@orion-agents/orion-code 0.1.4 → 0.1.6

package/dist/services/auth/auth.js

@@ -10,9 +10,19 @@ exports.getAuthService = getAuthService;
 exports.resetAuthService = resetAuthService;
 exports.getSecureStorage = getSecureStorage;
 const fs_1 = require("fs");
+const crypto_1 = require("crypto");
 const path_1 = require("path");
 const config_dir_1 = require("../config-dir");
+const atomic_write_1 = require("../atomic-write");
 const debug_log_1 = require("../../utils/debug-log");
+/**
+ * Credential files are the least recoverable state Orion Code owns: a torn
+ * write makes `JSON.parse` fail, and the loaders fall back to `{}`, which
+ * silently logs the user out and drops every stored secret. Write them via
+ * temp-file + rename with an fsync, so a crash leaves either the previous file
+ * or the complete new one.
+ */
+const CREDENTIAL_WRITE_OPTS = { mode: 0o600, fsync: true };
 // ============================================================================
 // Auth Service
 // ============================================================================
@@ -46,9 +56,8 @@ class AuthService {
      * 保存认证配置
      */
     save() {
-        (0, fs_1.writeFileSync)(this.configPath, JSON.stringify(this.config, null, 2), {
-            mode: 0o600, // 仅用户可读写
-        });
+        (0, atomic_write_1.atomicWriteFileSync)(this.configPath, JSON.stringify(this.config, null, 2), CREDENTIAL_WRITE_OPTS // 0600，仅用户可读写；原子写避免半截文件
+        );
     }
     /**
      * 设置 API Key
@@ -152,26 +161,111 @@ class AuthService {
 }
 exports.AuthService = AuthService;
 // ============================================================================
-// Secure Storage (macOS Keychain)
+// Encrypted-at-rest credential storage
 // ============================================================================
 /**
- * macOS Keychain 安全存储
- * 注意：这是简化实现，实际需要调用 security 命令
+ * Encrypted credential store (AES-256-GCM).
+ *
+ * The previous "SecureStorage" wrote credentials to `secure.json` in *plain
+ * text*, which is a confidentiality hole: a backup, a stray `cat`, or a leaked
+ * dotfile sync exposes every stored secret. Plaintext is never written to disk
+ * now — the credential map is sealed with AES-256-GCM before it touches the
+ * filesystem.
+ *
+ * Key management: a 256-bit key is generated once per config directory and kept
+ * in `secure.key` (mode 0600, alongside `secure.json`). This makes `secure.json`
+ * useless on its own (the realistic leak/backup scenario) — it cannot be
+ * decrypted without `secure.key`. The key file itself is not secret against an
+ * attacker who already owns the machine, so the strong option remains a real OS
+ * keychain (macOS Keychain / libsecret); this implementation is the portable,
+ * dependency-free improvement that closes the plaintext exposure (issue #66).
  */
+const SECURE_KEY_FILE = 'secure.key';
+const SECURE_DATA_FILE = 'secure.json';
+const KEY_BYTES = 32;
+function secureKeyPath() {
+    return (0, path_1.join)((0, config_dir_1.getConfigDir)(), SECURE_KEY_FILE);
+}
+function loadOrCreateKey() {
+    const keyPath = secureKeyPath();
+    if ((0, fs_1.existsSync)(keyPath)) {
+        return (0, fs_1.readFileSync)(keyPath);
+    }
+    const key = (0, crypto_1.randomBytes)(KEY_BYTES);
+    // Generated once; atomicity is not critical here. Keep it 0600 so it is not
+    // world-readable like a stray file might be.
