@actiondock/core 2.4.1 → 2.5.0

package/dist/profile/manager.js

@@ -118,6 +118,27 @@ export function addProfile(name, entry, customHome) {
         token: entry.token?.trim() || undefined,
         tokenEnv: entry.tokenEnv?.trim() || undefined,
         description: entry.description?.trim() || undefined,
+        insecure: entry.insecure !== undefined ? Boolean(entry.insecure) : undefined,
+    };
+    saveProfiles(profilesConfig, customHome);
+}
+export function updateProfile(name, entry, customHome) {
+    const trimmedName = name.trim();
+    if (!trimmedName) {
+        throw new Error("Profile name cannot be empty");
+    }
+    const profilesConfig = loadProfiles(customHome);
+    const existing = profilesConfig.profiles[trimmedName];
+    if (!existing) {
+        throw new Error(`Profile '${trimmedName}' not found. Configure it with 'ad profile add ${trimmedName} --server <url>'`);
+    }
+    const serverUrl = entry.serverUrl ? normalizeServerUrl(entry.serverUrl) : existing.serverUrl;
+    profilesConfig.profiles[trimmedName] = {
+        serverUrl,
+        token: entry.token !== undefined ? (entry.token.trim() || undefined) : existing.token,
+        tokenEnv: entry.tokenEnv !== undefined ? (entry.tokenEnv.trim() || undefined) : existing.tokenEnv,
+        description: entry.description !== undefined ? (entry.description.trim() || undefined) : existing.description,
+        insecure: entry.insecure !== undefined ? Boolean(entry.insecure) : existing.insecure,
     };
     saveProfiles(profilesConfig, customHome);
 }
@@ -215,14 +236,22 @@ export function resolveProfileToken(profileName, entry, explicitToken) {
     return { token: undefined, source: "none" };
 }
 export function resolveTarget(options, customHome) {
+    const envInsecure = typeof process !== "undefined" &&
+        (process.env?.ACTIONDOCK_INSECURE === "true" || process.env?.ACTIONDOCK_INSECURE === "1");
+    const envAllowInsecureHttp = typeof process !== "undefined" &&
+        (process.env?.ACTIONDOCK_ALLOW_INSECURE_HTTP === "true" || process.env?.ACTIONDOCK_ALLOW_INSECURE_HTTP === "1");
+    const effectiveAllowInsecureHttp = options?.allowInsecureHttp !== undefined ? Boolean(options.allowInsecureHttp) : envAllowInsecureHttp;
     // 1. Explicit CLI --server flag
     if (options?.server && options.server.trim()) {
         const resolvedToken = resolveProfileToken(undefined, undefined, options.token);
+        const effectiveInsecure = options.insecure !== undefined ? Boolean(options.insecure) : envInsecure;
         return {
             type: "remote",
             serverUrl: normalizeServerUrl(options.server),
             token: resolvedToken.token,
             tokenSource: resolvedToken.source,
+            insecure: effectiveInsecure,
+            allowInsecureHttp: effectiveAllowInsecureHttp,
         };
     }
     const profilesConfig = loadProfiles(customHome);
@@ -237,22 +266,30 @@ export function resolveTarget(options, customHome) {
             throw new Error(`Profile '${pName}' not found. Configure it with 'ad profile add ${pName} --server <url>'`);
         }
         const resolvedToken = resolveProfileToken(pName, found, options.token);
+        const effectiveInsecure = options.insecure !== undefined
+            ? Boolean(options.insecure)
+            : (envInsecure || Boolean(found.insecure));
         return {
             type: "remote",
             profileName: pName,
             serverUrl: found.serverUrl,
             token: resolvedToken.token,
             tokenSource: resolvedToken.source,
+            insecure: effectiveInsecure,
+            allowInsecureHttp: effectiveAllowInsecureHttp,
         };
     }
     // 3. Environment variable ACTIONDOCK_SERVER_URL
     if (process.env.ACTIONDOCK_SERVER_URL && process.env.ACTIONDOCK_SERVER_URL.trim()) {
         const resolvedToken = resolveProfileToken(undefined, undefined, options?.token);
+        const effectiveInsecure = options?.insecure !== undefined ? Boolean(options.insecure) : envInsecure;
         return {
             type: "remote",
             serverUrl: normalizeServerUrl(process.env.ACTIONDOCK_SERVER_URL),
             token: resolvedToken.token,
             tokenSource: resolvedToken.source,
+            insecure: effectiveInsecure,
+            allowInsecureHttp: effectiveAllowInsecureHttp,
         };
     }
     // 4. Environment variable ACTIONDOCK_PROFILE
@@ -266,12 +303,17 @@ export function resolveTarget(options, customHome) {
             throw new Error(`Profile '${pName}' (from ACTIONDOCK_PROFILE) not found. Configure it with 'ad profile add ${pName} --server <url>'`);
         }
         const resolvedToken = resolveProfileToken(pName, found, options?.token);
+        const effectiveInsecure = options?.insecure !== undefined
+            ? Boolean(options.insecure)
+            : (envInsecure || Boolean(found.insecure));
         return {
             type: "remote",
             profileName: pName,
             serverUrl: found.serverUrl,
             token: resolvedToken.token,
             tokenSource: resolvedToken.source,
+            insecure: effectiveInsecure,
+            allowInsecureHttp: effectiveAllowInsecureHttp,
         };
     }
     // 5. Current Profile in config
@@ -280,12 +322,17 @@ export function resolveTarget(options, customHome) {
         const found = profilesConfig.profiles[current];
         if (found && found.serverUrl && found.serverUrl !== "local") {
             const resolvedToken = resolveProfileToken(current, found, options?.token);
+            const effectiveInsecure = options?.insecure !== undefined
+                ? Boolean(options.insecure)
+                : (envInsecure || Boolean(found.insecure));
             return {
                 type: "remote",
                 profileName: current,
                 serverUrl: found.serverUrl,
                 token: resolvedToken.token,
                 tokenSource: resolvedToken.source,
+                insecure: effectiveInsecure,
+                allowInsecureHttp: effectiveAllowInsecureHttp,
             };
         }
     }

