@ai-workbench/remote-agent 0.8.5 → 0.8.11

package/dist/index.js

@@ -3,7 +3,7 @@ import Schema from '@deepseek-ai/schemastery';
 import { LlmAdapter, LlmError } from '@deepseek-ai/dsh-llm';
 import { fileURLToPath } from 'node:url';
 import { createHash, randomUUID } from 'node:crypto';
-import { recoveryJournal, recoveryKey } from "./recovery.js";
+import { recoveryJournal, runtimeRecoveryKey, supportsCodexContextPolicy } from "./recovery.js";
 import * as unstable from '@agentclientprotocol/sdk/unstable';
 import * as acp from '@agentclientprotocol/sdk';
 import { AcpSession } from "./acp.js";
@@ -12,7 +12,7 @@ import { StreamMapper } from "./mapping.js";
 import { connectProvider } from "./provider.js";
 import { brokerFactory } from "./broker.js";
 import { AGENTS, CODEX_AGENT } from "./agents.js";
-import { prepareInput } from "./input.js";
+import { prepareInput, prepareContinuation } from "./input.js";
 import { createWorkspaceNoticeConsumer, isWorkspaceNoticeMessage } from "./workspace-notice.js";
 import { NeedError } from "./remote.js";
 import { employeeFailure } from "./presentation.js";
@@ -23,12 +23,21 @@ import { StageTiming } from "./stage-timing.js";
 import { verifyRecoveryCheckpoint, currentInputIds } from "./recovery-checkpoint.js";
 import { ModelCatalog, modelInfo } from "./model-catalog.js";
 import { ModelConfigurationError } from "./model-configuration.js";
+import { officialEmployeeWorkspace } from "./employee-workspace.js";
+import { nativeWorkspaceSourceConfirmation } from "./workspace-source-confirmation.js";
+import { resolveEmployeeNative } from "./employee-native.js";
+import { createLocalUserTurnObserver } from "./local-user-turn.js";
+import { createClaudeLocalProvider } from "./claude-local.js";
+import { readLocalUserTurn } from "./local-user-turn.js";
+import { readEmployeeWorkspace } from "./employee-workspace.js";
+import { createModelDefaults, createDefaultSelectionWriter } from "./model-defaults.js";
+import { installModelInputRetention, markModelPreparationFailure } from "./model-input-retention.js";
 export const name = 'ai-workbench-remote-agent';
 export const settingsNamespace = 'ai-workbench-codex';
 // L can be installed/enabled after X; keeping X mounted lets it explain the prerequisite.
 export const inject = ['llm'];
 /** Owner-approved defaults; administrators may override through the existing settings. */
-export const DEFAULT_CONFIG = Object.freeze({ mode: 'session', acpMaxMessageBytes: 4194304, brokerMaxFrameBytes: 2097152, brokerControlMaxBytes: 1048576, oneShotSandbox: 'workspace-write', oneShotApproval: 'never' });
+export const DEFAULT_CONFIG = Object.freeze({ mode: 'session', acpMaxMessageBytes: 4194304, brokerMaxFrameBytes: 2097152, brokerControlMaxBytes: 1048576, oneShotSandbox: 'workspace-write', oneShotApproval: 'never', employeeShellKillGraceMs: 1000 });
 export const Config = Schema.object({
     mode: Schema.union([Schema.const('session').i18n({ en: 'Session', zh: '会话模式' }), Schema.const('one-shot').i18n({ en: 'One-shot', zh: '单次模式' })]).i18n({ en: 'Run mode; start a new session after switching modes', zh: 'Codex运行模式；Claude固定会话模式；切换后请新建会话' }).default(DEFAULT_CONFIG.mode).volatile(),
     acpMaxMessageBytes: Schema.number().min(1).step(1).i18n({ en: 'Session message limit; default 4 MiB, adjustable by administrators', zh: '会话消息容量；默认4 MiB，管理员可调整' }).default(DEFAULT_CONFIG.acpMaxMessageBytes).volatile(),
@@ -36,11 +45,13 @@ export const Config = Schema.object({
     brokerControlMaxBytes: Schema.number().min(1).step(1).i18n({ en: 'Host session control reply limit; default 1 MiB, adjustable by administrators', zh: '主机会话管理回复容量；默认1 MiB，管理员可调整' }).default(DEFAULT_CONFIG.brokerControlMaxBytes).volatile(),
     oneShotSandbox: Schema.union(['read-only', 'workspace-write', 'danger-full-access']).i18n({ en: 'One-shot sandbox; workspace changes are allowed by default', zh: '单次任务沙箱；默认允许工作区内修改' }).default(DEFAULT_CONFIG.oneShotSandbox).volatile(),
     oneShotApproval: Schema.const('never').i18n({ en: 'Non-interactive approval; permissions follow the launch policy, never automatic approval', zh: '单次模式无交互审批；权限由启动策略决定，不表示自动批准' }).default(DEFAULT_CONFIG.oneShotApproval).volatile(),
+    employeeShellKillGraceMs: Schema.number().min(0).max(2147483647).step(1).i18n({ en: 'Local command SSH cleanup grace in milliseconds; cancellation keeps the remote result unknown', zh: '本机命令SSH取消后的清理宽限毫秒；默认1000，取消仍保留员工端结果未知' }).default(DEFAULT_CONFIG.employeeShellKillGraceMs).volatile(),
 });
 /** DSH volatile settings are handles; adapters freeze their values once per invocation. */
 export function readConfig(config) {
     return Object.fromEntries(Object.entries(config).map(([key, value]) => [key, typeof value === 'object' && value !== null && 'get' in value ? value.get() : value]));
 }
+function validContextDigest(value) { return typeof value === 'string' && /^[a-fA-F0-9]{64}$/u.test(value); }
 function readPointer(options, agent) {
     const last = options.messages.findLast(message => message.role === 'assistant' && !isWorkspaceNoticeMessage(message));
     if (!last || last.role !== 'assistant')
@@ -53,6 +64,8 @@ function readPointer(options, agent) {
         throw new NeedError('SESSION_STATE_INVALID', '原对话缺少新版工作区/模型绑定，不能静默迁移，请新建会话', '有效的新一代远端会话恢复记录');
