@ai-workbench/remote-agent 0.8.5 → 0.8.11

package/dist/model-input-retention.js

@@ -0,0 +1,129 @@
+import { LlmError } from '@deepseek-ai/dsh-llm';
+import { Session } from '@deepseek-ai/dsh-session';
+import { isDeepStrictEqual } from 'node:util';
+const preparationFailures = new WeakMap();
+/** Mark only at the actual X adapter's preparation catch, then rethrow the same
+ * error. One error object can prove only its first preparation, for that signal.
+ * Public request config is an intermediate proposal and is not route evidence. */
+export function markModelPreparationFailure(provider, error, signal) {
+    if (!signal || signal.aborted || error === null || typeof error !== 'object' || preparationFailures.has(error))
+        return;
+    preparationFailures.set(error, { provider, signal, consumed: false });
+}
+// Even a source-proven unknown early failure is deliberately not replayed.
+const preparationCodes = new Set(['MODEL_REQUIRED', 'MODEL_CATALOG_UNAVAILABLE', 'INVALID_MODEL_INFO', 'INVALID_MODEL_CONTEXT', 'INVALID_MODEL_MAX_TOKENS', 'INVALID_MODEL_REASONING', 'UNSUPPORTED_REASONING_EFFORT']);
+function codeOf(error) {
+    const code = error !== null && typeof error === 'object' && 'code' in error ? error.code : undefined;
+    return typeof code === 'string' && /^[A-Z][A-Z0-9_]*$/u.test(code) ? code : undefined;
+}
+function committed(events, messages) {
+    return events.some(event => event.type === 'user/message' && messages.some(message => message.id === event.data.id));
+}
+/**
+ * Retain a claimed human batch only after a known, undispatched metadata prepare
+ * failure. Restoration uses the public durable inbox without sending or waking
+ * the agent. This cannot cover errors before pre-step/request, or unknown core
+ * admission failures; it never manufactures transcript messages or model routes.
+ */
+export function installModelInputRetention(ctx, options) {
+    const attempts = new Map();
+    let disposed = false;
+    const live = (a) => !disposed && attempts.get(a.agent) === a && !a.signal.aborted
+        && ctx.get('agents')?.get(a.agent.id) === a.agent && ctx.get('sessions')?.get(a.session.id) === a.session && a.agent.session === a.session;
+    const safe = (a) => {
+        const events = a.session.snapshotEvents();
+        return !a.dispatched && !committed(events, a.messages) && !events.slice(a.offset).some(event => event.type === 'request/header' || event.type === 'assistant/message' || event.type === 'assistant/attempt');
+    };
+    const report = (a, message) => { if (!disposed && a.provider)
+        options.diagnostic(a.provider, message); };
+    const restore = async (a, originalCode) => {
+        try {
+            await a.agent.whenIdle();
+            if (!live(a) || !safe(a))
+                return;
+            // Claim true idle synchronously. A competing maintenance claim is reported,
+            // not retried. Input waking during this task remains the driver's own work.
+            await a.agent.runMaintenance(async (signal) => {
+                if (!live(a) || signal.aborted || !safe(a))
+                    return;
+                const queue = [...a.agent.inbox.nextTurn, ...a.agent.inbox.nextStep];
+                if (a.messages.some(message => queue.some(item => item.id === message.id)))
+                    return;
+                a.agent.inbox.splice('next-turn', 0, 0, a.messages);
+                const store = ctx.get('sessions'), persistence = ctx.get('sessionPersistence');
+                if (!store || typeof persistence?.open !== 'function' || !await store.flush(a.session))
+                    throw Object.assign(new Error('缺少官方持久化能力'), { code: 'INPUT_RETENTION_PERSISTENCE_REQUIRED' });
+                if (!live(a) || signal.aborted)
+                    return;
+                const handle = await persistence.open(a.session.id, 'read');
+                try {
+                    if (handle.id !== a.session.id || handle.header?.id !== a.session.id || handle.access !== 'read')
+                        throw Object.assign(new Error('持久会话身份不符'), { code: 'INPUT_RETENTION_VERIFY_FAILED' });
+                    const { events } = await handle.read();
