@ai-workbench/remote-agent 0.8.5 → 0.8.11

package/dist/employee-relay.js

@@ -0,0 +1,49 @@
+/** Runs on the host. Only target discovery and SSH stdio forwarding; never user tools. */
+export const EMPLOYEE_TARGET_PYTHON = String.raw `
+import os,sys,json,subprocess,selectors,shlex,re
+def fail(code):
+ sys.stderr.write(json.dumps({"code":code})+"\n");sys.exit(254)
+try:
+ x=json.loads(sys.argv[1]);e=x["endpoint"];b=x["bridge"];maximum=x["maxBytes"]
+ if not isinstance(maximum,int) or isinstance(maximum,bool) or maximum<1:fail("EMPLOYEE_RELAY_SETTINGS_INVALID")
+ if b["command"]!="/usr/local/aw-host/bin/aw-employee-bridge":fail("EMPLOYEE_RELAY_TARGET_INVALID")
+ argv=[b["command"],"target","--settings",b["settingsPath"],"--device",e["deviceId"],"--if-instance",b["bridgeInstanceId"],"--if-generation",str(b["generation"]),"--if-endpoint",e["endpointInstanceId"],"--if-context",e["executionContextId"]]
+ p=subprocess.Popen(argv,stdin=subprocess.DEVNULL,stdout=subprocess.PIPE,stderr=subprocess.PIPE)
+ selector=selectors.DefaultSelector();selector.register(p.stdout,selectors.EVENT_READ,"out");selector.register(p.stderr,selectors.EVENT_READ,"err")
+ data={"out":bytearray(),"err":bytearray()}
+ while selector.get_map():
+  for key,_ in selector.select():
+   chunk=os.read(key.fileobj.fileno(),maximum+1)
+   if not chunk:selector.unregister(key.fileobj);continue
+   data[key.data].extend(chunk)
+   if len(data["out"])+len(data["err"])>maximum:
+    p.kill();p.wait();fail("EMPLOYEE_RELAY_CONTROL_TOO_LARGE")
+ selector.close()
+ if p.wait()!=0:
+  reason=re.fullmatch(r"BRIDGE_ERROR ([A-Z][A-Z0-9_]{0,63})\s*",data["err"].decode("utf-8",errors="strict"))
+  fail(reason.group(1) if reason else "EMPLOYEE_BRIDGE_TARGET_FAILED")
+ t=json.loads(data["out"])
+ if t.get("type")!="target" or t.get("protocolVersion")!=1 or t.get("endpoint",{}).get("state")!="online":fail("EMPLOYEE_BRIDGE_PROTOCOL_INVALID")
+ expected=dict(e,bridgeInstanceId=b["bridgeInstanceId"],generation=b["generation"])
+ if any(t["endpoint"].get(k)!=v for k,v in expected.items()):fail("EMPLOYEE_CONTEXT_CHANGED")
+ args=t.get("sshArgs")
+ if not isinstance(args,list) or not args or any(not isinstance(v,str) or "\x00" in v for v in args):fail("EMPLOYEE_BRIDGE_PROTOCOL_INVALID")
+`;
+export const EMPLOYEE_PYTHON_ERRORS = String.raw `
+except (KeyError,ValueError,TypeError,OSError):
+ fail("EMPLOYEE_RELAY_FAILED")
+`;
+export const EMPLOYEE_RELAY_PYTHON = EMPLOYEE_TARGET_PYTHON + String.raw `
+ socket=x["socketPath"]
+ if not isinstance(socket,str) or not socket.startswith("/") or "\x00" in socket:fail("EMPLOYEE_RELAY_SOCKET_INVALID")
+ command=shlex.join(["/usr/bin/nc","-U",socket])
+ os.execv("/usr/bin/ssh",["/usr/bin/ssh","-T"]+args+[command])
+` + EMPLOYEE_PYTHON_ERRORS;
+export function employeeRouting(target, socketPath, maxBytes) {
+    const names = ['Read', 'Write', 'Edit', 'Glob', 'Grep', 'Bash'];
+    return {
+        // ACP0.94.0 uses absence of "type" to recognize stdio. Do not add type:"stdio".
