dsh-crwu-workbench 0.0.39 → 0.0.41

package/lib/index.js

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync, statSync } from "node:fs";
+import { constants, existsSync, readFileSync, statSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import Schema from "@deepseek-ai/schemastery";
 import { parse } from "yaml";
@@ -8,6 +8,7 @@ import { setSandboxMode } from "@deepseek-ai/dsh-sandbox-policy";
 import { setApprovalPolicy } from "@deepseek-ai/dsh-user-approval";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { createHash, randomUUID } from "node:crypto";
+import { access, copyFile, lstat, mkdir, readFile, readdir, realpath, rm, stat, writeFile } from "node:fs/promises";
 import { compare, gt, gte, prerelease, valid } from "semver";
 //#region src/host/config/yaml.ts
 function record(value, path) {
@@ -231,7 +232,7 @@ const PLUGIN_INJECT = [
 * 还会让打包器的 JSON 插件成为隐式依赖。代价是升版本时要同时改这里 ——
 * `tests/unit/host-package.test.mjs` 有一条断言盯着它必须等于 `package.json` 的 version。
 */
-const PLUGIN_VERSION = "0.0.39";
+const PLUGIN_VERSION = "0.0.41";
 /**
 * `ping` / `boot` 应答里的版本指纹，形如 `pkg-0.0.5`。
 *
@@ -285,6 +286,15 @@ function registerRpcRoute(ctx, operations) {
 		kind: "exact",
 		path: WORKBENCH_ROUTE,
 		async handler(req, res) {
+			const controller = new AbortController();
+			const abort = () => {
+				controller.abort();
+			};
+			const disconnect = () => {
+				if (!res.writableEnded) abort();
+			};
+			req.once?.("aborted", abort);
+			res.once?.("close", disconnect);
 			try {
 				if (req.method !== "POST") {
 					writeJson$1(res, 405, {
@@ -312,12 +322,16 @@ function registerRpcRoute(ctx, operations) {
 					});
 					return;
 				}
-				writeJson$1(res, 200, await operation(body.args !== null && typeof body.args === "object" ? body.args : {}));
+				const result = await operation(body.args !== null && typeof body.args === "object" ? body.args : {}, { signal: controller.signal });
+				if (!controller.signal.aborted) writeJson$1(res, 200, result);
 			} catch (error) {
-				writeJson$1(res, 200, {
+				if (!controller.signal.aborted) writeJson$1(res, 200, {
 					ok: false,
 					error: error instanceof Error ? error.message : String(error)
 				});
+			} finally {
+				req.removeListener?.("aborted", abort);
+				res.removeListener?.("close", disconnect);
 			}
 		}
 	});
@@ -1539,7 +1553,8 @@ const TOOL_NAMES = {
 	ossPublish: "crwu_audit_oss_publish",
 	dingtalkArchive: "crwu_audit_dingtalk_archive",
 	dingtalkNotifySelf: "crwu_audit_dingtalk_notify_self",
-	runPythonScript: "crwu_run_python_script"
+	runPythonScript: "crwu_run_python_script",
+	localAuditClaim: "crwu_audit_local_claim"
 };
 /** 自研审核链路随包发布的三个二进制。 */
 const AUDIT_BINARIES = [
@@ -1661,7 +1676,7 @@ const NO_SANDBOX_FACTS = {
 	denied: false,
 	runnerFailed: false
 };
-function failed$1(error, sandbox = NO_SANDBOX_FACTS) {
+function failed$2(error, sandbox = NO_SANDBOX_FACTS) {
 	return {
 		ok: false,
 		error,
@@ -1693,9 +1708,9 @@ function failed$1(error, sandbox = NO_SANDBOX_FACTS) {
 */
 async function runShell(ctx, command, options = {}) {
 	const shell = ctx.get("shell");
-	if (shell === void 0) return failed$1("Host shell 服务不可用");
+	if (shell === void 0) return failed$2("Host shell 服务不可用");
 	const workRoot = options.workdir ?? "";
-	if (options.escalate === true && workRoot === "") return failed$1("未知会话工作区，无法申请无沙箱执行");
+	if (options.escalate === true && workRoot === "") return failed$2("未知会话工作区，无法申请无沙箱执行");
 	const declared = options.sandboxPolicy ?? (options.escalate === true ? {
 		mode: "danger-full-access",
 		workspaceRoot: workRoot
@@ -1714,7 +1729,7 @@ async function runShell(ctx, command, options = {}) {
 			...declared === void 0 ? {} : { sandboxPolicy: declared }
 		});
 	} catch (error) {
-		return failed$1(`执行失败：${failureMessage(error)}`, {
+		return failed$2(`执行失败：${failureMessage(error)}`, {
 			...NO_SANDBOX_FACTS,
 			requested: requestedMode
 		});
@@ -1745,7 +1760,7 @@ async function runShell(ctx, command, options = {}) {
 			}
 		};
 	} catch (error) {
-		return failed$1(`执行失败：${failureMessage(error)}`, baseSandbox);
+		return failed$2(`执行失败：${failureMessage(error)}`, baseSandbox);
 	}
 }
 /**
@@ -3074,7 +3089,7 @@ function classifyRun(run) {
 	return "cli";
 }
 /** 从任意一次运行结果里取一句最有信息量的失败描述。 */
-function reasonOf(run) {
+function reasonOf$1(run) {
 	const stderr = text(run.stderr).trim();
 	if (stderr !== "") return stderr.slice(0, 600);
 	const error = text(run.error).trim();
@@ -3171,10 +3186,11 @@ function samePathText(a, b) {
 */
 function isAuditChild(state, childId, parentSessionId = "") {
 	if (childId === "") return false;
+	if (parentSessionId !== "" && parentSessionId === state.auditRoot?.sessionId) return true;
 	for (const record of Object.values(state.audits ?? {})) {
 		if (record === void 0) continue;
-		if (record.childId === childId) return true;
-		if (record.pending === true && record.childId === "" && parentSessionId !== "" && record.parentSessionId === parentSessionId) return true;
+		if (record.childId === childId || record.replacedChildId === childId) return true;
+		if (parentSessionId !== "" && record.parentSessionId === parentSessionId) return true;
 	}
 	return false;
 }
@@ -3189,7 +3205,7 @@ function isAuditChild(state, childId, parentSessionId = "") {
 * 退路问的是会话存储本身：**审核根的孩子里有没有这个调用者**。
 * 两条都拿不到才算"问不到"，由门禁 fail closed（不猜）。
 *
-* 只对**待接管**的候选问（正常最多一条）：多条 pending 是状态异常，直接不认。
+* Query known audit roots so replaced children retain their managed identity.
 */
 async function callerParentSessionId(ctx, state, exec) {
 	const { childId, parentSessionId } = callerIdentity(exec);
@@ -3197,13 +3213,10 @@ async function callerParentSessionId(ctx, state, exec) {
 	if (parentSessionId !== "") return parentSessionId;
 	const subagents = ctx.get("subagents");
 	if (subagents === void 0 || typeof subagents.listChildren !== "function") return "";
-	const candidates = Object.values(state.audits ?? {}).filter((record) => record !== void 0 && record.pending === true && record.childId === "" && record.parentSessionId !== "");
-	if (candidates.length !== 1) return "";
-	const parentId = candidates[0]?.parentSessionId ?? "";
-	if (parentId === "") return "";
-	try {
+	const candidates = new Set([text(state.auditRoot?.sessionId), ...Object.values(state.audits ?? {}).map((record) => text(record?.parentSessionId))].filter((id) => id !== ""));
+	for (const parentId of candidates) try {
 		const children = await subagents.listChildren(parentId);
-		if (!Array.isArray(children)) return "";
+		if (!Array.isArray(children)) continue;
 		for (const child of children) {
 			if (child === null || typeof child !== "object") continue;
 			const record = child;
@@ -4800,7 +4813,7 @@ function bootstrapTools(deps) {
 				objectId
 			], runOptions);
 			if (!recordRun.ok) return {
-				...failure$1(recordRun.error !== "" ? "infrastructure" : "cli", reasonOf(recordRun)),
+				...failure$1(recordRun.error !== "" ? "infrastructure" : "cli", reasonOf$1(recordRun)),
 				...empty
 			};
 			const record = recordOf$1(recordRun.stdout);
@@ -4837,7 +4850,7 @@ function bootstrapTools(deps) {
 				objectId
 			], runOptions);
 			if (!filesRun.ok) return {
-				...failure$1(filesRun.error !== "" ? "infrastructure" : "cli", reasonOf(filesRun)),
+				...failure$1(filesRun.error !== "" ? "infrastructure" : "cli", reasonOf$1(filesRun)),
 				...empty
 			};
 			const attachments = attachmentsOf(filesRun.stdout);
@@ -5366,6 +5379,215 @@ function nodeSize(item) {
 	}
 	return null;
 }
+function createDiscussionScopeRegistry(options = {}) {
+	const now = options.now ?? (() => Date.now());
+	const ttlMs = options.ttlMs ?? 432e5;
+	const limit = options.limit ?? 32;
+	const scopes = /* @__PURE__ */ new Map();
+	/** 过期的一律先清掉：判据只有 `expiresAt` 与当前时刻。 */
+	const sweep = () => {
+		const at = now();
+		for (const [id, scope] of scopes) if (scope.expiresAt <= at) scopes.delete(id);
+	};
+	/** 超出上限时丢**最久没用过**的（不是最早建的：人可能一直在用一条老会话）。 */
+	const trim = () => {
+		while (scopes.size > limit) {
+			let oldestId = "";
+			let oldestAt = Number.POSITIVE_INFINITY;
+			for (const [id, scope] of scopes) if (scope.lastUsedAt < oldestAt) {
+				oldestAt = scope.lastUsedAt;
+				oldestId = id;
+			}
+			if (oldestId === "") return;
+			scopes.delete(oldestId);
+		}
+	};
+	return {
+		register(input) {
+			const at = now();
+			const scope = {
+				sessionId: text(input.sessionId),
+				seqNo: text(input.seqNo),
+				objectId: text(input.objectId),
+				caseDir: text(input.caseDir),
+				allowedAttachmentIds: [...input.allowedAttachmentIds].map((id) => text(id)).filter((id) => id !== ""),
+				createdAt: at,
+				lastUsedAt: at,
+				expiresAt: at + ttlMs
+			};
+			scopes.set(scope.sessionId, scope);
+			trim();
+			return scope;
+		},
+		use(sessionId) {
+			sweep();
+			const id = text(sessionId);
+			if (id === "") return void 0;
+			const scope = scopes.get(id);
+			if (scope === void 0) return void 0;
+			const touched = {
+				...scope,
+				lastUsedAt: now()
+			};
+			scopes.set(id, touched);
+			return touched;
+		},
+		peek(sessionId) {
+			sweep();
+			return scopes.get(text(sessionId));
+		},
+		drop(sessionId) {
+			scopes.delete(text(sessionId));
+		},
+		list() {
+			sweep();
+			return [...scopes.values()];
+		},
+		clear() {
+			scopes.clear();
+		},
+		size() {
+			sweep();
+			return scopes.size;
+		}
+	};
+}
+/**
+* 案例内 Tool 的**统一门禁**：认证身份 → 解析范围 → 校验模型提交的标识。
+*
+* 与 `requireAuditScope` 的关系：后者是"审核子会话"这一支的实现，这里在它之前再加一支
+* "已登记的讨论会话"。**讨论会话绝不复用审核 scope**（见文件头第 2 条）。
+*/
+async function requireMaterialScope(ctx, state, scopes, exec, args, options = {}) {
+	const { childId } = callerIdentity(exec);
+	if (childId === "") return { ...failure$1("policy", "无法确认调用者身份：案例内的操作只允许由本次审核的子会话或已登记的报告讨论会话发起") };
+	if (auditScopeFor(state, childId) !== void 0) {
+		const checked = await requireAuditScope(ctx, state, exec, args, options);
+		if (!checked.ok) return checked;
+		return {
+			ok: true,
+			material: {
+				kind: "audit",
+				scope: checked.scope
+			}
+		};
+	}
+	const scope = scopes.use(childId);
+	if (scope === void 0) return { ...failure$1("policy", "调用者既不是进行中的审核子会话，也不是已登记的报告讨论会话：案例内的操作一律拒绝（报告讨论请在工作台点「与 DeepSeek 讨论报告」重新登记材料范围）") };
+	const seqNo = text(args.seqNo).trim();
+	if (seqNo !== "" && seqNo !== scope.seqNo) return { ...failure$1("input", "流水号与本次登记的材料范围不一致：拒绝操作") };
+	const objectId = text(args.objectId).trim();
+	if (objectId !== "" && objectId !== scope.objectId) return { ...failure$1("input", "记录标识与本次登记的材料范围不一致：拒绝操作") };
+	const caseDir = text(args.caseDir).trim();
+	if (caseDir === "") {
+		if (options.requireCaseDir === false) return {
+			ok: true,
+			material: {
+				kind: "discussion",
+				scope
+			}
+		};