+                    // Replay through the official Session validator and registered inbox fold,
+                    // including exact fork metadata. Do not normalize invalid durable splices.
+                    const replay = Session.create(a.session.id, events, handle.header, handle.inheritedEventCount);
+                    const inbox = ctx.get('sessionProjections')?.snapshot(replay, ['inbox']).values.inbox;
+                    if (!inbox)
+                        throw Object.assign(new Error('缺少官方待发队列投影'), { code: 'INPUT_RETENTION_PROJECTION_REQUIRED' });
+                    const restored = [...inbox['next-turn'], ...inbox['next-step']];
+                    if (committed(events, a.messages) || a.messages.some(message => restored.filter(item => item !== null && typeof item === 'object' && !Array.isArray(item) && item.id === message.id).length !== 1 || !restored.some(item => isDeepStrictEqual(item, message))))
+                        throw Object.assign(new Error('持久待发队列核对失败'), { code: 'INPUT_RETENTION_VERIFY_FAILED' });
+                }
+                finally {
+                    await handle.close();
+                }
+                if (live(a) && !signal.aborted)
+                    report(a, `本次模型准备失败，员工原话已保留在待发送队列；请先选择模型或修正设置后手动发送。没有自动重试。（诊断代码：${originalCode}）`);
+            });
+        }
+        catch (error) {
+            report(a, `本次模型准备失败；员工原话的恢复或持久化未能确认，请联系管理员核对，不要重复发送。没有自动重试。（原诊断代码：${originalCode}；恢复诊断代码：${codeOf(error) ?? 'INPUT_RETENTION_FAILED'}）`);
+        }
+        finally {
+            if (attempts.get(a.agent) === a)
+                attempts.delete(a.agent);
+        }
+    };
+    ctx.on('agent/pre-step', async (payload, next) => {
+        const decision = await next();
+        if (disposed)
+            return decision;
+        const messages = payload.messages.filter(message => message.source.kind === 'user');
+        if (decision.kind !== 'enter' || messages.length === 0 || messages.some(message => !decision.messages.some(accepted => accepted === message || isDeepStrictEqual(accepted, message)))) {
+            attempts.delete(payload.agent);
+            return decision;
+        }
+        attempts.set(payload.agent, { agent: payload.agent, session: payload.agent.session, turn: payload.turn, step: payload.step, signal: payload.signal, messages, offset: payload.agent.session.snapshotEvents().length, scheduled: false, dispatched: false });
+        return decision;
+    });
+    ctx.on('agent/request', async (payload, next) => {
+        const config = await next(), a = attempts.get(payload.agent);
+        if (a && a.turn === payload.turn && a.step === payload.step && a.signal === payload.signal && options.isOurProvider(config.provider)) {
+            if (!config.model?.trim()) {
+                const error = new LlmError('请先选择模型', 'MODEL_REQUIRED');
+                markModelPreparationFailure(config.provider, error, payload.signal);
+                throw error;
+            }
+        }
+        return config;
+    });
+    ctx.on('agent/assistant-stream', ({ agent, frame }) => { const a = attempts.get(agent); if (a && frame.type === 'start' && frame.turn === a.turn && frame.step === a.step)
+        a.dispatched = true; });
+    ctx.on('agent/error', ({ agent, turn, step, error }) => {
+        const a = attempts.get(agent), code = codeOf(error);
+        const proof = error !== null && typeof error === 'object' ? preparationFailures.get(error) : undefined;
+        if (!a || a.turn !== turn || a.step !== step || !proof || proof.consumed || proof.signal !== a.signal || !options.isOurProvider(proof.provider))
+            return;
+        // Consume before further checks: canceled/unsafe attempts must not leave a
+        // reusable proof that could authorize a later failure of the same object.
+        proof.consumed = true;
+        if (a.scheduled || !code || !preparationCodes.has(code) || !live(a) || !safe(a))
+            return;
+        a.provider = proof.provider;
+        a.scheduled = true;
+        void restore(a, code);
+    });
+    ctx.on('agent/disposed', ({ agent }) => { attempts.delete(agent); });
+    ctx.effect(() => () => { disposed = true; attempts.clear(); });
+}