+        mcpServers: [{ name: 'employee', command: '/usr/bin/python3', args: ['-c', EMPLOYEE_RELAY_PYTHON, JSON.stringify({ endpoint: target.endpoint, bridge: target.bridge, socketPath, maxBytes })], env: [] }],
+        toolAliases: Object.fromEntries(names.map(name => [name, 'mcp__employee__' + name])),
+    };
+}

package/dist/employee-shell.d.ts

@@ -0,0 +1,26 @@
+import type { ChildProcessWithoutNullStreams } from 'node:child_process';
+import type { EmployeeEndpointTarget } from './employee-endpoint.ts';
+export interface EmployeeShellResult {
+    stdout: string;
+    stderr: string;
+    stderrSource: 'combined-ssh-and-command';
+    exitCode: number;
+    signal: null;
+}
+export type EmployeeShell = (request: {
+    command: string;
+    timeout?: number;
+    signal: AbortSignal;
+}) => Promise<EmployeeShellResult>;
+interface Options {
+    target: EmployeeEndpointTarget;
+    maxBytes: number;
+    killGraceMs: number;
+    attach: (spec: {
+        command: '/usr/bin/python3';
+        args: string[];
+    }) => Promise<ChildProcessWithoutNullStreams>;
+}
+/** Every invocation re-discovers the exact S target. Cancellation cannot prove remote exit. */
+export declare function createEmployeeShell(options: Options): EmployeeShell;
+export {};

package/dist/employee-shell.js

@@ -0,0 +1,89 @@
+import { randomUUID } from 'node:crypto';
+import { EMPLOYEE_TARGET_PYTHON, EMPLOYEE_PYTHON_ERRORS } from "./employee-relay.js";
+import { NeedError } from "./remote.js";
+const SHELL_PYTHON = EMPLOYEE_TARGET_PYTHON + String.raw `
+ cwd=x["directory"]["path"];device=x["directory"]["device"];inode=x["directory"]["inode"]
+ # User source is stdin, never argv. The sentinel preserves trailing newlines.
+ wrapper="cd -- "+shlex.quote(cwd)+" || exit 254; "+'test "$(/usr/bin/stat -f '+shlex.quote('%d %i')+' .)" = '+shlex.quote(str(device)+' '+str(inode))+" || exit 254; "+'test "$(/usr/bin/id -u)" = '+shlex.quote(str(e['remoteUid']))+" || exit 254; "+"printf '%s\\n' "+shlex.quote('AW_EMPLOYEE_SHELL_STARTED '+x['executionId'])+" >&2; "+'aw_x_source=$(/bin/cat; printf x); aw_x_source='+chr(36)+'{aw_x_source%?}; eval "'+chr(36)+'aw_x_source"'
+ command=shlex.join([e["endpointShell"],"-c",wrapper])
+ sys.stderr.write("AW_EMPLOYEE_SHELL_READY "+x["executionId"]+"\n");sys.stderr.flush()
+ p=subprocess.Popen(["/usr/bin/ssh","-T"]+args+[command],stdin=sys.stdin,stdout=sys.stdout,stderr=sys.stderr)
+ code=p.wait();sys.exit(code if code>=0 else 255)
+` + EMPLOYEE_PYTHON_ERRORS;
+const unknown = (code) => new NeedError(code, '本机命令结果未知；没有重放，也未改在主机执行。', '员工端真实退出回执');
+/** Every invocation re-discovers the exact S target. Cancellation cannot prove remote exit. */
+export function createEmployeeShell(options) {
+    return async ({ command, timeout, signal }) => {
+        signal.throwIfAborted();
+        const executionId = randomUUID(), target = options.target;
+        const child = await options.attach({ command: '/usr/bin/python3', args: ['-c', SHELL_PYTHON, JSON.stringify({ endpoint: target.endpoint, bridge: target.bridge, directory: target.local.directory, maxBytes: options.maxBytes, executionId })] });
+        return new Promise((yes, no) => {
+            let settled = false, bytes = 0, stdout = [], stderr = [], reason, grace, timer;
+            const finish = (error, code) => {
+                if (settled)
+                    return;
+                settled = true;
+                signal.removeEventListener('abort', abort);
+                if (grace)
+                    clearTimeout(grace);
+                if (timer)
