@agentunion/kite 1.4.0 → 1.6.0

package/extensions/services/auth/entry.py

@@ -0,0 +1,1054 @@
+"""
+Auth 模块入口 - 纯 RPC 认证服务
+
+从 stdin 读 boot_info → 连接 Kernel → auth → registry.register → module.ready → 消息循环
+无 HTTP 服务器，所有功能通过 RPC 提供。
+"""
+
+import builtins
+import json
+import os
+import sys
+import threading
+import re
+import time
+from datetime import datetime, timezone
+
+import asyncio
+import traceback
+import uuid
+import random
+
+import websockets
+
+
+# System broadcast events
+SYSTEM_BROADCAST_EVENTS = {
+    "module.ready", "module.registered", "module.started", "module.stopped",
+    "module.crashed", "module.exiting", "module.offline",
+    "module.shutdown.ack", "module.shutdown.ready",
+    "system.ready", "registry.updated",
+    "system.instance.started", "system.instance.stopped",
+}
+
+
+# ── Module configuration ──
+
+def _load_module_config() -> dict:
+    _this_dir = os.path.dirname(os.path.abspath(__file__))
+    module_md = os.path.join(_this_dir, "module.md")
+    project_root = os.environ.get("KITE_PROJECT", "")
+    if project_root and _this_dir.startswith(project_root):
+        rel_path = os.path.relpath(_this_dir, project_root)
+    else:
+        rel_path = _this_dir
+    result = {"name": "", "preferred_port": 0, "advertise_ip": "0.0.0.0"}
+    if not os.path.exists(module_md):
+        print(f"[{rel_path}] ERROR: module.md not found")
+        sys.exit(1)
+    try:
+        with open(module_md, encoding="utf-8") as f:
+            text = f.read()
+        m = re.match(r'^---\s*\n(.*?)\n---', text, re.DOTALL)
+        if not m:
+            print(f"[{rel_path}] ERROR: Missing YAML frontmatter")
+            sys.exit(1)
+        try:
+            import yaml
+            fm = yaml.safe_load(m.group(1)) or {}
+        except ImportError:
+            print(f"[{rel_path}] ERROR: PyYAML not installed")
+            sys.exit(1)
+        if "name" not in fm:
+            print(f"[{rel_path}] ERROR: Missing 'name' field")
+            sys.exit(1)
+        raw_name = str(fm["name"]).strip()
+        sanitized = re.sub(r'[^a-zA-Z0-9_\-]', '', raw_name)
+        if sanitized != raw_name or not sanitized:
+            print(f"[{rel_path}] ERROR: Invalid module name '{raw_name}'")
+            sys.exit(1)
+        result["name"] = sanitized
+        if "preferred_port" in fm:
+            try:
+                result["preferred_port"] = int(fm["preferred_port"])
+            except (ValueError, TypeError):
+                pass
+        if "advertise_ip" in fm:
+            result["advertise_ip"] = str(fm["advertise_ip"])
+        # max_connections（弹性连接上限）
+        try:
+            result["max_connections"] = max(1, min(10, int(fm.get("max_connections", 1))))
+        except (ValueError, TypeError):
+            result["max_connections"] = 1
+    except SystemExit:
+        raise
+    except Exception as e:
+        print(f"[{rel_path}] ERROR: Failed to read module.md: {e}")
+        sys.exit(1)
+    return result
+
+_module_config = _load_module_config()
+MODULE_NAME = _module_config["name"]
+
+
+# ── Safe stdout/stderr ──
+
+class _SafeWriter:
+    def __init__(self, stream):
+        self._stream = stream
+    def write(self, s):
+        try:
+            self._stream.write(s)
+        except (BrokenPipeError, OSError):
+            pass
+    def flush(self):
+        try:
+            self._stream.flush()
+        except (BrokenPipeError, OSError):
+            pass
+    def __getattr__(self, name):
+        return getattr(self._stream, name)
+
+sys.stdout = _SafeWriter(sys.stdout)
+sys.stderr = _SafeWriter(sys.stderr)
+
+
+# ── Timestamped print + log file writer ──
+
+_builtin_print = builtins.print
+_start_ts = time.monotonic()
+_last_ts = time.monotonic()
+_ANSI_RE = re.compile(r"\033\[[0-9;]*m")
+_log_lock = threading.Lock()
+_log_latest_path = None
+_log_daily_path = None
+_log_daily_date = ""
+_log_dir = None
+_crash_log_path = None
+
+def _strip_ansi(s: str) -> str:
+    return _ANSI_RE.sub("", s)
+
+def _resolve_daily_log_path():
+    global _log_daily_path, _log_daily_date
+    if not _log_dir:
+        return
+    today = datetime.now().strftime("%Y-%m-%d")
+    if today == _log_daily_date and _log_daily_path:
+        return
+    month_dir = os.path.join(_log_dir, today[:7])
+    os.makedirs(month_dir, exist_ok=True)
+    _log_daily_path = os.path.join(month_dir, f"{today}.log")
+    _log_daily_date = today
+
+def _write_log(plain_line: str):
+    with _log_lock:
+        if _log_latest_path:
+            try:
+                with open(_log_latest_path, "a", encoding="utf-8") as f:
+                    f.write(plain_line)
+            except Exception:
+                pass
+        _resolve_daily_log_path()
+        if _log_daily_path:
+            try:
+                with open(_log_daily_path, "a", encoding="utf-8") as f:
+                    f.write(plain_line)
+            except Exception:
+                pass
+
+def _write_crash(exc_type, exc_value, exc_tb, thread_name=None, severity="critical", handled=False):
+    record = {
+        "timestamp": datetime.now(timezone.utc).isoformat(),
+        "module": MODULE_NAME,
+        "thread": thread_name or threading.current_thread().name,
+        "exception_type": exc_type.__name__ if exc_type else "Unknown",
+        "exception_message": str(exc_value),
+        "traceback": "".join(traceback.format_exception(exc_type, exc_value, exc_tb)),
+        "severity": severity, "handled": handled,
+        "process_id": os.getpid(), "platform": sys.platform,
+        "runtime_version": f"Python {sys.version.split()[0]}",
+    }
+    if exc_tb:
+        tb_entries = traceback.extract_tb(exc_tb)
+        if tb_entries:
+            last = tb_entries[-1]
+            record["context"] = {"function": last.name, "file": os.path.basename(last.filename), "line": last.lineno}
+    line = json.dumps(record, ensure_ascii=False) + "\n"
+    if _crash_log_path:
+        try:
+            with open(_crash_log_path, "a", encoding="utf-8") as f:
+                f.write(line)
+        except Exception:
+            pass
+    if _log_dir:
+        try:
+            today = datetime.now().strftime("%Y-%m-%d")
+            archive_dir = os.path.join(_log_dir, "crashes", today[:7])
+            os.makedirs(archive_dir, exist_ok=True)
+            with open(os.path.join(archive_dir, f"{today}.jsonl"), "a", encoding="utf-8") as f:
+                f.write(line)
+        except Exception:
+            pass
+
+def _setup_exception_hooks():
+    _orig = sys.excepthook
+    def _excepthook(exc_type, exc_value, exc_tb):
+        _write_crash(exc_type, exc_value, exc_tb, severity="critical", handled=False)
+        _orig(exc_type, exc_value, exc_tb)
+    sys.excepthook = _excepthook
+    if hasattr(threading, "excepthook"):
+        def _thread_excepthook(args):
+            _write_crash(args.exc_type, args.exc_value, args.exc_traceback,
+                        thread_name=args.thread.name if args.thread else "unknown",
+                        severity="error", handled=False)
+        threading.excepthook = _thread_excepthook
+
+def _tprint(*args, **kwargs):
+    global _last_ts
+    now = time.monotonic()
+    elapsed = now - _start_ts
+    delta = now - _last_ts
+    _last_ts = now
+    elapsed_str = f"{elapsed*1000:.0f}ms" if elapsed < 1 else (f"{elapsed:.1f}s" if elapsed < 100 else f"{elapsed:.0f}s")
+    delta_str = "" if delta < 0.001 else (f"+{delta*1000:.0f}ms" if delta < 1 else (f"+{delta:.1f}s" if delta < 100 else f"+{delta:.0f}s"))
+    _builtin_print(*args, **kwargs)
+    if _log_latest_path or _log_daily_path:
+        sep = kwargs.get("sep", " ")
+        end = kwargs.get("end", "\n")
+        text = sep.join(str(a) for a in args)
+        ts = datetime.now().strftime("%H:%M:%S.%f")[:-3]
+        prefix = f"[{elapsed_str:>6}] {ts} {delta_str:>8} "
+        _write_log(prefix + _strip_ansi(text) + end)
+
+builtins.print = _tprint
+
+_project_root = os.environ.get("KITE_PROJECT") or os.path.dirname(os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__)))))
+if _project_root not in sys.path:
+    sys.path.insert(0, _project_root)
+
+
+def _fmt_elapsed(t0: float) -> str:
+    d = time.monotonic() - t0
+    if d < 1: return f"{d*1000:.0f}ms"
+    if d < 10: return f"{d:.1f}s"
+    return f"{d:.0f}s"
+
+
+def _read_stdin_kite_message(expected_type: str, timeout: float = 10) -> dict | None:
+    result = [None]
+    def _read():
+        try:
+            line = sys.stdin.readline().strip()
+            if line:
+                msg = json.loads(line)
+                if isinstance(msg, dict) and msg.get("kite") == expected_type:
+                    result[0] = msg
+        except Exception:
+            pass
+    t = threading.Thread(target=_read, daemon=True)
+    t.start()
+    t.join(timeout=timeout)
+    return result[0]
+
+
+# ── Global state ──
+
+_ws_global = None
+_shutting_down = False
+_exit_code = 0
+_pairing_verifier = None
+_kite_token_verifier = None
+_evol_account_verifier = None
+_token_store = None
+
+# 弹性多连接
+_extra_ws: dict = {}           # slot → WebSocket（附加连接）
+_extra_ws_tasks: dict = {}     # slot → recv loop Task
+_kernel_port = ""              # 缓存 kernel_port，供 offer handler 使用
+
+# RPC 响应等待
+_pending_rpc: dict[str, asyncio.Future] = {}
+
+_has_registered = False
+
+
+# ── Auth RPC handlers ──
+
+async def _rpc_verify(params: dict) -> dict:
+    """auth.verify — 统一认证入口"""
+    method = params.get("method", "")
+
+    if method == "pairing_code":
+        code = params.get("code", "")
+        result = _pairing_verifier.verify(code)
+        if result is None:
+            return {"success": False, "error": "invalid_code"}
