@cjhyy/code-shell-server 0.9.22 → 0.9.25

package/README.md

@@ -12,6 +12,8 @@ CodeShell 服务端传输与管理服务（纯 Node、零 Electron）：mobile r
 | ---------------------------------------- | ----------------------------------------------------------------- |
 | `@cjhyy/code-shell-server/storage`       | 磁盘 Session、附件暂存、图片探测和稳定 client-message ID          |
 | `@cjhyy/code-shell-server/worker`        | 与传输无关的 stdio worker 生命周期和行协议桥接                    |
+| `@cjhyy/code-shell-server/auth`          | 独立服务可复用的单 owner HTTP 初始化、登录及会话撤销              |
+| `@cjhyy/code-shell-server/remote-relay`  | 设备出站 WSS 连接器、固定回环目标、受限二进制字节流与 v1 协议     |
 | `@cjhyy/code-shell-server/mobile-remote` | 配对、访问门禁、rooms、上传、LAN/tunnel host 和移动端协议类型     |
 | `@cjhyy/code-shell-server/serve`         | Headless HTTP/WebSocket host 与 `code-shell-serve` CLI 组合默认值 |
 | `@cjhyy/code-shell-server/desktop-web`   | 设备配对换 Cookie、已知 Workspace 校验与共享管理 HTTP API         |
@@ -24,7 +26,7 @@ import { WorkerBridgeCore } from "@cjhyy/code-shell-server/worker";
 ```
 
 包根入口保留 storage、worker、mobile-remote、serve 和 desktop-web 的兼容导出；
-Link 使用独立 `/links` 入口。新消费方应避免根入口，以免只使用 storage
+Link 和独立服务认证分别使用 `/links`、`/auth` 入口。新消费方应避免根入口，以免只使用 storage
 或 transport 时也求值无关的宿主组合。
 
 `/storage`、`/worker` 和 `/mobile-remote` 没有 Coding/Web 静态导入。外部
@@ -32,6 +34,39 @@ Agent 策略由产品宿主通过 `ResidentAgentOptions.appendSystemPrompt` 注
 `/serve` 则是有意保留的开箱即用产品入口：CLI 被调用时解析 Coding stdio
 worker 和已构建的 Web app。
 
+电脑出站中继使用 `/remote-relay`。先以 `mode: "relay"` 启动已配置访问口令的
+`RemoteHostManager`，再把 `host.relayTarget()` 交给连接器；该能力在 Host 停止时立即
+撤销，不能继续暴露复用原端口的其他服务。协议、生命周期和真实网络测试范围见
+[设备中继说明](../../docs/device-relay.md)。桌面登记设置和物理手机验收仍是后续工作。
+
+`MobileUploadService.revokeDevice(deviceId)` 同步禁止该设备的新票据和领取操作，
+中止尚未被任务认领的上传，并返回可等待的临时文件清理结果。`RemoteHostManager`
+的同名方法会调用它、报告异步清理错误；`stop()` 会等待清理完成。已被任务认领的
+附件保留至原持有者 `finalize` 或 `release`；撤销后的 `release` 不会重新开放票据。
+自定义 `uploads` 适配器也必须实现这项设备级撤销。其他设备的上传不受影响。
+
+## 独立服务的单 owner 认证
+
+`/auth` 直接复用 Hub 的认证实现，运行时仅导出 `createHubAuth` 和
+`HUB_SESSION_COOKIE`，同时提供 `HubAuth`、`HubAuthOptions`、`HubSession` 类型。
+它不会创建 HTTP listener、Worker、项目或设备中继，也不提供多租户身份体系。
+
+宿主通过 `createHubAuth({ dataDir, publicOrigin, onRevoke })` 创建认证服务，先将请求
+交给 `auth.handle(request, response)` 处理现有 `/api/v1/auth/*` 端点。其他受保护
+路由必须同时检查 `auth.isOriginAllowed(request)` 和 `await auth.authenticate(request)`；
+认证成功本身不授予文件、工具或手机配对权限。
+
+`publicOrigin` 是部署者配置的可信根 Origin，公网必须使用 HTTPS，不能从请求的
+转发头推导。`dataDir` 保存单 owner 账号和会话；首次返回的 `bootstrapToken` 应交给
+管理员私密保存，不能记录到公共日志。`onRevoke(sessionId)` 用于同步撤销宿主持有的
+连接，长期连接还应重新检查会话有效性；Cookie/令牌只能用于本服务。
+多个独立认证服务应使用不同主机名和数据目录；Cookie 不按端口隔离，只更换监听
+端口不能隔离浏览器登录。
+
+`HubAuth.store` 保留原有返回类型，供宿主检查活动会话；本入口不额外导出 store
+构造器或令牌解析工具。`bun run test:package-release` 会从实际 tarball 的公开入口
+检查严格 NodeNext 类型，并用原生 Node HTTP 验证初始化、登录、Origin、撤销和重载。
+
 ## 两种宿主，共用浏览器工作台
 
 `packages/web/app/Workbench.tsx` 组合对话、模型、Skills、MCP、历史、文件及 Link 页面。
@@ -44,6 +79,10 @@ Desktop Web 不会创建第二个 Hub Worker，也不需要再建 Hub 管理员
 `hub/` 与 `/links` 实现。Electron 原生 renderer 仍使用原来的 IPC。
 具体文件与环境差异见 [共享 Web 工作台](../../docs/todo/shared-web-workbench.md)。
 
+Desktop Web 和 Hub 在注销或显式撤销会话时，会关闭该会话尚未完成的受保护 HTTP
+响应，包括正在下载的文件，并停止源文件读取、释放句柄。其他会话的下载不受影响；
+已经返回接受结果的后台任务仍由原来的任务生命周期管理。注销请求本身仍返回成功。
+
 ## code-shell-serve — 个人 Hub Web host
 
 在任意机器上把一个 workspace 变成浏览器可访问的 CodeShell：
@@ -138,3 +177,8 @@ Docker 部署到其他机器见 [Docker 部署说明](../../docs/docker-deployme
 更新 Hub 后需重建并重启服务。Desktop Web 的入口构建到 `packages/desktop/out/mobile`，
 还依赖新的主进程 HTTP 接线，因此必须重新构建 Desktop 并重启应用；只更新 Hub 的 `dist-app`
 或刷新旧桌面的浏览器页面不会完成升级。
+