+		return { ...failure$1("input", "缺少案例目录：案例内的操作必须带上本轮案例目录") };
+	}
+	if (fileSystem(ctx) === void 0) return { ...failure$1("infrastructure", "Host 文件服务不可用") };
+	try {
+		const given = await resolveTarget(ctx, caseDir);
+		const expected = await resolveTarget(ctx, scope.caseDir);
+		if (text(given.targetKey) === "" || given.targetKey !== expected.targetKey) return { ...failure$1("policy", "案例目录必须是本次登记的那一个（不许用工作空间根、兄弟案例或子目录）") };
+	} catch (error) {
+		return { ...failure$1("infrastructure", `案例目录解析失败：${error instanceof Error ? error.message : String(error)}`) };
+	}
+	return {
+		ok: true,
+		material: {
+			kind: "discussion",
+			scope
+		}
+	};
+}
+//#endregion
+//#region src/host/audit/case-access.ts
+/**
+* 本地审核的产物**不上传、不回传**（协议 28）。
+*
+* 产品口径是「审核结果只存在于这次对话里」：对话的固定提示词里已经写了不许调用这三条工具，
+* 但提示词是**请求**，不是门禁。真正的边界在这里 —— OSS 发布与钉钉归档 / 通知三条交付工具
+* 在本地审核的案例 scope 下一律拒绝，理由明确指向产品口径，而不是让模型以为"配置坏了"。
+*/
+function localDeliveryRefused(access) {
+	if (access.kind !== "local") return null;
+	return failure$1("policy", "本地审核的产物只留在本机临时案例目录里：不上传 OSS、也不做钉钉归档与通知。请把交付件留在案例目录并直接向我汇报，不要改道到任何远端。");
+}
+async function requireCaseAccess(ctx, state, discussions, exec, args, localAudit) {
+	const { childId } = callerIdentity(exec);
+	if (childId === "") return failure$1("policy", "无法确认调用者身份：案例操作需要会话上下文");
+	const parentId = await callerParentSessionId(ctx, state, exec);
+	if (isAuditChild(state, childId, parentId)) {
+		const checked = await requireAuditScope(ctx, state, exec, args);
+		if (!checked.ok) return checked;
+		return {
+			ok: true,
+			kind: "audit",
+			casePath: checked.casePath,
+			allowedAttachmentIds: checked.scope.allowedAttachmentIds
+		};
+	}
+	const local = localAudit?.scopeOf(childId);
+	if (local !== void 0) {
+		const caseDir = text(args.caseDir).trim();
+		if (caseDir === "") return {
+			ok: true,
+			kind: "local",
+			casePath: local.casePath
+		};
+		if (fileSystem(ctx) === void 0) return failure$1("infrastructure", "Host 文件服务不可用");
+		try {
+			const given = await resolveTarget(ctx, caseDir);
+			const expected = await resolveTarget(ctx, local.casePath);
+			if (text(given.targetKey) === "" || given.targetKey !== expected.targetKey) return failure$1("policy", "案例目录必须是**本次本地审核自己的**临时快照目录");
+		} catch (error) {
+			return failure$1("infrastructure", `案例目录解析失败：${error instanceof Error ? error.message : String(error)}`);
+		}
+		return {
+			ok: true,
+			kind: "local",
+			casePath: local.casePath
+		};
+	}
+	const header = exec.agent?.session?.header;
+	if (Object.values(state.audits ?? {}).some((record) => record?.pending === true && record.childId === "") && parentId === "" && header === void 0) return failure$1("policy", "审核子会话正在建立，尚无法确认调用者的会话范围：请稍后重试");
+	if (discussions.peek(childId) !== void 0) {
+		const checked = await requireMaterialScope(ctx, state, discussions, exec, args);
+		if (!checked.ok) return checked;
+		const scope = checked.material.scope;
+		return {
+			ok: true,
+			kind: checked.material.kind,
+			casePath: checked.material.kind === "audit" ? checked.material.scope.casePath : checked.material.scope.caseDir,
+			allowedAttachmentIds: scope.allowedAttachmentIds
+		};
+	}
+	const root = allowedCaseRootOf(state);
+	const checked = await requireCaseDir(ctx, args.caseDir, { allowedRoot: root });
+	if (!checked.ok) return checked;
+	const seqNo = text(args.seqNo).trim() || basenameLocalPath(checked.path);
+	if (seqNo === "." || seqNo === ".." || /[\\/]/.test(seqNo)) return failure$1("input", "流水号必须是单段案例目录名，不能包含路径分隔符");
+	const expectedPath = caseDirOf(root, seqNo);
+	if (expectedPath === "") return failure$1("input", "流水号必须是有效的案例目录名");
+	try {
+		const given = await resolveTarget(ctx, checked.path);
+		const expected = await resolveTarget(ctx, expectedPath);
+		const workspace = await resolveTarget(ctx, root);
+		if (text(given.targetKey) === "" || given.targetKey === workspace.targetKey || given.targetKey !== expected.targetKey) return failure$1("policy", "案例目录必须是当前工作空间下的 `<工作空间>/<流水号>`，不能使用工作空间根或嵌套目录");
+	} catch (error) {
+		return failure$1("infrastructure", `案例目录解析失败：${error instanceof Error ? error.message : String(error)}`);
+	}
+	return {
+		ok: true,
+		kind: "session",
+		casePath: checked.path
+	};
+}
 //#endregion
 //#region src/host/dws/run.ts
 /** 允许出现在产品域之前的**全局**取值 flag；值必须紧随其后。 */
@@ -5767,14 +5989,19 @@ function dingtalkTools(deps) {
 				steps
 			};
 			const ctx = toolContext(deps.ctx, exec);
-			const caseCheck = await requireAuditScope(ctx, deps.state, exec, {
+			const caseCheck = await requireCaseAccess(ctx, deps.state, deps.discussionScopes, exec, {
 				caseDir: args.caseDir,
 				seqNo: args.seqNo
-			});
+			}, deps.localAudit);
 			if (!caseCheck.ok) return {
 				...caseCheck,
 				...empty
 			};
+			const localRefused = localDeliveryRefused(caseCheck);
+			if (localRefused !== null) return {
+				...localRefused,
+				...empty
+			};
 			const seqNo = text(args.seqNo).trim();
 			const requested = text(args.fileName).trim() || `审核结果.${seqNo}.json`;
 			const inside = await requireInsideCase(ctx, caseCheck.casePath, requested);
@@ -6153,14 +6380,19 @@ function dingtalkTools(deps) {
 				openDingId: "",
 				steps
 			};
-			const caseCheck = await requireAuditScope(ctx, deps.state, exec, {
+			const caseCheck = await requireCaseAccess(ctx, deps.state, deps.discussionScopes, exec, {
 				caseDir: args.caseDir,
 				seqNo: args.seqNo
-			});
+			}, deps.localAudit);
 			if (!caseCheck.ok) return {
 				...caseCheck,
 				...empty
 			};
+			const localRefused = localDeliveryRefused(caseCheck);
+			if (localRefused !== null) return {
+				...localRefused,
+				...empty
+			};
 			const seqNo = text(args.seqNo).trim();
 			if (seqNo === "") return {
 				...failure$1("input", "seqNo 不能为空"),
@@ -6481,140 +6713,10 @@ function locateMessage(payload, fileName) {
 async function persistNotifyState(ctx, path, state, options) {
 	return (await writeCaseText(ctx, path, `${JSON.stringify(state, null, 2)}\n`, options)).ok;
 }
-function createDiscussionScopeRegistry(options = {}) {
-	const now = options.now ?? (() => Date.now());
-	const ttlMs = options.ttlMs ?? 432e5;
-	const limit = options.limit ?? 32;
-	const scopes = /* @__PURE__ */ new Map();
-	/** 过期的一律先清掉：判据只有 `expiresAt` 与当前时刻。 */
-	const sweep = () => {
-		const at = now();
-		for (const [id, scope] of scopes) if (scope.expiresAt <= at) scopes.delete(id);
-	};
-	/** 超出上限时丢**最久没用过**的（不是最早建的：人可能一直在用一条老会话）。 */
-	const trim = () => {
-		while (scopes.size > limit) {
-			let oldestId = "";
-			let oldestAt = Number.POSITIVE_INFINITY;
-			for (const [id, scope] of scopes) if (scope.lastUsedAt < oldestAt) {
-				oldestAt = scope.lastUsedAt;
-				oldestId = id;
-			}
-			if (oldestId === "") return;
-			scopes.delete(oldestId);
-		}
-	};
-	return {
-		register(input) {
-			const at = now();
-			const scope = {
-				sessionId: text(input.sessionId),
-				seqNo: text(input.seqNo),
-				objectId: text(input.objectId),
-				caseDir: text(input.caseDir),
-				allowedAttachmentIds: [...input.allowedAttachmentIds].map((id) => text(id)).filter((id) => id !== ""),
-				createdAt: at,
-				lastUsedAt: at,
-				expiresAt: at + ttlMs
-			};
-			scopes.set(scope.sessionId, scope);
-			trim();
-			return scope;
-		},
-		use(sessionId) {
-			sweep();
-			const id = text(sessionId);
-			if (id === "") return void 0;
-			const scope = scopes.get(id);
-			if (scope === void 0) return void 0;
-			const touched = {
-				...scope,
-				lastUsedAt: now()
-			};
-			scopes.set(id, touched);
-			return touched;
-		},
-		peek(sessionId) {
-			sweep();
-			return scopes.get(text(sessionId));
-		},
-		drop(sessionId) {
-			scopes.delete(text(sessionId));
-		},
-		list() {
-			sweep();
-			return [...scopes.values()];
-		},
-		clear() {
-			scopes.clear();
-		},
-		size() {
-			sweep();
-			return scopes.size;
-		}
-	};
-}
+//#endregion
+//#region src/host/tools/h3yun.ts
 /**
-* 案例内 Tool 的**统一门禁**：认证身份 → 解析范围 → 校验模型提交的标识。
-*
-* 与 `requireAuditScope` 的关系：后者是"审核子会话"这一支的实现，这里在它之前再加一支
-* "已登记的讨论会话"。**讨论会话绝不复用审核 scope**（见文件头第 2 条）。
-*/
-async function requireMaterialScope(ctx, state, scopes, exec, args, options = {}) {
-	const { childId } = callerIdentity(exec);
-	if (childId === "") return { ...failure$1("policy", "无法确认调用者身份：案例内的操作只允许由本次审核的子会话或已登记的报告讨论会话发起") };
-	if (auditScopeFor(state, childId) !== void 0) {
-		const checked = await requireAuditScope(ctx, state, exec, args, options);
-		if (!checked.ok) return checked;
-		return {
-			ok: true,
-			material: {
-				kind: "audit",
-				scope: checked.scope
-			}
-		};
-	}
-	const scope = scopes.use(childId);
-	if (scope === void 0) return { ...failure$1("policy", "调用者既不是进行中的审核子会话，也不是已登记的报告讨论会话：案例内的操作一律拒绝（报告讨论请在工作台点「与 DeepSeek 讨论报告」重新登记材料范围）") };
-	const seqNo = text(args.seqNo).trim();
-	if (seqNo !== "" && seqNo !== scope.seqNo) return { ...failure$1("input", "流水号与本次登记的材料范围不一致：拒绝操作") };
-	const objectId = text(args.objectId).trim();
-	if (objectId !== "" && objectId !== scope.objectId) return { ...failure$1("input", "记录标识与本次登记的材料范围不一致：拒绝操作") };
-	const caseDir = text(args.caseDir).trim();
-	if (caseDir === "") {
-		if (options.requireCaseDir === false) return {
-			ok: true,
-			material: {
-				kind: "discussion",
-				scope
-			}
-		};
-		return { ...failure$1("input", "缺少案例目录：案例内的操作必须带上本轮案例目录") };
-	}
-	if (fileSystem(ctx) === void 0) return { ...failure$1("infrastructure", "Host 文件服务不可用") };
-	try {
-		const given = await resolveTarget(ctx, caseDir);
-		const expected = await resolveTarget(ctx, scope.caseDir);
-		if (text(given.targetKey) === "" || given.targetKey !== expected.targetKey) return { ...failure$1("policy", "案例目录必须是本次登记的那一个（不许用工作空间根、兄弟案例或子目录）") };
-	} catch (error) {
-		return { ...failure$1("infrastructure", `案例目录解析失败：${error instanceof Error ? error.message : String(error)}`) };
-	}
-	return {
-		ok: true,
-		material: {
-			kind: "discussion",
-			scope
-		}
-	};
-}
-/** 这次调用是不是**已登记**的报告讨论会话（给它开材料权限的那一条身份判据）。 */
-function isRegisteredDiscussion(scopes, sessionId) {
-	return scopes.peek(sessionId) !== void 0;
-}
-//#endregion
-//#region src/host/tools/h3yun.ts
-/**
-* 氚云（H3Yun）业务 Tool。
+* 氚云（H3Yun）业务 Tool。
 *
 * 三个工具对应审核链路的三个动作，**都不是通用逃生口**：模型提交的只有业务标识
 * （`objectId` / `fileId`）与案例目录，argv 由这里按固定模板拼装。
@@ -6746,10 +6848,17 @@ function h3yunTools(deps) {
 					...failure$1("policy", "审核子会话不能直接查询氚云记录：本轮记录与附件清单已在输入快照里"),
 					...base
 				};
-				if (isRegisteredDiscussion(deps.discussionScopes, callerIdentity(exec).childId)) return {
-					...failure$1("policy", "报告讨论会话不能查询氚云记录：材料范围只包含登记时取到的那批附件"),
-					...base
-				};
+				const discussion = deps.discussionScopes.peek(callerIdentity(exec).childId);
+				if (discussion !== void 0) {
+					const checked = await requireMaterialScope(ctx, deps.state, deps.discussionScopes, exec, {