package/dist/presentation.d.ts

@@ -3,4 +3,4 @@ export declare const REMOTE_CODEX_NAME = "Codex\uFF08\u8FDC\u7A0B\u4E3B\u673A\uF
 export declare const CONNECTION_REQUIRED = "\u8FDC\u7A0B\u4E3B\u673A\u8FDE\u63A5\u7EC4\u4EF6\u6CA1\u6709\u88C5\u597D\uFF0C\u8BF7\u8054\u7CFB\u7BA1\u7406\u5458\u3002";
 export declare const TEST_HOST_NOTICE = "\u8FDC\u7A0B\u4E3B\u673A\u6B63\u5728\u4F7F\u7528\u6D4B\u8BD5\u914D\u7F6E\uFF0C\u9047\u5230\u95EE\u9898\u8BF7\u8054\u7CFB\u7BA1\u7406\u5458\u3002";
 /** Employee failures use business language; diagnostic codes remain separately available. */
-export declare function employeeFailure(code: string): string;
+export declare function employeeFailure(code: string, brand?: 'codex' | 'claude'): string;

package/dist/presentation.js

@@ -3,11 +3,25 @@ export const REMOTE_CODEX_NAME = 'Codex（远程主机）';
 export const CONNECTION_REQUIRED = '远程主机连接组件没有装好，请联系管理员。';
 export const TEST_HOST_NOTICE = '远程主机正在使用测试配置，遇到问题请联系管理员。';
 /** Employee failures use business language; diagnostic codes remain separately available. */
-export function employeeFailure(code) {
+export function employeeFailure(code, brand = 'codex') {
     const messages = {
+        WORKSPACE_SOURCE_CONFIRMATION_DECLINED: '你没有确认改用本机文件夹，本轮未执行；你的原话仍保留。',
+        WORKSPACE_SOURCE_CONFIRMATION_UNAVAILABLE: '我需要打开工作区来源确认，目前无法显示确认动作；本轮未执行，你的原话仍保留。',
+        WORKSPACE_SOURCE_SELECTION_UNCONFIRMED: '无法核对工作区来源的确认结果，本轮已停止；你的原话仍保留。',
+        WORKSPACE_SOURCE_CONFIRMATION_FAILED: '工作区来源确认未完成，本轮已停止；你的原话仍保留。',
+        WORKSPACE_LOCATION_REQUIRED: '我需要你确认这个工作区使用哪一个文件夹，本轮未执行；你的原话仍保留。',
+        WORKSPACE_LOCATION_CONFLICT: '工作区来源选择已更新，本次确认不能覆盖新的选择；本轮未执行，你的原话仍保留。',
+        LOCAL_USER_TURN_CHANGED: '本次输入已变化，本轮已停止，请确认对话后重新发送。',
+        LOCAL_USER_TURN_UNCONFIRMED: '无法核对本次员工输入，本轮已停止；请在当前会话重新发送。',
+        LOCAL_USER_TURN_ACCEPTANCE_INVALID: '本次输入的核验回执不一致，本轮已停止，请联系管理员。',
         TECHNICAL_DETAILS_UNAVAILABLE: '技术详情暂不可用，请更新远程主机连接组件。',
         REMOTE_DETAIL_STORAGE_FAILED: '技术详情保存失败，本轮已停止，请联系管理员检查。',
         REMOTE_DETAIL_DELIVERY_UNKNOWN: '技术详情的持久结果无法核对，本轮已停止。',
+        REMOTE_DETAIL_SCOPE_INVALID: '无法核对当前会话的技术详情，本轮已停止；我需要更新后的远程主机连接组件。',
+        EMPLOYEE_CONTEXT_UNAVAILABLE: '我需要远程主机连接组件提供当前本机工作区，本轮未执行。',
+        EMPLOYEE_ENDPOINT_UNAVAILABLE: '我需要员工电脑的执行连接就绪，本轮未执行；请联系管理员检查连接组件。',
+        EMPLOYEE_CONTEXT_CHANGED: '本机文件夹或连接已改变，原工具已停止；请在当前工作区重新开始。',
+        EMPLOYEE_WORKSPACE_INVALID: '无法核对这条对话所属的本机文件夹，本轮未执行；请在工作区中重新打开对话。',
         REMOTE_DETAIL_TOO_LARGE: '技术详情超过已配置的单事件容量，本轮已停止；请联系管理员调整conversationDetails.maxEventBytes。',
         DEPENDENCY_REQUIRED: CONNECTION_REQUIRED,
         LOGIN_REQUIRED: '需要登录，请到设置 → 远程主机连接 点登录',
@@ -33,6 +47,12 @@ export function employeeFailure(code) {
         CONTENT_UNSUPPORTED: '远程 Codex 暂不支持这类附件，请联系管理员。',
         SYSTEM_PROMPT_UPDATE_PENDING: 'Claude原会话无法保证立即应用已变化的系统或开发者要求，本轮未发送；请新建会话应用新要求。',
         SYSTEM_PROMPT_UNSUPPORTED: '远端没有声明系统与开发者上下文能力，本轮未发送；需要管理员提供支持该能力的远端适配器。',
