
+            const runtime = await options.local(request, api, connection, target);
+            if (runtime) {
+                try {
+                    await stable();
+                }
+                catch (error) {
+                    await runtime.dispose?.();
+                    throw error;
+                }
+                return runtime;
+            }
+        }
         await options.notice?.reconcile(request, api);
         await stable();
         const resolved = await request.timing.run('workspace-resolve', async () => unwrap(await awaitL(() => api.resolveSessionProject(request.sessionId, { provider: agent.loginProvider, purpose: 'user-turn' }), request.signal)));

package/dist/readiness.js

@@ -46,7 +46,7 @@ function details(target) {
     return [{ label: '主机配置', value: h.enforcement }, { label: '检查退出码', value: String(h.checkExitCode) }, ...h.failedChecks.map(item => ({ label: '未通过检查', value: `${item.id}（${item.status}）` })), ...h.unverifiedChecks.map(item => ({ label: '未核实检查', value: `${item.id}（${item.status}）` }))];
 }
 function blocked(code, technical = [], agent = CODEX_AGENT) {
-    return { phase: 'blocked', loginStatus: 'unknown', title: `无法确认 ${agent.name.zh} 登录状态`, message: employeeFailure(code), technical: [...technical, { label: '诊断代码', value: code }] };
+    return { phase: 'blocked', loginStatus: 'unknown', title: `无法确认 ${agent.name.zh} 登录状态`, message: employeeFailure(code, agent.loginProvider), technical: [...technical, { label: '诊断代码', value: code }] };
 }
 /** L owns both evidence and inquiry. Missing per-brand evidence is never false. */
 function snapshot(api, agent = CODEX_AGENT) {

package/dist/recovery.d.ts

@@ -27,8 +27,21 @@ export interface RecoveryJournal {
     write(state: RecoveryState): Promise<void>;
 }
 export declare function validateRecovery(value: unknown): RecoveryState;
-/** Only negotiated booleans/known empty capability markers, never agent metadata. */
+export declare const codexContextPolicy: Readonly<{
+    version: 1;
+    scope: "new-session";
+    mode: "append";
+    content: "text";
+    resume: "omit-only";
+    changed: "new-session-required";
+    mapping: "developerInstructions";
+    nativeCliUnmodified: true;
+}>;
+export declare function supportsCodexContextPolicy(capabilities: AgentCapabilities): boolean;
+/** Known capabilities plus the exact Codex policy whitelist; no arbitrary metadata. */
 export declare function recoveryCapabilities(c: AgentCapabilities): AgentCapabilities;
 export declare function recoveryKey(value: unknown): string;
+/** Preserve legacy lookup bytes; each employee endpoint scope owns a separate journal. */
+export declare function runtimeRecoveryKey(identity: string, provider: string, sessionId: string | undefined, employeeScope?: string): string;
 /** History is immutable; current is atomically replaced only after fsync. No expiry. */
 export declare function recoveryJournal(profileDir: string, key: string): RecoveryJournal;

package/dist/recovery.js

@@ -15,11 +15,20 @@ export function validateRecovery(value) {
         throw invalid();
     return structuredClone(s);
 }
-/** Only negotiated booleans/known empty capability markers, never agent metadata. */
+export const codexContextPolicy = Object.freeze({ version: 1, scope: 'new-session', mode: 'append', content: 'text', resume: 'omit-only', changed: 'new-session-required', mapping: 'developerInstructions', nativeCliUnmodified: true });
+export function supportsCodexContextPolicy(capabilities) {
+    const policy = capabilities._meta?.aiWorkbenchSystemPrompt;
+    return !!policy && typeof policy === 'object' && !Array.isArray(policy) && Object.keys(policy).length === Object.keys(codexContextPolicy).length && Object.entries(codexContextPolicy).every(([key, value]) => policy[key] === value);
+}
+/** Known capabilities plus the exact Codex policy whitelist; no arbitrary metadata. */
 export function recoveryCapabilities(c) {
-    return { loadSession: c.loadSession === true, promptCapabilities: { image: c.promptCapabilities?.image === true, audio: c.promptCapabilities?.audio === true, embeddedContext: c.promptCapabilities?.embeddedContext === true }, sessionCapabilities: { ...(c.sessionCapabilities?.resume ? { resume: {} } : {}), ...(c.sessionCapabilities?.systemPrompt ? { systemPrompt: {} } : {}) } };
+    return { loadSession: c.loadSession === true, promptCapabilities: { image: c.promptCapabilities?.image === true, audio: c.promptCapabilities?.audio === true, embeddedContext: c.promptCapabilities?.embeddedContext === true }, sessionCapabilities: { ...(c.sessionCapabilities?.resume ? { resume: {} } : {}), ...(c.sessionCapabilities?.systemPrompt ? { systemPrompt: {} } : {}) }, ...(supportsCodexContextPolicy(c) ? { _meta: { aiWorkbenchSystemPrompt: { ...codexContextPolicy } } } : {}) };
 }
 export function recoveryKey(value) { return createHash('sha256').update(JSON.stringify(value)).digest('hex'); }
+/** Preserve legacy lookup bytes; each employee endpoint scope owns a separate journal. */
+export function runtimeRecoveryKey(identity, provider, sessionId, employeeScope) {
+    return recoveryKey([identity, provider, sessionId, ...(employeeScope ? ['employee', employeeScope] : [])]);
+}
 /** History is immutable; current is atomically replaced only after fsync. No expiry. */
 export function recoveryJournal(profileDir, key) {
     if (!/^[a-f0-9]{64}$/.test(key))