+The focused `/remote-relay` entry also exposes `environmentIdentity(dataDir)` so
+desktop enrollment uses the same stable identity as its Web descriptor. It is not
+added to the root entry. `DeviceRelayState` includes terminal `unauthorized` for
+TLS-verified 401/403 control handshakes; temporary failures continue reconnecting.

package/dist/bin/code-shell-settings-recovery.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin/code-shell-settings-recovery.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+// Offline administrator entry: no HTTP listener, worker or TUI bootstrap.
+import { runSettingsRecoveryCli } from "../serve/settings-recovery-cli.js";
+process.exitCode = await runSettingsRecoveryCli();

package/dist/desktop-web/http-api.js

@@ -1,3 +1,4 @@
+import { describeEnvironment, environmentIdentity } from "../environment-identity.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { isAbsolute } from "node:path";
 import { createHubConfiguration, HubConfigurationError } from "../hub/configuration.js";
@@ -5,6 +6,7 @@ import { createHubFiles } from "../hub/files.js";
 import { createHubMcpConfiguration } from "../hub/mcp-configuration.js";
 import { createHubSessions } from "../hub/session-management.js";
 import { createHubSkills } from "../hub/skills-management.js";
+import { createSessionHttpResponses } from "../session-http-responses.js";
 const COOKIE = "cs_desktop_session";
 const SESSION_TTL = 30 * 60_000;
 const MAX_SESSIONS = 512;
@@ -109,11 +111,13 @@ export function createDesktopWebApi(options) {
     if (!Number.isSafeInteger(ttl) || ttl < 1000 || ttl > 24 * 60 * 60_000)
         throw new Error("Desktop HTTP session lifetime must be between one second and one day");
     const sessions = new Map();
+    const responses = createSessionHttpResponses();
     const identities = new WeakMap();
     const workspaces = new Map();
     let generation = 0;
     let closed = false;
     function cancelSession(session) {
+        responses.cancelOwner(session.id);
         for (const services of workspaces.values()) {
             services.configuration.cancelOwner(session.id);
             services.mcp.cancelOwner(session.id);
@@ -336,6 +340,16 @@ export function createDesktopWebApi(options) {
                 }
                 if (!current || !token)
                     throw new HubConfigurationError(401, "设备连接已失效，请重新连接桌面。");
+                responses.track(current.session.id, response);
+                if (url.pathname === "/api/v1/environment" && request.method === "GET") {
+                    const id = await environmentIdentity(options.dataDir);
+                    if (closed ||
+                        generation !== requestGeneration ||
+                        principal(token)?.session !== current.session)
+                        throw new HubConfigurationError(401, "设备连接已失效，请重新连接桌面。");
+                    json(response, 200, describeEnvironment(id, "desktop"));
+                    return true;
+                }
                 const input = workspaceInput(request, url);
                 const cwd = await options.resolveWorkspace(input, current.device.id);
                 if (closed ||

package/dist/environment-identity.d.ts

@@ -0,0 +1,4 @@
+import type { EnvironmentDescriptor } from "@cjhyy/code-shell-web";
+/** Publish once, atomically. Never silently replace a corrupt identity or adopt a symlink. */
+export declare function environmentIdentity(dataDir: string): Promise<string>;
+export declare function describeEnvironment(id: string, kind: EnvironmentDescriptor["kind"]): EnvironmentDescriptor;