+                    clearTimeout(timer);
+                child.stdin.destroy();
+                child.stdout.destroy();
+                child.stderr.destroy();
+                if (error) {
+                    no(error);
+                    return;
+                }
+                let out, err;
+                try {
+                    out = new TextDecoder('utf8', { fatal: true, ignoreBOM: true }).decode(Buffer.concat(stdout));
+                    err = new TextDecoder('utf8', { fatal: true, ignoreBOM: true }).decode(Buffer.concat(stderr));
+                }
+                catch {
+                    no(unknown('EMPLOYEE_OUTPUT_BINARY_UNSUPPORTED'));
+                    return;
+                }
+                const header = 'AW_EMPLOYEE_SHELL_READY ' + executionId + '\n', started = 'AW_EMPLOYEE_SHELL_STARTED ' + executionId + '\n';
+                const start = err.indexOf(started, header.length);
+                if (!err.startsWith(header) || start < header.length || start > header.length && err[start - 1] !== '\n') {
+                    const raw = err.startsWith(header) ? err.slice(header.length) : err;
+                    let source;
+                    try {
+                        const parsed = JSON.parse(raw);
+                        if (typeof parsed.code === 'string' && /^[A-Z][A-Z0-9_]{0,63}$/.test(parsed.code))
+                            source = parsed.code;
+                    }
+                    catch { /* Never expose arbitrary transport diagnostics. */ }
+                    no(unknown(source ?? 'EMPLOYEE_EXIT_UNKNOWN'));
+                    return;
+                }
+                if (code === null || code === undefined || code === 255) {
+                    no(unknown('EMPLOYEE_EXIT_UNKNOWN'));
+                    return;
+                }
+                yes({ stdout: out, stderr: err.slice(header.length, start) + err.slice(start + started.length), stderrSource: 'combined-ssh-and-command', exitCode: code, signal: null });
+            };
+            const stop = (code) => { if (settled || reason)
+                return; reason = unknown(code); child.kill('SIGTERM'); grace = setTimeout(() => { if (child.exitCode === null && child.signalCode === null)
+                child.kill('SIGKILL'); finish(reason); }, options.killGraceMs); };
+            const abort = () => stop('EMPLOYEE_CANCELLED_UNKNOWN');
+            const collect = (destination, chunk) => { bytes += chunk.length; if (bytes > options.maxBytes) {
+                stop('EMPLOYEE_OUTPUT_TOO_LARGE_UNKNOWN');
+                return;
+            } destination.push(chunk); };
+            child.stdout.on('data', (b) => collect(stdout, b));
+            child.stderr.on('data', (b) => collect(stderr, b));
+            child.stdin.on('error', () => stop('EMPLOYEE_INPUT_UNKNOWN'));
+            child.once('error', () => { finish(unknown('EMPLOYEE_TRANSPORT_UNKNOWN')); });
+            child.once('close', code => finish(reason, code));
+            signal.addEventListener('abort', abort, { once: true });
+            if (signal.aborted)
+                abort();
+            if (timeout !== undefined)
+                timer = setTimeout(() => stop('EMPLOYEE_TIMEOUT_UNKNOWN'), timeout);
+            if (!reason)
+                child.stdin.end(command);
+        });
+    };
+}

package/dist/employee-ssh.d.ts

@@ -0,0 +1,22 @@
+import type { EmployeeEndpointTarget } from '@ai-workbench/network/api';
+import { type BrokerIo, type SshArgv } from './broker.ts';
+import type { ConnectTarget } from './provider.ts';