     if (options.sessionId && pointer.dshSessionId !== options.sessionId)
         throw new NeedError('SESSION_CONTEXT_MISMATCH', '此恢复记录属于另一会话，复制或分叉后不能沿用原远端进程，请新建会话', '当前DSH会话自己的远端恢复记录');
+    if (agent.loginProvider === 'codex' && (!validContextDigest(pointer.contextSha256) || (pointer.previousRemoteSessions !== undefined && (!Array.isArray(pointer.previousRemoteSessions) || !pointer.previousRemoteSessions.every(ref => ref && typeof ref.sessionId === 'string' && ref.sessionId.length > 0 && validContextDigest(ref.contextSha256))))))
+        throw new NeedError('SESSION_CONTEXT_DIGEST_INVALID', '原Codex会话的初建上下文摘要未知或无效，不能猜测是否相同，本轮未发送', '原会话合法的64位十六进制初建上下文摘要');
     return pointer;
 }
 export class CodexRemoteAdapter extends LlmAdapter {
@@ -90,17 +103,25 @@ export class CodexRemoteAdapter extends LlmAdapter {
     finally {
         catalog.release();
     } }
-    async resolveModel(provider, id, signal) { const catalog = await this.catalog(signal); try {
-        const model = catalog.models.find(model => model.id === id);
-        if (!model)
-            throw new LlmError('无法获取模型列表：所选模型已不在当前主机目录中', 'MODEL_CATALOG_UNAVAILABLE');
-        return modelInfo(provider, model);
+    async resolveModel(provider, id, signal) { try {
+        const catalog = await this.catalog(signal);
+        try {
+            const model = catalog.models.find(model => model.id === id);
+            if (!model)
+                throw new LlmError(id === 'remote' ? '无法获取模型列表：这个会话保存的是旧版模型选择，请打开本会话的模型菜单，重新选择模型后再发送。' : '所选模型已不在当前主机目录中，请打开本会话的模型菜单重新选择模型。', 'MODEL_CATALOG_UNAVAILABLE');
+            return modelInfo(provider, model);
+        }
+        finally {
+            catalog.release();
+        }
     }
-    finally {
-        catalog.release();
+    catch (error) {
+        markModelPreparationFailure(provider, error, signal);
+        throw error;
     } }
     async invalidateModelState() { for (const turn of this.turns.values())
         turn.abort(); await Promise.all([...this.sessions.keys()].map(id => this.disposeSession(id))); }
+    async invalidateEmployeeState() { await Promise.all([...this.sessions].filter(([, live]) => live.runtime.employeeExecutionMeta || live.runtime.execution).map(([id]) => this.disposeSession(id))); }
     providerRetryPolicy() { return { mode: 'normal', maxRetries: 0, retryableCodes: [], initialDelayMs: 0, maxDelayMs: 0, jitterRatio: 0 }; }
     cleanupRuntime(runtime) {
         const existing = this.cleanups.get(runtime);
@@ -165,7 +186,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 throw new LlmError(error.message, error.code, { cause: error });
             if (error instanceof NeedError) {
                 const rpc = /RPC 错误码 (-?\d+)/u.exec(error.requires)?.[1];
-                const message = employeeFailure(error.code) + (rpc ? `（技术详情：RPC 错误码 ${rpc}）` : '');
+                const message = employeeFailure(error.code, this.agent.loginProvider) + (rpc ? `（技术详情：RPC 错误码 ${rpc}）` : '');
                 let diagnostic = error.technical ? JSON.stringify(error.technical) : '';
                 if (error.technical && this.reportLoginFailure) {
                     try {
@@ -195,11 +216,14 @@ export class CodexRemoteAdapter extends LlmAdapter {
         const signal = AbortSignal.any([this.lifetime.signal, turn.signal, ...(original.signal ? [original.signal] : [])]);
         const options = { ...original, signal };
         const timing = new StageTiming();
+        let request;
+        let earlyStage = 'input-prepare';
         let runtime;
         let session;
         let live;
         let succeeded = false;
         let remoteAttempted = false;
+        let preserveRecoveredRuntime = false;
         let activeMapper;
         let catalog;
         let selected;
@@ -221,18 +245,34 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 throw new NeedError('SESSION_STATE_UNCONFIRMED', '上轮远端状态未确认，不能自动重发或重开，请新建会话并核对项目', '管理员核对原会话状态');
             if (live && !previous)
                 throw new NeedError('SESSION_STATE_MISSING', '上一轮回复尚无持久恢复记录，不能继续当前远端会话', '原会话的持久回复记录');
-            const configuration = JSON.stringify([mode, config.acpMaxMessageBytes, config.brokerMaxFrameBytes, config.brokerControlMaxBytes]);
+            const configuration = JSON.stringify([mode, config.acpMaxMessageBytes, config.brokerMaxFrameBytes, config.brokerControlMaxBytes, config.employeeShellKillGraceMs]);
             if (live && live.configuration !== configuration)
                 throw new NeedError('SESSION_CONTEXT_MISMATCH', '会话运行设置已改变，请新建会话', '原会话运行设置');
-            const request = { timing, acpMaxMessageBytes: config.acpMaxMessageBytes, resumeSessionId: previous?.sessionId, recoveryCheckpointId: previous?.recoveryCheckpointId, sessionId: options.sessionId, mode, cwd: previous?.cwd, identity: previous?.identity, bindingId: previous?.bindingId, workspaceId: previous?.workspaceId, agent: this.agent, retainProcess: !!key && mode === 'session', signal, brokerSettings: Object.freeze({ brokerMaxFrameBytes: config.brokerMaxFrameBytes, brokerControlMaxBytes: config.brokerControlMaxBytes }) };