+						caseDir: args.caseDir,
+						objectId
+					}, { requireCaseDir: false });
+					if (!checked.ok) return {
+						...checked,
+						...base
+					};
+				}
 				const platform = await deps.world.platform();
 				const gap = await requireCrwu(ctx, platform);
 				if (gap !== null) return {
@@ -6762,7 +6871,7 @@ function h3yunTools(deps) {
 					...base
 				};
 				const requested = text(args.caseDir).trim();
-				let workdir = await deps.world.workdir();
+				let workdir = discussion?.caseDir || await deps.world.workdir();
 				if (requested !== "") {
 					const caseCheck = await requireCaseDir(ctx, requested, { allowedRoot: allowedCaseRootOf(deps.state) });
 					if (!caseCheck.ok) return {
@@ -6790,7 +6899,7 @@ function h3yunTools(deps) {
 					signal: exec.signal
 				});
 				if (!run.ok) return {
-					...failure$1(run.error !== "" ? "infrastructure" : "cli", reasonOf(run)),
+					...failure$1(run.error !== "" ? "infrastructure" : "cli", reasonOf$1(run)),
 					...base
 				};
 				const record = recordOf(run.stdout);
@@ -6885,11 +6994,18 @@ function h3yunTools(deps) {
 					count: 0,
 					files: []
 				};
-				if (isRegisteredDiscussion(deps.discussionScopes, callerIdentity(exec).childId)) return {
-					...failure$1("policy", "报告讨论会话不能列举氚云附件：材料范围只包含登记时取到的那批附件"),
-					count: 0,
-					files: []
-				};
+				const discussion = deps.discussionScopes.peek(callerIdentity(exec).childId);
+				if (discussion !== void 0) {
+					const checked = await requireMaterialScope(ctx, deps.state, deps.discussionScopes, exec, {
+						caseDir: args.caseDir,
+						objectId
+					}, { requireCaseDir: false });
+					if (!checked.ok) return {
+						...checked,
+						count: 0,
+						files: []
+					};
+				}
 				const platform = await deps.world.platform();
 				const gap = await requireCrwu(ctx, platform);
 				if (gap !== null) return {
@@ -6904,7 +7020,7 @@ function h3yunTools(deps) {
 					files: []
 				};
 				const requested = text(args.caseDir).trim();
-				let workdir = await deps.world.workdir();
+				let workdir = discussion?.caseDir || await deps.world.workdir();
 				if (requested !== "") {
 					const caseCheck = await requireCaseDir(ctx, requested, { allowedRoot: allowedCaseRootOf(deps.state) });
 					if (!caseCheck.ok) return {
@@ -6933,7 +7049,7 @@ function h3yunTools(deps) {
 					signal: exec.signal
 				});
 				if (!run.ok) return {
-					...failure$1(run.error !== "" ? "infrastructure" : "cli", reasonOf(run)),
+					...failure$1(run.error !== "" ? "infrastructure" : "cli", reasonOf$1(run)),
 					count: 0,
 					files: []
 				};
@@ -6967,7 +7083,7 @@ function h3yunTools(deps) {
 			name: TOOL_NAMES.h3yunFileGet,
 			description: [
 				"按 fileId **单附件定向下载**氚云记录附件到**本轮案例目录**内的相对路径。",
-				"只接受本轮输入快照（附件清单）里登记过的 fileId；不在清单里的附件在起进程之前就被拒绝。",
+				"普通会话可按员工权限下载；托管审核与已登记讨论会话只接受本次材料清单里的 fileId。",
 				"目标必须落在给定案例目录之下（越界直接拒绝）。",
 				"本工具没有「整单下载」路径：一次只取一个附件，失败就是失败，不会退化成批量下载。"
 			].join(" "),
@@ -6975,7 +7091,7 @@ function h3yunTools(deps) {
 				fileId: {
 					type: "string",
 					required: true,
-					description: "附件 fileId（只接受本轮输入快照登记过的附件）"
+					description: "附件 fileId（托管审核与已登记讨论会话须在本次材料清单内）"
 				},
 				caseDir: {
 					type: "string",
@@ -7013,22 +7129,22 @@ function h3yunTools(deps) {
 			async execute(args, exec) {
 				const ctx = toolContext(deps.ctx, exec);
 				const fileId = text(args.fileId).trim();
-				const materialCheck = await requireMaterialScope(ctx, deps.state, deps.discussionScopes, exec, { caseDir: args.caseDir });
+				const materialCheck = await requireCaseAccess(ctx, deps.state, deps.discussionScopes, exec, { caseDir: args.caseDir }, deps.localAudit);
 				if (!materialCheck.ok) return {
 					...materialCheck,
 					fileId,
 					path: "",
 					sizeBytes: 0
 				};
-				const material = materialCheck.material;
-				const casePath = material.kind === "audit" ? material.scope.casePath : material.scope.caseDir;
+				const material = materialCheck;
+				const casePath = material.casePath;
 				if (fileId === "") return {
 					...failure$1("input", "fileId 不能为空"),
 					fileId,
 					path: "",
 					sizeBytes: 0
 				};
-				if (!material.scope.allowedAttachmentIds.includes(fileId)) return {
+				if (material.kind !== "session" && !material.allowedAttachmentIds?.includes(fileId)) return {
 					...failure$1("policy", material.kind === "audit" ? "这个附件不在本轮审核的输入快照里：只允许下载本次登记的附件" : "这个附件不在本次登记的材料范围里：只允许下载登记时取到的那批附件（请在工作台重新点「与 DeepSeek 讨论报告」刷新）"),
 					fileId,
 					path: "",
@@ -7077,7 +7193,7 @@ function h3yunTools(deps) {
 					signal: exec.signal
 				});
 				if (!run.ok) return {
-					...failure$1(run.error !== "" ? "infrastructure" : "cli", reasonOf(run)),
+					...failure$1(run.error !== "" ? "infrastructure" : "cli", reasonOf$1(run)),
 					fileId,
 					path: target.path,
 					sizeBytes: 0
@@ -9406,7 +9522,7 @@ function knowledgeTools(deps) {
 				...failure$1("input", "paths 不能为空"),
 				...empty
 			};
-			const caseCheck = await requireAuditScope(ctx, deps.state, exec, { caseDir: args.caseDir });
+			const caseCheck = await requireCaseAccess(ctx, deps.state, deps.discussionScopes, exec, { caseDir: args.caseDir }, deps.localAudit);
 			if (!caseCheck.ok) return {
 				...caseCheck,
 				...empty
@@ -9670,6 +9786,160 @@ async function writeManifest(ctx, path, payload, options) {
 	};
 }
 //#endregion
+//#region src/host/tools/local-claim.ts
+function idle() {
+	return {
+		ok: false,
+		errorKind: "",
+		error: "",
+		caseDir: "",
+		mode: "local",
+		fileCount: 0,
+		skippedCount: 0,
+		files: [],
+		skipped: []
+	};
+}
+function localClaimTools(deps) {
+	return [defineTool({
+		name: TOOL_NAMES.localAuditClaim,
+		description: [
+			"认领一次**本地审核**交接：提交 handoffId，取回本轮临时案例目录与材料清单，",
+			"并把该案例目录绑定到当前对话。",
+			"只由 Workbench「本地审核」生成的提示词调用一次；过期 / 已用 / 快照不存在时如实失败，",
+			"不要自己去找用户本机的文件。"
+		].join(" "),
+		parameters: { handoffId: {
+			type: "string",
+			required: true,
+			description: "本地审核提示词里的交接标识（形如 la-<时间戳>-<随机段>）；由 Workbench 生成，不要自己编。"
+		} },
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					ok: {
+						required: true,
+						type: "boolean"
+					},
+					errorKind: {
+						required: true,
+						type: "string"
+					},
+					error: {
+						required: true,
+						type: "string"
+					},
+					caseDir: {
+						required: true,
+						type: "string",
+						description: "本轮案例目录（也是本次本地审核的工作目录与可写范围）"
+					},
+					mode: {
+						required: true,
+						type: "string",
+						description: "固定为 local（本地审核）"
+					},
+					fileCount: {
+						required: true,
+						type: "integer"
+					},
+					skippedCount: {
+						required: true,
+						type: "integer"
+					},
+					files: {
+						required: true,
+						type: "array",
+						items: {
+							type: "object",
+							additionalProperties: false,
+							properties: {
+								name: {
+									required: true,
+									type: "string"
+								},
+								relativePath: {
+									required: true,
+									type: "string"
+								},
+								sizeBytes: {
+									required: true,
+									type: "integer"
+								}
+							}
+						}
+					},
+					skipped: {
+						required: true,
+						type: "array",
+						items: {
+							type: "object",
+							additionalProperties: false,
+							properties: {
+								name: {
+									required: true,
+									type: "string"
+								},
+								relativePath: {
+									required: true,
+									type: "string"
+								},
+								reason: {
+									required: true,
+									type: "string"
+								}
+							}
+						}
+					}
+				}
+			},
+			render: (_args, value) => renderJson(value)
+		},
+		isConcurrencySafe: () => false,
+		async execute(args, exec) {
+			const base = idle();
+			const registry = deps.localAudit;
+			const io = deps.localAuditIo;
+			if (registry === void 0 || io === void 0) return {
+				...base,
+				...failure$1("capability-gap", "本地审核注册表没有装配：本插件实例不能认领本地审核交接")
+			};
+			const handoffId = text(args.handoffId).trim();
+			if (handoffId === "") return {
+				...base,
+				...failure$1("input", "缺少 handoffId：请把 Workbench 提示词里的交接标识原样提交")
+			};
+			const { childId } = callerIdentity(exec);
+			if (childId === "") return {
+				...base,
+				...failure$1("policy", "无法确认调用者的会话身份：本地审核必须绑定到具体对话")
+			};
+			const outcome = await registry.claim(handoffId, childId, io);
+			return {
+				...base,
+				ok: outcome.ok,
+				errorKind: outcome.errorKind,
+				error: outcome.error,
+				caseDir: outcome.casePath,
+				fileCount: outcome.fileCount,
+				skippedCount: outcome.skippedCount,
+				files: outcome.files.map((file) => ({
+					name: file.name,
+					relativePath: file.relativePath,
+					sizeBytes: file.sizeBytes
+				})),
+				skipped: outcome.skipped.map((item) => ({
+					name: item.name,
+					relativePath: item.relativePath,
+					reason: item.reason
+				}))
+			};
+		}
+	})];
+}
+//#endregion
 //#region src/host/oss/sanitize.ts
 /**
 * OSS 输出脱敏：**唯一**一处把 ossutil 的 stdout / stderr 变成可以给人看（或进日志）的文本。
@@ -9983,14 +10253,19 @@ function ossTools(deps) {
 				...failure$1("input", `流水号形状不对（不放进 OSS 路径）：${seqNo === "" ? "(空)" : seqNo}`),
 				...empty
 			};
-			const caseCheck = await requireAuditScope(ctx, deps.state, exec, {
+			const caseCheck = await requireCaseAccess(ctx, deps.state, deps.discussionScopes, exec, {
 				caseDir: args.caseDir,
 				seqNo: args.seqNo
-			});
+			}, deps.localAudit);
 			if (!caseCheck.ok) return {
 				...caseCheck,
 				...empty
 			};
+			const localRefused = localDeliveryRefused(caseCheck);
+			if (localRefused !== null) return {
+				...localRefused,
+				...empty
+			};
 			const oss = normalizeOss(deps.state.manifest.oss, deps.state.manifest.oss);
 			if (!oss.enabled) return {
 				...failure$1("policy", "OSS 回传未启用（受信配置里 oss.enabled 不是 true）"),
@@ -10410,7 +10685,7 @@ function pythonScriptTools(deps) {
 			caseDir: {
 				required: true,
 				type: "string",
-				description: "本轮案例目录（Host 用它做审核范围校验）。"
+				description: "本轮案例目录（Host 校验工作空间与案例范围）。"
 			},
 			script: {
 				required: true,
@@ -10522,7 +10797,7 @@ function pythonScriptTools(deps) {
 		async execute(args, exec) {
 			const ctx = toolContext(deps.ctx, exec);
 			const base = idleResult();
-			const caseCheck = await requireAuditScope(ctx, deps.state, exec, { caseDir: args.caseDir });
+			const caseCheck = await requireCaseAccess(ctx, deps.state, deps.discussionScopes, exec, { caseDir: args.caseDir }, deps.localAudit);
 			if (!caseCheck.ok) return {
 				...base,
 				...caseCheck
@@ -10553,7 +10828,7 @@ function pythonScriptTools(deps) {
 				...base,
 				...failure$1("capability-gap", "DSH 自带 Python 解析器没有装配：本插件实例不能执行技能脚本")
 			};
-			const runtime = await deps.python.check();
+			const runtime = await deps.python.check({ agent: exec.agent });