+        # 配对码验证成功，生成 kite_token
+        client_info = params.get("client_info", {})
+        kite_token = _token_store.create_token(
+            auth_method="pairing_code",
+            client_info=client_info,
+            trust_level="high",
+            role=result["role"],
+        )
+        # 发布成功事件
+        if _ws_global:
+            await _publish_event(_ws_global, "auth.success", {
+                "method": "pairing_code", "role": result["role"],
+                "device_id": client_info.get("device_id", "unknown"),
+            })
+            await _publish_event(_ws_global, "auth.token.created", {
+                "method": "pairing_code", "token_prefix": kite_token[:10] + "...",
+            })
+        return {"success": True, "role": result["role"], "trust_level": "high", "token": kite_token}
+
+    elif method == "evol_account":
+        phone = params.get("phone", "")
+        code = params.get("code", "")
+        result = await _evol_account_verifier.verify(phone, code)
+        if result is None:
+            if _ws_global:
+                await _publish_event(_ws_global, "auth.failed", {
+                    "method": "evol_account", "error": "verification_failed",
+                })
+            return {"success": False, "error": "verification_failed"}
+        # Evol 账号验证成功，生成 kite_token
+        client_info = params.get("client_info", {})
+        client_info["phone"] = result["phone"]
+        kite_token = _token_store.create_token(
+            auth_method="evol_account",
+            client_info=client_info,
+            trust_level="medium",
+            role=result["role"],
+        )
+        if _ws_global:
+            await _publish_event(_ws_global, "auth.success", {
+                "method": "evol_account", "role": result["role"],
+                "device_id": client_info.get("device_id", "unknown"),
+            })
+            await _publish_event(_ws_global, "auth.token.created", {
+                "method": "evol_account", "token_prefix": kite_token[:10] + "...",
+            })
+        return {"success": True, "role": result["role"], "trust_level": "medium", "token": kite_token}
+
+    elif method == "kite_token":
+        token = params.get("token", "")
+        result = _kite_token_verifier.verify(token)
+        if result is None:
+            if _ws_global:
+                await _publish_event(_ws_global, "auth.failed", {
+                    "method": "kite_token", "error": "invalid_token",
+                })
+            return {"success": False, "error": "invalid_token"}
+        return {"success": True, "role": result["role"], "trust_level": result["trust_level"]}
+
+    else:
+        return {"success": False, "error": f"unsupported method: {method}"}
+
+
+async def _rpc_request_pairing_code(params: dict) -> dict:
+    """auth.request_pairing_code — 生成配对码"""
+    role = params.get("role", "admin")
+    try:
+        code = _pairing_verifier.generate(role=role)
+    except RuntimeError as e:
+        return {"success": False, "error": str(e)}
+    # 配对码仅在控制台输出，不返回给远程客户端
+    print(f"\033[1;31m[auth] 配对码: {code}\033[0m")
+    if _ws_global:
+        await _publish_event(_ws_global, "auth.code_generated", {
+            "role": role, "ttl": _pairing_verifier.code_ttl, "timestamp": time.time(),
+        })
+    return {"status": "generated", "ttl": _pairing_verifier.code_ttl}
+
+
+async def _rpc_list_tokens(params: dict) -> dict:
+    """auth.list_tokens — 列出所有有效 token"""
+    tokens = _token_store.list_tokens()
+    return {"tokens": tokens, "count": len(tokens)}
+
+
+async def _rpc_revoke_token(params: dict) -> dict:
+    """auth.revoke_token — 撤销指定 token"""
+    token = params.get("token", "")
+    if not token:
+        return {"success": False, "error": "missing token"}
+    ok = _token_store.revoke(token)
+    if ok and _ws_global:
+        await _publish_event(_ws_global, "auth.token.revoked", {
+            "token_prefix": token[:10] + "...",
+        })
+    return {"success": ok}
+
+
+async def _rpc_get_pending_codes(params: dict) -> dict:
+    """auth.get_pending_codes — 返回当前有效的配对码列表（供本地控制台展示）"""
+    _pairing_verifier._cleanup_expired()
+    codes = []
+    now = time.time()
+    for code, info in _pairing_verifier._pending_codes.items():
+        remaining = _pairing_verifier.code_ttl - (now - info["created_at"])
+        if remaining > 0:
+            codes.append({"code": code, "role": info["role"], "remaining_ttl": round(remaining)})
+    return {"codes": codes, "count": len(codes)}
+
+
+async def _rpc_send_sms_code(params: dict) -> dict:
+    """auth.send_sms_code — 发送短信验证码（pre-auth 方法）"""
+    phone = params.get("phone", "")
+    if not phone:
+        return {"success": False, "msg": "缺少手机号"}
+    result = await _evol_account_verifier.send_sms_code(phone)