+            request = { timing, acpMaxMessageBytes: config.acpMaxMessageBytes, resumeSessionId: previous?.sessionId, recoveryCheckpointId: previous?.recoveryCheckpointId, sessionId: options.sessionId, mode, cwd: previous?.cwd, identity: previous?.identity, bindingId: previous?.bindingId, workspaceId: previous?.workspaceId, agent: this.agent, retainProcess: !!key && mode === 'session', signal, brokerSettings: Object.freeze({ brokerMaxFrameBytes: config.brokerMaxFrameBytes, brokerControlMaxBytes: config.brokerControlMaxBytes }) };
+            const after = options.messages.findLastIndex(message => message.role === 'assistant' && !isWorkspaceNoticeMessage(message));
+            request.userInputIds = Object.freeze(options.messages.slice(after + 1).flatMap(message => message.role === 'user' && message.source?.kind === 'user' && typeof message.id === 'string' ? [message.id] : []));
+            request.userMessageIds = request.userInputIds;
             await this.resolveRuntime.preflight?.(request);
-            const input = await timing.run('input-prepare', () => prepareInput(options, this.readImage));
+            let input = await timing.run('input-prepare', () => prepareInput(options, this.readImage));
             const contextSha256 = createHash('sha256').update(input.systemPrompt ?? '').digest('hex');
             request.contextSha256 = contextSha256;
+            const codex = this.agent.loginProvider === 'codex';
+            if (codex && live && previous && live.contextSha256 !== previous.contextSha256.toLowerCase())
+                throw new NeedError('SESSION_CONTEXT_DIGEST_INVALID', '持久上下文摘要与当前远端会话的初建摘要不一致，本轮未发送', '原会话一致的初建上下文摘要');
+            const contextChanged = !!previous && codex && previous.contextSha256.toLowerCase() !== contextSha256;
+            // Only identical durable context can prove a legacy context-bound journal.
+            // New Codex transport scopes are independent of the native context digest.
+            if (contextChanged)
+                request.contextSha256 = undefined;
             if (previous && this.agent.loginProvider === 'claude' && previous.contextSha256 !== contextSha256)
                 throw new NeedError('SYSTEM_PROMPT_UPDATE_PENDING', 'Claude原会话的系统或开发者要求已变化；主机仅承诺下次上下文整理后生效，本轮未发送，请新建会话应用新要求', '新建Claude会话以立即应用当前系统与开发者要求');
+            if (contextChanged)
+                input = await prepareContinuation(options, input, this.readImage);
             if (live) {
-                live.session.validateContext({ systemPrompt: input.systemPrompt });
+                if (contextChanged)
+                    live.session.validateNewSessionContext({ systemPrompt: input.systemPrompt });
+                else
+                    live.session.validateContext({ systemPrompt: input.systemPrompt });
                 live.session.validatePrompt(input.prompt);
             }
             if (mode === 'one-shot' && (input.systemPrompt || input.prompt.some(block => block.type !== 'text')))
@@ -241,36 +281,63 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 throw new NeedError('ACP_MESSAGE_TOO_LARGE', '本轮输入超过已设置的会话消息容量，未截断或发送', '管理员调整acpMaxMessageBytes');
             if (mode === 'one-shot')
                 throw new NeedError('MODEL_CONFIGURATION_UNSUPPORTED', '单次模式不支持确认当前模型与推理等级，请改用会话模式', '支持模型配置确认的会话模式');
+            request.localAdmissionCheck?.();
+            earlyStage = 'model-catalog';
             catalog = await this.catalog(signal);
             selected = catalog.models.find(model => model.id === options.model);
             if (!selected)
                 throw new ModelConfigurationError('所选模型不在本次可信主机目录中，请重新选择模型');
             if (options.reasoningEffort !== undefined && !selected.reasoning.options.some(option => option.value === options.reasoningEffort))
                 throw new ModelConfigurationError('所选推理等级不在本次模型目录中');
-            const modelSignal = AbortSignal.any([signal, catalog.signal]);
+            let modelSignal = AbortSignal.any([signal, catalog.signal]);
             options.signal = modelSignal;
             request.signal = modelSignal;
+            earlyStage = 'runtime-resolve';
             runtime = await this.resolveRuntime(request);
             signal.throwIfAborted();
+            if (runtime.execution?.signal) {
+                modelSignal = AbortSignal.any([modelSignal, runtime.execution.signal]);
+                options.signal = modelSignal;
+                request.signal = modelSignal;
+                modelSignal.throwIfAborted();
+            }
             catalog.assertCurrent();
             if (runtime.connection && (runtime.connection.instanceId !== catalog.target.instanceId || runtime.connection.epoch !== catalog.target.epoch) || runtime.identity !== `${catalog.target.target.username}@${catalog.target.target.host}:${catalog.target.target.port}`)
                 throw new ModelConfigurationError('模型目录与当前会话可信员工主机不一致');
             if (previous && (previous.identity !== runtime.identity || previous.cwd !== runtime.cwd || previous.bindingId && previous.bindingId !== runtime.binding?.bindingId || previous.workspaceId && previous.workspaceId !== runtime.binding?.workspaceId))
                 throw new NeedError('SESSION_CONTEXT_MISMATCH', '原会话的员工主机或工作区已改变，请新建会话', '原会话的可信目标和工作区');
+            if (contextChanged && runtime.recoveredSession) {
+                const capabilities = runtime.recoveredSession.capabilities;
+                // A clean reattach has sent no ACP input. A known policy refusal must
+                // detach it, preserving the original native session and checkpoint.