+        SYSTEM_CONTEXT_TYPE_UNSUPPORTED: '系统或开发者要求包含暂不支持的非文本内容，本轮未新建或发送；请使用文本要求或联系管理员。',
+        RECOVERY_CONTEXT_POLICY_UNSUPPORTED: '旧版会话恢复记录仍绑定模型要求，无法安全接回；本轮未发送，请联系管理员核对原会话。',
+        SYSTEM_PROMPT_POLICY_UNSUPPORTED: '远端还不支持保留原会话并按新要求继续，请联系管理员更新远端适配器；本轮未发送。',
+        SYSTEM_PROMPT_NEW_SESSION_REQUIRED: '会话要求已变化，需要新建 Codex 会话并承接历史后继续；本轮未发送。',
+        SESSION_CONTEXT_DIGEST_INVALID: '原会话的要求记录无法核对，本轮未发送；请联系管理员核对原会话。',
+        HISTORY_CONTENT_UNSUPPORTED: '此前对话含有暂时无法完整承接的内容，本轮未新建或发送；请联系管理员检查历史内容类型。',
         SYSTEM_PROMPT_UPDATE_UNSUPPORTED: '远端不能更新原会话的系统与开发者要求，本轮未发送；请新建会话。',
         PROMPT_CONTENT_UNSUPPORTED: '远端没有声明这类输入能力，本轮未发送；请使用受支持的内容或联系管理员。',
         ATTACHMENT_REQUIRED: '我需要官方附件组件读取这张图片，请联系管理员检查组件。',
@@ -45,5 +65,35 @@ export function employeeFailure(code) {
         MODEL_RESOLUTION_UNCONFIRMED: '所选模型的具体型号尚未获得当前会话确认，本轮未发送；请重新选择模型或联系管理员。',
         REMOTE_CLEANUP_UNCONFIRMED: '原主机会话的清理结果尚未确认，已阻断继续发送；请联系管理员核对，不能自动重开。',
     };
-    return messages[code] ?? `远程主机暂时无法完成这次操作，请联系管理员。技术详情：诊断代码 ${code}`;
+    if (messages[code])
+        return messages[code];
+    if (code === 'EMPLOYEE_OPERATION_UNSUPPORTED')
+        return '当前本机工作区暂不支持单次运行和断开后的冷恢复；请使用会话模式新建会话，原记录保留可查。';
+    if (code === 'AW_EMPLOYEE_COLD_RESUME_UNSUPPORTED' || code === 'EMPLOYEE_RECOVERY_UNSUPPORTED')
+        return '当前版本暂不支持恢复已关闭的本机执行会话；请新建会话，原记录保留可查。';
+    if (code === 'AW_EMPLOYEE_HOST_AUXILIARY_CONFIG_UNSUPPORTED')
+        return '当前主机启用的MCP、hooks或插件尚未支持改到员工电脑，本轮没有执行，请联系管理员。';
+    if (code === 'AW_EMPLOYEE_HOST_PROJECT_CONFIG_UNSUPPORTED')
+        return '主机上存在与本机工作区路径重合的项目配置，当前版本无法安全应用，本轮没有执行，请联系管理员。';
+    if (code === 'AW_EMPLOYEE_EXECUTOR_MCP_UNSUPPORTED')
+        return '本机工作区配置了附加MCP工具，当前版本尚不支持这类工具，本轮没有继续执行。';
+    if (['AW_EMPLOYEE_CONFIG_ADMISSION_INVALID', 'AW_EMPLOYEE_CONFIG_ADMISSION_FAILED', 'AW_EMPLOYEE_EXECUTOR_CONFIG_PROTOCOL_INVALID', 'AW_EMPLOYEE_EXECUTOR_CONFIG_READ_FAILED'].includes(code))
+        return '无法核验这次本机工作区的助手配置，本轮没有继续执行，请联系管理员查看技术详情。';
+    if (code === 'AW_EMPLOYEE_MCP_UNSUPPORTED')
+        return '当前版本尚不支持把附加MCP工具改到员工电脑，本轮没有执行。';
+    if (code === 'AW_EMPLOYEE_HOST_AUXILIARY_UNSUPPORTED')
+        return '这项辅助操作尚未支持在员工电脑执行，本轮没有执行。';
+    if (code === 'AW_EMPLOYEE_SLASH_COMMAND_UNSUPPORTED')
+        return '这项快捷命令暂不支持本机执行，请直接描述任务。';
+    if (code === 'AW_EMPLOYEE_HOST_FILE_REPORT_UNSUPPORTED')
+        return '这项文件报告暂不支持本机工作区；请查看对话和技术详情中的已有执行记录。';
+    if (code === 'AW_EMPLOYEE_CONFIG_DISCOVERY_OVERRIDE_UNSUPPORTED')
+        return '当前助手的项目配置覆盖与本机执行不兼容，本轮没有执行，请联系管理员。';
+    if (code === 'EMPLOYEE_PLATFORM_UNSUPPORTED')
+        return brand === 'claude' ? '本机执行目前只支持Mac；当前设备尚不支持，本轮未执行。' : '当前版本的Codex本机执行仅验证了Apple芯片Mac，本轮没有执行。';
+    if (code.startsWith('AW_EMPLOYEE_BINARY_'))
+        return 'Codex本机执行组件缺失或校验失败，本轮没有执行，请联系管理员。';
+    if (code.startsWith('AW_EMPLOYEE_') || code.startsWith('EMPLOYEE_'))
+        return '员工电脑的执行连接不可用或工作区已变化，本轮已停止；在途操作结果尚待确认，请查看技术详情。';
+    return `远程主机暂时无法完成这次操作，请联系管理员。技术详情：诊断代码 ${code}`;
 }