+    (0, fs_1.writeFileSync)(keyPath, key, { mode: 0o600 });
+    return key;
+}
+function encryptMap(plain, key) {
+    const iv = (0, crypto_1.randomBytes)(12);
+    const cipher = (0, crypto_1.createCipheriv)('aes-256-gcm', key, iv);
+    const ciphertext = Buffer.concat([
+        cipher.update(JSON.stringify(plain), 'utf-8'),
+        cipher.final(),
+    ]);
+    const blob = {
+        v: 1,
+        iv: iv.toString('base64'),
+        tag: cipher.getAuthTag().toString('base64'),
+        data: ciphertext.toString('base64'),
+    };
+    return JSON.stringify(blob);
+}
+function decryptMap(blob, key) {
+    try {
+        const parsed = JSON.parse(blob);
+        if (parsed.v !== 1)
+            return null;
+        const decipher = (0, crypto_1.createDecipheriv)('aes-256-gcm', key, Buffer.from(parsed.iv, 'base64'));
+        decipher.setAuthTag(Buffer.from(parsed.tag, 'base64'));
+        const plaintext = Buffer.concat([
+            decipher.update(Buffer.from(parsed.data, 'base64')),
+            decipher.final(),
+        ]).toString('utf-8');
+        return JSON.parse(plaintext);
+    }
+    catch {
+        // A corrupt or tampered blob is indistinguishable from "no credentials"
+        // to the caller, which is the confusing case — log it upstream.
+        return null;
+    }
+}
+function readCredentialMap() {
+    const storagePath = (0, path_1.join)((0, config_dir_1.getConfigDir)(), SECURE_DATA_FILE);
+    if (!(0, fs_1.existsSync)(storagePath)) {
+        // No file yet: a fresh, empty map. Storing/deleting is safe to proceed.
+        return {};
+    }
+    const key = loadOrCreateKey();
+    const map = decryptMap((0, fs_1.readFileSync)(storagePath, 'utf-8'), key);
+    if (map === null) {
+        // The file exists but cannot be decrypted (corrupt/tampered/wrong key).
+        // Distinguish this from "no credentials": if we returned {} here, store()
+        // and delete() would silently overwrite the file with an empty map and
+        // wipe every credential we couldn't read. Instead, surface the failure so
+        // the caller's try/catch returns false (safe failure) rather than erasing
+        // data. retrieve() still returns null, which is the correct "can't read".
+        throw new Error('secure storage file exists but is corrupt or unreadable');
+    }
+    return map;
+}
+function writeCredentialMap(map) {
+    const storagePath = (0, path_1.join)((0, config_dir_1.getConfigDir)(), SECURE_DATA_FILE);
+    const key = loadOrCreateKey();
+    // Read-modify-write over the whole file: a torn write here loses *every*
+    // stored secret, not just the one being added.
+    (0, atomic_write_1.atomicWriteFileSync)(storagePath, encryptMap(map, key), CREDENTIAL_WRITE_OPTS);
+}
 class SecureStorage {
     /**
-     * 存储到 Keychain
+     * Store a credential, encrypted at rest.
      */
     async store(service, account, password) {
-        // macOS: security add-generic-password
         try {
-            // 简化实现：存储到加密文件
-            const storagePath = (0, path_1.join)((0, config_dir_1.getConfigDir)(), 'secure.json');
-            const content = (0, fs_1.existsSync)(storagePath)
-                ? JSON.parse((0, fs_1.readFileSync)(storagePath, 'utf-8'))
-                : {};
-            content[`${service}:${account}`] = password;
-            (0, fs_1.writeFileSync)(storagePath, JSON.stringify(content), { mode: 0o600 });
+            const map = readCredentialMap();
+            map[`${service}:${account}`] = password;
+            writeCredentialMap(map);
             return true;
         }
         catch (error) {
@@ -182,36 +276,28 @@ class SecureStorage {
         }
     }
     /**
-     * 从 Keychain 获取
+     * Retrieve a credential (decrypted from disk).
      */
     async retrieve(service, account) {
         try {
-            const storagePath = (0, path_1.join)((0, config_dir_1.getConfigDir)(), 'secure.json');
-            if (!(0, fs_1.existsSync)(storagePath)) {
-                return null;
-            }
-            const content = JSON.parse((0, fs_1.readFileSync)(storagePath, 'utf-8'));
-            return content[`${service}:${account}`] || null;
+            const map = readCredentialMap();
+            return map[`${service}:${account}`] ?? null;
         }
         catch (error) {
-            // A parse failure here is indistinguishable from "no credential
+            // A parse/decrypt failure here is indistinguishable from "no credential
             // stored" to the caller, which is exactly the confusing case.