+    return result
+
+
+async def _rpc_get_supported_methods(params: dict) -> dict:
+    """auth.get_supported_methods — 返回支持的认证方式"""
+    return {"methods": ["pairing_code", "evol_account", "kite_token"]}
+
+
+# ── WebSocket connection + message loop ──
+
+async def _ws_loop(token: str, kernel_port: int, _t0: float):
+    global _shutting_down, _exit_code
+    retry_delay = 0.5
+    max_delay = 10.0
+    attempt = 0
+    cooldown_attempts = 0
+    conn_refused_count = 0
+
+    while not _shutting_down:
+        try:
+            await _ws_connect(token, kernel_port, _t0)
+            retry_delay = 0.5
+            attempt = 0
+            cooldown_attempts = 0
+            conn_refused_count = 0
+        except asyncio.CancelledError:
+            return
+        except Exception as e:
+            if _shutting_down:
+                return
+            code = _get_close_code(e)
+            if code in (4001, 4003, 4004, 1008, 4010):
+                print(f"[auth] 致命错误 (code {code})，退出")
+                _exit_code = 1
+                _shutting_down = True
+                return
+            if code == 4020:
+                cooldown_attempts += 1
+                if cooldown_attempts >= 5:
+                    print(f"[auth] 速率限制重试 5 次，退出")
+                    _exit_code = 1
+                    _shutting_down = True
+                    return
+                print(f"[auth] 速率限制，10s 后重试 ({cooldown_attempts}/5)")
+                await asyncio.sleep(10.0)
+                continue
+
+            # 连接被拒绝/重置 — Kernel 可能正在关闭
+            # Windows 的 [WinError 1225] 是 OSError 不是 ConnectionRefusedError
+            _is_conn_refused = isinstance(e, (ConnectionRefusedError, ConnectionResetError))
+            if not _is_conn_refused and isinstance(e, OSError) and getattr(e, 'winerror', None) == 1225:
+                _is_conn_refused = True
+            if _is_conn_refused:
+                conn_refused_count += 1
+                if conn_refused_count >= 3:
+                    print(f"[auth] Kernel 持续不可达 ({conn_refused_count} 次)，正常退出")
+                    _exit_code = 0
+                    _shutting_down = True
+                    return
+                jitter = retry_delay * 0.2 * random.random()
+                sleep_time = retry_delay + jitter
+                print(f"[auth] Kernel 连接失败: {type(e).__name__}, {sleep_time:.1f}s 后重试 ({conn_refused_count}/3)")
+            else:
+                conn_refused_count = 0
+                attempt += 1
+                jitter = retry_delay * 0.2 * random.random()
+                sleep_time = retry_delay + jitter
+                _write_crash(type(e), e, e.__traceback__, severity="error", handled=True)
+                print(f"[auth] 连接错误: {e}, {sleep_time:.1f}s 后重试 (attempt {attempt})")
+                if attempt >= 10:
+                    print(f"[auth] 连续 {attempt} 次连接失败，正常退出")
+                    _exit_code = 0
+                    _shutting_down = True
+                    return
+
+        _ws_global_clear()
+        if _shutting_down:
+            return
+        await asyncio.sleep(sleep_time if 'sleep_time' in locals() else retry_delay)
+        retry_delay = min(retry_delay * 2, max_delay)
+
+
+def _get_close_code(e: Exception) -> int:
+    if hasattr(e, 'rcvd') and e.rcvd is not None:
+        return getattr(e.rcvd, 'code', 0)
+    return 0
+
+
+def _ws_global_clear():
+    global _ws_global
+    _ws_global = None
+
+
+async def _do_init(ws):
+    """收到 system.require_init 后执行：subscribe + register + module.ready"""
+    global _has_registered
+    reason = "startup" if not _has_registered else "recovery"
+    print(f"[auth] Received system.require_init (reason={reason})")
+
+    # 1. Subscribe（等待响应）
+    await _rpc_call(ws, "event.subscribe", {
+        "events": ["module.ready", "module.shutdown"],
+    })
+    print(f"[auth] Subscribed to events")
+
+    # 2. Register（等待响应）
+    await _rpc_call(ws, "registry.register", {
+        "module_id": "auth",
+        "module_type": "service",
+        "launcher_id": "launcher",
+        "tools": {
+            "rpc": {
+                "auth": {
+                    "verify": {"method": "verify", "description": "统一认证入口"},
+                    "request_pairing_code": {"method": "request_pairing_code", "description": "生成配对码"},
+                    "send_sms_code": {"method": "send_sms_code", "description": "发送短信验证码"},
+                    "list_tokens": {"method": "list_tokens", "description": "列出所有 Token"},
+                    "revoke_token": {"method": "revoke_token", "description": "撤销 Token"},
+                    "get_supported_methods": {"method": "get_supported_methods", "description": "支持的认证方式"},
+                    "get_pending_codes": {"method": "get_pending_codes", "description": "获取当前有效配对码"},
+                },