package/dist/remote-details.d.ts

@@ -18,6 +18,7 @@ export interface DetailRequest {
     provider: 'claude' | 'codex';
     identity: string;
     connection: Connection;
+    readonly localAcceptanceId?: string;
 }
 export declare function privateDirectory(path: string): Promise<void>;
 export declare function durableWrite(path: string, value: unknown): Promise<void>;
@@ -26,6 +27,12 @@ export declare function createRemoteDetails(options: {
     profileDir: string;
     getApi: () => RemoteDetailsApi | undefined;
 }): {
+    recordLocalFailure(request: {
+        sessionId?: string;
+        provider: "claude" | "codex";
+        code: string;
+        observation?: DetailObservation;
+    }): Promise<void>;
     recordLoginFailure(request: {
         sessionId?: string;
         code: string;

package/dist/remote-details.js

@@ -91,6 +91,12 @@ export function createRemoteDetails(options) {
     const scopes = new Map(), loginScopes = new Map();
     const initialize = async () => { await privateDirectory(join(options.profileDir, 'ai-workbench-remote-agent')); await privateDirectory(root); };
     return {
+        async recordLocalFailure(request) {
+            await initialize();
+            if (!/^[A-Z][A-Z0-9_]*$/.test(request.code))
+                throw failure('REMOTE_DETAIL_STORAGE_FAILED');
+            await durableWrite(join(root, randomUUID() + '.json'), { version: 1, kind: 'local-admission', code: request.code, provider: request.provider, sessionHash: request.sessionId ? hash(request.sessionId) : null, ...request.observation ? { observation: sanitizeObservation(request.observation, true) } : {} });
+        },
         async recordLoginFailure(request) {
             await initialize();
             const eventId = randomUUID(), diagnostic = request.diagnostic;
@@ -221,6 +227,10 @@ export function createRemoteDetails(options) {
             return { eventId, recorded: true };
         },
         async open(request) {
+            request = structuredClone(request);
+            if (request.localAcceptanceId !== undefined && (typeof request.localAcceptanceId !== 'string' || !request.localAcceptanceId.trim()))
+                throw failure('REMOTE_DETAIL_SCOPE_INVALID');
+            const localScope = request.localAcceptanceId === undefined ? undefined : Object.freeze({ localAcceptanceId: request.localAcceptanceId });
             if (!request.sessionId || !request.identity || !request.connection.instanceId || !Number.isSafeInteger(request.connection.epoch) || request.connection.epoch < 0 || !['claude', 'codex'].includes(request.provider))
                 throw failure('REMOTE_DETAIL_SCOPE_INVALID');
             try {
@@ -348,7 +358,7 @@ export function createRemoteDetails(options) {
                         stable();
                         let response;
                         try {
-                            response = await api.appendRemoteConversationDetail(structuredClone(detail));
+                            response = await (localScope === undefined ? api.appendRemoteConversationDetail(structuredClone(detail)) : api.appendRemoteConversationDetail(structuredClone(detail), localScope));
                         }
                         catch {
                             stable();

package/helpers/ripgrep/LICENSE-vscode

@@ -0,0 +1,13 @@
+vscode-ripgrep
+
+Copyright (c) Microsoft Corporation
+
+All rights reserved.
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the ""Software""), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/helpers/ripgrep/PROVENANCE.md