+                if (!capabilities.sessionCapabilities?.systemPrompt || !supportsCodexContextPolicy(capabilities)) {
+                    preserveRecoveredRuntime = true;
+                    if (!capabilities.sessionCapabilities?.systemPrompt)
+                        throw new NeedError('SYSTEM_PROMPT_UNSUPPORTED', '远端未声明系统与开发者上下文能力，不能丢弃这些要求继续', '支持 systemPrompt 的公开 ACP 能力');
+                    throw new NeedError('SYSTEM_PROMPT_POLICY_UNSUPPORTED', '远端没有明确声明Codex上下文仅新建生效的兼容政策，本轮未发送', 'systemPrompt与精确的aiWorkbenchSystemPrompt新建政策');
+                }
+            }
             if (runtime.restartNotice) {
                 const ids = runtime.restartInputIds;
                 if (!ids?.length || new Set(ids).size !== ids.length || ids.some(id => input.users.filter(u => u.id === id).length !== 1))
                     throw new NeedError('CURRENT_INPUT_UNCONFIRMED', '无法核对本次输入，尚未发送给模型', '官方当前步骤的已接纳用户输入');
-                input.prompt = ids.flatMap(id => input.users.find(u => u.id === id).prompt);
+                input = { ...input, prompt: ids.flatMap(id => input.users.find(u => u.id === id).prompt) };
+                if (contextChanged)
+                    input = await timing.run('input-prepare', () => prepareContinuation(options, input, this.readImage));
             }
             const details = runtime.details;
             if (!details)
                 throw new NeedError('TECHNICAL_DETAILS_UNAVAILABLE', '技术详情暂不可用，请更新远程主机连接组件。', 'L技术详情持久接收能力');
             timing.bind(detail => details.record(detail));
-            const mapper = new StreamMapper(mode === 'session' ? (runtime.restartNotice ? undefined : live ? live.usageSnapshot : previous ? (previous.usageSnapshot ?? null) : undefined) : undefined, observation => details.record(observation));
+            request.recordEarlyFailure = undefined;
+            const mapper = new StreamMapper(mode === 'session' && !contextChanged ? (runtime.restartNotice ? undefined : live ? live.usageSnapshot : previous ? (previous.usageSnapshot ?? null) : undefined) : undefined, observation => details.record(observation));
             activeMapper = mapper;
             let id;
             let stop;
+            if (runtime.employeePresentation) {
+                yield* mapper.text(runtime.employeePresentation + '\n\n');
+                yield* mapper.flush();
+            }
             if (runtime.workspaceNotice) {
                 yield* mapper.text(runtime.workspaceNotice.text);
                 yield* mapper.flush();
@@ -279,6 +346,11 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 yield* mapper.text(runtime.restartNotice + '\n\n');
                 yield* mapper.flush();
             }
+            if (runtime.execution) {
+                details.record({ kind: 'session', severity: 'warning', code: 'CLAUDE_EMPLOYEE_SCOPE', summary: '本机工具路由及未覆盖操作范围', payload: runtime.execution.scope });
+                yield* mapper.text(runtime.execution.notice + '\n\n');
+                yield* mapper.flush();
+            }
             if (mode === 'session') {
                 if (live && live.runtime !== runtime)
                     throw new NeedError('SESSION_TRANSPORT_MISMATCH', '原会话的主机通道已更换，不能自动切换进程', '原主机会话通道');
@@ -289,7 +361,22 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 let done = false;
                 let failure;
                 const push = (chunks) => { queue.push(...chunks); wake?.(); wake = undefined; };
-                const hooks = { broker: runtime.broker, timing, approve: (permission, approvalSignal) => this.approve?.(permission, approvalSignal, options) ?? Promise.resolve('unavailable'), onUpdate: notification => { try {
+                const hooks = { broker: runtime.broker, employeeExecution: runtime.employeeExecution, timing, approve: async (permission, approvalSignal) => {
+                        const execution = runtime.execution;
+                        const toolName = permission.toolCall.name ?? permission.toolCall._meta?.claudeCode?.toolName;
+                        if (execution) {
+                            if (toolName && ['Agent', 'Task', 'TaskOutput', 'TaskStop', 'Read', 'Write', 'Edit', 'Glob', 'Grep', 'Bash'].includes(toolName)) {
+                                details.record({ kind: 'need', severity: 'warning', code: 'CLAUDE_HOST_TOOL_UNSUPPORTED', summary: '这类原生调用没有经过员工端别名，本机来源不支持；本次审批已取消', payload: { operation: toolName } });
+                                push(mapper.text('\n这类操作尚不支持在本机执行，已取消本次审批，没有在主机代跑。\n'));
+                                return 'cancelled';
+                            }
+                            await execution.validate(approvalSignal);
+                        }
+                        const answer = await this.approve?.(permission, approvalSignal, options, execution && toolName?.startsWith('mcp__employee__') ? 'employee-local' : undefined) ?? 'unavailable';
+                        if (execution && answer === 'allowed-once')
+                            await execution.validate(approvalSignal);
+                        return answer;
+                    }, onUpdate: notification => { try {
                         push(mapper.acp(notification.update));
                     }
                     catch (error) {
@@ -300,7 +387,7 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 if (fresh) {