+                "module": {
+                    "health": {"method": "health", "description": "健康检查"},
+                    "status": {"method": "status", "description": "状态查询"},
+                }
+            }
+        },
+        "events_publish": {
+            "auth": {
+                "success": {"description": "认证成功"},
+                "failed": {"description": "认证失败"},
+                "code_generated": {"description": "配对码已生成"},
+                "token.created": {"description": "Token 已创建"},
+                "token.revoked": {"description": "Token 已撤销"},
+            }
+        },
+        "events_subscribe": ["module.ready", "module.shutdown"],
+    })
+    print(f"[auth] Registered to Kernel")
+
+    # 3. module.ready（不等响应）
+    if not _shutting_down:
+        await _publish_event(ws, "module.ready", {
+            "module_id": "auth",
+            "graceful_shutdown": True,
+            "startup_time": time.monotonic() - _start_ts,
+            "reason": reason,
+        })
+        print(f"[auth] module.ready published (reason={reason})")
+
+    _has_registered = True
+
+
+async def _ws_connect(token: str, kernel_port: int, _t0: float):
+    global _ws_global, _kernel_port
+
+    _kernel_port = kernel_port
+    ws_url = f"ws://127.0.0.1:{kernel_port}/ws?id=auth"
+    print(f"[auth] Connecting to Kernel: {ws_url}")
+
+    async with websockets.connect(ws_url, open_timeout=5, ping_interval=None, close_timeout=10) as ws:
+        # 1. Auth（手动等待，不走 _rpc_call）
+        await ws.send(json.dumps({
+            "jsonrpc": "2.0", "id": "auth", "method": "auth",
+            "params": {"token": token}
+        }))
+        auth_resp = json.loads(await asyncio.wait_for(ws.recv(), timeout=5))
+        if "error" in auth_resp:
+            raise Exception(f"Auth failed: {auth_resp['error']}")
+
+        _ws_global = ws
+        print(f"[auth] Connected to Kernel ({_fmt_elapsed(_t0)})")
+
+        # 启动接收循环（后台任务），等待 system.require_init 触发 _do_init
+        receiver_task = asyncio.create_task(_ws_receiver(ws))
+
+        try:
+            # 等待接收循环结束（连接断开时自然退出）
+            await receiver_task
+        finally:
+            receiver_task.cancel()
+            # 断连清理 pending futures
+            for fut in _pending_rpc.values():
+                if not fut.done():
+                    fut.set_result({"error": {"code": -32001, "message": "Connection lost"}})
+            _pending_rpc.clear()
+
+
+async def _ws_receiver(ws):
+    """WebSocket 接收循环（后台任务）— 三路分发，检测 system.require_init"""
+    try:
+        async for raw in ws:
+            try:
+                msg = json.loads(raw)
+            except (json.JSONDecodeError, TypeError):
+                continue
+            try:
+                has_method = "method" in msg
+                has_id = "id" in msg
+                if has_method and not has_id:
+                    # 检测 system.require_init 事件
+                    params = msg.get("params", {})
+                    event_type = params.get("event", "")
+                    if event_type == "system.require_init":
+                        asyncio.create_task(_do_init(ws))
+                        continue
+                    asyncio.create_task(_handle_event_notification(msg))
+                elif has_method and has_id:
+                    asyncio.create_task(_handle_rpc_request(ws, msg))
+                elif not has_method and has_id:
+                    _handle_rpc_response(msg)
+            except Exception as e:
+                print(f"[auth] 消息处理异常（已忽略）: {e}")
+    except Exception as e:
+        if not _shutting_down:
+            print(f"[auth] Receive loop exited: {e}")
+
+
+# ── RPC call + event publish helpers ──
+
+async def _rpc_call(ws, method: str, params: dict = None,
+                    wait_response: bool = True, timeout: float = 3.0) -> dict:
+    """JSON-RPC 2.0 request。默认等待响应。"""
+    rpc_id = str(uuid.uuid4())
+    msg = {"jsonrpc": "2.0", "id": rpc_id, "method": method}
+    if params:
+        msg["params"] = params
+
+    if not wait_response:
+        await ws.send(json.dumps(msg))
+        return {}
+
+    future = asyncio.get_event_loop().create_future()
+    _pending_rpc[rpc_id] = future
+    await ws.send(json.dumps(msg))
+    try:
+        return await asyncio.wait_for(future, timeout=timeout)
+    except asyncio.TimeoutError:
+        _pending_rpc.pop(rpc_id, None)
+        return {"error": {"code": -32000, "message": f"RPC timeout: {method} ({timeout}s)"}}
+
+
+def _handle_rpc_response(msg: dict):
+    """Route JSON-RPC response to pending future."""
+    rpc_id = msg.get("id")
+    future = _pending_rpc.pop(rpc_id, None)
+    if future and not future.done():
+        future.set_result(msg)
+
+
+async def _publish_event(ws, event: str, data: dict = None):
+    """Publish event via event.publish RPC (fire-and-forget)."""