 			if (!runtime.ok) return {
 				...base,
 				...failure$1("capability-gap", `DSH 自带 Python 不可用（${runtime.state}）：${runtime.error}`),
@@ -10581,7 +10856,7 @@ function pythonScriptTools(deps) {
 			return {
 				ok: run.ok && errorKind === "",
 				errorKind,
-				error: errorKind === "" ? "" : reasonOf(run),
+				error: errorKind === "" ? "" : reasonOf$1(run),
 				scriptPath,
 				argv,
 				exitCode: run.exitCode,
@@ -10623,7 +10898,8 @@ function registerCrwuTools(ctx, deps) {
 		ifindTool(deps),
 		...ossTools(deps),
 		...dingtalkTools(deps),
-		...pythonScriptTools(deps)
+		...pythonScriptTools(deps),
+		...localClaimTools(deps)
 	].map((definition) => registry.register(definition));
 	return () => {
 		for (const dispose of [...disposers].reverse()) try {
@@ -12344,7 +12620,7 @@ function emptyView(input = {}) {
 		expiresAt: 0
 	};
 }
-function failed(view, errorKind, error) {
+function failed$1(view, errorKind, error) {
 	return {
 		...view,
 		ok: false,
@@ -12352,123 +12628,1075 @@ function failed(view, errorKind, error) {
 		error: error.slice(0, 600)
 	};
 }
-/** 会话层级事实：只有子代理才有 `origin === 'subagent'` / `delegationDepth > 0`。 */
-function sessionShapeOf(ctx, sessionId) {
-	const out = {
-		found: false,
-		subagent: false,
-		depth: 0
+/** 会话层级事实：只有子代理才有 `origin === 'subagent'` / `delegationDepth > 0`。 */
+function sessionShapeOf(ctx, sessionId) {
+	const out = {
+		found: false,
+		subagent: false,
+		depth: 0
+	};
+	if (sessionId === "") return out;
+	try {
+		const sessions = ctx.get("sessions");
+		const header = typeof sessions?.get === "function" ? sessions.get(sessionId)?.header : void 0;
+		if (header === void 0) return out;
+		out.found = true;
+		out.subagent = text(header.origin) === "subagent";
+		out.depth = typeof header.delegationDepth === "number" ? header.delegationDepth : 0;
+	} catch (error) {}
+	return out;
+}
+async function openDiscussionMaterial(deps, args) {
+	const { ctx, state } = deps;
+	const sessionId = text(args.sessionId).trim();
+	const seqNo = text(args.seqNo).trim();
+	const objectId = text(args.objectId).trim();
+	const base = emptyView({
+		sessionId,
+		seqNo,
+		objectId
+	});
+	if (sessionId === "") return failed$1(base, "input", "缺少 sessionId：材料范围必须绑定到一条具体会话");
+	if (seqNo === "" || !isSafeSeqNo(seqNo)) return failed$1(base, "input", "流水号缺失或形状不合法");
+	if (objectId === "") return failed$1(base, "input", "缺少 objectId：无法核对这条报告");
+	const shape = sessionShapeOf(ctx, sessionId);
+	if (shape.subagent || shape.depth > 0) return failed$1(base, "policy", "这条会话本身是子代理：报告讨论的材料范围只登记给顶层会话");
+	const workspace = text(state.workspacePath) || text(state.caseRoot);
+	if (workspace === "") return failed$1(base, "input", "尚未选定工作空间：请先在工作台第 ① 步选择一个已有目录");
+	const caseDir = caseDirOf(workspace, seqNo);
+	if (caseDir === "") return failed$1(base, "input", "案例目录无法确定：请确认流水号与工作空间");
+	const platform = await deps.world.platform();
+	const made = await ensureCaseDirectory(deps.access, caseDir, {
+		workspace,
+		probeWorkdir: await deps.world.workdir(),
+		platform,
+		source: "panel"
+	});
+	if (!made.ok) return failed$1(base, made.errorKind === "missing" ? "input" : "infrastructure", made.error);
+	const form = await deps.form.ensure();
+	if (!form.ok) return failed$1(base, form.error.startsWith("未在氚云定位到表单") ? "not-found" : "cli", form.error);
+	const runOptions = {
+		workdir: caseDir,
+		timeoutMs: 9e4,
+		access: deps.access,
+		source: "panel",
+		platform,
+		stdoutMaxBytes: RECORDS_STDOUT_MAX
+	};
+	const recordRun = await runCrwu(ctx, [
+		"crwu",
+		"h3yun",
+		"records",
+		"get",
+		"--schema",
+		form.code,
+		"--id",
+		objectId
+	], runOptions);
+	if (!recordRun.ok) return failed$1(base, recordRun.error !== "" ? "infrastructure" : "cli", `核对报告身份失败：${text(recordRun.error) || text(recordRun.stderr) || "records get 未成功"}`);
+	const record = jsonObject(recordRun.stdout);
+	const data = record !== null && record.data !== null && typeof record.data === "object" && !Array.isArray(record.data) ? record.data : null;
+	if (data === null) return failed$1(base, "cli", "记录接口没有返回可解析的记录对象");
+	const recordId = text(pick(data, [
+		"ObjectId",
+		"objectId",
+		"Id",
+		"id"
+	]));
+	const recordSeq = text(pick(data, ["SeqNo", "seqNo"]));
+	if (recordId === "" || recordSeq === "") return failed$1(base, "cli", "记录缺少 ObjectId / SeqNo：无法确认材料属于这条报告");
+	if (recordId !== objectId) return failed$1(base, "input", "取回的记录不是请求的那一条（ObjectId 不一致）");
+	if (recordSeq !== seqNo) return failed$1(base, "input", "记录的流水号与请求的不一致：拒绝登记材料范围");
+	const filesRun = await runCrwu(ctx, [
+		"crwu",
+		"h3yun",
+		"files",
+		"list",
+		"--schema",
+		form.code,
+		"--id",
+		objectId
+	], runOptions);
+	if (!filesRun.ok) return failed$1(base, filesRun.error !== "" ? "infrastructure" : "cli", `读取附件清单失败：${text(filesRun.error) || text(filesRun.stderr) || "files list 未成功"}`);
+	const rows = attachmentsOf(filesRun.stdout);
+	if (rows === null) return failed$1(base, "cli", "附件接口没有返回附件数组");
+	const registered = deps.scopes.register({
+		sessionId,
+		seqNo,
+		objectId,
+		caseDir,
+		allowedAttachmentIds: rows.map((row) => row.fileId)
+	});
+	return {
+		ok: true,
+		error: "",
+		errorKind: "",
+		sessionId,
+		seqNo,
+		objectId,
+		caseDir,
+		attachments: rows.map((row) => ({
+			fileId: row.fileId,
+			fileName: row.fileName,
+			localName: row.localName,
+			fileSize: row.fileSize,
+			nameTotal: row.nameTotal
+		})),
+		attachmentCount: rows.length,
+		expiresAt: registered.expiresAt
+	};
+}
+//#endregion
+//#region src/host/local-audit/consts.ts
+/** 一次性 handoff 的有效期（用户复制提示词后太久没发就会过期）。 */
+const LOCAL_AUDIT_HANDOFF_TTL_MS = 18e5;
+/**
+* 本地审核案例目录的**父目录名**（在员工选定的工作空间下）。
+*
+* ⚠️ 2026-10-11 用户实测后改的：本地审核的案例目录**曾经**在操作系统临时目录下，
+* 两个后果都不能接受 ——
+* ① 会话 cwd 只能是那个临时目录，于是这条会话**永远落「未分组」**（用户要求"创建在我
+*    环境信息规定的工作区下面"）；而把 cwd 设成工作空间的话，临时目录在沙箱之外，
+*    对话里的案例内工具（非特权）又写不进去；
+* ② 交付件躺在系统临时目录里，用户根本找不到（而且会被清理逻辑删掉，见 `handoff.ts`）。
+*
+* 现在它落在 `<工作空间>/本地审核/<handoffId>/`：会话 cwd = 工作空间（分组正确、沙箱边界
+* 正好罩住案例目录），交付件也在用户自己的目录里找得到。
+* 这符合仓规「插件只允许在工作空间下创建 Host 推导出来的案例目录」。
+*/
+const LOCAL_AUDIT_CASE_PARENT_DIR = "本地审核";
+/** 快照里材料目录名：与审核链路共用同一个名字（`host/tools/consts.ts` 的 `CASE_MATERIAL_DIR`）。 */
+const LOCAL_AUDIT_SOURCE_DIR = "材料-源";
+/** 快照里「读到了什么」的清单（人可读，模型也读它）。 */
+const LOCAL_AUDIT_MANIFEST_FILE = "本地审核清单.json";
+/** 快照元数据：handoffId、时刻、计数、指纹。 */
+const LOCAL_AUDIT_META_FILE = "快照元数据.json";
+//#endregion
+//#region src/host/local-audit/prompt.ts
+function localAuditPrompt(input) {
+	const extra = input.extraPrompt.trim();
+	const L = [];
+	L.push("请对下面这批**本机文件**执行一次完整的资产评估审核（本地审核）。");
+	L.push("");
+	L.push("## 第一步：认领这次交接");
+	L.push("");
+	L.push("这是一次**一次性交接**，材料已经复制进一个案例目录（在工作空间下的 `本地审核/` 里）。先调用一次：");
+	L.push("");
+	L.push("```text");
+	L.push(`crwu_audit_local_claim({ handoffId: "${input.handoffId}" })`);
+	L.push("```");
+	L.push("");
+	L.push("它返回本轮**案例目录**（也是你的工作目录与可写范围）与材料清单。");
+	L.push("之后所有案例内操作（`crwu_run_python_script` 等）的 `caseDir` 参数一律用返回的那条路径。");
+	L.push("如果它报「已过期 / 已使用 / 快照不在了」：**立即停止**，把原文告诉我，不要自己找文件、不要重新扫描本机目录。");
+	L.push("");
+	L.push("## 审核范围");
+	L.push("");
+	L.push(`已提供 ${String(input.files.length)} 个文件：`);
+	L.push("");
+	for (const file of input.files) L.push(`- ${file.name} → ${file.relativePath}`);
+	L.push("");
+	if (input.skipped.length > 0) {
+		L.push(`另有 ${String(input.skipped.length)} 个文件**没有进入审核范围**（跳过），必须如实记入「未审核」：`);
+		L.push("");
+		for (const item of input.skipped) L.push(`- ${item.name}（${item.relativePath}）：${item.reason}`);
+		L.push("");
+	}
+	L.push("## 固定审核要求");
+	L.push("");
+	L.push("1. **按 crwu-audit 技能执行**：先读 `references/14-orchestration-workflow.md`，按它的步骤 1–16 走完两阶段（阶段一独立审核并冻结，再进入阶段二复核对照）。");
+	L.push("2. **材料只在快照目录里**：不要读我本机的其它目录，不要按文件名去别处找材料，也不要在本机做任何搜索。");
+	L.push("3. **这次是本地审核，不是报告审核**：没有氚云记录、没有报告流水号，也没有人工复核件。");
+	L.push("   涉及氚云记录 / 附件 / 复核对照的步骤在没有对应材料时**记为不适用**，不要伪造，也不要当成材料缺失。");
+	L.push("4. **禁止任何上传与回传**：不要调用 OSS 发布、钉钉归档、钉钉通知这三条由云端交付使用的工具，");
+	L.push("   也不要把材料或结论发到任何远端。交付件只落在案例目录里。");
+	L.push("5. **交付件必须标记为「本地审核」**：`审核结果.<项目ID>.json` 与 `审核意见.<项目ID>.html` 都写成");
+	L.push("   `本地审核` / `本地文件审核`，不要写成报告审核或氚云审核。");
+	L.push("6. **HTML 必须明确区分四种状态**：没有该数据（中性灰）、数据存在但处理失败（错误色）、");
+	L.push("   当前类型不适用、以及**文件没有被审核**；并且逐条列出已审核 / 未审核 / 画像缺失与不可用字段。");
+	L.push("   不许只用颜色表达状态，也不要用大面积红色背景。");
+	L.push("7. **算不出来的必须写「未核」**：禁止心算、估算，也禁止把「未核」写成「缺失」或「已核」。");
+	L.push("8. **能力缺口如实登记**：缺什么就写什么，不擅自下确定性结论。");
+	L.push("");
+	L.push("## 汇报口径（对话里，不是交付件）");
+	L.push("");
+	L.push("开始审核时先给一句**简短阶段说明**（不要连续百分比、不要假装有进度条），例如：");
+	L.push("");
+	L.push("```text");
+	L.push("本地审核已开始。");
+	L.push("");
+	L.push(`审核范围：${String(input.files.length)} 个文件`);
+	L.push("当前阶段：正在分析文件内容");
+	L.push("```");
+	L.push("");
+	L.push("审核结束后，必须按这个结构收尾：");
+	L.push("");
+	L.push("```text");
+	L.push("本次本地审核已完成。");
+	L.push("");
+	L.push("交付件（**完整路径**，方便我直接点开）：");
+	L.push("- <caseDir>/审核意见.<项目ID>.html");
+	L.push("- <caseDir>/审核结果.<项目ID>.json");
+	L.push("");
+	L.push("已审核：");
+	L.push("- <文件名>");
+	L.push("");
+	L.push("未审核：");
+	L.push("- <文件名>：<原因>");
+	L.push("");
+	L.push("画像缺失：");
+	L.push("- <画像字段>：<为什么拿不到>");
+	L.push("```");
+	L.push("");
+	L.push("⚠️ **交付件那一块必须写完整路径**（用 `crwu_audit_local_claim` 返回的 `caseDir` 拼上文件名），");
+	L.push("不要只写文件名：界面里的文件链接是**按这条会话的工作空间根去解析**的，只写文件名会指到一个");
+	L.push("不存在的路径（点开什么都没有）。同一句话里也不要写成 Markdown 链接的假地址。");
+	L.push("");
+	L.push("## 补充要求");
+	L.push("");
+	L.push(extra === "" ? "（我没有额外要求，按默认本地审核规则执行。）" : extra);
+	return L.join("\n");
+}
+//#endregion
+//#region src/host/local-audit/snapshot.ts
+/** 生产实现：`node:fs/promises`。 */
+function nodeSnapshotIo() {
+	return {
+		async makeDir(path) {
+			await mkdir(path, { recursive: true });
+		},
+		async copyFile(from, to) {
+			await copyFile(from, to);
+		},
+		async writeText(path, content) {
+			await writeFile(path, content, "utf8");
+		},
+		async readText(path) {
+			return await readFile(path, "utf8");
+		},
+		async removeTree(path) {
+			await rm(path, {
+				recursive: true,
+				force: true
+			});
+		}
+	};
+}
+/**
+* 本地审核案例目录的父目录（在员工选定的工作空间下；空工作空间 = 不能开始本地审核）。
+*
+* 「工作空间」由 Host 从状态里取（`state.workspacePath`），不由调用方提交 ——
+* 与报告审核的案例目录同一条口径。
+*/
+function localAuditRootDir(workspacePath) {
+	const root = trimTrailingSeparators(workspacePath);
+	return root === "" ? "" : joinLocalPath(root, LOCAL_AUDIT_CASE_PARENT_DIR);
+}
+/** 一次 handoff 的案例目录（`<工作空间>/本地审核/<handoffId>`）。 */
+function localAuditCaseDir(workspacePath, handoffId) {
+	const root = localAuditRootDir(workspacePath);
+	return root === "" ? "" : joinLocalPath(root, handoffId);
+}
+/**
+* 建立快照。
+*
+* `handoffId` 由调用方（Host）生成 —— 它同时也是案例目录名，所以必须是安全的单段标识。
+*/
+async function prepareSnapshot(handoffId, candidates, io, options) {
+	const casePath = options.casePath;