package/dist/provider.d.ts

@@ -11,9 +11,24 @@ import type { DetailChannel } from './remote-details.ts';
 import type { WorkspaceNoticePresentation } from './workspace-notice.ts';
 import { StageTiming } from './stage-timing.ts';
 import type { RecoveryJournal, AcpRecovery } from './recovery.ts';
+import type { EmployeeProviderOptions } from './employee-provider.ts';
+import { type WorkspaceSourceOptions, type SourceAdmissionStage } from './workspace-source.ts';
+import type { LocalUserTurnAcceptance } from '@ai-workbench/connect/api';
+import type { EmployeeRouting } from './employee-relay.ts';
+export interface EmployeeExecution {
+    hostCwd: string;
+    routing: EmployeeRouting;
+    notice: string;
+    scope: Record<string, unknown>;
+    signal?: AbortSignal;
+    beginTurn(signal: AbortSignal): Promise<void>;
+    endTurn(): void;
+    validate(signal?: AbortSignal): Promise<void>;
+}
 export interface Runtime {
     identity: string;
     cwd: string;
+    execution?: EmployeeExecution;
     acpTransport?: {
         writable: WritableStream<Uint8Array>;
         readable: ReadableStream<Uint8Array>;
@@ -39,13 +54,29 @@ export interface Runtime {
         turn: string | number | null;
         step: string | number | null;
     };
+    employeeExecutionMeta?: {
+        version: 1;
+        bindingId: string;
+        workspaceId: string;
+        cwd: string;
+        acpMaxMessageBytes: number;
+    };
+    employeeExecution?: (params: unknown, signal?: AbortSignal) => Promise<Record<string, unknown>>;
+    employeePresentation?: string;
 }
 export interface RuntimeRequest extends Invocation {
+    recordEarlyFailure?: (error: unknown, stage: SourceAdmissionStage) => Promise<void>;
+    userInputIds?: readonly string[];
+    localAcceptance?: Readonly<LocalUserTurnAcceptance>;
+    localAdmissionCheck?: () => void;
+    readonly localAcceptanceId?: string;
+    userMessageIds?: readonly string[];
     recoveryJournal?: RecoveryJournal;
     detailChannel?: DetailChannel;
     validateContext?: (ignoreCancellation?: boolean) => Promise<void>;
     verifyRecovery?: () => Promise<boolean>;
     acpMaxMessageBytes?: number;
+    employeeScope?: string;
     contextSha256?: string;
     resumeSessionId?: string;
     recoveryCheckpointId?: string;
@@ -106,7 +137,7 @@ type Result<T> = {
     } & Pick<ConnectNeed, 'officialReason'>;
 };
 /** 消费正式connect-api 0.7公开子集；X不响应L登录票据、不直接调用登录。 */
-export interface ConnectApi extends Pick<LConnectApi, 'getConnectionState' | 'getLoginPromptState' | 'requestLoginPrompt' | 'refreshLoginPrompts'>, Partial<NativeWorkspaceApi>, Partial<Pick<LConnectApi, 'getWorkspaceBindingState' | 'getModelCatalogTarget' | 'onConnectionState' | 'onLoginPromptState' | 'appendRemoteConversationDetail' | 'getRemoteConversationDetailReceipt' | 'listRemoteConversationDetails'>> {
+export interface ConnectApi extends Pick<LConnectApi, 'getConnectionState' | 'getLoginPromptState' | 'requestLoginPrompt' | 'refreshLoginPrompts'>, Partial<NativeWorkspaceApi>, Partial<Pick<LConnectApi, 'getWorkspaceBindingState' | 'getModelCatalogTarget' | 'onConnectionState' | 'onLoginPromptState' | 'appendRemoteConversationDetail' | 'getRemoteConversationDetailReceipt' | 'listRemoteConversationDetails' | 'getWorkspaceLocationState' | 'getLocalWorkspaceContext' | 'onWorkspaceLocationState' | 'acceptLocalWorkspaceUserTurn' | 'selectWorkspaceLocation'>> {
     getState?(): ConnectState;
     getSshTarget(): Promise<Result<ConnectTarget>>;
     checkLogin(provider: LoginProvider): Promise<Result<{
@@ -130,7 +161,7 @@ export declare function requireLoginCoordinator(api: ConnectApi): void;
 export declare function requireLoginState(state: LoginPromptState): void;
 declare module '@deepseek-ai/cordis' {
     interface Context {
-        aiWorkbenchConnect: ConnectApi;
+        aiWorkbenchConnect: LConnectApi;
     }
     interface Events {
         'ai-workbench/connection-state': (state: ConnectionState) => void;
@@ -152,11 +183,17 @@ export interface NoticeConsumer {
     reconcile(request: RuntimeRequest, api: ConnectApi): Promise<void>;
     deliver(notice: WorkspaceNotice, resolved: SessionProjectTarget, request: RuntimeRequest, api: ConnectApi): Promise<WorkspaceNoticePresentation | void>;
 }
+export type LocalRuntimeProvider = ((request: RuntimeRequest, api: ConnectApi, connection: ConnectionState, target: ConnectTarget) => Promise<Runtime | undefined>) & {
+    admit?: (request: RuntimeRequest, api: ConnectApi, connection: ConnectionState, target: ConnectTarget) => Promise<void>;
+};
 export declare function sameTarget(a: ConnectTarget, b: ConnectTarget): boolean;
 export declare function connectProvider(get: () => ConnectApi | undefined, options?: {
     agent?: AgentDefinition;
     ask?: Interaction;
     notice?: NoticeConsumer;
+    workspaceSource?: WorkspaceSourceOptions;
+    employee?: EmployeeProviderOptions;
+    local?: LocalRuntimeProvider;
     details?: (request: RuntimeRequest, api: ConnectApi, connection: ConnectionState, target: ConnectTarget) => Promise<DetailChannel>;
     open?: (target: ConnectTarget, project: Project, request: RuntimeRequest) => Promise<Runtime>;
 }): RuntimeProvider;