             (0, debug_log_1.debugError)('auth.retrieve', error, `${service}:${account}`);
             return null;
         }
     }
     /**
-     * 从 Keychain 删除
+     * Delete a credential.
      */
     async delete(service, account) {
         try {
-            const storagePath = (0, path_1.join)((0, config_dir_1.getConfigDir)(), 'secure.json');
-            if (!(0, fs_1.existsSync)(storagePath)) {
-                return true;
-            }
-            const content = JSON.parse((0, fs_1.readFileSync)(storagePath, 'utf-8'));
-            delete content[`${service}:${account}`];
-            (0, fs_1.writeFileSync)(storagePath, JSON.stringify(content), { mode: 0o600 });
+            const map = readCredentialMap();
+            delete map[`${service}:${account}`];
+            writeCredentialMap(map);
             return true;
         }
         catch (error) {

package/dist/services/auth/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/services/auth/auth.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAmTH,wCAKC;AAED,4CAEC;AAID,4CAKC;AAnUD,2BAA6D;AAC7D,+BAA4B;AAC5B,8CAA8D;AAC9D,qDAAmD;AAgDnD,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,MAAa,WAAW;IAItB;QAHQ,WAAM,GAAsB,IAAI,CAAC;QAIvC,IAAA,4BAAe,GAAE,CAAC;QAClB,IAAI,CAAC,UAAU,GAAG,IAAA,WAAI,EAAC,IAAA,yBAAY,GAAE,EAAE,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;OAEG;IACK,IAAI;QACV,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAA,iBAAY,EAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,oEAAoE;YACpE,IAAA,sBAAU,EAAC,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,IAAI;QACV,IAAA,kBAAa,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YACnE,IAAI,EAAE,KAAK,EAAG,SAAS;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,GAAW,EAAE,SAAkC,MAAM;QAC7D,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QAEnC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG;YACnB,GAAG;YACH,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;OAEG;IACH,SAAS;QACP,aAAa;QACb,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC/E,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,aAAa;QACb,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;QAChC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,aAAa,CACX,QAAgB,EAChB,WAAmB,EACnB,YAAqB,EACrB,SAAkB;QAElB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QAEnC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG;YAClB,QAAQ;YACR,WAAW;YACX,YAAY;YACZ,SAAS;SACV,CAAC;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;OAEG;IACH,aAAa;QACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,SAAS;QACT,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YAC5E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAAe,EAAE,MAAe;QACzC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QAEnC,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG;YAChB,OAAO;YACP,MAAM,EAAE,MAAM,IAAI,WAAW;SAC9B,CAAC;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;IAC7E,CAAC;IAED;;OAEG;IACH,SAAS;QAQP,OAAO;YACL,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE;YAC7B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE;YAChC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE;YAC3B,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM;YACzC,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ;YAC3C,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO;SACtC,CAAC;IACJ,CAAC;CACF;AArKD,kCAqKC;AAED,+EAA+E;AAC/E,kCAAkC;AAClC,+EAA+E;AAE/E;;;GAGG;AACH,MAAa,aAAa;IACxB;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,OAAe,EAAE,OAAe,EAAE,QAAgB;QAC5D,uCAAuC;QACvC,IAAI,CAAC;YACH,eAAe;YACf,MAAM,WAAW,GAAG,IAAA,WAAI,EAAC,IAAA,yBAAY,GAAE,EAAE,aAAa,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,IAAA,eAAU,EAAC,WAAW,CAAC;gBACrC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,WAAW,EAAE,OAAO,CAAC,CAAC;gBAChD,CAAC,CAAC,EAAE,CAAC;YAEP,OAAO,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC;YAC5C,IAAA,kBAAa,EAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAErE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qEAAqE;YACrE,+DAA+D;YAC/D,IAAA,sBAAU,EAAC,YAAY,EAAE,KAAK,EAAE,