+	const empty = {
+		ok: false,
+		error: "",
+		errorKind: "",
+		casePath,
+		files: [],
+		skipped: [],
+		digest: ""
+	};
+	if (casePath === "") return {
+		...empty,
+		errorKind: "input",
+		error: "还没有选定工作空间：请先在「环境信息」里选择工作空间"
+	};
+	if (candidates.length === 0) return {
+		...empty,
+		errorKind: "no-readable-files",
+		error: "没有可审核的文件"
+	};
+	const files = [];
+	const skipped = [];
+	try {
+		await io.makeDir(casePath);
+	} catch (error) {
+		return {
+			...empty,
+			errorKind: "infrastructure",
+			error: `无法创建本地审核临时目录：${reasonOf(error)}`
+		};
+	}
+	for (const candidate of candidates) {
+		const parts = candidate.relativePath.split("/").filter((part) => part !== "");
+		const target = joinLocalPath(casePath, LOCAL_AUDIT_SOURCE_DIR, ...parts);
+		const targetDir = joinLocalPath(casePath, LOCAL_AUDIT_SOURCE_DIR, ...parts.slice(0, -1));
+		try {
+			await io.makeDir(targetDir);
+			await io.copyFile(candidate.sourcePath, target);
+			files.push({
+				relativePath: `${LOCAL_AUDIT_SOURCE_DIR}/${candidate.relativePath}`,
+				name: candidate.name,
+				sizeBytes: candidate.sizeBytes
+			});
+		} catch (error) {
+			skipped.push({
+				relativePath: candidate.relativePath,
+				name: candidate.name,
+				reason: "快照读取失败"
+			});
+		}
+	}
+	if (files.length === 0) {
+		await io.removeTree(casePath).catch(() => void 0);
+		return {
+			...empty,
+			errorKind: "no-readable-files",
+			error: "没有可审核的文件：请检查文件是否存在、是否被其他程序锁定，或重新选择文件",
+			skipped
+		};
+	}
+	const createdAt = (options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString()))();
+	const digest = digestOf([
+		handoffId,
+		createdAt,
+		...files.map((item) => canonicalJson(item))
+	]);
+	const manifest = {
+		schema: "crwu.local-audit-manifest.v1",
+		handoffId,
+		createdAt,
+		mode: "local",
+		fileCount: files.length,
+		skippedCount: skipped.length,
+		files: files.map((item) => ({
+			name: item.name,
+			relativePath: item.relativePath,
+			sizeBytes: item.sizeBytes
+		})),
+		skipped: skipped.map((item) => ({
+			name: item.name,
+			relativePath: item.relativePath,
+			reason: item.reason
+		}))
+	};
+	const meta = {
+		schema: "crwu.local-audit-snapshot.v1",
+		handoffId,
+		createdAt,
+		mode: "local",
+		fileCount: files.length,
+		skippedCount: skipped.length,
+		digest
+	};
+	try {
+		await io.writeText(joinLocalPath(casePath, LOCAL_AUDIT_MANIFEST_FILE), `${canonicalJson(manifest)}\n`);
+		await io.writeText(joinLocalPath(casePath, LOCAL_AUDIT_META_FILE), `${canonicalJson(meta)}\n`);
+	} catch (error) {
+		await io.removeTree(casePath).catch(() => void 0);
+		return {
+			...empty,
+			errorKind: "infrastructure",
+			error: `写入本地审核清单失败：${reasonOf(error)}`
+		};
+	}
+	return {
+		ok: true,
+		error: "",
+		errorKind: "",
+		casePath,
+		files,
+		skipped,
+		digest
+	};
+}
+/**
+* 读回清单（claim 时核对快照还在、内容与 handoff 记录一致）。
+*
+* ⚠️ 路径由**调用方给**（handoff 记录里的 `casePath`），不要在这里重新按 id 拼一次：
+* 一旦两处拼法漂移，"清单读不到"就会变成一次莫名其妙的 capability gap。
+*/
+async function readManifest(io, casePath, handoffId) {
+	try {
+		const raw = await io.readText(joinLocalPath(casePath, LOCAL_AUDIT_MANIFEST_FILE));
+		const parsed = JSON.parse(raw);
+		if (parsed === null || typeof parsed !== "object") return null;
+		const doc = parsed;
+		if (doc.handoffId !== handoffId) return null;
+		return {
+			fileCount: typeof doc.fileCount === "number" ? doc.fileCount : 0,
+			skippedCount: typeof doc.skippedCount === "number" ? doc.skippedCount : 0
+		};
+	} catch (error) {
+		return null;
+	}
+}
+function reasonOf(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+//#endregion
+//#region src/host/local-audit/handoff.ts
+function newHandoffId(now = Date.now()) {
+	return `la-${String(now)}-${randomUUID().slice(0, 8)}`;
+}
+const MAX_RECORDS = 32;
+function createLocalAuditRegistry() {
+	const handoffs = /* @__PURE__ */ new Map();
+	const scopes = /* @__PURE__ */ new Map();
+	/**
+	* 待清理的案例目录。
+	*
+	* 为什么单独一份：`drop()` 会在**同步**路径上被调用（新建时淘汰最旧的一条），那里没有 IO
+	* 可做 —— 不记账的话，被淘汰那条的快照目录既不在 `handoffs` 里、也不会再被 `sweep` 遍历到，
+	* 于是永久留在临时目录里。记在这里，下一次 `sweep` 顺手删掉。
+	*/
+	const orphans = /* @__PURE__ */ new Set();
+	const drop = (id) => {
+		const record = handoffs.get(id);
+		handoffs.delete(id);
+		const claimed = record?.used === true;
+		for (const [sessionId, scope] of [...scopes]) if (scope.handoffId === id) scopes.delete(sessionId);
+		if (record !== void 0 && record.casePath !== "" && !claimed) orphans.add(record.casePath);
+	};
+	return {
+		create(input) {
+			const now = input.now ?? Date.now();
+			const id = input.id;
+			const record = {
+				id,
+				casePath: input.casePath,
+				createdAt: now,
+				expiresAt: now + LOCAL_AUDIT_HANDOFF_TTL_MS,
+				used: false,
+				claimedSessionId: "",
+				fileCount: input.files.length,
+				skippedCount: input.skipped.length,
+				files: [...input.files],
+				skipped: [...input.skipped]
+			};
+			handoffs.set(id, record);
+			while (handoffs.size > MAX_RECORDS) {
+				const oldest = handoffs.keys().next().value;
+				if (oldest === void 0 || oldest === id) break;
+				drop(oldest);
+			}
+			return record;
+		},
+		peek: (id) => handoffs.get(id),
+		async claim(id, sessionId, io, now = Date.now()) {
+			const empty = {
+				ok: false,
+				error: "",
+				errorKind: "",
+				casePath: "",
+				fileCount: 0,
+				skippedCount: 0,
+				files: [],
+				skipped: []
+			};
+			const record = handoffs.get(id);
+			if (record === void 0) return {
+				...empty,
+				errorKind: "policy",
+				error: "本地审核提示词已过期。\n\n请回到 Workbench，重新选择或准备文件后再试。"
+			};
+			if (record.used) {
+				if (record.claimedSessionId !== "" && record.claimedSessionId === sessionId) return {
+					ok: true,
+					error: "",
+					errorKind: "",
+					casePath: record.casePath,
+					fileCount: record.fileCount,
+					skippedCount: record.skippedCount,
+					files: [...record.files],
+					skipped: [...record.skipped]
+				};
+				return {
+					...empty,
+					errorKind: "policy",
+					error: "这份本地审核提示词已经用过了：请回到 Workbench 重新准备文件后再试。"
+				};
+			}
+			if (now > record.expiresAt) {
+				drop(id);
+				return {
+					...empty,
+					errorKind: "policy",
+					error: "本地审核提示词已过期。\n\n请回到 Workbench，重新选择或准备文件后再试。"
+				};
+			}
+			if (sessionId === "") return {
+				...empty,
+				errorKind: "policy",
+				error: "无法确认调用者的会话身份：本地审核必须绑定到具体对话"
+			};
+			if (await readManifest(io, record.casePath, id) === null) {
+				drop(id);
+				return {
+					...empty,
+					errorKind: "capability-gap",
+					error: "本地审核的临时快照已经不在了：请回到 Workbench 重新准备文件。"
+				};
+			}
+			record.used = true;
+			record.claimedSessionId = sessionId;
+			scopes.set(sessionId, {
+				handoffId: id,
+				casePath: record.casePath,
+				claimedAt: now
+			});
+			return {
+				ok: true,
+				error: "",
+				errorKind: "",
+				casePath: record.casePath,
+				fileCount: record.fileCount,
+				skippedCount: record.skippedCount,
+				files: [...record.files],
+				skipped: [...record.skipped]
+			};
+		},
+		scopeOf: (sessionId) => sessionId === "" ? void 0 : scopes.get(sessionId),
+		async sweep(io, now = Date.now()) {
+			const dropped = [];
+			for (const [id, record] of [...handoffs]) {
+				if (record.used || now <= record.expiresAt) continue;
+				dropped.push(id);
+				drop(id);
+				if (record.casePath !== "") orphans.add(record.casePath);
+			}
+			const removed = [];
+			for (const casePath of [...orphans]) {
+				orphans.delete(casePath);
+				try {
+					await io.removeTree(casePath);
+					removed.push(casePath);
+				} catch (error) {
+					orphans.add(casePath);
+				}
+			}
+			return {
+				dropped,
+				removed
+			};
+		},
+		size: () => handoffs.size
+	};
+}
+//#endregion
+//#region src/host/local-audit/scan.ts
+/** 生产实现：`node:fs/promises`。 */
+function nodeLocalAuditFs() {
+	return {
+		async kindOf(path) {
+			try {
+				const info = await lstat(path);
+				if (info.isSymbolicLink()) return "symlink";
+				if (info.isFile()) return "file";
+				if (info.isDirectory()) return "directory";
+				return "other";
+			} catch (error) {
+				if (isAbsent(error)) return "absent";
+				return "other";
+			}
+		},
+		async list(path) {
+			const entries = await readdir(path, { withFileTypes: true });
+			const out = [];
+			for (const entry of entries) {
+				const full = `${trimTrailingSeparators(path)}/${entry.name}`;
+				let sizeBytes = 0;
+				if (entry.isFile()) try {
+					sizeBytes = (await stat(full)).size;
+				} catch (error) {
+					sizeBytes = 0;
+				}
+				out.push({
+					name: entry.name,
+					kind: entry.isSymbolicLink() ? "symlink" : entry.isFile() ? "file" : entry.isDirectory() ? "directory" : "other",
+					sizeBytes
+				});
+			}
+			out.sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
+			return out;
+		},
+		async canonical(path) {
+			try {
+				return await realpath(path);
+			} catch (error) {
+				return trimTrailingSeparators(path);
+			}
+		},
+		async readable(path) {
+			try {
+				await access(path, constants.R_OK);
+				return true;
+			} catch (error) {
+				return false;
+			}
+		},
+		async sizeOf(path) {
+			try {
+				return (await stat(path)).size;
+			} catch (error) {
+				return 0;
+			}
+		}
+	};
+}
+function isAbsent(error) {
+	const code = error?.code;
+	return code === "ENOENT" || code === "ENOTDIR";
+}
+function emptyScan() {
+	return {
+		ok: false,
+		error: "",
+		errorKind: "",
+		items: [],
+		files: [],
+		skipped: [],
+		fileCount: 0,
+		limit: 30,
+		overLimit: false,
+		readableCount: 0,
+		skippedCount: 0,
+		truncated: false
+	};
+}
+/** 展示用的相对路径拼接：固定用 `/`（提示词与界面都读它，和平台无关）。 */
+function relativeOf(root, rest) {
+	return rest === "" ? root : `${root}/${rest}`;
+}
+/**
+* 展开一次选择。
+*
+* `selection` 是用户在界面上选的全部入口（绝对路径，顺序即用户选择顺序）。
+*
+* `options.excluded` 是员工在界面上**逐个移除**掉的文件（绝对路径）—— 被排除的文件不进
+* 清单、不计入数量、也不进快照，因此"移除一个文件"这件事在重新扫描后依然成立。
+* 它只认**入口之内**的文件：入口本身要去掉就把它从 `selection` 里删掉（界面就是这么做的）。
+*/
+async function scanSelection(selection, fs, options = {}) {
+	const scan = emptyScan();
+	const roots = [];
+	const seenRoots = /* @__PURE__ */ new Set();
+	const excludedKeys = /* @__PURE__ */ new Set();
+	for (const raw of options.excluded ?? []) {
+		const path = trimTrailingSeparators(raw);
+		if (path === "" || !isAbsolute(path)) continue;
+		excludedKeys.add(await fs.canonical(path));
+	}
+	for (const raw of selection) {
+		const path = trimTrailingSeparators(raw);
+		if (path === "") continue;
+		if (!isAbsolute(path)) return {
+			...scan,
+			ok: false,
+			errorKind: "input",
+			error: `本地审核只接受绝对路径：${path}`
+		};
+		const key = await fs.canonical(path);
+		if (seenRoots.has(key)) continue;
+		seenRoots.add(key);
+		roots.push(path);
+	}
+	if (roots.length === 0) return scan;
+	const items = [];
+	const files = [];
+	const skipped = [];