package/dist/provider.js

@@ -3,6 +3,7 @@ import { NeedError } from "./remote.js";
 import { CONNECTION_REQUIRED, TEST_HOST_NOTICE } from "./presentation.js";
 import { CODEX_AGENT } from "./agents.js";
 import { StageTiming } from "./stage-timing.js";
+import { confirmLegacyWorkspaceSource } from "./workspace-source.js";
 export function requireLoginCoordinator(api) {
     if (!['getConnectionState', 'getLoginPromptState', 'requestLoginPrompt', 'refreshLoginPrompts'].every(key => typeof api[key] === 'function'))
         throw new NeedError('CONNECT_API_MISMATCH', '我需要 connect-api 0.6.1 的统一登录询问与连接状态能力', 'L >=0.6.1');
@@ -154,6 +155,9 @@ export function sameTarget(a, b) {
 }
 export function connectProvider(get, options = {}) {
     const agent = options.agent ?? CODEX_AGENT;
+    // Keep the legacy source SDK wrapper's strip-only import graph free of broker runtime syntax.
+    // Cache the initialization promise so concurrent sessions share this provider's binding lifetimes.
+    let employee;
     const admissions = new WeakMap();
     const preflight = async (request) => {
         request.timing ??= new StageTiming();
@@ -165,19 +169,49 @@ export function connectProvider(get, options = {}) {
         requireLoginCoordinator(api);
         if (request.mode === 'one-shot' && !agent.oneShot)
             throw new NeedError('MODE_UNSUPPORTED', '此远程模型仅支持会话模式', '使用会话模式');
-        const { target, connection } = await request.timing.run('login-ready', async () => {
-            const before = api.getConnectionState();
-            const target = await ensureReady(api, agent.loginProvider, request.signal);
-            validateTarget(target);
-            request.signal?.throwIfAborted();
-            if (get() !== api)
-                throw new NeedError('CONNECTION_LOST', '远程主机连接组件已更换', '当前员工连接');
-            const connection = await waitForLogin(api, agent.loginProvider, before, get, request.signal);
-            return { target, connection };
-        });
-        if (request.identity && request.identity !== identity(target))
-            throw new NeedError('SESSION_CONTEXT_MISMATCH', '员工主机与原会话不一致，请新建会话', '原员工主机');
-        admissions.set(request, { api, target, connection });
+        const confirmedSource = options.workspaceSource ? await confirmLegacyWorkspaceSource(get, api, request, options.workspaceSource) : undefined;
+        let sourceStage = 'input-acceptance';
+        if (confirmedSource)
+            request.recordEarlyFailure = (error, stage) => confirmedSource.recordFailure(error, stage);
+        try {
+            confirmedSource?.assertCurrent();
+            if (options.employee) {
+                const module = await import("./employee-provider.js");
+                request.localAcceptance = await module.acceptEmployeeUserTurn(get, options.employee, agent, api, request);
+            }
+            confirmedSource?.assertCurrent();
+            if (confirmedSource) {
+                const previous = request.localAdmissionCheck;
+                request.localAdmissionCheck = () => { confirmedSource.assertCurrent(); previous?.(); };
+            }
+            sourceStage = 'login-readiness';
+            const { target, connection } = await request.timing.run('login-ready', async () => {
+                request.localAdmissionCheck?.();
+                const before = api.getConnectionState();
+                const target = await ensureReady(api, agent.loginProvider, request.signal);
+                validateTarget(target);
+                request.signal?.throwIfAborted();
+                if (get() !== api)
+                    throw new NeedError('CONNECTION_LOST', '远程主机连接组件已更换', '当前员工连接');
+                const connection = await waitForLogin(api, agent.loginProvider, before, get, request.signal);
+                return { target, connection };
+            });
+            if (request.identity && request.identity !== identity(target))
+                throw new NeedError('SESSION_CONTEXT_MISMATCH', '员工主机与原会话不一致，请新建会话', '原员工主机');
+            if (options.employee && request.localAcceptance)
+                await (await import("./employee-provider.js")).validateEmployeeUserTurn(get, options.employee, api, request, connection);
+            request.localAdmissionCheck?.();
+            admissions.set(request, { api, target, connection });
+            sourceStage = 'local-admission';
+            await options.local?.admit?.(request, api, connection, target);
+            confirmedSource?.assertCurrent();
+        }
+        catch (error) {
+            admissions.delete(request);
+            request.recordEarlyFailure = undefined;
+            await confirmedSource?.recordFailure(error, sourceStage);
+            throw error;
+        }
     };
     const resolve = async (request) => {
         if (!admissions.has(request))
@@ -187,8 +221,30 @@ export function connectProvider(get, options = {}) {
         const { api, target, connection } = admitted;
         const stable = () => request.timing.run('connection-confirm', () => waitForLogin(api, agent.loginProvider, connection, get, request.signal));
         await stable();
+        request.localAdmissionCheck?.();
         if (!request.sessionId)
             throw new NeedError('PROJECT_BINDING_REQUIRED', '我需要当前会话和已选择的工作区，请使用原生工作区入口', 'DSH会话与原生工作区');
+        if (options.employee) {
+            employee ??= import("./employee-provider.js").then(module => module.createEmployeeProvider(get, options, agent));
+            const local = await (await employee)({ api, target, connection, request, stable: signal => request.timing.run('connection-confirm', () => waitForLogin(api, agent.loginProvider, connection, get, signal)) });
+            if (local) {
+                local.loginRequired = () => offerLogin(api, request, get, agent);
+                return local;
+            }
+        }
+        if (agent.loginProvider === 'claude' && options.local) {
+            const runtime = await options.local(request, api, connection, target);
+            if (runtime) {
+                try {
+                    await stable();
+                }
+                catch (error) {
+                    await runtime.dispose?.();
+                    throw error;
+                }
+                return runtime;
+            }
+        }
         await options.notice?.reconcile(request, api);
         await stable();
         const resolved = await request.timing.run('workspace-resolve', async () => unwrap(await awaitL(() => api.resolveSessionProject(request.sessionId, { provider: agent.loginProvider, purpose: 'user-turn' }), request.signal)));