                     const transport = runtime.acpTransport instanceof acp.AgentApp || runtime.acpTransport instanceof unstable.AgentApp ? runtime.acpTransport : acp.ndJsonStream(runtime.acpTransport.writable, runtime.acpTransport.readable, { maxMessageBytes: config.acpMaxMessageBytes });
                     session = new AcpSession(transport, hooks);
-                    live = { session, runtime, configuration, usageSnapshot: mapper.usageSnapshot };
+                    live = { session, runtime, configuration, contextSha256, usageSnapshot: mapper.usageSnapshot };
                     if (key)
                         this.sessions.set(key, live);
                 }
@@ -313,17 +400,30 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 const task = (async () => {
                     remoteAttempted = true;
                     try {
-                        if (fresh) {
-                            if (runtime.recoveredSession)
-                                session.restore(runtime.cwd, runtime.recoveredSession, { systemPrompt: input.systemPrompt });
-                            else
-                                await session.start(runtime.cwd, runtime.restartNotice ? undefined : previous?.sessionId, modelSignal, { systemPrompt: input.systemPrompt });
+                        if (fresh && runtime.recoveredSession) {
+                            if (previous && runtime.recoveredSession.sessionId !== previous.sessionId)
+                                throw new NeedError('SESSION_STATE_INVALID', '已接回的会话与持久标识不一致，本轮未发送', '原会话的恢复标识');
+                            session.restore(runtime.execution?.hostCwd ?? runtime.cwd, runtime.recoveredSession, { systemPrompt: input.systemPrompt, ...(runtime.execution ? { employeeRouting: runtime.execution.routing } : {}), ...(codex ? { codexNewSessionOnly: true } : {}) }, codex && !!previous && !contextChanged);
+                            session.validatePrompt(input.prompt);
+                            if (contextChanged)
+                                await session.newContextSession({ systemPrompt: input.systemPrompt }, modelSignal);
                         }
+                        else if (fresh)
+                            await session.start(runtime.execution?.hostCwd ?? runtime.cwd, contextChanged || runtime.restartNotice ? undefined : previous?.sessionId, modelSignal, { systemPrompt: contextChanged ? (input.systemPrompt ?? '') : input.systemPrompt, ...(runtime.execution ? { employeeRouting: runtime.execution.routing } : {}), ...(codex ? { codexNewSessionOnly: true } : {}), ...(runtime.employeeExecutionMeta ? { employeeExecution: runtime.employeeExecutionMeta } : {}) }, input.prompt);
+                        else if (contextChanged)
+                            await session.newContextSession({ systemPrompt: input.systemPrompt }, modelSignal);
                         else {
                             const updated = await session.updateContext({ systemPrompt: input.systemPrompt }, modelSignal);
                             if (updated && this.agent.loginProvider === 'claude')
                                 throw new NeedError('SYSTEM_PROMPT_UPDATE_PENDING', 'Claude原会话的系统或开发者要求已变化；主机仅承诺下次上下文整理后生效，本轮未发送，请新建会话应用新要求', '新建Claude会话以立即应用当前系统与开发者要求');
                         }
+                        if (contextChanged) {
+                            if (session.id === previous.sessionId)
+                                throw new NeedError('SESSION_STATE_INVALID', '新会话标识与原会话相同，无法确认独立承接，本轮未发送', '独立的新远端会话标识');
+                            live.contextSha256 = contextSha256;
+                            live.usageSnapshot = mapper.usageSnapshot;
+                            details.record({ kind: 'session', severity: 'info', code: 'CODEX_CONTEXT_SESSION_REPLACED', summary: 'Codex要求仅在新建生效，已保留原会话；新会话承接可见用户及助手正文，内部推理不转发', payload: { reason: 'system-context-changed', oldSessionId: previous.sessionId, newSessionId: session.id, oldContextSha256: previous.contextSha256, newContextSha256: contextSha256, history: input.historyTransfer } });
+                        }
                         catalog.assertCurrent();
                         const actual = await session.selectModel(selected.value, options.reasoningEffort, modelSignal);
                         catalog.assertCurrent();
@@ -350,11 +450,16 @@ export class CodexRemoteAdapter extends LlmAdapter {
                     details.beginTurn(runtime.detailContext?.() ?? { turn: null, step: null });
                     catalog.assertCurrent();
                     session.assertModelSelection(selected.value, options.reasoningEffort);
+                    await runtime.execution?.beginTurn(modelSignal);
                     id = session.id;
                     try {
-                        return await session.prompt(input.prompt, modelSignal);
+                        const result = await session.prompt(input.prompt, modelSignal);
+                        if (contextChanged)
+                            push(mapper.text(runtime.restartNotice ? '\n\n会话要求已变化，已把此前可见对话带入新 Codex 会话继续处理。' : '\n\n会话要求已变化，已新建 Codex 会话继续处理，原会话仍保留。'));
+                        return result;
                     }
                     finally {
+                        runtime.execution?.endTurn();
                         details.endTurn();
                     }
                 })();
@@ -406,7 +511,8 @@ export class CodexRemoteAdapter extends LlmAdapter {