+	const seenFiles = /* @__PURE__ */ new Set();
+	let entries = 0;
+	let truncated = false;
+	/** 命中了多少条排除项（只用来把"全被移除"与"压根读不到"分开说）。 */
+	let excludedHits = 0;
+	const pushFile = async (sourcePath, relativePath, sizeBytes, parentPath) => {
+		const key = await fs.canonical(sourcePath);
+		if (seenFiles.has(key)) return;
+		seenFiles.add(key);
+		if (excludedKeys.has(key)) {
+			excludedHits += 1;
+			return;
+		}
+		if (files.length >= 2e3) {
+			truncated = true;
+			return;
+		}
+		if (!await fs.readable(sourcePath)) {
+			skipped.push({
+				relativePath,
+				name: basenameLocalPath(relativePath),
+				reason: "权限不足"
+			});
+			return;
+		}
+		files.push({
+			sourcePath,
+			relativePath,
+			name: basenameLocalPath(relativePath),
+			sizeBytes,
+			parentPath
+		});
+	};
+	const walk = async (dir, prefix, root, budget) => {
+		let listing;
+		try {
+			listing = await fs.list(dir);
+		} catch (error) {
+			return false;
+		}
+		for (const entry of listing) {
+			if (budget.left <= 0) {
+				truncated = true;
+				return true;
+			}
+			budget.left -= 1;
+			entries += 1;
+			if (entries > 2e4) {
+				truncated = true;
+				return true;
+			}
+			const child = `${trimTrailingSeparators(dir)}/${entry.name}`;
+			const rel = relativeOf(prefix, entry.name);
+			if (entry.kind === "symlink") {
+				skipped.push({
+					relativePath: rel,
+					name: entry.name,
+					reason: "符号链接不纳入审核范围"
+				});
+				continue;
+			}
+			if (entry.kind === "other") {
+				skipped.push({
+					relativePath: rel,
+					name: entry.name,
+					reason: "特殊文件（不是普通文件或目录）"
+				});
+				continue;
+			}
+			if (entry.kind === "directory") {
+				if (await walk(child, rel, root, budget)) return true;
+				continue;
+			}
+			await pushFile(child, rel, entry.sizeBytes, root);
+		}
+		return false;
+	};
+	for (const root of roots) {
+		const name = basenameLocalPath(root) || root;
+		const kind = await fs.kindOf(root);
+		if (kind === "absent") {
+			items.push({
+				path: root,
+				name,
+				kind: "file",
+				sizeBytes: 0,
+				fileCount: 0,
+				status: "unreadable",
+				reason: "路径不存在或无法读取"
+			});
+			continue;
+		}
+		if (kind === "symlink") {
+			items.push({
+				path: root,
+				name,
+				kind: "file",
+				sizeBytes: 0,
+				fileCount: 0,
+				status: "skipped",
+				reason: "符号链接不纳入审核范围"
+			});
+			continue;
+		}
+		if (kind === "other") {
+			items.push({
+				path: root,
+				name,
+				kind: "file",
+				sizeBytes: 0,
+				fileCount: 0,
+				status: "skipped",
+				reason: "特殊文件（不是普通文件或目录）"
+			});
+			continue;
+		}
+		if (kind === "file") {
+			const before = files.length;
+			const size = await fs.sizeOf(root);
+			const excludedHere = excludedKeys.has(await fs.canonical(root));
+			await pushFile(root, name, size, root);
+			const accepted = files.length > before;
+			items.push({
+				path: root,
+				name,
+				kind: "file",
+				sizeBytes: size,
+				fileCount: accepted ? 1 : 0,
+				status: accepted ? "scanned" : excludedHere ? "removed" : "unreadable",
+				reason: accepted ? "" : excludedHere ? "已移除，不参与本次审核" : "无法读取（权限不足或文件被占用）"
+			});
+			continue;
+		}
+		const before = files.length;
+		const skillSkipped = skipped.length;
+		const excludedBefore = excludedHits;
+		if (await walk(root, name, root, { left: 2e4 - entries })) truncated = true;
+		const added = files.length - before;
+		const refused = skipped.length - skillSkipped;
+		const removed = excludedHits - excludedBefore;
+		items.push({
+			path: root,
+			name,
+			kind: "directory",
+			sizeBytes: 0,
+			fileCount: added,
+			status: added > 0 ? "scanned" : removed > 0 ? "removed" : "unreadable",
+			reason: added > 0 ? "" : removed > 0 ? "展开后的文件都被移除了" : refused > 0 ? "展开后没有可读取的普通文件" : "目录为空或无法读取"
+		});
+	}
+	const overLimit = files.length > 30;
+	if (overLimit) {
+		for (const item of items) if (item.status === "scanned") {
+			item.status = "over-limit";
+			item.reason = `展开后共 ${String(files.length)} 个文件，超过单次最多 ${String(30)} 个文件的限制`;
+		}
+	}
+	return {
+		...scan,
+		ok: true,
+		items,
+		files,
+		skipped,
+		fileCount: files.length,
+		overLimit,
+		readableCount: files.length,
+		skippedCount: skipped.length,
+		truncated
+	};
+}
+/** 绝对路径判据：与 `shared/utils/local-path.ts` 同口径，但这里只需要布尔。 */
+function isAbsolute(path) {
+	if (path.startsWith("/")) return true;
+	if (/^[A-Za-z]:[\\/]/.test(path)) return true;
+	return /^[\\/]{2}[^\\/]/.test(path);
+}
+//#endregion
+//#region src/host/local-audit/ops.ts
+/** 本机访问操作名：读用户选中的本机文件并写入临时快照。 */
+const LOCAL_AUDIT_OPERATION = "system.local-audit-material.snapshot";
+function scanView(scan) {
+	return {
+		ok: scan.ok,
+		error: scan.error === "" && scan.overLimit ? `当前选择会展开为 ${String(scan.fileCount)} 个文件，超过单次最多 ${String(30)} 个文件的限制。请移除部分文件或文件夹后再继续。` : scan.error,
+		errorKind: scan.errorKind,
+		fileCount: scan.fileCount,
+		limit: 30,
+		overLimit: scan.overLimit,
+		readableCount: scan.readableCount,
+		skippedCount: scan.skippedCount,
+		items: scan.items,
+		files: scan.files.map((item) => ({
+			parentPath: item.parentPath,
+			path: item.sourcePath,
+			name: item.name,
+			relativePath: item.relativePath,
+			sizeBytes: item.sizeBytes
+		})),
+		skipped: scan.skipped
+	};
+}
+function emptyStart() {
+	return {
+		ok: false,
+		error: "",
+		errorKind: "",
+		handoffId: "",
+		prompt: "",
+		providedCount: 0,
+		skippedCount: 0,
+		expiresAt: 0,
+		workspacePath: "",
+		casePath: "",
+		files: [],
+		skipped: []
+	};
+}
+/** 选择的规范化：只接受字符串数组，逐个 trim。 */
+function selectionOf(args) {
+	const raw = args.selection;
+	if (!Array.isArray(raw)) return [];
+	return raw.map((item) => text(item).trim()).filter((item) => item !== "");
+}
+/**
+* 排除清单的规范化：员工在界面上**逐个移除**掉的文件（绝对路径）。
+*
+* 每个入口本身要不要审，是靠从 `selection` 里删掉它表达的；这里只装"入口之内的某个文件"。
+*/
+function excludedOf(args) {
+	const raw = args.excluded;
+	if (!Array.isArray(raw)) return [];
+	return raw.map((item) => text(item).trim()).filter((item) => item !== "");
+}
+async function localAuditStatus(deps, args) {
+	const selection = selectionOf(args);
+	if (selection.length === 0) return { ...scanView({
+		ok: false,
+		error: "",
+		errorKind: "",
+		items: [],
+		files: [],
+		skipped: [],
+		fileCount: 0,
+		limit: 30,
+		overLimit: false,
+		readableCount: 0,
+		skippedCount: 0,
+		truncated: false
+	}) };
+	return scanView(await scanSelection(selection, deps.fs, { excluded: excludedOf(args) }));
+}
+async function localAuditStart(deps, args) {
+	const selection = selectionOf(args);
+	if (selection.length === 0) return {
+		...emptyStart(),
+		errorKind: "input",
+		error: "请先选择文件或文件夹"
 	};
-	if (sessionId === "") return out;
-	try {
-		const sessions = ctx.get("sessions");
-		const header = typeof sessions?.get === "function" ? sessions.get(sessionId)?.header : void 0;
-		if (header === void 0) return out;
-		out.found = true;
-		out.subagent = text(header.origin) === "subagent";
-		out.depth = typeof header.delegationDepth === "number" ? header.delegationDepth : 0;
-	} catch (error) {}
-	return out;
-}
-async function openDiscussionMaterial(deps, args) {
-	const { ctx, state } = deps;
-	const sessionId = text(args.sessionId).trim();
-	const seqNo = text(args.seqNo).trim();
-	const objectId = text(args.objectId).trim();
-	const base = emptyView({
-		sessionId,
-		seqNo,
-		objectId
+	const scan = await scanSelection(selection, deps.fs, { excluded: excludedOf(args) });
+	if (!scan.ok) return {
+		...emptyStart(),
+		errorKind: scan.errorKind === "input" ? "input" : "infrastructure",
+		error: scan.error
+	};
+	if (scan.overLimit) return {
+		...emptyStart(),
+		errorKind: "input",
+		error: `当前选择会展开为 ${String(scan.fileCount)} 个文件，超过单次最多 ${String(30)} 个文件的限制。请移除部分文件或文件夹后再继续。`
+	};
+	if (scan.files.length === 0) return {
+		...emptyStart(),
+		errorKind: "input",
+		error: "没有可审核的文件"
+	};
+	const workdir = await deps.world.workdir();
+	const decision = deps.access.authorize({
+		operation: LOCAL_AUDIT_OPERATION,
+		source: "panel",
+		...workdir === "" ? {} : { workdir }
 	});
-	if (sessionId === "") return failed(base, "input", "缺少 sessionId：材料范围必须绑定到一条具体会话");
-	if (seqNo === "" || !isSafeSeqNo(seqNo)) return failed(base, "input", "流水号缺失或形状不合法");
-	if (objectId === "") return failed(base, "input", "缺少 objectId：无法核对这条报告");
-	const shape = sessionShapeOf(ctx, sessionId);
-	if (shape.subagent || shape.depth > 0) return failed(base, "policy", "这条会话本身是子代理：报告讨论的材料范围只登记给顶层会话");
-	const workspace = text(state.workspacePath) || text(state.caseRoot);
-	if (workspace === "") return failed(base, "input", "尚未选定工作空间：请先在工作台第 ① 步选择一个已有目录");
-	const caseDir = caseDirOf(workspace, seqNo);
-	if (caseDir === "") return failed(base, "input", "案例目录无法确定：请确认流水号与工作空间");
-	const platform = await deps.world.platform();
-	const made = await ensureCaseDirectory(deps.access, caseDir, {
-		workspace,
-		probeWorkdir: await deps.world.workdir(),
-		platform,
+	if (!decision.ok) return {
+		...emptyStart(),
+		errorKind: "policy",
+		error: decision.error
+	};
+	/**
+	* 案例目录落在**员工选定的工作空间**下：`<工作空间>/本地审核/<handoffId>`。
+	*
+	* 为什么必须有工作空间（2026-10-11 用户口径：「本地审核对话应该创建在我环境信息规定的
+	* 工作区下面」）：会话的分组与沙箱边界都由 **cwd** 决定 —— cwd 逐字等于工作空间路径时，
+	* 这条会话才挂到那个工作空间下；而 cwd = 工作空间又要求案例目录**在工作空间之内**，
+	* 否则对话里的案例内工具（非特权）写不进去。交付件也因此落在员工自己的目录里。
+	*/
+	const workspacePath = trimTrailingSeparators(text(deps.state.workspacePath) || text(deps.state.caseRoot));
+	if (workspacePath === "") return {
+		...emptyStart(),
+		errorKind: "policy",
+		error: "还没有选定工作空间：请先在「环境信息」里选择工作空间，再开始本地审核。"
+	};
+	const handoffId = newHandoffId();
+	const snapshot = await prepareSnapshot(handoffId, scan.files, deps.io, { casePath: localAuditCaseDir(workspacePath, handoffId) });
+	if (!snapshot.ok) {
+		deps.access.note({
+			operation: LOCAL_AUDIT_OPERATION,
+			source: "panel"
+		}, { errorClass: "infrastructure" });
+		return {
+			...emptyStart(),
+			errorKind: snapshot.errorKind === "infrastructure" ? "infrastructure" : "input",
+			error: snapshot.error
+		};
+	}
+	deps.access.note({
+		operation: LOCAL_AUDIT_OPERATION,
 		source: "panel"
 	});
-	if (!made.ok) return failed(base, made.errorKind === "missing" ? "input" : "infrastructure", made.error);
-	const form = await deps.form.ensure();
-	if (!form.ok) return failed(base, form.error.startsWith("未在氚云定位到表单") ? "not-found" : "cli", form.error);
-	const runOptions = {
-		workdir: caseDir,
-		timeoutMs: 9e4,
-		access: deps.access,
-		source: "panel",
-		platform,
-		stdoutMaxBytes: RECORDS_STDOUT_MAX
-	};
-	const recordRun = await runCrwu(ctx, [
-		"crwu",
-		"h3yun",
-		"records",
-		"get",
-		"--schema",
-		form.code,
-		"--id",
-		objectId
-	], runOptions);
-	if (!recordRun.ok) return failed(base, recordRun.error !== "" ? "infrastructure" : "cli", `核对报告身份失败：${text(recordRun.error) || text(recordRun.stderr) || "records get 未成功"}`);