package/dist/readiness.js

@@ -46,7 +46,7 @@ function details(target) {
     return [{ label: '主机配置', value: h.enforcement }, { label: '检查退出码', value: String(h.checkExitCode) }, ...h.failedChecks.map(item => ({ label: '未通过检查', value: `${item.id}（${item.status}）` })), ...h.unverifiedChecks.map(item => ({ label: '未核实检查', value: `${item.id}（${item.status}）` }))];
 }
 function blocked(code, technical = [], agent = CODEX_AGENT) {
-    return { phase: 'blocked', loginStatus: 'unknown', title: `无法确认 ${agent.name.zh} 登录状态`, message: employeeFailure(code), technical: [...technical, { label: '诊断代码', value: code }] };
+    return { phase: 'blocked', loginStatus: 'unknown', title: `无法确认 ${agent.name.zh} 登录状态`, message: employeeFailure(code, agent.loginProvider), technical: [...technical, { label: '诊断代码', value: code }] };
 }
 /** L owns both evidence and inquiry. Missing per-brand evidence is never false. */
 function snapshot(api, agent = CODEX_AGENT) {

package/dist/recovery.d.ts

@@ -27,8 +27,21 @@ export interface RecoveryJournal {
     write(state: RecoveryState): Promise<void>;
 }
 export declare function validateRecovery(value: unknown): RecoveryState;
-/** Only negotiated booleans/known empty capability markers, never agent metadata. */
+export declare const codexContextPolicy: Readonly<{
+    version: 1;
+    scope: "new-session";
+    mode: "append";
+    content: "text";
+    resume: "omit-only";
+    changed: "new-session-required";
+    mapping: "developerInstructions";
+    nativeCliUnmodified: true;
+}>;
+export declare function supportsCodexContextPolicy(capabilities: AgentCapabilities): boolean;
+/** Known capabilities plus the exact Codex policy whitelist; no arbitrary metadata. */
 export declare function recoveryCapabilities(c: AgentCapabilities): AgentCapabilities;
 export declare function recoveryKey(value: unknown): string;
+/** Preserve legacy lookup bytes; each employee endpoint scope owns a separate journal. */
+export declare function runtimeRecoveryKey(identity: string, provider: string, sessionId: string | undefined, employeeScope?: string): string;
 /** History is immutable; current is atomically replaced only after fsync. No expiry. */
 export declare function recoveryJournal(profileDir: string, key: string): RecoveryJournal;

package/dist/recovery.js

@@ -15,11 +15,20 @@ export function validateRecovery(value) {
         throw invalid();
     return structuredClone(s);
 }
-/** Only negotiated booleans/known empty capability markers, never agent metadata. */
+export const codexContextPolicy = Object.freeze({ version: 1, scope: 'new-session', mode: 'append', content: 'text', resume: 'omit-only', changed: 'new-session-required', mapping: 'developerInstructions', nativeCliUnmodified: true });
+export function supportsCodexContextPolicy(capabilities) {
+    const policy = capabilities._meta?.aiWorkbenchSystemPrompt;
+    return !!policy && typeof policy === 'object' && !Array.isArray(policy) && Object.keys(policy).length === Object.keys(codexContextPolicy).length && Object.entries(codexContextPolicy).every(([key, value]) => policy[key] === value);
+}
+/** Known capabilities plus the exact Codex policy whitelist; no arbitrary metadata. */
 export function recoveryCapabilities(c) {
-    return { loadSession: c.loadSession === true, promptCapabilities: { image: c.promptCapabilities?.image === true, audio: c.promptCapabilities?.audio === true, embeddedContext: c.promptCapabilities?.embeddedContext === true }, sessionCapabilities: { ...(c.sessionCapabilities?.resume ? { resume: {} } : {}), ...(c.sessionCapabilities?.systemPrompt ? { systemPrompt: {} } : {}) } };
+    return { loadSession: c.loadSession === true, promptCapabilities: { image: c.promptCapabilities?.image === true, audio: c.promptCapabilities?.audio === true, embeddedContext: c.promptCapabilities?.embeddedContext === true }, sessionCapabilities: { ...(c.sessionCapabilities?.resume ? { resume: {} } : {}), ...(c.sessionCapabilities?.systemPrompt ? { systemPrompt: {} } : {}) }, ...(supportsCodexContextPolicy(c) ? { _meta: { aiWorkbenchSystemPrompt: { ...codexContextPolicy } } } : {}) };
 }
 export function recoveryKey(value) { return createHash('sha256').update(JSON.stringify(value)).digest('hex'); }
+/** Preserve legacy lookup bytes; each employee endpoint scope owns a separate journal. */
+export function runtimeRecoveryKey(identity, provider, sessionId, employeeScope) {
+    return recoveryKey([identity, provider, sessionId, ...(employeeScope ? ['employee', employeeScope] : [])]);
+}
 /** History is immutable; current is atomically replaced only after fsync. No expiry. */
 export function recoveryJournal(profileDir, key) {
     if (!/^[a-f0-9]{64}$/.test(key))

package/dist/remote-details.d.ts

@@ -18,6 +18,7 @@ export interface DetailRequest {
     provider: 'claude' | 'codex';
     identity: string;
     connection: Connection;
+    readonly localAcceptanceId?: string;
 }
 export declare function privateDirectory(path: string): Promise<void>;
 export declare function durableWrite(path: string, value: unknown): Promise<void>;
@@ -26,6 +27,12 @@ export declare function createRemoteDetails(options: {
     profileDir: string;
     getApi: () => RemoteDetailsApi | undefined;
 }): {
+    recordLocalFailure(request: {
+        sessionId?: string;
+        provider: "claude" | "codex";
+        code: string;
+        observation?: DetailObservation;
+    }): Promise<void>;
     recordLoginFailure(request: {
         sessionId?: string;
         code: string;