@@ -0,0 +1,9 @@
+# Bundled Mac search component
+
+Original unmodified binaries from Microsoft @vscode/ripgrep-universal 1.18.0. The npm integrity/SHA256, per-file SHA/bytes and upstream release archives are in manifest.json. Both npm binaries were compared byte for byte with the pinned Microsoft release assets (v15.0.1). No employee download/install hook or PATH lookup.
+
+Microsoft packaging tag v1.18.0 commit d22dec46c67fc8c5d307c9b18dba2792efd1f016 locks ripgrep-prebuilt v15.0.1 commit 67202aaafb17aecd9b5b7046d5b7baa92b05237a. Its config pins upstream ripgrep15.0.0 plus the retained Microsoft patch (Windows/ARM-musl adjustments); reported binaries are ripgrep15.0.0 with PCRE2 10.45. Upstream source: https://github.com/BurntSushi/ripgrep/tree/15.0.0 ; vendor source/config: https://github.com/microsoft/ripgrep-prebuilt/tree/v15.0.1 ; npm wrapper: https://github.com/microsoft/vscode-ripgrep/tree/v1.18.0 . Source-input hashes are retained in manifest.json. This is vendor artifact provenance, not a local reproducible build attestation; exact vendor compiler invocation/runtime std build was not independently attested.
+
+LICENSE-vscode retains Microsoft packaging MIT text. notices/ contains ripgrep MIT/Unlicense/COPYING, PCRE2 licence, and a conservative full upstream Cargo.lock dependency superset plus Microsoft's Windows-only msvc_spectre_libs. Every crate archive matches its Cargo checksum; DEPENDENCIES.json identifies original package, version, licence and retained texts. r-efi licence is embedded in AUTHORS. wasip2 texts omitted from its crate were retrieved at its .cargo_vcs_info.json exact source commit. Superset inclusion is not a claim all non-Mac/build/test crates are linked into these Mac binaries. prepare-ripgrep-notices.py regenerates notices from the retained pinned inputs.
+
+Runtime validates shipped rg size/SHA256, executable regular file, macOS arm64/x64 only. No strip/sign/byte alteration by X. Arm64 actual PCRE2 operation is fixture-tested; x64 is byte/inventory verified, not executed on this arm64 Mac. macOS SDK/system libraries are supplied by the OS; binaries have no Homebrew dylib dependency. The plugin message/output bound uses named acpMaxMessageBytes. Other platforms fail explicitly rather than host fallback.

package/helpers/ripgrep/manifest.json

@@ -0,0 +1,56 @@
+{
+  "npm": "@vscode/ripgrep-universal@1.18.0",
+  "source": "https://registry.npmjs.org/@vscode/ripgrep-universal/-/ripgrep-universal-1.18.0.tgz",
+  "archiveSha256": "76a03f429dc13a90f53b60995211a54308ab4f67b2521bac00f9c4be953dff52",
+  "integrity": "sha512-kgrAVy1L/v/8erAjo+I720ifTf7o4rvYUwgsuEu97XAEBtPT9sk3HhcSgFpxMydvNmwdJtXo9/AVee7JjocTrg==",
+  "files": {
+    "darwin-arm64": {
+      "bytes": 4528512,
+      "sha256": "6ef40346bf31fcce79d9614c7745c198542925a0c7d4911e1ffe794c53392ac1"
+    },
+    "darwin-x64": {
+      "bytes": 4742676,
+      "sha256": "f999495980a5e6f1e7d26461ef5768b4013a62df610ed7d77a8b2de247a5b228"
+    }
+  },
+  "vendorRelease": "microsoft/ripgrep-prebuilt@v15.0.1",
+  "vendorCommit": "67202aaafb17aecd9b5b7046d5b7baa92b05237a",
+  "sourceRipgrep": "BurntSushi/ripgrep@15.0.0",
+  "reportedVersion": "ripgrep 15.0.0 / PCRE2 10.45",
+  "sourceInputs": [
+    {
+      "file": "vscode-build.json",
+      "sha256": "fcf6b245175385854a06785ae990546fe0d197ceb65ec9ca58860a5817f07abd"
+    },
+    {
+      "file": "vscode-binaries.lock.json",
+      "sha256": "0bd421f46e3ee2f127290f67e73adb240e1311162d6d33c25121849e5f2beadc"
+    },
+    {
+      "file": "prebuilt-config.json",
+      "sha256": "71bc7b3ecdd5442001f74896a738eafb3b831ee5a183e128067fe6b6d6b64ea7"
+    },
+    {
+      "file": "prebuilt-build-build.sh",
+      "sha256": "cf0d97cafca064c763d3ceeebe8b2f7647f5b4b35710b37c74804a4d3e1b3929"
+    },
+    {
+      "file": "prebuilt-patches-0001-resolve-binskim-issues.patch",
+      "sha256": "45f8b58bba714c446de407f93120f557736b45fad6f43ea283077201646a1be7"
+    },
+    {
+      "file": "ripgrep-lock",
+      "sha256": "257bfa1eeacfa4d8222e2c50f9d2f8d15ef07e96adee46eaa87839f3b6cfa3b4"
+    }
+  ],
+  "vendorArchives": {
+    "darwin-arm64": {
+      "sha256": "2fa16464fd8638588a67c7fc172d3c4b57fbdc65dff366e10b0b0e90734628a6",
+      "url": "https://github.com/microsoft/ripgrep-prebuilt/releases/download/v15.0.1/ripgrep-v15.0.1-aarch64-apple-darwin.tar.gz"
+    },
+    "darwin-x64": {
+      "sha256": "591c693e80bb444ef1907b2a906feb9c77bcafe1cdf509107cc75dcf0e875bd2",
+      "url": "https://github.com/microsoft/ripgrep-prebuilt/releases/download/v15.0.1/ripgrep-v15.0.1-x86_64-apple-darwin.tar.gz"
+    }
+  }
+}

package/helpers/ripgrep/notices/COPYING-ripgrep

@@ -0,0 +1,3 @@
+This project is dual-licensed under the Unlicense and MIT licenses.
+
+You may use this code under the terms of either license.