package/dist/environment-identity.js

@@ -0,0 +1,67 @@
+import { randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { link, lstat, mkdir, open, rm } from "node:fs/promises";
+import { join } from "node:path";
+const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
+/** Publish once, atomically. Never silently replace a corrupt identity or adopt a symlink. */
+export async function environmentIdentity(dataDir) {
+    await mkdir(dataDir, { recursive: true, mode: 0o700 });
+    const path = join(dataDir, "environment.json");
+    try {
+        await lstat(path);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        const temporary = join(dataDir, `.environment-${randomUUID()}.tmp`);
+        const file = await open(temporary, "wx", 0o600);
+        try {
+            await file.writeFile(JSON.stringify({ version: 1, id: randomUUID() }));
+            await file.sync();
+            await file.close();
+            try {
+                await link(temporary, path);
+            }
+            catch (cause) {
+                if (cause.code !== "EEXIST")
+                    throw cause;
+            }
+        }
+        finally {
+            await file.close().catch(() => { });
+            await rm(temporary, { force: true });
+        }
+    }
+    const metadata = await lstat(path);
+    if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > 256)
+        throw new Error("Invalid environment identity file");
+    const file = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        const actual = await file.stat();
+        if (!actual.isFile() ||
+            actual.size > 256 ||
+            actual.ino !== metadata.ino ||
+            actual.dev !== metadata.dev)
+            throw new Error("Environment identity changed while opening");
+        const bytes = Buffer.alloc(257);
+        const { bytesRead } = await file.read(bytes, 0, bytes.length, 0);
+        if (bytesRead > 256)
+            throw new Error("Environment identity exceeds size limit");
+        const value = JSON.parse(bytes.subarray(0, bytesRead).toString("utf8"));
+        if (value?.version !== 1 || typeof value.id !== "string" || !UUID.test(value.id))
+            throw new Error("Invalid environment identity");
+        return value.id;
+    }
+    finally {
+        await file.close();
+    }
+}
+export function describeEnvironment(id, kind) {
+    return {
+        version: 1,
+        id,
+        name: kind === "desktop" ? "我的电脑" : kind === "project-host" ? "云端项目" : "Hub 工作台",
+        kind,
+        entryPath: kind === "desktop" ? "/mobile" : "/",
+    };
+}

package/dist/hub/auth-store.d.ts

@@ -41,6 +41,8 @@ export declare class HubAuthStore {
     login(input: HubLoginInput, replaceToken?: string): Promise<HubSessionGrant>;
     authenticate(token: string | undefined): HubSession | null;
     listSessions(): HubSession[];
+    /** Offline restore must not resurrect sessions revoked after the snapshot. */
+    revokeAllSessions(): void;
     revoke(id: string): boolean;
     private checkBootstrap;
     private grant;

package/dist/hub/auth-store.js

@@ -115,6 +115,13 @@ export class HubAuthStore {
             .map((session) => this.toPublic(record, session))
             .sort((a, b) => b.lastSeenAt - a.lastSeenAt);
     }
+    /** Offline restore must not resurrect sessions revoked after the snapshot. */
+    revokeAllSessions() {
+        this.mutate((record) => {
+            record.sessions = [];
+            return { result: undefined, changed: true };
+        });
+    }