package/dist/profile/types.d.ts

@@ -13,6 +13,8 @@ export interface ProfileEntry {
     tokenEnv?: string;
     /** 该机器/环境的描述信息 */
     description?: string;
+    /** 是否跳过 TLS 证书合法性校验（用于局域网内网自签证书） */
+    insecure?: boolean;
 }
 /**
  * 全局 profiles.json 配置文件结构契约。
@@ -41,6 +43,10 @@ export interface ResolvedTarget {
     token?: string;
     /** Token 数据来源 */
     tokenSource?: TokenResolutionSource;
+    /** 是否跳过 TLS 证书合法性校验 */
+    insecure?: boolean;
+    /** 是否允许向非回环地址发送明文 HTTP 请求 */
+    allowInsecureHttp?: boolean;
 }
 /**
  * 远端服务器健康探测与时延检测结果。

package/dist/project/init.js

@@ -86,10 +86,10 @@ export function initProject(targetDir, options = {}) {
             node: ">=24.12.0",
         },
         dependencies: {
-            "@actiondock/sdk": "^2.4.1",
+            "@actiondock/sdk": "^2.5.0",
         },
         devDependencies: {
-            "@actiondock/testing": "^2.4.1",
+            "@actiondock/testing": "^2.5.0",
             "@types/node": "^22.13.0",
             "tsx": "^4.19.0",
             "typescript": "^5.7.0",