+import { type EmployeeExecutionTransport } from './employee-exec.ts';
+export interface EmployeeSshOptions {
+    target: ConnectTarget;
+    endpoint: EmployeeEndpointTarget;
+    /** Automatically discovered package binary path on this same employee device. */
+    employeeBinary: string;
+    binarySha256: string;
+    acpMaxMessageBytes: number;
+    argv: SshArgv;
+    validate(signal: AbortSignal): Promise<void>;
+    /** Fixture seam only. Production uses L's exported argv through sshIo. */
+    io?: BrokerIo;
+}
+/** Fixed bootstrap only; cwd for every native operation remains in its original RPC. */
+export declare function employeeExecServerCommand(binary: string, binarySha256: string): string;
+/** Invoke this in EmployeeExecution.validate before and after each native RPC write. */
+export declare function validateEmployeeSshTarget(options: EmployeeSshOptions, signal?: AbortSignal): Promise<void>;
+/** Outer L-authenticated host SSH, then S-authenticated employee SSH; no host execution fallback. */
+export declare function createEmployeeSshTransport(options: EmployeeSshOptions, signal?: AbortSignal): Promise<EmployeeExecutionTransport>;

package/dist/employee-ssh.js

@@ -0,0 +1,123 @@
+import { sshIo } from "./broker.js";
+import { createEmployeeProcessTransport } from "./employee-exec.js";
+import { NeedError, shellQuote } from "./remote.js";
+const fail = (code = 'EMPLOYEE_BRIDGE_PROTOCOL_INVALID') => new NeedError(code, '员工执行目标无法核验（' + code + '），没有改用主机执行或重试', '当前 L/N/S 同代员工端点及固定员工执行器');
+const object = (value) => !!value && typeof value === 'object' && !Array.isArray(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+const exact = (value, keys) => object(value) && Object.keys(value).length === keys.length && keys.every(key => Object.hasOwn(value, key));
+const text = (value) => typeof value === 'string' && value.length > 0 && !value.includes('\0');
+const absolute = (value) => text(value) && value.startsWith('/');
+const integer = (value, min = 0, max = Number.MAX_SAFE_INTEGER) => typeof value === 'number' && Number.isSafeInteger(value) && value >= min && value <= max;
+const uuid = (value) => typeof value === 'string' && /^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/i.test(value);
+const hash = (value) => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
+function checkSignal(signal) { if (signal.aborted)
+    throw fail('ABORTED'); }
+function awaitSignal(promise, signal) {
+    if (signal.aborted) {
+        void promise.catch(() => { });
+        return Promise.reject(fail('ABORTED'));
+    }
+    return new Promise((resolve, reject) => {
+        const abort = () => { signal.removeEventListener('abort', abort); reject(fail('ABORTED')); };
+        signal.addEventListener('abort', abort, { once: true });
+        void promise.then(value => { signal.removeEventListener('abort', abort); resolve(value); }, error => { signal.removeEventListener('abort', abort); reject(error); });
+        if (signal.aborted)
+            abort();
+    });
+}
+function checkEndpoint(endpoint, target) {