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;YACzD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAe,EAAE,OAAe;QAC7C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAA,WAAI,EAAC,IAAA,yBAAY,GAAE,EAAE,aAAa,CAAC,CAAC;YACxD,IAAI,CAAC,IAAA,eAAU,EAAC,WAAW,CAAC,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;YAC/D,OAAO,OAAO,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gEAAgE;YAChE,8DAA8D;YAC9D,IAAA,sBAAU,EAAC,eAAe,EAAE,KAAK,EAAE,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,OAAe;QAC3C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAA,WAAI,EAAC,IAAA,yBAAY,GAAE,EAAE,aAAa,CAAC,CAAC;YACxD,IAAI,CAAC,IAAA,eAAU,EAAC,WAAW,CAAC,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;YAC/D,OAAO,OAAO,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;YACxC,IAAA,kBAAa,EAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAErE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gEAAgE;YAChE,qDAAqD;YACrD,IAAA,sBAAU,EAAC,aAAa,EAAE,KAAK,EAAE,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAnED,sCAmEC;AAED,+EAA+E;AAC/E,KAAK;AACL,+EAA+E;AAE/E,IAAI,WAAW,GAAuB,IAAI,CAAC;AAE3C,SAAgB,cAAc;IAC5B,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAgB,gBAAgB;IAC9B,WAAW,GAAG,IAAI,CAAC;AACrB,CAAC;AAED,IAAI,aAAa,GAAyB,IAAI,CAAC;AAE/C,SAAgB,gBAAgB;IAC9B,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/services/auth/auth.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAgaH,wCAKC;AAED,4CAEC;AAID,4CAKC;AAhbD,2BAA6D;AAC7D,mCAAuE;AACvE,+BAA4B;AAC5B,8CAA8D;AAC9D,kDAAsD;AACtD,qDAAmD;AAEnD;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAW,CAAC;AAwDpE,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,MAAa,WAAW;IAItB;QAHQ,WAAM,GAAsB,IAAI,CAAC;QAIvC,IAAA,4BAAe,GAAE,CAAC;QAClB,IAAI,CAAC,UAAU,GAAG,IAAA,WAAI,EAAC,IAAA,yBAAY,GAAE,EAAE,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;OAEG;IACK,IAAI;QACV,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAA,iBAAY,EAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,oEAAoE;YACpE,IAAA,sBAAU,EAAC,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,IAAI;QACV,IAAA,kCAAmB,EACjB,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EACpC,qBAAqB,CAAE,wBAAwB;SAChD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,GAAW,EAAE,SAAkC,MAAM;QAC7D,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QAEnC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG;YACnB,GAAG;YACH,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;OAEG;IACH,SAAS;QACP,aAAa;QACb,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC/E,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,aAAa;QACb,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;QAChC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,aAAa,CACX,QAAgB,EAChB,WAAmB,EACnB,YAAqB,EACrB,SAAkB;QAElB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QAEnC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG;YAClB,QAAQ;YACR,WAAW;YACX,YAAY;YACZ,SAAS;SACV,CAAC;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;OAEG;IACH,aAAa;QACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,SAAS;QACT,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YAC5E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAAe,EAAE,MAAe;QACzC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QAEnC,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG;YAChB,OAAO;YACP,MAAM,EAAE,MAAM,IAAI,WAAW;SAC9B,CAAC;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;IAC7E,CAAC;IAED;;OAEG;IACH,SAAS;QAQP,OAAO;YACL,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE;YAC7B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE;YAChC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE;YAC3B,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM;YACzC,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ;YAC3C,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO;SACtC,CAAC;IACJ,CAAC;CACF;AAvKD,kCAuKC;AAED,+EAA+E;AAC/E,uCAAuC;AACvC,+EAA+E;AAE/E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,eAAe,GAAG,YAAY,CAAC;AACrC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AACvC,MAAM,SAAS,GAAG,EAAE,CAAC;AASrB,SAAS,aAAa;IACpB,OAAO,IAAA,WAAI