package/dist/server/dispatcher.d.ts

@@ -0,0 +1,24 @@
+/**
+ * 获取底层 HTTP 调度器（如 Undici Agent 或自定义 Dispatcher）的提供者函数契约。
+ */
+export type FetchDispatcherProvider = () => unknown;
+/**
+ * 注册全局用于忽略服务端证书校验的调度器提供者。
+ */
+export declare function setInsecureDispatcherProvider(provider?: FetchDispatcherProvider): void;
+/**
+ * 获取当前已注册的调度器提供者函数。
+ */
+export declare function getInsecureDispatcherProvider(): FetchDispatcherProvider | undefined;
+/**
+ * 获取用于忽略服务端证书校验的调度器实例。
+ * 纯粹解耦设计：
+ * 1. 优先调用显式注册的提供者（如由 @actiondock/runtime-node 注册）；
+ * 2. 检查全局符号注入的提供者；
+ * 3. 若在 Node 环境下且前述未注入，安全动态加载兜底连接池，绝不让 core 包产生静态硬编译依赖。
+ */
+export declare function getInsecureDispatcher(): unknown;
+/**
+ * 显式强制重置并销毁调度器连接池（仅用于单元测试重置或进程退出）。
+ */
+export declare function closeInsecureDispatcher(): Promise<void>;

package/dist/server/dispatcher.js

@@ -0,0 +1,86 @@
+import { createRequire } from "node:module";
+let insecureDispatcherProvider;
+let fallbackInsecureAgent;
+/**
+ * 注册全局用于忽略服务端证书校验的调度器提供者。
+ */
+export function setInsecureDispatcherProvider(provider) {
+    insecureDispatcherProvider = provider;
+}
+/**
+ * 获取当前已注册的调度器提供者函数。
+ */
+export function getInsecureDispatcherProvider() {
+    return insecureDispatcherProvider;
+}
+/**
+ * 获取用于忽略服务端证书校验的调度器实例。
+ * 纯粹解耦设计：
+ * 1. 优先调用显式注册的提供者（如由 @actiondock/runtime-node 注册）；
+ * 2. 检查全局符号注入的提供者；
+ * 3. 若在 Node 环境下且前述未注入，安全动态加载兜底连接池，绝不让 core 包产生静态硬编译依赖。
+ */
+export function getInsecureDispatcher() {
+    if (insecureDispatcherProvider) {
+        return insecureDispatcherProvider();
+    }
+    const globalProvider = globalThis[Symbol.for("actiondock.insecureDispatcherProvider")];
+    if (typeof globalProvider === "function") {
+        return globalProvider();
+    }
+    if (typeof process !== "undefined" && process.versions?.node) {
+        try {
+            const req = createRequire(import.meta.url);
+            const runtimeNode = req("@actiondock/runtime-node");
+            if (typeof runtimeNode?.getInsecureDispatcher === "function") {
+                return runtimeNode.getInsecureDispatcher();
+            }
+        }
+        catch {
+            // 忽略未安装 @actiondock/runtime-node 的情况
+        }
+        if (!fallbackInsecureAgent || fallbackInsecureAgent.closed || fallbackInsecureAgent.destroyed) {
+            try {
+                const req = createRequire(import.meta.url);
+                const undici = req("undici");
+                if (undici?.Agent) {
+                    fallbackInsecureAgent = new undici.Agent({
+                        connect: {
+                            rejectUnauthorized: false,
+                        },
+                        bodyTimeout: 0,
+                    });
+                }
+            }
+            catch {
+                // 忽略非 Node 环境或未安装 undici 的异常
+            }
+        }
+        return fallbackInsecureAgent;
+    }
+    return undefined;
+}
+/**
+ * 显式强制重置并销毁调度器连接池（仅用于单元测试重置或进程退出）。
+ */
+export async function closeInsecureDispatcher() {
+    const globalClose = globalThis[Symbol.for("actiondock.closeInsecureDispatcher")];
+    if (typeof globalClose === "function") {
+        try {
+            await globalClose();
+        }
+        catch {
+            // 忽略关闭异常
+        }
+    }
+    if (fallbackInsecureAgent) {
+        const agent = fallbackInsecureAgent;
+        fallbackInsecureAgent = undefined;
+        try {
+            await agent.close();
+        }
+        catch {
+            // 忽略关闭异常
+        }
+    }
+}