     revoke(id) {
         return this.mutate((record) => {
             const index = record.sessions.findIndex((session) => session.id === id);

package/dist/index.auth.d.ts

@@ -0,0 +1,3 @@
+/** Single-owner HTTP authentication for trusted service compositions; no worker is started. */
+export { createHubAuth, HUB_SESSION_COOKIE, type HubAuth, type HubAuthOptions, } from "./hub/auth-http.js";
+export type { HubSession } from "./hub/auth-store.js";

package/dist/index.auth.js

@@ -0,0 +1,2 @@
+/** Single-owner HTTP authentication for trusted service compositions; no worker is started. */
+export { createHubAuth, HUB_SESSION_COOKIE, } from "./hub/auth-http.js";

package/dist/index.links.d.ts

@@ -4,3 +4,4 @@ export * from "./links/device-oauth.js";
 export * from "./links/service.js";
 export * from "./links/types.js";
 export * from "./links/http.js";
+export * from "./links/remote-configuration.js";

package/dist/index.links.js

@@ -4,3 +4,4 @@ export * from "./links/device-oauth.js";
 export * from "./links/service.js";
 export * from "./links/types.js";
 export * from "./links/http.js";
+export * from "./links/remote-configuration.js";

package/dist/index.panels.d.ts

@@ -1,4 +1,6 @@
 export { createPanelHttp } from "./panels/http.js";
+export * from "./panels/automations.js";
+export * from "./panels/hub-automations.js";
 export { createPanelManagement, PanelManagementError } from "./panels/management.js";
 export { createPanelRuntime, panelWebCompatibility } from "./panels/runtime.js";
 export { PanelRuntimeServices } from "./panels/runtime-services.js";
@@ -16,3 +18,8 @@ export * from "./panels/connections.js";
 export * from "./panels/tool-jobs.js";
 export * from "./panels/tool-executor.js";
 export * from "./panels/directory-bookmarks.js";
+export * from "./panels/shared-tool-jobs.js";
+export * from "./panels/task-cookies.js";
+export * from "./panels/task-cookie-host.js";
+export * from "./panels/execution-gate.js";
+export * from "./panels/package-mutation.js";

package/dist/index.panels.js

@@ -1,4 +1,6 @@
 export { createPanelHttp } from "./panels/http.js";
+export * from "./panels/automations.js";
+export * from "./panels/hub-automations.js";
 export { createPanelManagement, PanelManagementError } from "./panels/management.js";
 export { createPanelRuntime, panelWebCompatibility } from "./panels/runtime.js";
 export { PanelRuntimeServices } from "./panels/runtime-services.js";
@@ -15,3 +17,8 @@ export * from "./panels/connections.js";
 export * from "./panels/tool-jobs.js";
 export * from "./panels/tool-executor.js";
 export * from "./panels/directory-bookmarks.js";
+export * from "./panels/shared-tool-jobs.js";
+export * from "./panels/task-cookies.js";
+export * from "./panels/task-cookie-host.js";
+export * from "./panels/execution-gate.js";
+export * from "./panels/package-mutation.js";

package/dist/index.remote-relay.d.ts

@@ -0,0 +1,5 @@
+/** Authenticated outbound device transport. Does not replace phone authorization. */
+export * from "./remote-relay/protocol.js";
+export * from "./remote-relay/byte-stream.js";
+export * from "./remote-relay/connector.js";
+export { environmentIdentity } from "./environment-identity.js";

package/dist/index.remote-relay.js

@@ -0,0 +1,6 @@
+/** Authenticated outbound device transport. Does not replace phone authorization. */
+export * from "./remote-relay/protocol.js";
+export * from "./remote-relay/byte-stream.js";
+export * from "./remote-relay/connector.js";
+// Enrollment must use the same persisted identity as the Host's Web descriptor.