,EAAC,IAAA,yBAAY,GAAE,EAAE,eAAe,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,IAAI,IAAA,eAAU,EAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,IAAA,iBAAY,EAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,oBAAW,EAAC,SAAS,CAAC,CAAC;IACnC,4EAA4E;IAC5E,6CAA6C;IAC7C,IAAA,kBAAa,EAAC,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,KAA6B,EAAE,GAAW;IAC5D,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAA,uBAAc,EAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAC7C,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IACH,MAAM,IAAI,GAAkB;QAC1B,CAAC,EAAE,CAAC;QACJ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3C,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACpC,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,GAAW;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;QACjD,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAA,yBAAgB,EAC/B,aAAa,EACb,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CACjC,CAAC;QACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACnD,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAA2B,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,gEAAgE;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,WAAW,GAAG,IAAA,WAAI,EAAC,IAAA,yBAAY,GAAE,EAAE,gBAAgB,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAA,eAAU,EAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,wEAAwE;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,UAAU,CAAC,IAAA,iBAAY,EAAC,WAAW,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IAChE,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,GAA2B;IACrD,MAAM,WAAW,GAAG,IAAA,WAAI,EAAC,IAAA,yBAAY,GAAE,EAAE,gBAAgB,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,yEAAyE;IACzE,+CAA+C;IAC/C,IAAA,kCAAmB,EAAC,WAAW,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC;AAChF,CAAC;AAED,MAAa,aAAa;IACxB;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,OAAe,EAAE,OAAe,EAAE,QAAgB;QAC5D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;YAChC,GAAG,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC;YACxC,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qEAAqE;YACrE,+DAA+D;YAC/D,IAAA,sBAAU,EAAC,YAAY,EAAE,KAAK,EAAE,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;YACzD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAe,EAAE,OAAe;QAC7C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;YAChC,OAAO,GAAG,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,8DAA8D;YAC9D,IAAA,sBAAU,EAAC,eAAe,EAAE,KAAK,EAAE,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,OAAe;QAC3C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;YAChC,OAAO,GAAG,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;YACpC,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gEAAgE;YAChE,qDAAqD;YACrD,IAAA,sBAAU,EAAC,aAAa,EAAE,KAAK,EAAE,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAjDD,sCAiDC;AAED,+EAA+E;AAC/E,KAAK;AACL,+EAA+E;AAE/E,IAAI,WAAW,GAAuB,IAAI,CAAC;AAE3C,SAAgB,cAAc;IAC5B,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAgB,gBAAgB;IAC9B,WAAW,GAAG,IAAI,CAAC;AACrB,CAAC;AAED,IAAI,aAAa,GAAyB,IAAI,CAAC;AAE/C,SAAgB,gBAAgB;IAC9B,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/services/auth/aws.d.ts

@@ -20,6 +20,8 @@ export declare function verifyAwsCredentials(auth: AwsAuth): Promise<StsResult>;
  * 获取临时 STS Token
  */
 export declare function getStsToken(auth: AwsAuth, durationSeconds?: number): Promise<StsResult>;
+/** Assume an IAM role and return its validated temporary credentials. */
+export declare function assumeAwsRole(auth: AwsAuth, roleArn: string, durationSeconds?: number): Promise<StsResult>;
 /**
  * 检测 AWS CLI 是否可用
  */

package/dist/services/auth/aws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../../src/services/auth/aws.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAMtC,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAsC5E;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,OAAO,EACb,eAAe,GAAE,MAAa,GAC7B,OAAO,CAAC,SAAS,CAAC,CA0CpB;AAED;;GAEG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAQ7D"}