package/dist/server/index.d.ts

@@ -3,3 +3,4 @@ export * from "./security.js";
 export * from "./body.js";
 export * from "./routes/index.js";
 export * from "./server.js";
+export * from "./dispatcher.js";

package/dist/server/index.js

@@ -3,3 +3,4 @@ export * from "./security.js";
 export * from "./body.js";
 export * from "./routes/index.js";
 export * from "./server.js";
+export * from "./dispatcher.js";

package/dist/server/server.d.ts

@@ -1,4 +1,4 @@
-import type { ActionDockServerInstance, CoreHttpServerInstance, ServerOptions } from "./types.js";
+import type { ActionDockServerInstance, CoreHttpServerInstance, ServerOptions, ServerTlsOptions } from "./types.js";
 /**
  * 规范化主机地址用于拼接 URL。
  * 若 host 包含冒号 : 且不以 [ 开头，则添加中括号包裹（IPv6 标准格式）。
@@ -7,7 +7,7 @@ export declare function formatHostForUrl(host: string): string;
 /**
  * 根据当前运行时环境启动标准 Web Request/Response 兼容的 HTTP 服务。
  */
-export declare function launchHttpServer(port: number, host: string, fetchHandler: (req: Request) => Promise<Response>): Promise<CoreHttpServerInstance>;
+export declare function launchHttpServer(port: number, host: string, fetchHandler: (req: Request) => Promise<Response>, tls?: ServerTlsOptions): Promise<CoreHttpServerInstance>;
 /**
  * 启动 ActionDock 2.0 原生轻量级 HTTP 服务端。
  * 作为 ActionDockHost 与 ActionDockTarget 的薄适配层，负责中间件流转、认证拦截与路由分发。

package/dist/server/server.js

@@ -1,4 +1,5 @@
 import { createServer as createNodeHttpServer } from "node:http";
+import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
@@ -21,8 +22,8 @@ export function formatHostForUrl(host) {
 /**
  * 根据当前运行时环境启动标准 Web Request/Response 兼容的 HTTP 服务。
  */
-export async function launchHttpServer(port, host, fetchHandler) {
-    const srv = createNodeHttpServer(async (req, res) => {
+export async function launchHttpServer(port, host, fetchHandler, tls) {
+    const requestListener = async (req, res) => {
         const ac = new AbortController();
         const onReqClose = () => {
             if (!req.complete) {
@@ -84,7 +85,33 @@ export async function launchHttpServer(port, host, fetchHandler) {
             req.removeListener("close", onReqClose);
             res.removeListener("close", onResClose);
         }
-    });
+    };
+    let srv;
+    if (tls) {
+        let cert = tls.cert;
+        if (!cert && tls.certPath) {
+            cert = readFileSync(tls.certPath);
+        }
+        let key = tls.key;
+        if (!key && tls.keyPath) {
+            key = readFileSync(tls.keyPath);
+        }
+        const httpsOptions = {
+            cert,
+            key,
+        };
+        if (tls.ca) {
+            httpsOptions.ca = tls.ca;
+        }
+        if (tls.passphrase) {
+            httpsOptions.passphrase = tls.passphrase;
+        }
+        const { createServer: createHttpsServer } = await import("node:https");
+        srv = createHttpsServer(httpsOptions, requestListener);
+    }
+    else {
+        srv = createNodeHttpServer(requestListener);
+    }
     const instance = {
         port,
         stop: async () => {
@@ -313,11 +340,12 @@ export async function startActionDockServer(options = {}) {
             },
         }, 404, corsHeaders);
     };
-    const server = await launchHttpServer(port, host, fetchHandler);
+    const server = await launchHttpServer(port, host, fetchHandler, options.tls);
     if (server.ready) {
         await server.ready;
     }
     const actualHost = host === "0.0.0.0" ? "127.0.0.1" : host;
+    const protocol = options.tls ? "https" : "http";
     const instance = {
         get port() {
             return server.port ?? port;
@@ -328,13 +356,14 @@ export async function startActionDockServer(options = {}) {
         host: hostInstance,
         target: targetInstance,
         get url() {
-            return `http://${formatHostForUrl(actualHost)}:${this.port}`;
+            return `${protocol}://${formatHostForUrl(actualHost)}:${this.port}`;
         },
         ready: Promise.resolve(),
         stop: async (stopOptions) => {
+            await server.stop(true);
             if (targetInstance) {
                 try {
-                    await targetInstance.close();
+                    await targetInstance.close(stopOptions?.graceMs !== undefined ? { timeoutMs: stopOptions.graceMs } : undefined);
                 }
                 catch {
                     // 忽略关闭异常
@@ -348,7 +377,6 @@ export async function startActionDockServer(options = {}) {
                     // 忽略宿主关闭异常
                 }
             }
-            await server.stop(true);
         },
     };
     return instance;