+    await _rpc_call(ws, "event.publish", {
+        "event_id": str(uuid.uuid4()),
+        "event": event,
+        "data": data or {},
+    }, wait_response=False)
+
+
+# ── Event + RPC handlers ──
+
+async def _handle_ping_event(data: dict):
+    if _ws_global:
+        await _publish_event(_ws_global, "system.pong", {
+            "module_id": MODULE_NAME, "ping_time": data.get("ping_time"), "pong_time": time.time(),
+        })
+
+
+async def _handle_event_notification(msg: dict):
+    params = msg.get("params", {})
+    event_type = params.get("event", "")
+    data = params.get("data", {})
+
+    if event_type == "system.ping":
+        await _handle_ping_event(data)
+        return
+
+    # 弹性连接 offer/release
+    if event_type == "system.connection.offer":
+        asyncio.create_task(_handle_connection_offer(data))
+        return
+    if event_type == "system.connection.release":
+        asyncio.create_task(_handle_connection_release(data))
+        return
+
+    if event_type == "module.shutdown":
+        target = data.get("module_id", "")
+        reason = data.get("reason", "")
+        if target == "auth" or not target or reason == "launcher_lost":
+            await _handle_shutdown()
+            return
+
+    if event_type in SYSTEM_BROADCAST_EVENTS:
+        return
+
+
+async def _handle_rpc_request(ws, msg: dict):
+    rpc_id = msg.get("id", "")
+    method = msg.get("method", "")
+    params = msg.get("params", {})
+
+    handlers = {
+        "verify": _rpc_verify,
+        "request_pairing_code": _rpc_request_pairing_code,
+        "send_sms_code": _rpc_send_sms_code,
+        "list_tokens": _rpc_list_tokens,
+        "revoke_token": _rpc_revoke_token,
+        "get_supported_methods": _rpc_get_supported_methods,
+        "get_pending_codes": _rpc_get_pending_codes,
+        "health": lambda p: _rpc_health(),
+        "status": lambda p: _rpc_status(),
+    }
+    handler = handlers.get(method)
+    if handler:
+        try:
+            result = await handler(params)
+            await ws.send(json.dumps({"jsonrpc": "2.0", "id": rpc_id, "result": result}))
+        except Exception as e:
+            await ws.send(json.dumps({
+                "jsonrpc": "2.0", "id": rpc_id,
+                "error": {"code": -32603, "message": str(e)},
+            }))
+    else:
+        await ws.send(json.dumps({
+            "jsonrpc": "2.0", "id": rpc_id,
+            "error": {"code": -32601, "message": f"Method not found: {method}"},
+        }))
+
+
+async def _rpc_health() -> dict:
+    return {"status": "healthy", "details": {"uptime_seconds": round(time.monotonic() - _start_ts)}}
+
+
+async def _rpc_status() -> dict:
+    return {"module": "auth", "status": "running", "uptime_seconds": round(time.monotonic() - _start_ts)}
+
+
+async def _handle_connection_offer(data):
+    """处理 Kernel 下发的 slot token，建立附加连接。"""
+    slots = data.get("slots", {})
+    for slot_str, info in slots.items():
+        slot = int(slot_str)
+        token = info.get("token", "")
+        if not token or slot in _extra_ws:
+            continue
+        asyncio.create_task(_connect_slot(slot, token))
+
+
+async def _connect_slot(slot, token):
+    """建立单个 slot 附加连接。"""
+    ws_url = f"ws://127.0.0.1:{_kernel_port}/ws"
+    try:
+        ws = await websockets.connect(ws_url, open_timeout=5, ping_interval=None, close_timeout=5)
+        auth_req = {"jsonrpc": "2.0", "id": f"auth-slot-{slot}", "method": "auth", "params": {"token": token}}
+        await ws.send(json.dumps(auth_req))
+        resp = json.loads(await asyncio.wait_for(ws.recv(), timeout=5))
+        if "error" in resp:
+            await ws.close()
+            return
+        _extra_ws[slot] = ws
+        _extra_ws_tasks[slot] = asyncio.create_task(_slot_recv_loop(slot, ws))
+        print(f"[auth] Slot {slot} connected")
+    except Exception as e:
+        print(f"[auth] Slot {slot} connect failed: {e}")
+
+
+async def _slot_recv_loop(slot, ws):
+    """附加连接的接收循环：与主连接平等处理所有消息。"""
+    try:
+        async for raw in ws:
+            try:
+                msg = json.loads(raw)
+            except (json.JSONDecodeError, TypeError):
+                continue
+            try:
+                has_method = "method" in msg
+                has_id = "id" in msg
+                if has_method and not has_id:
+                    asyncio.create_task(_handle_event_notification(msg))
+                elif has_method and has_id:
+                    asyncio.create_task(_handle_rpc_request(ws, msg))
+                elif not has_method and has_id:
+                    _handle_rpc_response(msg)
+            except Exception as e:
+                print(f"[auth] Slot {slot} 消息处理异常（已忽略）: {e}")
+    except Exception:
+        pass
+    finally:
+        _extra_ws.pop(slot, None)
+        _extra_ws_tasks.pop(slot, None)
+
+
+async def _handle_connection_release(data):
+    """Kernel 请求释放 slot，优雅关闭。"""
+    for slot in data.get("slots", []):