+{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../../src/services/auth/aws.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAMtC,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAoFD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CA4C5E;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,OAAO,EACb,eAAe,GAAE,MAAa,GAC7B,OAAO,CAAC,SAAS,CAAC,CAqCpB;AAED,yEAAyE;AACzE,wBAAsB,aAAa,CACjC,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,MAAM,EACf,eAAe,GAAE,MAAa,GAC7B,OAAO,CAAC,SAAS,CAAC,CAmCpB;AAED;;GAEG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAQ7D"}

package/dist/services/auth/aws.js

@@ -7,24 +7,97 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.verifyAwsCredentials = verifyAwsCredentials;
 exports.getStsToken = getStsToken;
+exports.assumeAwsRole = assumeAwsRole;
 exports.checkAwsCliAvailable = checkAwsCliAvailable;
 const child_process_1 = require("child_process");
+function validateExpiration(value, source) {
+    if (!value)
+        return undefined;
+    const expiresAt = Date.parse(value);
+    if (!Number.isFinite(expiresAt))
+        return `${source} credential expiration is invalid`;
+    if (expiresAt <= Date.now())
+        return `${source} credentials have expired`;
+    return undefined;
+}
+/** Resolve credentials without silently falling through a partial/expired source. */
+function resolveCredentialContext(auth) {
+    const env = { ...process.env };
+    const envAccessKey = process.env.AWS_ACCESS_KEY_ID;
+    const envSecret = process.env.AWS_SECRET_ACCESS_KEY;
+    const envToken = process.env.AWS_SESSION_TOKEN;
+    const hasAnyEnvCredential = Boolean(envAccessKey || envSecret || envToken);
+    if (hasAnyEnvCredential) {
+        if (!envAccessKey || !envSecret) {
+            return {
+                profileArgs: [],
+                env,
+                error: 'AWS environment credentials are incomplete',
+            };
+        }
+        const expirationError = validateExpiration(process.env.AWS_CREDENTIAL_EXPIRATION, 'AWS environment');
+        return { profileArgs: [], env, error: expirationError };
+    }
+    const hasAnyAuthCredential = Boolean(auth.accessKeyId || auth.secretAccessKey || auth.sessionToken);
+    if (hasAnyAuthCredential) {
+        if (!auth.accessKeyId || !auth.secretAccessKey) {
+            return { profileArgs: [], env, error: 'Configured AWS credentials are incomplete' };
+        }
+        const expirationError = validateExpiration(auth.expiration, 'Configured AWS');
+        if (expirationError)
+            return { profileArgs: [], env, error: expirationError };
+        env.AWS_ACCESS_KEY_ID = auth.accessKeyId;
+        env.AWS_SECRET_ACCESS_KEY = auth.secretAccessKey;
+        if (auth.sessionToken)
+            env.AWS_SESSION_TOKEN = auth.sessionToken;
+        return { profileArgs: [], env };
+    }
+    return {
+        profileArgs: auth.profile ? ['--profile', auth.profile] : [],
+        env,
+    };
+}
+function credentialsFromResponse(value) {
+    if (!value || typeof value !== 'object') {
+        return { success: false, error: 'STS response is missing Credentials' };
+    }
+    const credentials = value;
+    if (typeof credentials.AccessKeyId !== 'string' ||
+        typeof credentials.SecretAccessKey !== 'string' ||
+        typeof credentials.SessionToken !== 'string' ||
+        typeof credentials.Expiration !== 'string') {
+        return { success: false, error: 'STS response contains invalid temporary credentials' };
+    }
+    const expirationError = validateExpiration(credentials.Expiration, 'STS');
+    if (expirationError)
+        return { success: false, error: expirationError };
+    return {
+        success: true,
+        accessKeyId: credentials.AccessKeyId,
+        secretAccessKey: credentials.SecretAccessKey,
+        sessionToken: credentials.SessionToken,
+        expiration: credentials.Expiration,
+    };
+}
 /**
  * 验证 AWS 凭证
  */
 async function verifyAwsCredentials(auth) {
+    const credentialContext = resolveCredentialContext(auth);
+    if (credentialContext.error)
+        return { success: false, error: credentialContext.error };