package/dist/server/types.d.ts

@@ -5,10 +5,25 @@ export interface CoreHttpServerInstance {
     stop: (closeActiveConnections?: boolean) => void | Promise<void>;
     ready?: Promise<void>;
 }
+export interface ServerTlsOptions {
+    /** TLS 证书内容（PEM 格式字符串或 Buffer） */
+    cert?: string | Buffer;
+    /** TLS 私钥内容（PEM 格式字符串或 Buffer） */
+    key?: string | Buffer;
+    /** TLS 证书文件绝对或相对路径 */
+    certPath?: string;
+    /** TLS 私钥文件绝对或相对路径 */
+    keyPath?: string;
+    /** CA 根证书或证书链内容/路径 */
+    ca?: string | Buffer | Array<string | Buffer>;
+    /** 私钥密码口令（若私钥被密码加密） */
+    passphrase?: string;
+}
 export type CoreHttpServerFactory = (options: {
     port: number;
     host: string;
     fetch: (req: Request) => Promise<Response>;
+    tls?: ServerTlsOptions;
 }) => CoreHttpServerInstance | Promise<CoreHttpServerInstance>;
 /**
  * 启动 ActionDock HTTP Runner 服务端的配置选项。
@@ -56,6 +71,8 @@ export interface ServerOptions {
     enableManagement?: boolean;
     /** 是否扫描并加载外部链接包（默认在未指定 projectRoot 时为 true，指定时为 false） */
     scanLinkedPackages?: boolean;
+    /** 服务端 TLS/HTTPS 安全传输选项 */
+    tls?: ServerTlsOptions;
 }
 /**
  * 已启动的 ActionDock HTTP Runner 实例句柄。

package/dist/target/remote.d.ts

@@ -11,6 +11,8 @@ export declare function streamRemoteEvents(serverUrl: string, runId: string, tok
     signal?: AbortSignal;
     maxQueueSize?: number;
     allowInsecureHttp?: boolean;
+    insecure?: boolean;
+    dispatcher?: unknown;
 }): AsyncIterable<ExecutionEvent>;
 /**
  * 远程 ActionDockTarget 门面实现。
@@ -22,7 +24,11 @@ export declare class RemoteActionDockTarget implements ActionDockTarget {
     readonly timeoutMs?: number;
     readonly baseTimeoutMs: number;
     readonly allowInsecureHttp?: boolean;
+    readonly insecure?: boolean;
+    readonly dispatcher?: unknown;
+    private isClosed;
     constructor(options: RemoteTargetOptions);
+    private assertNotClosed;
     info(): Promise<TargetInfo>;
     listPackages(): Promise<PackageInfo[]>;
     listActions(options?: ListActionsOptions): Promise<ActionSummary[]>;