                 if (await runtime.saveCheckpoint(id, session.checkpoint))
                     recoveryCheckpointId = id;
             }
-            const pointer = { ...(modelConfiguration ? { modelConfiguration } : {}), ...(recoveryCheckpointId ? { recoveryCheckpointId } : {}), ...(runtime.workspaceNotice ? { presentation: { workspaceNotice: runtime.workspaceNotice } } : {}), version: 2, agent: this.agent.id, contextSha256, ...(mode === 'session' ? { usageSnapshot: mapper.usageSnapshot } : {}), ...(options.sessionId ? { dshSessionId: options.sessionId } : {}), mode, identity: runtime.identity, cwd: runtime.cwd, sessionId: id, ...(runtime.binding ? { bindingId: runtime.binding.bindingId, workspaceId: runtime.binding.workspaceId } : {}) };
+            const previousRemoteSessions = [...(previous?.previousRemoteSessions ?? []), ...(contextChanged ? [{ sessionId: previous.sessionId, contextSha256: previous.contextSha256 }] : [])];
+            const pointer = { ...(previousRemoteSessions.length ? { previousRemoteSessions } : {}), ...(modelConfiguration ? { modelConfiguration } : {}), ...(recoveryCheckpointId ? { recoveryCheckpointId } : {}), ...(runtime.workspaceNotice ? { presentation: { workspaceNotice: runtime.workspaceNotice } } : {}), version: 2, agent: this.agent.id, contextSha256, ...(mode === 'session' ? { usageSnapshot: mapper.usageSnapshot } : {}), ...(options.sessionId ? { dshSessionId: options.sessionId } : {}), mode, identity: runtime.identity, cwd: runtime.cwd, sessionId: id, ...(runtime.binding ? { bindingId: runtime.binding.bindingId, workspaceId: runtime.binding.workspaceId } : {}) };
             succeeded = true;
             yield { type: 'finish', reason: { kind: stop === 'max_tokens' || stop === 'max_turn_requests' ? 'max-tokens' : 'stop' }, replayState: { response: pointer } };
         }
@@ -414,11 +520,29 @@ export class CodexRemoteAdapter extends LlmAdapter {
             if (live && (remoteAttempted || runtime === live.runtime))
                 live.failure = { cause: error };
             let reportingFailure;
+            if (request?.recordEarlyFailure) {
+                const record = request.recordEarlyFailure;
+                request.recordEarlyFailure = undefined;
+                const code = error instanceof NeedError || error instanceof ModelConfigurationError ? error.code : error instanceof LlmError ? error.failure.code : signal.aborted ? 'ABORTED' : 'WORKSPACE_SOURCE_CONFIRMATION_FAILED';
+                try {
+                    await record(new NeedError(code, '来源确认后本轮在执行前失败。', '白名单阶段与错误代码'), earlyStage);
+                }
+                catch (failure) {
+                    reportingFailure = { cause: failure };
+                }
+            }
             try {
                 await runtime?.details?.flush();
             }
             catch (failure) {
-                reportingFailure = { cause: failure };
+                if (reportingFailure === undefined)
+                    reportingFailure = { cause: failure };
+                else {
+                    const first = reportingFailure.cause;
+                    const originalCode = error instanceof NeedError || error instanceof ModelConfigurationError ? error.code : error instanceof LlmError ? error.failure.code : 'WORKSPACE_SOURCE_CONFIRMATION_FAILED';
+                    const flushCode = failure instanceof NeedError || failure instanceof ModelConfigurationError ? failure.code : failure instanceof LlmError ? failure.failure.code : 'CONVERSATION_DETAILS_FAILED';
+                    reportingFailure = { cause: Object.assign(new NeedError('CONVERSATION_DETAILS_FAILED', '本轮诊断保存及详情收尾失败，已停止。', '原错误代码 ' + originalCode + '；' + (first instanceof NeedError ? first.requires : '早期诊断保存失败') + '；详情收尾代码 ' + flushCode), { cause: new AggregateError([error, first, failure], 'ADMISSION_DIAGNOSTIC_AND_FLUSH_FAILED') }) };
+                }
             }
             if (activeMapper)
                 yield* activeMapper.flush();
@@ -427,9 +551,10 @@ export class CodexRemoteAdapter extends LlmAdapter {
             throw error;
         }
         finally {
+            runtime?.execution?.endTurn();
             catalog?.release();
             try {
-                if (this.shuttingDown || key && this.detached.has(key)) {
+                if (preserveRecoveredRuntime || this.shuttingDown || key && this.detached.has(key)) {
                     session?.close();
                     await runtime?.detach?.();
                 }
@@ -459,6 +584,7 @@ export class RemoteAgentsAdapter extends LlmAdapter {
     listModels(provider) { return this.adapter(provider).listModels(provider); }
     resolveModel(provider, model, signal) { return this.adapter(provider).resolveModel(provider, model, signal); }
     async invalidateModelState() { await Promise.all([...this.adapters.values()].map(adapter => adapter.invalidateModelState())); }
+    async invalidateEmployeeState() { await Promise.all([...this.adapters.values()].map(adapter => adapter.invalidateEmployeeState())); }
     providerRetryPolicy() { return { mode: 'normal', maxRetries: 0, retryableCodes: [], initialDelayMs: 0, maxDelayMs: 0, jitterRatio: 0 }; }
     stream(options) { return this.adapter(options.provider).stream(options); }
     async disposeSession(sessionId) { await Promise.all([...this.adapters.values()].map(adapter => adapter.disposeSession(sessionId))); }