     // 尝试调用 AWS CLI
     return new Promise((resolve) => {
-        const profile = auth.profile || 'default';
         const region = auth.region || 'us-east-1';
         (0, child_process_1.execFile)('aws', [
             'sts',
             'get-caller-identity',
-            '--profile', profile,
+            ...credentialContext.profileArgs,
             '--region', region,
             '--output', 'json',
         ], {
             timeout: 10000,
+            env: credentialContext.env,
         }, (error, stdout, stderr) => {
             if (error) {
                 resolve({
@@ -35,6 +108,10 @@ async function verifyAwsCredentials(auth) {
             }
             try {
                 const result = JSON.parse(stdout.toString());
+                if (!result || typeof result.Arn !== 'string') {
+                    resolve({ success: false, error: 'AWS identity response is missing Arn' });
+                    return;
+                }
                 resolve({
                     success: true,
                     // get-caller-identity 不返回凭证，仅验证身份
@@ -54,18 +131,23 @@ async function verifyAwsCredentials(auth) {
  * 获取临时 STS Token
  */
 async function getStsToken(auth, durationSeconds = 3600) {
+    if (auth.roleArn)
+        return assumeAwsRole(auth, auth.roleArn, durationSeconds);
+    const credentialContext = resolveCredentialContext(auth);
+    if (credentialContext.error)
+        return { success: false, error: credentialContext.error };
     return new Promise((resolve) => {
-        const profile = auth.profile || 'default';
         const region = auth.region || 'us-east-1';
         (0, child_process_1.execFile)('aws', [
             'sts',
             'get-session-token',
-            '--profile', profile,
+            ...credentialContext.profileArgs,
             '--region', region,
             '--duration-seconds', String(durationSeconds),
             '--output', 'json',
         ], {
             timeout: 15000,
+            env: credentialContext.env,
         }, (error, stdout, stderr) => {
             if (error) {
                 resolve({
@@ -76,14 +158,7 @@ async function getStsToken(auth, durationSeconds = 3600) {
             }
             try {
                 const result = JSON.parse(stdout.toString());
-                const credentials = result.Credentials;
-                resolve({
-                    success: true,
-                    accessKeyId: credentials.AccessKeyId,
-                    secretAccessKey: credentials.SecretAccessKey,
-                    sessionToken: credentials.SessionToken,
-                    expiration: credentials.Expiration,
-                });
+                resolve(credentialsFromResponse(result.Credentials));
             }
             catch {
                 resolve({
@@ -94,6 +169,45 @@ async function getStsToken(auth, durationSeconds = 3600) {
         });
     });
 }
+/** Assume an IAM role and return its validated temporary credentials. */
+async function assumeAwsRole(auth, roleArn, durationSeconds = 3600) {
+    if (!roleArn.trim())
+        return { success: false, error: 'AWS role ARN is required' };
+    const credentialContext = resolveCredentialContext(auth);
+    if (credentialContext.error)
+        return { success: false, error: credentialContext.error };
+    const region = auth.region || 'us-east-1';
+    const sessionName = auth.roleSessionName || `orion-code-${process.pid}`;
+    const externalIdArgs = auth.externalId ? ['--external-id', auth.externalId] : [];
+    return new Promise(resolve => {
+        (0, child_process_1.execFile)('aws', [
+            'sts',
+            'assume-role',
+            '--role-arn', roleArn,
+            '--role-session-name', sessionName,
+            ...externalIdArgs,
+            ...credentialContext.profileArgs,
+            '--region', region,
+            '--duration-seconds', String(durationSeconds),
+            '--output', 'json',
+        ], {
+            timeout: 15000,
+            env: credentialContext.env,
+        }, (error, stdout, stderr) => {