-	const record = jsonObject(recordRun.stdout);
-	const data = record !== null && record.data !== null && typeof record.data === "object" && !Array.isArray(record.data) ? record.data : null;
-	if (data === null) return failed(base, "cli", "记录接口没有返回可解析的记录对象");
-	const recordId = text(pick(data, [
-		"ObjectId",
-		"objectId",
-		"Id",
-		"id"
-	]));
-	const recordSeq = text(pick(data, ["SeqNo", "seqNo"]));
-	if (recordId === "" || recordSeq === "") return failed(base, "cli", "记录缺少 ObjectId / SeqNo：无法确认材料属于这条报告");
-	if (recordId !== objectId) return failed(base, "input", "取回的记录不是请求的那一条（ObjectId 不一致）");
-	if (recordSeq !== seqNo) return failed(base, "input", "记录的流水号与请求的不一致：拒绝登记材料范围");
-	const filesRun = await runCrwu(ctx, [
-		"crwu",
-		"h3yun",
-		"files",
-		"list",
-		"--schema",
-		form.code,
-		"--id",
-		objectId
-	], runOptions);
-	if (!filesRun.ok) return failed(base, filesRun.error !== "" ? "infrastructure" : "cli", `读取附件清单失败：${text(filesRun.error) || text(filesRun.stderr) || "files list 未成功"}`);
-	const rows = attachmentsOf(filesRun.stdout);
-	if (rows === null) return failed(base, "cli", "附件接口没有返回附件数组");
-	const registered = deps.scopes.register({
-		sessionId,
-		seqNo,
-		objectId,
-		caseDir,
-		allowedAttachmentIds: rows.map((row) => row.fileId)
+	const extraPrompt = text(args.prompt);
+	const prompt = localAuditPrompt({
+		handoffId,
+		files: snapshot.files,
+		skipped: snapshot.skipped,
+		extraPrompt
+	});
+	const record = deps.registry.create({
+		id: handoffId,
+		casePath: snapshot.casePath,
+		files: snapshot.files,
+		skipped: snapshot.skipped
 	});
 	return {
 		ok: true,
 		error: "",
 		errorKind: "",
-		sessionId,
-		seqNo,
-		objectId,
-		caseDir,
-		attachments: rows.map((row) => ({
-			fileId: row.fileId,
-			fileName: row.fileName,
-			localName: row.localName,
-			fileSize: row.fileSize,
-			nameTotal: row.nameTotal
+		handoffId: record.id,
+		prompt,
+		providedCount: snapshot.files.length,
+		skippedCount: snapshot.skipped.length,
+		expiresAt: record.expiresAt,
+		/**
+		* 新会话的 **cwd**（= 员工选定的工作空间，逐字）。
+		*
+		* DSH 按 cwd 把会话归到工作空间下；同时它也是会话的沙箱边界，而案例目录就在它里面。
+		* 只回给客户端，**不进提示词**。
+		*/
+		workspacePath,
+		/** 本轮案例目录（`<工作空间>/本地审核/<handoffId>`）；只回给客户端，不进提示词。 */
+		casePath: snapshot.casePath,
+		files: snapshot.files.map((item) => ({
+			relativePath: item.relativePath,
+			name: item.name
 		})),
-		attachmentCount: rows.length,
-		expiresAt: registered.expiresAt
+		skipped: snapshot.skipped
+	};
+}
+/**
+* 认领 handoff。
+*
+* `sessionId` **必须由调用方身份给出**：RPC 路由上它是客户端刚创建的那条会话（同源面板
+* 本来就知道自己建了哪条），Tool 上它是 `exec.agent.id`（不可伪造）。两者都走同一个注册表，
+* 所以"哪条会话能用这个案例目录"的判据只有一处。
+*/
+async function localAuditClaim(deps, args) {
+	const handoffId = text(args.handoffId).trim();
+	const sessionId = text(args.sessionId).trim();
+	if (handoffId === "") return {
+		ok: false,
+		errorKind: "input",
+		casePath: "",
+		fileCount: 0,
+		skippedCount: 0,
+		files: [],
+		skipped: [],
+		error: "缺少 handoffId"
+	};
+	if (sessionId === "") return {
+		ok: false,
+		errorKind: "input",
+		casePath: "",
+		fileCount: 0,
+		skippedCount: 0,
+		files: [],
+		skipped: [],
+		error: "缺少会话标识：本地审核必须绑定到具体对话"
 	};
+	return { ...await deps.registry.claim(handoffId, sessionId, deps.io) };
 }
 //#endregion
 //#region src/host/environment/probe.ts
@@ -13204,6 +14432,28 @@ async function requireOss(deps) {
 		ossutil: lookup.path
 	};
 }
+async function listOssDirectory(deps, ready, prefix, options = {}) {
+	const argv = [
+		ready.ossutil,
+		"ls",
+		`oss://${ready.oss.bucket}/${prefix}`
+	];
+	if (ready.oss.endpoint !== "") argv.push("--endpoint", ready.oss.endpoint);
+	return await runOssutil({
+		ctx: deps.ctx,
+		access: deps.access,
+		platform: deps.platform,
+		source: deps.source,
+		workdir: options.workdir ?? await shellWorkdir(deps)
+	}, {
+		operation: "oss.remote.read",
+		argv,
+		signal: options.signal,
+		timeoutMs: options.timeoutMs ?? 9e4,
+		stdoutMaxBytes: 4194304,
+		summary: "ossutil ls（查询报告审核文件）"
+	});
+}
 /**
 * 列举 OSS 上的交付件。
 *
@@ -13230,26 +14480,14 @@ async function ossIndex(deps, args = {}) {
 		error: ready.error,
 		...empty
 	};
-	const { oss, ossutil } = ready;
+	const { oss } = ready;
 	const listedPrefix = seqNo === "" ? oss.prefix : `${oss.prefix}/${seqNo}`;
 	if (seqNo !== "" && stripPrefix(`${listedPrefix}/`, oss.prefix) === "") return {
 		ok: false,
 		error: "流水号越出配置的 OSS 前缀",
 		...empty
 	};
-	const argv = [
-		ossutil,
-		"ls",
-		`oss://${oss.bucket}/${listedPrefix}/`
-	];
-	if (oss.endpoint !== "") argv.push("--endpoint", oss.endpoint);
-	const run = await runOssutil(await exec(deps), {
-		operation: "oss.remote.read",
-		argv,
-		timeoutMs: 9e4,
-		stdoutMaxBytes: 4194304,
-		summary: "ossutil ls（列举交付件）"
-	});
+	const run = await listOssDirectory(deps, ready, `${listedPrefix}/`);
 	if (!run.ok) return {
 		ok: false,
 		error: (text(run.stderr) || text(run.error) || text(run.stdout) || "列举失败").trim().slice(0, 400),
@@ -13308,9 +14546,22 @@ async function ossResult(deps, args) {
 		info: auditInfoFromResult(doc)
 	};
 }
-/** 生成访问链接并用系统默认程序打开。 */
+/**
+* 生成访问链接；**默认**顺便用系统默认程序打开，`open: false` 时只回链接。
+*
+* 为什么要有 `open: false`（2026-10-11 用户实测「点查看报告后浏览器很慢」）：
+* 这条链路原来是**两次串行的提权进程** —— ①`ossutil sign` 出链接；②`open <url>` 拉起浏览器。
+* 第②步完全可以由**客户端**直接做：DSH 桌面端主进程的 `setWindowOpenHandler` 会把
+* `window.open(url)` 转成 `shell.openExternal` → 系统默认浏览器（本仓 notes §14.1 那张表里
+* 已经写明，登录流程正是**为了避开**它才改用内置浏览器）。少一次提权进程就少一段等待，
+* 而且 Web profile 下 `window.open` 开的就是浏览器标签页 —— 两种部署都对。
+*
+* 兼容性：旧宿主**不认**这个参数，照旧自己打开并回 `opened: true`；客户端看到
+* `opened === true` 就不再自己开一次，所以「新界面 + 旧宿主」不会开出两个窗口。
+*/
 async function ossLink(deps, args) {
 	const key = text(args.key);
+	const shouldOpen = args.open !== false;
 	const failed = (error) => ({
 		ok: false,
 		error,
@@ -13351,6 +14602,15 @@ async function ossLink(deps, args) {
 		if (url === "") return failed(`签名命令没有输出 URL：${text(run.stdout).slice(0, 200)}`);
 	}
 	if (url.startsWith("http://")) url = `https://${url.slice(7)}`;
+	if (!shouldOpen) return {
+		ok: true,
+		error: "",
+		url,
+		mode: oss.linkMode,
+		ttl: oss.linkTtl,
+		opened: false,
+		openError: ""
+	};
 	const opened = await deps.access.runShell({
 		operation: "system.browser.open",
 		source: "panel",
@@ -13701,6 +14961,179 @@ async function runUploadWatch(deps) {
 	return Object.values(state.audits).some((record) => record.uploadedAt === "" && record.uploadError === "" && (record.uploading === true || record.key === state.activeKey));
 }
 //#endregion
+//#region src/host/oss/batch.ts
+const failed = (errorKind, error) => ({
+	ok: false,
+	errorKind,
+	error,
+	item: null
+});
+function createOssBatchQueue(resolveDeps, options = {}) {
+	const jobs = [];
+	const batches = /* @__PURE__ */ new Set();
+	let active = 0;
+	let disposed = false;
+	const drain = () => {
+		while (active < 3 && jobs.length > 0) {
+			const job = jobs.shift();
+			if (job.signal.aborted) {
+				job.finish(job.cancelled());
+				continue;
+			}
+			active++;
+			job.run().then(job.finish, () => job.finish(failed("command", "查询审核文件失败，请重试"))).finally(() => {
+				active--;
+				drain();
+			});
+		}
+	};
+	const run = async (args, signal) => {
+		const reject = (error) => ({
+			ok: false,
+			error,
+			results: {}
+		});
+		if ("seqNo" in args || !Array.isArray(args.seqNos) || args.seqNos.length > 100 || args.seqNos.some((value) => typeof value !== "string" || !isSafeSeqNo(value))) return reject("报告流水号列表不合法：最多 100 项，且每项必须是有效流水号");
+		const serials = [...new Set(args.seqNos.map((value) => value.trim()))];
+		if (serials.length === 0) return {
+			ok: true,
+			error: "",
+			results: {}
+		};
+		if (disposed || signal?.aborted) return reject("查询已取消");
+		const controller = new AbortController();
+		const batchJobs = /* @__PURE__ */ new Set();
+		const results = {};
+		batches.add(controller);
+		let timedOut = false;
+		const deadlineMs = options.deadlineMs ?? 9e4;
+		const deadline = Date.now() + deadlineMs;
+		const cancelled = () => timedOut ? failed("timeout", "查询审核文件超时，请重试") : failed("cancelled", "查询已取消");
+		const abort = () => {
+			controller.abort();
+		};
+		signal?.addEventListener("abort", abort, { once: true });
+		const timer = setTimeout(() => {
+			timedOut = true;
+			controller.abort();
+			drain();
+		}, deadlineMs);
+		let rejectPreparation = () => {};
+		const interruption = new Promise((_resolve, reject) => {
+			rejectPreparation = () => reject(/* @__PURE__ */ new Error("cancelled"));
+		});
+		const onAbort = () => {
+			for (let i = jobs.length - 1; i >= 0; i--) if (jobs[i].signal === controller.signal) jobs.splice(i, 1)[0].finish(cancelled());
+			for (const job of batchJobs) job.finish(cancelled());
+			rejectPreparation();
+		};
+		controller.signal.addEventListener("abort", onAbort, { once: true });
+		try {
+			const prepared = await Promise.race([interruption, (async () => {
+				const deps = await resolveDeps();
+				if (controller.signal.aborted) return null;
+				const ready = await requireOss(deps);
+				if (!ready.ok || controller.signal.aborted) return null;
+				return {
+					deps,
+					ready,
+					workdir: await deps.workdir()
+				};
+			})()]);
+			if (controller.signal.aborted) return {
+				ok: true,
+				error: "",
+				results: Object.fromEntries(serials.map((seq) => [seq, cancelled()]))
+			};
+			if (prepared === null) return reject("OSS 查询环境未就绪，请在环境信息中检查配置和本机访问授权");
+			const { deps, ready, workdir } = prepared;
+			const read = async (seq) => {
+				if (controller.signal.aborted) return cancelled();
+				const prefix = `${ready.oss.prefix}/${seq}/`;
+				const result = await listOssDirectory(deps, ready, prefix, {
+					workdir,
+					signal: controller.signal,
+					timeoutMs: Math.max(1, deadline - Date.now())
+				});
+				if (controller.signal.aborted) return cancelled();
+				if (result.timedOut) return failed("timeout", "查询审核文件超时，请重试");
+				if (result.aborted) return failed("cancelled", "查询已取消");
+				if (!result.ok) return failed(result.sandbox.denied ? "access" : "command", "查询审核文件失败，请检查 OSS 连接与访问权限后重试");
+				if (result.truncated) return failed("truncated", "审核文件清单过大，查询结果不完整");
+				if ([...result.stdout.matchAll(/oss:\/\/([^/\s]+)\//g)].some((match) => match[1] !== ready.oss.bucket)) return failed("invalid-result", "审核文件清单无法解析，请重试");
+				const entries = parseLsEntries(result.stdout, ready.oss.bucket);
+				const keys = parseLsObjects(result.stdout, ready.oss.bucket);
+				const list = entries.length > 0 ? entries : keys;
+				if (result.stdout.split(/\r?\n/).filter((line) => /^oss:\/\/|^\d{4}-\d{2}-\d{2} /u.test(line.trim())).length !== list.length) return failed("invalid-result", "审核文件清单无法解析，请重试");
+				const declared = /Object Number is:\s*(\d+)/i.exec(result.stdout);