@@ -476,6 +602,7 @@ export function apply(ctx, live) {
         return attachments.readImage(ref, signal);
     };
     const openByAgent = new Map(AGENTS.map(agent => [agent.id, brokerFactory(get, undefined, config)]));
+    const localTurns = createLocalUserTurnObserver(ctx);
     const detailManagers = new Map();
     const managerForProfile = () => {
         const profile = ctx.get('profileContext');
@@ -488,15 +615,35 @@ export function apply(ctx, live) {
         }
         return manager;
     };
-    let changed = () => { };
-    const modelDirectory = new ModelCatalog(get, () => config().acpMaxMessageBytes, undefined, () => changed());
-    const adapter = new RemoteAgentsAdapter(config, agent => connectProvider(get, { agent, notice: createWorkspaceNoticeConsumer(ctx, agent), details: async (request, api, connection, target) => {
-            return managerForProfile().open({ sessionId: request.sessionId, provider: agent.loginProvider, identity: `${target.username}@${target.host}:${target.port}`, connection });
-        }, open: async (...args) => {
+    let changed = () => { }, publishDiagnostics = () => { };
+    const diagnostics = new Map();
+    const diagnostic = (scope, provider, message) => {
+        let entry = diagnostics.get(provider);
+        if (!entry) {
+            entry = new Map();
+            diagnostics.set(provider, entry);
+        }
+        if (entry.get(scope) === message)
+            return;
+        if (message === undefined)
+            entry.delete(scope);
+        else
+            entry.set(scope, message);
+        publishDiagnostics();
+    };
+    let defaults;
+    const modelDirectory = new ModelCatalog(get, () => config().acpMaxMessageBytes, undefined, () => changed(), (brand, message) => {
+        diagnostic('catalog', AGENTS.find(agent => agent.loginProvider === brand).id, message);
+    }, (agent, models, assertCurrent) => defaults?.observe(agent, models, assertCurrent));
+    const adapter = new RemoteAgentsAdapter(config, agent => {
+        const details = async (request, api, connection, target) => {
+            return managerForProfile().open({ sessionId: request.sessionId, provider: agent.loginProvider, identity: `${target.username}@${target.host}:${target.port}`, connection, localAcceptanceId: request.localAcceptanceId ?? request.localAcceptance?.acceptanceId });
+        };
+        const open = async (...args) => {
             const profile = ctx.get('profileContext');
             if (!profile?.dir)
                 throw new NeedError('RECOVERY_STORAGE_REQUIRED', '会话恢复需要官方profile目录', '官方profileContext.dir');
-            args[2].recoveryJournal = recoveryJournal(profile.dir, recoveryKey([`${args[0].username}@${args[0].host}:${args[0].port}`, agent.id, args[2].sessionId]));
+            args[2].recoveryJournal = recoveryJournal(profile.dir, runtimeRecoveryKey(`${args[0].username}@${args[0].host}:${args[0].port}`, agent.id, args[2].sessionId, args[2].employeeScope));
             args[2].verifyRecovery = () => verifyRecoveryCheckpoint(ctx, args[2], agent.id);
             args[2].currentInputIds = await currentInputIds(ctx, args[2]);
             const runtime = await openByAgent.get(agent.id)(...args);
@@ -520,7 +667,23 @@ export function apply(ctx, live) {
                 return { turn, step };
             };
             return runtime;
-        } }), dshApproval(ctx), agent => agent.name[language], readImage, (sessionId, code, diagnostic) => {
+        };
+        const local = agent.loginProvider === 'claude' ? createClaudeLocalProvider({ getConnect: get, getNetwork: () => ctx.get('aiWorkbenchNetwork'), readWorkspace: id => readEmployeeWorkspace(ctx, id), readUserTurn: request => readLocalUserTurn(ctx, { sessionId: request.sessionId, route: agent.id, userMessageIds: request.userMessageIds ?? [] }), reportAdmissionFailure: (request, code) => managerForProfile().recordLocalFailure({ sessionId: request.sessionId, provider: 'claude', code }), recordUnscoped: (request, observation) => managerForProfile().recordLocalFailure({ sessionId: request.sessionId, provider: 'claude', code: observation.code, observation }), configuration: config, details, open }) : undefined;
+        const workspace = async (request) => {
+            const services = ctx;
+            const registry = services.get('workspaceRegistry');
+            const sessions = services.get('sessions');
+            return officialEmployeeWorkspace(request.sessionId, registry, sessions?.get(request.sessionId)?.header);
+        };
+        return connectProvider(get, { agent, workspaceSource: {
+                workspace, currentUserTurn: request => localTurns.current(request), confirm: nativeWorkspaceSourceConfirmation(ctx),
+                record: (request, observation) => managerForProfile().recordLocalFailure({ sessionId: request.sessionId, provider: agent.loginProvider, code: observation.code, observation }),
+            }, ...(agent.loginProvider === 'codex' ? { employee: {
+                    currentUserTurn: request => localTurns.current(request),
+                    getNetwork: () => ctx.get('aiWorkbenchNetwork'),
+                    workspace, native: () => resolveEmployeeNative(),
+                } } : {}), notice: createWorkspaceNoticeConsumer(ctx, agent), details, open, local });
+    }, dshApproval(ctx), agent => agent.name[language], readImage, (sessionId, code, diagnostic) => {