+        ws = _extra_ws.pop(slot, None)
+        task = _extra_ws_tasks.pop(slot, None)
+        if ws:
+            try:
+                await ws.close(code=1000, reason="release")
+            except Exception:
+                pass
+        if task:
+            task.cancel()
+
+
+async def _handle_shutdown():
+    global _shutting_down
+    print("[auth] Received shutdown request")
+    _shutting_down = True
+    await _publish_event(_ws_global, "module.shutdown.ack", {"module_id": "auth"})
+    await _publish_event(_ws_global, "module.exiting", {
+        "module_id": "auth", "type": "passive",
+        "reason": "shutdown_requested", "restart": "auto",
+        "action": "none", "timeout": 2.0, "restart_delay": 0.0,
+    })
+    # 关闭所有附加连接
+    for _s, _w in list(_extra_ws.items()):
+        try:
+            await _w.close(code=1000, reason="shutdown")
+        except Exception:
+            pass
+    for _t in _extra_ws_tasks.values():
+        _t.cancel()
+    _extra_ws.clear()
+    _extra_ws_tasks.clear()
+    await _publish_event(_ws_global, "module.shutdown.ready", {"module_id": "auth"})
+    print("[auth] Shutdown ready, exiting")
+    await asyncio.sleep(0.1)
+    if _ws_global:
+        try:
+            await _ws_global.close(code=1000, reason="Graceful shutdown")
+        except Exception:
+            pass
+
+
+# ── Startup ──
+
+
+
+def _init_logs_and_auth(log_base_dir: str = None, suffix: str = ""):
+    """初始化日志和认证组件（本地/远程共用）。"""
+    global _log_dir, _log_latest_path, _crash_log_path
+    global _pairing_verifier, _kite_token_verifier, _evol_account_verifier, _token_store
+
+    if log_base_dir:
+        _log_dir = os.path.join(log_base_dir, "log")
+        os.makedirs(_log_dir, exist_ok=True)
+        _log_latest_path = os.path.join(_log_dir, f"latest{suffix}.log")
+        try:
+            with open(_log_latest_path, "w", encoding="utf-8") as f: pass
+        except Exception: _log_latest_path = None
+        _crash_log_path = os.path.join(_log_dir, f"crashes{suffix}.jsonl")
+        try:
+            with open(_crash_log_path, "w", encoding="utf-8") as f: pass
+        except Exception: _crash_log_path = None
+        _resolve_daily_log_path()
+
+    _setup_exception_hooks()
+
+    # 初始化认证组件
+    module_data = os.environ.get("KITE_MODULE_DATA")
+    data_dir = os.path.join(module_data, "data") if module_data else os.path.join(os.path.dirname(os.path.abspath(__file__)), "data")
+    os.makedirs(data_dir, exist_ok=True)
+
+    from verifiers.pairing_code import PairingCodeVerifier
+    from verifiers.kite_token import KiteTokenVerifier
+    from verifiers.evol_account import EvolAccountVerifier
+    from token_store import TokenStore
+
+    _token_store = TokenStore(data_dir)
+    _pairing_verifier = PairingCodeVerifier()
+    _kite_token_verifier = KiteTokenVerifier(_token_store)
+    _evol_account_verifier = EvolAccountVerifier()
+    print(f"[auth] 认证组件初始化完成，数据目录: {data_dir}")
+
+
+def _run_local_mode(kernel_port: int):
+    """本地模式：从 stdin 读 boot_info，连接 Kernel。"""
+    module_data = os.environ.get("KITE_MODULE_DATA")
+    suffix = os.environ.get("KITE_INSTANCE_SUFFIX", "")
+    _init_logs_and_auth(log_base_dir=module_data, suffix=suffix)
+
+    _t0 = time.monotonic()
+    line = sys.stdin.readline().strip()
+    if not line:
+        print(f"[{MODULE_NAME}] ERROR: stdin closed"); sys.exit(1)
+    try: msg = json.loads(line)
+    except json.JSONDecodeError as e:
+        print(f"[{MODULE_NAME}] ERROR: Invalid JSON: {e}"); sys.exit(1)
+    if "error" in msg:
+        print(f"[{MODULE_NAME}] 启动失败: {msg.get('message')}"); sys.exit(1)
+    token = msg.get("token", "")
+    if not token:
+        print(f"[{MODULE_NAME}] ERROR: No token"); sys.exit(1)
+
+    print(f"[{MODULE_NAME}] Local mode: port={kernel_port}")
+    try:
+        asyncio.run(_ws_loop(token, kernel_port, _t0))
+    except (ConnectionRefusedError, ConnectionResetError, OSError) as e:
+        if isinstance(e, OSError) and getattr(e, 'winerror', None) != 1225 and not isinstance(e, (ConnectionRefusedError, ConnectionResetError)):
+            raise
+        print(f"[{MODULE_NAME}] Kernel 不可达，正常退出")
+        sys.exit(0)
+    except Exception as e:
+        _write_crash(type(e), e, e.__traceback__, severity="critical", handled=True)
+        _print_crash_summary(type(e), e.__traceback__)
+        sys.exit(1)
+    sys.exit(_exit_code)
+
+
+def _run_remote_mode(gateway_url: str):
+    """远程模式：通过 Gateway 连接 Kernel。"""
+    home = os.environ.get("HOME") or os.environ.get("USERPROFILE") or os.path.expanduser("~")
+    data_dir = os.path.join(home, ".kite", "remote", MODULE_NAME)
+    os.makedirs(data_dir, exist_ok=True)
+    _init_logs_and_auth(log_base_dir=data_dir)
+
+    _t0 = time.monotonic()
+    kite_token = _get_kite_token(MODULE_NAME, gateway_url)
+    print(f"[{MODULE_NAME}] Remote mode: gateway={gateway_url}")
+
+    try:
+        asyncio.run(_remote_ws_loop(gateway_url, kite_token, _t0))
+    except Exception as e:
+        _write_crash(type(e), e, e.__traceback__, severity="critical", handled=True)
+        _print_crash_summary(type(e), e.__traceback__)
+        sys.exit(1)
+    sys.exit(_exit_code)
+
+
+async def _remote_ws_loop(gateway_url: str, kite_token: str, _t0: float):
+    """远程模式重连循环。"""
+    global _shutting_down, _exit_code
+    retry_delay = 0.5
+    max_delay = 10.0
+
+    while not _shutting_down:
+        try:
+            await _remote_connect(gateway_url, kite_token, _t0)
+            retry_delay = 0.5
+        except asyncio.CancelledError:
+            return
+        except Exception as e:
+            if _shutting_down: return
+            _write_crash(type(e), e, e.__traceback__, severity="error", handled=True)
+            jitter = retry_delay * 0.2 * random.random()
+            print(f"[{MODULE_NAME}] 远程连接错误: {e}, {retry_delay + jitter:.1f}s 后重试")
+            await asyncio.sleep(retry_delay + jitter)
+            retry_delay = min(retry_delay * 2, max_delay)
+
+        _ws_global_clear()
+        if _shutting_down: return
+
+
+async def _remote_connect(gateway_url: str, kite_token: str, _t0: float):
+    """远程模式：连接 Gateway 并走认证+注册流程。"""
+    global _ws_global
+
+    print(f"[{MODULE_NAME}] Connecting to Gateway: {gateway_url}")
+    async with websockets.connect(gateway_url, open_timeout=10, ping_interval=None, close_timeout=10) as ws:
+        # 1. 接收 challenge
+        challenge = json.loads(await asyncio.wait_for(ws.recv(), timeout=10))
+        nonce = challenge.get("params", {}).get("nonce", "")
+
+        # 2. 发送 auth.connect
+        await ws.send(json.dumps({
+            "jsonrpc": "2.0", "id": "auth-connect",
+            "method": "auth.connect",
+            "params": {
+                "nonce": nonce,
+                "module_id": MODULE_NAME,
+                "auth": {"method": "kite_token", "token": kite_token},
+                "client": {"type": "module"}
+            }
+        }))
+
+        # 3. 等待认证响应
+        resp = json.loads(await asyncio.wait_for(ws.recv(), timeout=10))
+        if "error" in resp:
+            error = resp["error"]
+            code = error.get("code", 0)
+            if code in (4001, 4010, 4011):
+                _clear_token_cache(MODULE_NAME, gateway_url)
+                print(f"[{MODULE_NAME}] Token 无效，请重新配对")
+                sys.exit(1)
+            raise Exception(f"Gateway 认证失败: {error}")
+
+        _ws_global = ws
+        print(f"[{MODULE_NAME}] Connected via Gateway ({_fmt_elapsed(_t0)})")
+
+        # 启动接收循环，等待 system.require_init 触发 _do_init
+        receiver_task = asyncio.create_task(_ws_receiver(ws))
+
+        try:
+            # 等待接收循环结束
+            await receiver_task
+        finally:
+            receiver_task.cancel()
+            for fut in _pending_rpc.values():
+                if not fut.done():
+                    fut.set_result({"error": {"code": -32001, "message": "Connection lost"}})
+            _pending_rpc.clear()
+
+
+# ── Token 管理（远程模式）──
+
+def _gateway_to_filename(gateway_url: str) -> str:
+    try:
+        from urllib.parse import urlparse
+        parsed = urlparse(gateway_url)
+        host = parsed.hostname or "unknown"
+        port = parsed.port or (443 if parsed.scheme == "wss" else 80)
+        return f"{host}-{port}.json".replace(":", "-").replace("/", "-")
+    except Exception: return "default.json"
+
+def _load_token_cache(module_name: str, gateway_url: str) -> dict | None:
+    home = os.environ.get("HOME") or os.environ.get("USERPROFILE") or os.path.expanduser("~")
+    token_file = os.path.join(home, ".kite", "remote", module_name, "tokens", _gateway_to_filename(gateway_url))
+    if not os.path.exists(token_file): return None
+    try:
+        with open(token_file, "r") as f: return json.load(f)
+    except Exception: return None
+
+def _clear_token_cache(module_name: str, gateway_url: str):
+    home = os.environ.get("HOME") or os.environ.get("USERPROFILE") or os.path.expanduser("~")
+    token_file = os.path.join(home, ".kite", "remote", module_name, "tokens", _gateway_to_filename(gateway_url))
+    try: os.remove(token_file)
+    except Exception: pass
+
+def _get_kite_token(module_name: str, gateway_url: str) -> str:
+    token = os.environ.get("KITE_TOKEN")
+    if token: return token
+    cache = _load_token_cache(module_name, gateway_url)
+    if cache: return cache["token"]
+    print(f"[{module_name}] No token for {gateway_url}")
+    print(f"  export KITE_TOKEN=<token>")
+    sys.exit(1)
+
+
+if __name__ == "__main__":
+    kernel_port = os.environ.get("KITE_KERNEL_PORT")
+    if kernel_port:
+        _run_local_mode(int(kernel_port))
+    else:
+        config = _load_module_config()
+        gateway_url = config.get("gateway_url") or os.environ.get("KITE_GATEWAY_URL")
+        if gateway_url:
+            _run_remote_mode(gateway_url)
+        else:
+            print(f"[{MODULE_NAME}] ERROR: No KITE_KERNEL_PORT and no gateway_url")
+            sys.exit(1)