+    if (endpoint?.version !== 1 || !endpoint.local || !endpoint.endpoint || !endpoint.bridge || endpoint.bridge.protocolVersion !== 1 || endpoint.bridge.command !== '/usr/local/aw-host/bin/aw-employee-bridge' || !absolute(endpoint.bridge.settingsPath) || endpoint.bridge.settingsPath !== target.session.settingsPath || !uuid(endpoint.bridge.bridgeInstanceId) || !integer(endpoint.bridge.generation, 1) || !hash(endpoint.endpoint.deviceId) || !uuid(endpoint.endpoint.endpointInstanceId) || !uuid(endpoint.endpoint.executionContextId) || !text(endpoint.endpoint.remoteUser) || !integer(endpoint.endpoint.remoteUid, 1, 4294967294) || ![endpoint.endpoint.remoteHome, endpoint.endpoint.endpointCwd, endpoint.endpoint.endpointShell, endpoint.local.directory?.path].every(absolute) || !text(endpoint.local.bindingId) || !text(endpoint.local.workspaceId) || !text(endpoint.local.instanceId) || !integer(endpoint.local.epoch) || !integer(endpoint.local.directory.device) || !integer(endpoint.local.directory.inode))
+        throw fail();
+}
+function policySource(value, scope) {
+    return exact(value, ['path', 'sha256', 'development', 'scope']) && absolute(value.path) && hash(value.sha256) && typeof value.development === 'boolean' && value.scope === scope;
+}
+function policy(value) {
+    const keys = ['controlMaxBytes', 'handshakeTimeoutMs', 'registerLeaseMs', 'heartbeatIntervalMs', 'maxHandshakeConnections', 'controlQueueMaxBytes', 'maxPendingStreams', 'maxActiveStreams', 'relayHighWaterBytes', 'relayLowWaterBytes', 'relayReadBytes'];
+    if (!exact(value, keys) || !keys.every(key => integer(value[key], key === 'relayLowWaterBytes' ? 0 : 1)))
+        return false;
+    const p = value;
+    return p.controlMaxBytes >= 1024 && p.controlMaxBytes <= 16777216 && p.controlQueueMaxBytes >= p.controlMaxBytes && p.controlQueueMaxBytes <= 16777216 && p.registerLeaseMs >= 3 * p.heartbeatIntervalMs && p.relayHighWaterBytes <= 16777216 && p.relayLowWaterBytes <= p.relayHighWaterBytes && p.relayReadBytes <= p.relayHighWaterBytes && ['handshakeTimeoutMs', 'registerLeaseMs', 'heartbeatIntervalMs', 'maxHandshakeConnections', 'maxPendingStreams', 'maxActiveStreams'].every(key => p[key] <= 2147483647);
+}
+function readTarget(raw, expected, maxBytes) {
+    if (Buffer.byteLength(raw) > maxBytes)
+        throw fail('ACP_MESSAGE_TOO_LARGE');
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw fail();
+    }
+    if (!exact(value, ['type', 'protocolVersion', 'endpoint', 'sshArgs', 'clientPolicySource']) || value.type !== 'target' || value.protocolVersion !== 1 || !policySource(value.clientPolicySource, 'client-handshake') || value.clientPolicySource.path !== expected.bridge.settingsPath)
+        throw fail();
+    const actual = value.endpoint;
+    const keys = ['deviceId', 'bridgeInstanceId', 'generation', 'endpointInstanceId', 'executionContextId', 'remoteUser', 'remoteUid', 'remoteHome', 'endpointCwd', 'endpointShell', 'state', 'policy', 'policySource', 'remainingLeaseMs', 'activeStreams', 'pendingStreams', 'clientPublicKey', 'hostKeyAlias', 'socketPath'];
+    if (!exact(actual, keys) || actual.state !== 'online' || !policy(actual.policy) || !policySource(actual.policySource, 'registration') || actual.policySource.path !== expected.bridge.settingsPath || !integer(actual.remainingLeaseMs) || !integer(actual.activeStreams) || !integer(actual.pendingStreams) || !text(actual.clientPublicKey) || !text(actual.hostKeyAlias) || !absolute(actual.socketPath))
+        throw fail();
+    for (const key of ['deviceId', 'endpointInstanceId', 'executionContextId', 'remoteUser', 'remoteUid', 'remoteHome', 'endpointCwd', 'endpointShell'])
+        if (actual[key] !== expected.endpoint[key])
+            throw fail('EMPLOYEE_CONTEXT_CHANGED');
+    if (actual.bridgeInstanceId !== expected.bridge.bridgeInstanceId || actual.generation !== expected.bridge.generation)
+        throw fail('EMPLOYEE_CONTEXT_CHANGED');
+    const args = value.sshArgs;
+    // S0.4.11 d6cdcc7 lib/employee_bridge.py:ssh_args already includes the destination.