package/dist/remote-details.js

@@ -91,6 +91,12 @@ export function createRemoteDetails(options) {
     const scopes = new Map(), loginScopes = new Map();
     const initialize = async () => { await privateDirectory(join(options.profileDir, 'ai-workbench-remote-agent')); await privateDirectory(root); };
     return {
+        async recordLocalFailure(request) {
+            await initialize();
+            if (!/^[A-Z][A-Z0-9_]*$/.test(request.code))
+                throw failure('REMOTE_DETAIL_STORAGE_FAILED');
+            await durableWrite(join(root, randomUUID() + '.json'), { version: 1, kind: 'local-admission', code: request.code, provider: request.provider, sessionHash: request.sessionId ? hash(request.sessionId) : null, ...request.observation ? { observation: sanitizeObservation(request.observation, true) } : {} });
+        },
         async recordLoginFailure(request) {
             await initialize();
             const eventId = randomUUID(), diagnostic = request.diagnostic;
@@ -221,6 +227,10 @@ export function createRemoteDetails(options) {
             return { eventId, recorded: true };
         },
         async open(request) {
+            request = structuredClone(request);
+            if (request.localAcceptanceId !== undefined && (typeof request.localAcceptanceId !== 'string' || !request.localAcceptanceId.trim()))
+                throw failure('REMOTE_DETAIL_SCOPE_INVALID');
+            const localScope = request.localAcceptanceId === undefined ? undefined : Object.freeze({ localAcceptanceId: request.localAcceptanceId });
             if (!request.sessionId || !request.identity || !request.connection.instanceId || !Number.isSafeInteger(request.connection.epoch) || request.connection.epoch < 0 || !['claude', 'codex'].includes(request.provider))
                 throw failure('REMOTE_DETAIL_SCOPE_INVALID');
             try {
@@ -348,7 +358,7 @@ export function createRemoteDetails(options) {
                         stable();
                         let response;
                         try {
-                            response = await api.appendRemoteConversationDetail(structuredClone(detail));
+                            response = await (localScope === undefined ? api.appendRemoteConversationDetail(structuredClone(detail)) : api.appendRemoteConversationDetail(structuredClone(detail), localScope));
                         }
                         catch {
                             stable();

package/dist/workspace-source-confirmation.d.ts

@@ -0,0 +1,4 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { WorkspaceSourceOptions } from './workspace-source.ts';
+/** Official same-turn one-shot question; never changes policy or fabricates a tool call. */
+export declare function nativeWorkspaceSourceConfirmation(ctx: Context): WorkspaceSourceOptions['confirm'];

package/dist/workspace-source-confirmation.js

@@ -0,0 +1,12 @@
+import { SessionId } from '@deepseek-ai/dsh-session';
+/** Official same-turn one-shot question; never changes policy or fabricates a tool call. */
+export function nativeWorkspaceSourceConfirmation(ctx) {
+    return async (question, request) => {
+        const agent = request.sessionId ? ctx.get('agents')?.get(SessionId(request.sessionId)) : undefined;
+        const approval = ctx.get('approval');
+        const session = request.sessionId ? ctx.get('sessions')?.get(SessionId(request.sessionId)) : undefined;
+        if (!agent || !approval || !session || agent.session !== session)
+            return 'unavailable';
+        return approval.request({ agent, toolName: question.action, reason: question.question, signal: request.signal });
+    };
+}

package/dist/workspace-source.d.ts

@@ -0,0 +1,25 @@
+import type { ConnectApi, RuntimeRequest } from './provider.ts';
+import type { DetailObservation } from './conversation-details.ts';
+export type SourceDecision = 'allowed-once' | 'rejected' | 'cancelled' | 'unavailable';
+export type SourceAdmissionStage = 'source-context' | 'source-confirmation' | 'input-acceptance' | 'login-readiness' | 'local-admission' | 'input-prepare' | 'model-catalog' | 'runtime-resolve';
+export interface WorkspaceSourceAdmission {
+    assertCurrent(): void;
+    recordFailure(error: unknown, stage: SourceAdmissionStage): Promise<void>;
+}
+export interface WorkspaceSourceOptions {
+    workspace(request: RuntimeRequest): Promise<{
+        id: string;
+        path: string;
+    }>;
+    currentUserTurn(request: RuntimeRequest): {
+        turn: number;
+        userMessageId: string;
+    };
+    confirm(question: {
+        question: string;
+        action: string;
+    }, request: RuntimeRequest): Promise<SourceDecision>;
+    record(request: RuntimeRequest, observation: DetailObservation): Promise<void>;
+}
+/** Explicit human source transition only. No source selection is inferred from a folder path. */
+export declare function confirmLegacyWorkspaceSource(get: () => ConnectApi | undefined, api: ConnectApi, request: RuntimeRequest, hooks: WorkspaceSourceOptions): Promise<WorkspaceSourceAdmission | undefined>;