+export { environmentIdentity } from "./environment-identity.js";

package/dist/index.serve.d.ts

@@ -2,3 +2,5 @@
 export * from "./serve/headless-server.js";
 export { startProjectControlServer, type ProjectControlServerOptions, } from "./project-runtime/control-server.js";
 export { parseServeArgs, resolveWebAppRoot, resolveWorkerCapabilityModules, resolveWorkerEntry, runServeCli, } from "./serve/cli.js";
+export { backupProjectInstallation, restoreProjectInstallation, type ProjectBackupOptions, type ProjectRestoreOptions, } from "./project-runtime/backup.js";
+export { readProjectSeccompProfile, type ProjectSeccompProfile, } from "./project-runtime/seccomp.js";

package/dist/index.serve.js

@@ -2,3 +2,5 @@
 export * from "./serve/headless-server.js";
 export { startProjectControlServer, } from "./project-runtime/control-server.js";
 export { parseServeArgs, resolveWebAppRoot, resolveWorkerCapabilityModules, resolveWorkerEntry, runServeCli, } from "./serve/cli.js";
+export { backupProjectInstallation, restoreProjectInstallation, } from "./project-runtime/backup.js";
+export { readProjectSeccompProfile, } from "./project-runtime/seccomp.js";

package/dist/links/http.d.ts

@@ -23,6 +23,9 @@ export declare function createLinkHttp(options: LinkHttpOptions): {
         rename: (context: LinkOperationContext, id: string, label: string, expectedRevision: string) => Promise<import("@cjhyy/code-shell-link").MaskedLinkConnection>;
         disconnect: (context: LinkOperationContext, id: string, expectedRevision: string) => Promise<void>;
         startDeviceAuth: (context: LinkOperationContext, input: LinkConnectionInput) => Promise<import("@cjhyy/code-shell-link").LinkAuthorization>;
+        startRemoteAuth: (context: LinkOperationContext, input: LinkConnectionInput) => Promise<import("@cjhyy/code-shell-link").LinkAuthorization>;
+        completeRemoteAuth: (context: LinkOperationContext, id: string, callbackUrl: string) => Promise<import("@cjhyy/code-shell-link").LinkAuthorization>;
+        retryRemoteCleanup: () => Promise<void>;
         authorization: (context: LinkOperationContext, id: string) => Promise<import("@cjhyy/code-shell-link").LinkAuthorization>;
         cancelAuthorization: (context: LinkOperationContext, id: string) => Promise<void>;
         cancelOwner: (ownerId: string) => void;

package/dist/links/http.js

@@ -80,8 +80,14 @@ export function createLinkHttp(options) {
                 else {
                     const cli = /^\/api\/v1\/links\/providers\/([^/]+)\/cli$/.exec(url.pathname);
                     const connection = /^\/api\/v1\/links\/connections\/([^/]+)$/.exec(url.pathname);
+                    const remoteComplete = /^\/api\/v1\/links\/authorizations\/([^/]+)\/complete$/.exec(url.pathname);
                     const authorization = /^\/api\/v1\/links\/authorizations\/([^/]+)$/.exec(url.pathname);
-                    if (cli && method === "GET")
+                    if (remoteComplete && method === "POST") {
+                        const input = await body(request);
+                        fields(input, ["callbackUrl"]);
+                        result = await service.completeRemoteAuth(owner, decodeURIComponent(remoteComplete[1]), input.callbackUrl);
+                    }
+                    else if (cli && method === "GET")
                         result = await service.cliStatus(owner, decodeURIComponent(cli[1]));
                     else if (authorization && method === "GET")
                         result = await service.authorization(owner, decodeURIComponent(authorization[1]));
@@ -94,6 +100,7 @@ export function createLinkHttp(options) {
                             ROOT + "/connections/token",
                             ROOT + "/connections/cli",
                             ROOT + "/authorizations/device",
+                            ROOT + "/authorizations/remote",
                         ].includes(url.pathname)) {
                         const input = await body(request);
                         const token = url.pathname.endsWith("/token");
@@ -109,7 +116,9 @@ export function createLinkHttp(options) {
                             ? await service.connectToken(owner, input)
                             : url.pathname.endsWith("/cli")
                                 ? await service.connectCli(owner, input)
-                                : await service.startDeviceAuth(owner, input);
+                                : url.pathname.endsWith("/remote")
+                                    ? await service.startRemoteAuth(owner, input)
+                                    : await service.startDeviceAuth(owner, input);