         const events = sessionId ? ctx.get('agents')?.get(SessionId(sessionId))?.session.snapshotEvents() : undefined;
         let turn = null, step = null;
         for (const event of events ?? []) {
@@ -540,12 +703,43 @@ export function apply(ctx, live) {
         return managerForProfile().recordLoginFailure({ sessionId, code, diagnostic, context: { turn, step } });
     }, modelDirectory);
     const ids = AGENTS.map(agent => agent.id);
-    const entries = () => AGENTS.map(agent => ({ provider: agent.id, displayName: agent.name[language], settingsNs: settingsNamespace, settingsPath: [] }));
+    const entries = () => AGENTS.map(agent => ({ provider: agent.id, displayName: agent.name[language], settingsNs: settingsNamespace, settingsPath: [], ...(diagnostics.get(agent.id)?.size ? { error: [...diagnostics.get(agent.id).values()].join('\n') } : {}) }));
     const directory = ctx.llm.registerConfigurableProviders(entries());
     const registration = ctx.llm.registerAdapter(ids, adapter);
-    changed = () => { registration.replace(ids); void adapter.invalidateModelState().catch(() => { ctx.logger('remote-agent').warn('原会话清理结果未确认，已阻断继续发送；请联系管理员核对。'); }); };
-    ctx.on('internal/service', service => { if (service === 'aiWorkbenchConnect')
-        modelDirectory.refresh(); });
+    installModelInputRetention(ctx, { isOurProvider: provider => ids.includes(provider), diagnostic: (provider, message) => diagnostic('input', provider, message) });
+    const serviceValue = (name) => ctx.get(name);
+    publishDiagnostics = () => directory.replace(entries());
+    const refreshDefault = () => {
+        const service = serviceValue('agentDefaultModel');
+        const selected = service?.currentSelection();
+        const agent = AGENTS.find(agent => agent.id === selected?.provider);
+        if (!defaults || !agent)
+            return;
+        // Read through the same trusted, fresh catalog. Failures are already recorded there.
+        void modelDirectory.read(agent).then(lease => lease.release(), () => { });
+    };
+    ctx.inject(['agentDefaultModel'], child => {
+        const service = child.get('agentDefaultModel');
+        const current = createModelDefaults(service, (provider, message) => diagnostic('default', provider, message), createDefaultSelectionWriter(service, () => serviceValue('configEditor')));
+        defaults = current;
+        refreshDefault();
+        child.effect(() => () => { current.dispose(); if (defaults === current)
+            defaults = undefined; });
+    });
+    changed = () => { registration.replace(ids); refreshDefault(); void adapter.invalidateModelState().catch(() => { ctx.logger('remote-agent').warn('原会话清理结果未确认，已阻断继续发送；请联系管理员核对。'); }); };
+    let employeeConnect = serviceValue('aiWorkbenchConnect'), employeeNetwork = serviceValue('aiWorkbenchNetwork');
+    ctx.on('internal/service', service => {
+        if (service === 'aiWorkbenchConnect')
+            modelDirectory.refresh();
+        if (service !== 'aiWorkbenchConnect' && service !== 'aiWorkbenchNetwork')
+            return;
+        const nextConnect = serviceValue('aiWorkbenchConnect'), nextNetwork = serviceValue('aiWorkbenchNetwork');
+        if (nextConnect === employeeConnect && nextNetwork === employeeNetwork)
+            return;
+        employeeConnect = nextConnect;
+        employeeNetwork = nextNetwork;
+        void adapter.invalidateEmployeeState().catch(() => { ctx.logger('remote-agent').warn('本机执行连接的清理结果未确认，已阻断继续发送；请联系管理员核对。'); });
+    });
     new ProviderLocaleRemote(ctx, next => { language = next; directory.replace(entries()); registration.replace(ids); });
     const cleanup = (id) => adapter.detachSession(id);
     ctx.on('agent/disposed', ({ agent }) => cleanup(agent.session.id));
@@ -558,7 +752,7 @@ export function dshApproval(ctx) {
         const approval = ctx.get('approval');
         if (!agent || !approval)
             return 'unavailable';
-        const label = approvalLabel(request);
+        const label = approvalLabel(request, context === 'employee-local' ? 'local' : 'host');
         if (!label)
             return 'unavailable';
         return approval.request({ agent, ...label, signal });

package/dist/input.d.ts

@@ -4,6 +4,14 @@ export type ImageReader = (ref: ImageBlock['attachment'], signal?: AbortSignal)
     ref: ImageBlock['attachment'];
     data: Uint8Array;
 }>;
+export interface HistoryTransfer {
+    scope: 'visible-user-assistant-text-and-images';
+    textBlocks: number;
+    imageBlocks: number;
+    offloadedImagePlaceholders: number;
+    omittedReasoningBlocks: number;
+    reasoningOmissionReason: 'dsh-internal-reasoning';
+}
 export interface PreparedInput {
     prompt: AcpContentBlock[];
     users: {
@@ -11,6 +19,9 @@ export interface PreparedInput {
         prompt: AcpContentBlock[];
     }[];
     systemPrompt?: string;
+    historyTransfer?: HistoryTransfer;
 }
+/** Role-labelled public history only; never serialize source/replay/tool internals. */
+export declare function prepareContinuation(options: GenerateOptions, input: PreparedInput, readImage?: ImageReader): Promise<PreparedInput>;
 /** The attachment service supplies verified bytes; client paths never cross SSH. */
 export declare function prepareInput(options: GenerateOptions, readImage?: ImageReader): Promise<PreparedInput>;