+    if (!Array.isArray(args) || args.length !== 23 || !args.every(text))
+        throw fail();
+    const fixed = new Map([[0, '-F'], [1, '/dev/null'], [2, '-o'], [3, 'BatchMode=yes'], [4, '-o'], [5, 'IdentitiesOnly=yes'], [6, '-o'], [7, 'StrictHostKeyChecking=yes'], [8, '-o'], [9, 'IdentityAgent=none'], [10, '-o'], [12, '-o'], [13, 'GlobalKnownHostsFile=/dev/null'], [14, '-o'], [15, 'HostKeyAlias=' + actual.hostKeyAlias], [16, '-o'], [18, '-o'], [20, '-l'], [21, expected.endpoint.remoteUser], [22, 'aw-employee-endpoint']]);
+    if ([...fixed].some(([i, wanted]) => args[i] !== wanted) || !args[11].startsWith('UserKnownHostsFile="/') || !args[11].endsWith('"') || !args[17].startsWith('ProxyCommand=') || args[17].length <= 'ProxyCommand='.length || !args[19].startsWith('IdentityFile="/') || !args[19].endsWith('"'))
+        throw fail();
+    return args;
+}
+/** Fixed bootstrap only; cwd for every native operation remains in its original RPC. */
+export function employeeExecServerCommand(binary, binarySha256) {
+    if (!absolute(binary) || !hash(binarySha256))
+        throw fail('EMPLOYEE_BINARY_REQUIRED');
+    const file = shellQuote(binary), digest = shellQuote(binarySha256);
+    const stop = (code) => `{ printf '%s\\n' '${code}' >&2; exit 126; }`;
+    return `if [ ! -f ${file} ] || [ ! -x ${file} ]; then ${stop('AW_EMPLOYEE_BINARY_UNAVAILABLE')}; fi; ` +
+        `aw_employee_digest=$(/usr/bin/shasum -a 256 < ${file} 2>/dev/null) || ${stop('AW_EMPLOYEE_BINARY_HASH_FAILED')}; ` +
+        `aw_employee_digest=\${aw_employee_digest%% *}; [ "$aw_employee_digest" = ${digest} ] || ${stop('AW_EMPLOYEE_BINARY_HASH_MISMATCH')}; ` +
+        `aw_employee_version=$(${file} --version 2>/dev/null) || ${stop('AW_EMPLOYEE_BINARY_VERSION_FAILED')}; ` +
+        `[ "$aw_employee_version" = 'codex-cli 0.160.1' ] || ${stop('AW_EMPLOYEE_BINARY_VERSION_MISMATCH')}; ` +
+        `exec ${file} exec-server --listen stdio`;
+}
+async function currentTarget(options, signal) {
+    checkSignal(signal);
+    if (!Number.isSafeInteger(options.acpMaxMessageBytes) || options.acpMaxMessageBytes < 1)
+        throw fail('SETTINGS_REQUIRED');
+    const endpoint = structuredClone(options.endpoint), target = structuredClone(options.target);
+    checkEndpoint(endpoint, target);
+    const io = options.io ?? sshIo(target, options.argv, options.acpMaxMessageBytes);
+    const gate = async () => { checkSignal(signal); await awaitSignal(options.validate(signal), signal); checkSignal(signal); };
+    await gate();
+    const b = endpoint.bridge, e = endpoint.endpoint;
+    const command = [b.command, 'target', '--settings', b.settingsPath, '--device', e.deviceId, '--if-instance', b.bridgeInstanceId, '--if-generation', String(b.generation), '--if-endpoint', e.endpointInstanceId, '--if-context', e.executionContextId].map(shellQuote).join(' ');
+    const raw = await awaitSignal(io.run(command, signal), signal);
+    const args = readTarget(raw, endpoint, options.acpMaxMessageBytes);
+    await gate();
+    return { io, args, gate };
+}
+/** Invoke this in EmployeeExecution.validate before and after each native RPC write. */
+export async function validateEmployeeSshTarget(options, signal = new AbortController().signal) { await currentTarget(options, signal); }
+/** Outer L-authenticated host SSH, then S-authenticated employee SSH; no host execution fallback. */
+export async function createEmployeeSshTransport(options, signal = new AbortController().signal) {
+    checkSignal(signal);
+    const remote = employeeExecServerCommand(options.employeeBinary, options.binarySha256);
+    const { io, args, gate } = await currentTarget(options, signal);
+    checkSignal(signal);
+    // EmployeeExecution races the user's open wait; this factory retains any late child cleanup.