+				if (declared === null) return failed("invalid-result", "审核文件清单无法解析，请重试");
+				if (declared !== null && Number(declared[1]) !== list.length) return failed("invalid-result", "审核文件清单不完整，请重试");
+				if (list.some((entry) => !(typeof entry === "string" ? entry : entry.key).startsWith(prefix))) return failed("invalid-result", "审核文件与报告流水号不匹配");
+				if (list.length === 0) return {
+					ok: true,
+					error: "",
+					item: null
+				};
+				const items = groupObjects(list, ready.oss.prefix);
+				if (Object.keys(items).some((key) => key !== seq) || items[seq] === void 0) return failed("invalid-result", "审核文件与报告流水号不匹配");
+				return {
+					ok: true,
+					error: "",
+					item: items[seq]
+				};
+			};
+			await Promise.all(serials.map((seq) => new Promise((resolve) => {
+				if (controller.signal.aborted) {
+					results[seq] = cancelled();
+					resolve();
+					return;
+				}
+				let settled = false;
+				const job = {
+					signal: controller.signal,
+					run: () => read(seq),
+					cancelled,
+					finish: (result) => {
+						if (settled) return;
+						settled = true;
+						batchJobs.delete(job);
+						results[seq] = result;
+						resolve();
+					}
+				};
+				batchJobs.add(job);
+				jobs.push(job);
+				drain();
+			})));
+			return {
+				ok: true,
+				error: "",
+				results: Object.fromEntries(serials.map((seq) => [seq, results[seq]]))
+			};
+		} catch {
+			if (controller.signal.aborted) return {
+				ok: true,
+				error: "",
+				results: Object.fromEntries(serials.map((seq) => [seq, results[seq] ?? cancelled()]))
+			};
+			return reject("OSS 查询环境不可用，请重试");
+		} finally {
+			clearTimeout(timer);
+			signal?.removeEventListener("abort", abort);
+			controller.signal.removeEventListener("abort", onAbort);
+			batches.delete(controller);
+		}
+	};
+	return {
+		run,
+		dispose: () => {
+			disposed = true;
+			for (const controller of batches) controller.abort();
+			drain();
+		}
+	};
+}
+//#endregion
 //#region src/host/report/files.ts
 const LOCAL_MAX_DEPTH = 3;
 const LOCAL_MAX_FILES = 300;
@@ -15028,6 +16461,7 @@ function missingAccessBroker() {
 				}
 			};
 		},
+		note: () => void 0,
 		consent: () => missingLocalAccessView(),
 		diagnostics: () => [],
 		lastDiagnostic: () => null
@@ -16237,6 +17671,8 @@ function createCoreOperations(ctx, config, state, world, resolvers, extra = {})
 		access: resolvers.access
 	});
 	const watch = createUploadWatch(ctx, state, ossDeps);
+	const ossBatch = createOssBatchQueue(ossDeps);
+	ctx.effect(() => ossBatch.dispose, "crwu-workbench: OSS query queue");
 	/**
 	* 「我是谁」的进程内缓存（面板头部那句问候的姓名）。
 	*
@@ -16304,6 +17740,36 @@ function createCoreOperations(ctx, config, state, world, resolvers, extra = {})
 	*/
 	const guard = async (operation) => await guardOperation(gate, operation);
 	const updateOperations = extra.update ?? {};
+	/**
+	* 本地审核操作的依赖（逐次构造）。
+	*
+	* **不抓快照**：`ctx` / `world` 都是活的服务句柄，构造一次就固化的东西在这里没有意义 ——
+	* 与上面 `ossDeps` 同一条理由。
+	*
+	* 三件依赖缺任何一件时返回 `null`（而不是抛 TypeError）：TS 调用方必须传，
+	* 但 JS / 旧调用点漏传时**失败关闭并说人话**，而不是把一个 `undefined.sweep` 抛到路由层。
+	*/
+	const localAuditDeps = () => {
+		const registry = resolvers.localAudit;
+		const fs = resolvers.localAuditFs;
+		const io = resolvers.localAuditIo;
+		if (registry === void 0 || fs === void 0 || io === void 0) return null;
+		return {
+			ctx,
+			access: resolvers.access,
+			state,
+			world,
+			registry,
+			fs,
+			io
+		};
+	};
+	/** 没装配时的失败信封（形状与 `LocalAuditStartView` 兼容，界面按普通错误显示）。 */
+	const localAuditUnwired = {
+		ok: false,
+		error: "本地审核没有装配：本插件实例不能准备本地审核文件",
+		errorKind: "capability-gap"
+	};
 	return {
 		...updateOperations,
 		ping: () => ({
@@ -16313,7 +17779,7 @@ function createCoreOperations(ctx, config, state, world, resolvers, extra = {})
 			buildKind: HOST_BUILD_KIND,
 			at: (/* @__PURE__ */ new Date()).toISOString(),
 			builtAt: HOST_BUILD_STAMP,
-			protocol: 25
+			protocol: 31
 		}),
 		boot: async () => {
 			const home = await world.home();
@@ -16332,7 +17798,7 @@ function createCoreOperations(ctx, config, state, world, resolvers, extra = {})
 			});
 			return {
 				ok: true,
-				protocol: 25,
+				protocol: 31,
 				permissionSchemaVersion: 1,
 				localAccess: await syncLocalAccessConsent({
 					ctx,
@@ -16380,6 +17846,9 @@ function createCoreOperations(ctx, config, state, world, resolvers, extra = {})
 						"oss-cred-save",
 						"report-files",
 						"discussion-material-open",
+						"local-audit-status",
+						"local-audit-start",
+						"local-audit-claim",
 						"ifind-status",
 						"ifind-credential-save",
 						"ifind-credential-clear",
@@ -16433,7 +17902,7 @@ function createCoreOperations(ctx, config, state, world, resolvers, extra = {})
 		*/
 		trust: async () => ({
 			ok: false,
-			error: `客户端与宿主的权限说明版本不一致：本机访问授权已改为版本化收据（协议 ${String(25)}），请完全退出并重新打开 DeepSeek Harness 后在「账号连接」里按新的范围允许一次。`,
+			error: `客户端与宿主的权限说明版本不一致：本机访问授权已改为版本化收据（协议 ${String(31)}），请完全退出并重新打开 DeepSeek Harness 后在「账号连接」里按新的范围允许一次。`,
 			protocolMismatch: true,
 			consent: await readLocalAccessConsent({
 				ctx,
@@ -16611,6 +18080,60 @@ function createCoreOperations(ctx, config, state, world, resolvers, extra = {})
 			form: resolvers.form,
 			scopes: resolvers.discussionScopes
 		}, args),
+		/**
+		* **本地审核**（协议 28）。
+		*
+		* 三条操作共用一份依赖：注册表、扫描用的 fs、快照 IO。它们**不判环境门禁** ——
+		* 本地审核的存在意义就是"不需要氚云 / OSS / 工作空间也能审本机文件"；它唯一需要的是
+		* **本机访问授权**，而那一条由 Broker 在自己的操作表里判（`local-audit-start` 内）。
+		*/
+		"local-audit-status": async (args) => {
+			const ready = localAuditDeps();
+			if (ready === null) return {
+				...localAuditUnwired,
+				fileCount: 0,
+				limit: 30,
+				overLimit: false,
+				readableCount: 0,
+				skippedCount: 0,
+				items: [],
+				skipped: []
+			};
+			return await localAuditStatus(ready, args);
+		},
+		"local-audit-start": async (args) => {
+			const ready = localAuditDeps();
+			if (ready === null) return {
+				...localAuditUnwired,
+				handoffId: "",
+				prompt: "",
+				providedCount: 0,
+				skippedCount: 0,
+				expiresAt: 0,
+				workspacePath: "",
+				casePath: "",
+				files: [],
+				skipped: []
+			};
+			await ready.registry.sweep(ready.io).catch(() => void 0);
+			return await localAuditStart(ready, args);
+		},
+		/**
+		* 认领。`sessionId` 由**客户端**提交（它刚创建了那条会话，这是它自己的事实），
+		* Tool 侧走的是 `crwu_audit_local_claim`（身份来自 Agent，不经过这里）。
+		*/
+		"local-audit-claim": async (args) => {
+			const ready = localAuditDeps();
+			if (ready === null) return {
+				...localAuditUnwired,
+				casePath: "",
+				fileCount: 0,
+				skippedCount: 0,
+				files: [],
+				skipped: []
+			};
+			return await localAuditClaim(ready, args);
+		},
 		"report-files": async (args) => await reportFiles({
 			ctx,
 			oss: await ossDeps(),
@@ -16620,7 +18143,7 @@ function createCoreOperations(ctx, config, state, world, resolvers, extra = {})
 			platform: await world.platform(),
 			workdir: () => world.workdir()
 		}, args),
-		"oss-index": async (args) => await ossIndex(await ossDeps(), args),
+		"oss-index": async (args, context) => "seqNos" in args ? await ossBatch.run(args, context?.signal) : await ossIndex(await ossDeps(), args),
 		"oss-result": async (args) => await ossResult(await ossDeps(), args),
 		"oss-link": async (args) => await ossLink(await ossDeps(), args),
 		"oss-upload": async (args) => {
@@ -18005,6 +19528,7 @@ function accessOf(deps) {
 				runnerFailed: false
 			}
 		}),
+		note: () => void 0,
 		consent: () => missingLocalAccessView(),
 		diagnostics: () => [],
 		lastDiagnostic: () => null
@@ -18330,6 +19854,12 @@ const LOCAL_ACCESS_OPERATIONS = {
 		privileged: true,
 		allowedSources: [...AUDIT_SOURCES, "panel"]
 	},
+	"system.local-audit-material.snapshot": {
+		capability: "system-integration",
+		transport: "filesystem",
+		privileged: true,
+		allowedSources: PANEL
+	},
 	"python.script.run": {
 		capability: "system-integration",
 		transport: "shell",
@@ -18444,6 +19974,20 @@ function createLocalAccessBroker(deps) {
 		consent: consentOf,
 		diagnostics: () => diagnostics.list(),
 		lastDiagnostic: () => diagnostics.list()[0] ?? null,
+		note(call, options = {}) {
+			const requested = localAccessDescriptorOf(call.operation)?.privileged === true ? "danger-full-access" : "";
+			record({
+				operation: call.operation,
+				source: call.source,
+				...options.summary === void 0 ? {} : { summary: options.summary }
+			}, options.errorClass ?? "", {
+				requested,
+				resolved: "",
+				ran: "",
+				denied: options.errorClass === "sandbox-denied",
+				runnerFailed: false
+			}, false);
+		},
 		async runShell(call, command, options = {}) {
 			const descriptor = localAccessDescriptorOf(call.operation);
 			if (descriptor !== void 0 && descriptor.transport !== "shell") return failedShell(`${call.operation} 不是 shell 操作（transport=${descriptor.transport}）`);
@@ -18722,6 +20266,8 @@ var H3yunFormResolver = class {
 };
 //#endregion
 //#region src/host/apply.ts
+/** 过期快照的兜底清理间隔（面板每次准备也会顺手清一次）。 */
+const LOCAL_AUDIT_SWEEP_INTERVAL_MS = 6e5;
 /** 装配 DSH 工作台 Host 插件。 */
 function apply(ctx, pluginConfig) {
 	const config = resolveWorkbenchConfig(pluginConfig);
@@ -18747,7 +20293,7 @@ function apply(ctx, pluginConfig) {
 			"oss-config": ossConfigPath
 		},
 		hostVersion: PLUGIN_VERSION,
-		protocolVersion: 25
+		protocolVersion: 31
 	});
 	subscribeAuditEvents(ctx, state);
 	const form = new H3yunFormResolver({
@@ -18768,6 +20314,20 @@ function apply(ctx, pluginConfig) {
 	* 所以这份白名单必须挂在实例上（模块级会跨插件实例串味，落盘会引出新的暴露面）。
 	*/
 	const discussionScopes = createDiscussionScopeRegistry();
+	/**
+	* **本地审核的一次性 handoff 与案例 scope**（协议 28）。同样是进程内、随插件生命周期释放：
+	* 产品口径是「审核结果只存在于这次对话里」，所以交接记录不落盘、不做历史、重启即失效。
+	* 它的案例目录在操作系统临时目录下，普通会话判据覆盖不到，因此必须有自己的注册表。
+	*/
+	const localAudit = createLocalAuditRegistry();
+	const localAuditIo = nodeSnapshotIo();
+	const cleanupTimer = setInterval(() => {
+		localAudit.sweep(localAuditIo).catch(() => void 0);
+	}, LOCAL_AUDIT_SWEEP_INTERVAL_MS);
+	cleanupTimer.unref?.();
+	ctx.effect(() => () => {
+		clearInterval(cleanupTimer);
+	}, "crwu-workbench: local audit sweep");
 	ctx.effect(() => registerCrwuTools(ctx, {
 		ctx,
 		config,
@@ -18776,6 +20336,8 @@ function apply(ctx, pluginConfig) {
 		form,
 		access,
 		discussionScopes,
+		localAudit,
+		localAuditIo,
 		python
 	}), "crwu-workbench: tools");
 	const update = createUpdateOperations({
@@ -18790,7 +20352,10 @@ function apply(ctx, pluginConfig) {
 		form,
 		python,
 		access,
-		discussionScopes
+		discussionScopes,
+		localAudit,
+		localAuditFs: nodeLocalAuditFs(),
+		localAuditIo
 	}, { update: update.operations });
 	ctx.effect(() => registerRpcRoute(ctx, operations), "crwu-workbench: rpc route");
 	ctx.logger?.info?.("中瑞世联工作台 Host 半（包形态骨架）已装配 %o", {