                     }
                     else if (connection && (method === "PATCH" || method === "DELETE")) {
                         const input = await body(request);

package/dist/links/remote-configuration.d.ts

@@ -0,0 +1,4 @@
+import { type RemoteLinkConfiguration } from "@cjhyy/code-shell-core";
+/** Validate trusted deployment input without echoing credentials in startup errors. */
+export declare function remoteLinkHostConfiguration(input: RemoteLinkConfiguration | undefined, publicOrigin: string | undefined, callbackPath?: "/link/callback" | "/mobile/link/callback"): RemoteLinkConfiguration | undefined;
+export declare function remoteLinkFromEnvironment(env: NodeJS.ProcessEnv, publicOrigin: string | undefined, callbackPath?: "/link/callback" | "/mobile/link/callback"): RemoteLinkConfiguration | undefined;

package/dist/links/remote-configuration.js

@@ -0,0 +1,32 @@
+import { beginRemoteLinkAuthorization } from "@cjhyy/code-shell-core";
+/** Validate trusted deployment input without echoing credentials in startup errors. */
+export function remoteLinkHostConfiguration(input, publicOrigin, callbackPath = "/link/callback") {
+    if (input === undefined)
+        return undefined;
+    try {
+        if (!["/link/callback", "/mobile/link/callback"].includes(callbackPath))
+            throw new Error("path");
+        if (!publicOrigin || new URL(publicOrigin).origin !== publicOrigin)
+            throw new Error("origin");
+        const config = beginRemoteLinkAuthorization(input).configuration;
+        if (config.redirectUri !== `${publicOrigin}${callbackPath}`)
+            throw new Error("callback");
+        return Object.freeze(config);
+    }
+    catch {
+        throw new Error("Remote Link requires a valid service, client ID and the exact public Link callback URL.");
+    }
+}
+export function remoteLinkFromEnvironment(env, publicOrigin, callbackPath = "/link/callback") {
+    const issuer = env.CODE_SHELL_REMOTE_LINK_ISSUER;
+    const clientId = env.CODE_SHELL_REMOTE_LINK_CLIENT_ID;
+    const clientSecret = env.CODE_SHELL_REMOTE_LINK_CLIENT_SECRET;
+    if (!issuer && !clientId && !clientSecret)
+        return undefined;
+    return remoteLinkHostConfiguration({
+        issuer: issuer ?? "",
+        clientId: clientId ?? "",
+        redirectUri: `${publicOrigin}${callbackPath}`,
+        ...(clientSecret ? { clientSecret } : {}),
+    }, publicOrigin, callbackPath);
+}

package/dist/links/service.d.ts

@@ -1,4 +1,4 @@
-import { CredentialStore, connectCliLink, getCliLinkStatus, validateLocalLinkToken, type LocalLinkValidationResult } from "@cjhyy/code-shell-core";
+import { CredentialStore, type RemoteLinkConfiguration, connectCliLink, getCliLinkStatus, validateLocalLinkToken, type LocalLinkValidationResult } from "@cjhyy/code-shell-core";
 import { LinkDeviceOAuthBroker, type LocalBrowserAuthToken } from "./device-oauth.js";
 import type { LinkAuthorization, LinkConnectionInput, LinkErrorCode, LinkOperationContext, LinkSnapshot, MaskedLinkConnection, TokenConnectionInput } from "./types.js";
 export declare class LinkServiceError extends Error {
@@ -13,6 +13,8 @@ export interface LinkServiceOptions {
     withMutation?: <T>(write: () => Promise<T>) => Promise<T>;
     onChanged?: () => void | Promise<void>;
     now?: () => number;
+    /** Trusted Host configuration; never accepted from a browser request. */
+    remoteLink?: () => RemoteLinkConfiguration | undefined;
     /** Test seams. Production delegates to Core's fixed provider and CLI executors. */
     validateToken?: typeof validateLocalLinkToken;
     cliStatus?: typeof getCliLinkStatus;
@@ -46,6 +48,9 @@ export declare function createLinkService(options?: LinkServiceOptions): {
     rename: (context: LinkOperationContext, id: string, label: string, expectedRevision: string) => Promise<MaskedLinkConnection>;
     disconnect: (context: LinkOperationContext, id: string, expectedRevision: string) => Promise<void>;
     startDeviceAuth: (context: LinkOperationContext, input: LinkConnectionInput) => Promise<LinkAuthorization>;
+    startRemoteAuth: (context: LinkOperationContext, input: LinkConnectionInput) => Promise<LinkAuthorization>;
+    completeRemoteAuth: (context: LinkOperationContext, id: string, callbackUrl: string) => Promise<LinkAuthorization>;
+    retryRemoteCleanup: () => Promise<void>;
     authorization: (context: LinkOperationContext, id: string) => Promise<LinkAuthorization>;
     cancelAuthorization: (context: LinkOperationContext, id: string) => Promise<void>;
     cancelOwner: (ownerId: string) => void;