+    const child = await io.attach('exec ' + ['/usr/bin/ssh', ...args, remote].map(shellQuote).join(' '));
+    const transport = createEmployeeProcessTransport(child, options.acpMaxMessageBytes, ['AW_EMPLOYEE_BINARY_UNAVAILABLE', 'AW_EMPLOYEE_BINARY_HASH_FAILED', 'AW_EMPLOYEE_BINARY_HASH_MISMATCH', 'AW_EMPLOYEE_BINARY_VERSION_FAILED', 'AW_EMPLOYEE_BINARY_VERSION_MISMATCH']);
+    if (signal.aborted) {
+        await transport.close();
+        throw fail('ABORTED');
+    }
+    try {
+        await gate();
+        return transport;
+    }
+    catch (error) {
+        await transport.close();
+        throw error;
+    }
+}

package/dist/employee-tools.d.ts

@@ -0,0 +1,117 @@
+import type { DetailObservation } from './conversation-details.ts';
+import type { EmployeeShell } from './employee-shell.ts';
+export declare const EMPLOYEE_TOOL_NAMES: readonly ["Read", "Write", "Edit", "Glob", "Grep", "Bash"];
+export type EmployeeToolName = typeof EMPLOYEE_TOOL_NAMES[number];
+interface Options {
+    cwd: string;
+    shell: string;
+    uid: number;
+    maxBytes: number;
+    killGraceMs: number;
+    validate: (signal?: AbortSignal) => Promise<void>;
+    detail: (event: DetailObservation) => void;
+    rgPath?: string;
+    runShell?: EmployeeShell;
+}
+/** Executed only in the employee DSH process; never creates a host fallback. */
+export declare function createEmployeeTools(options: Options): {
+    call(name: string, input: unknown, requestSignal?: AbortSignal, observer?: Options["detail"]): Promise<{
+        [x: string]: unknown;
+        content: ({
+            type: "text";
+            text: string;
+            annotations?: {
+                audience?: ("assistant" | "user")[] | undefined;
+                priority?: number | undefined;
+                lastModified?: string | undefined;
+            } | undefined;
+            _meta?: {
+                [x: string]: unknown;
+            } | undefined;
+        } | {
+            type: "image";
+            data: string;
+            mimeType: string;
+            annotations?: {
+                audience?: ("assistant" | "user")[] | undefined;
+                priority?: number | undefined;
+                lastModified?: string | undefined;
+            } | undefined;
+            _meta?: {
+                [x: string]: unknown;
+            } | undefined;
+        } | {
+            type: "audio";
+            data: string;
+            mimeType: string;
+            annotations?: {
+                audience?: ("assistant" | "user")[] | undefined;
+                priority?: number | undefined;
+                lastModified?: string | undefined;
+            } | undefined;
+            _meta?: {
+                [x: string]: unknown;
+            } | undefined;
+        } | {
+            uri: string;
+            name: string;
+            type: "resource_link";
+            description?: string | undefined;
+            mimeType?: string | undefined;
+            size?: number | undefined;
+            annotations?: {
+                audience?: ("assistant" | "user")[] | undefined;
+                priority?: number | undefined;
+                lastModified?: string | undefined;
+            } | undefined;
+            _meta?: {
+                [x: string]: unknown;
+            } | undefined;
+            icons?: {
+                src: string;
+                mimeType?: string | undefined;
+                sizes?: string[] | undefined;
+                theme?: "light" | "dark" | undefined;
+            }[] | undefined;
+            title?: string | undefined;
+        } | {
+            type: "resource";
+            resource: {
+                uri: string;
+                text: string;
+                mimeType?: string | undefined;
+                _meta?: {
+                    [x: string]: unknown;
+                } | undefined;
+            } | {
+                uri: string;
+                blob: string;
+                mimeType?: string | undefined;
+                _meta?: {
+                    [x: string]: unknown;
+                } | undefined;
+            };
+            annotations?: {
+                audience?: ("assistant" | "user")[] | undefined;
+                priority?: number | undefined;
+                lastModified?: string | undefined;
+            } | undefined;
+            _meta?: {
+                [x: string]: unknown;
+            } | undefined;
+        })[];
+        _meta?: {
+            [x: string]: unknown;
+            progressToken?: string | number | undefined;
+            "io.modelcontextprotocol/related-task"?: {
+                taskId: string;
+            } | undefined;
+        } | undefined;
+        structuredContent?: {
+            [x: string]: unknown;
+        } | undefined;
+        isError?: boolean | undefined;
+    }>;
+    close(): Promise<void>;
+};
+export {};