+            if (error) {
+                resolve({ success: false, error: stderr.toString() || error.message });
+                return;
+            }
+            try {
+                const result = JSON.parse(stdout.toString());
+                resolve(credentialsFromResponse(result.Credentials));
+            }
+            catch {
+                resolve({ success: false, error: 'Failed to parse STS response' });
+            }
+        });
+    });
+}
 /**
  * 检测 AWS CLI 是否可用
  */

package/dist/services/auth/aws.js.map

@@ -1 +1 @@
-{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../../src/services/auth/aws.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAqBH,oDAsCC;AAKD,kCA6CC;AAKD,oDAQC;AAxHD,iDAAyC;AAgBzC;;GAEG;AACI,KAAK,UAAU,oBAAoB,CAAC,IAAa;IACtD,eAAe;IACf,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;QAE1C,IAAA,wBAAQ,EAAC,KAAK,EAAE;YACd,KAAK;YACL,qBAAqB;YACrB,WAAW,EAAE,OAAO;YACpB,UAAU,EAAE,MAAM;YAClB,UAAU,EAAE,MAAM;SACnB,EAAE;YACD,OAAO,EAAE,KAAK;SACf,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC3B,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,CAAC,OAAO;iBAC1C,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC7C,OAAO,CAAC;oBACN,OAAO,EAAE,IAAI;oBACb,kCAAkC;oBAClC,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;iBACtD,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,8BAA8B;iBACtC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,WAAW,CAC/B,IAAa,EACb,kBAA0B,IAAI;IAE9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;QAE1C,IAAA,wBAAQ,EAAC,KAAK,EAAE;YACd,KAAK;YACL,mBAAmB;YACnB,WAAW,EAAE,OAAO;YACpB,UAAU,EAAE,MAAM;YAClB,oBAAoB,EAAE,MAAM,CAAC,eAAe,CAAC;YAC7C,UAAU,EAAE,MAAM;SACnB,EAAE;YACD,OAAO,EAAE,KAAK;SACf,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC3B,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,CAAC,OAAO;iBAC1C,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;gBAEvC,OAAO,CAAC;oBACN,OAAO,EAAE,IAAI;oBACb,WAAW,EAAE,WAAW,CAAC,WAAW;oBACpC,eAAe,EAAE,WAAW,CAAC,eAAe;oBAC5C,YAAY,EAAE,WAAW,CAAC,YAAY;oBACtC,UAAU,EAAE,WAAW,CAAC,UAAU;iBACnC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,8BAA8B;iBACtC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,oBAAoB;IACxC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAA,wBAAQ,EAAC,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE;YAC7B,OAAO,EAAE,IAAI;SACd,EAAE,CAAC,KAAK,EAAE,EAAE;YACX,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../../src/services/auth/aws.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAuGH,oDA4CC;AAKD,kCAwCC;AAGD,sCAuCC;AAKD,oDAQC;AArPD,iDAAyC;AAsBzC,SAAS,kBAAkB,CAAC,KAAyB,EAAE,MAAc;IACnE,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,GAAG,MAAM,mCAAmC,CAAC;IACrF,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,MAAM,2BAA2B,CAAC;IACzE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qFAAqF;AACrF,SAAS,wBAAwB,CAAC,IAAa;IAC7C,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC/C,MAAM,mBAAmB,GAAG,OAAO,CAAC,YAAY,IAAI,SAAS,IAAI,QAAQ,CAAC,CAAC;IAE3E,IAAI,mBAAmB,EAAE,CAAC;QACxB,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,OAAO;gBACL,WAAW,EAAE,EAAE;gBACf,GAAG;gBACH,KAAK,EAAE,4CAA4C;aACpD,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAG,kBAAkB,CACxC,OAAO,CAAC,GAAG,CAAC,yBAAyB,EACrC,iBAAiB,CAClB,CAAC;QACF,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,oBAAoB,GAAG,OAAO,CAClC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,YAAY,CAC9D,CAAC;IACF,IAAI,oBAAoB,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/C,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;QACtF,CAAC;QACD,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAC9E,IAAI,eAAe;YAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QAC7E,GAAG,CAAC,iBAAiB,GAAG,IAAI,CAAC,WAAW,CAAC;QACzC,GAAG,CAAC,qBAAqB,GAAG,IAAI,CAAC,eAAe,CAAC;QACjD,IAAI,IAAI,CAAC,YAAY;YAAE,GAAG,CAAC,iBAAiB,GAAG,IAAI,CAAC,YAAY,CAAC;QACjE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;IAClC,CAAC;IAED,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;QAC5D,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;IAC1E,CAAC;IACD,MAAM,WAAW,GAAG,KAAgC,CAAC;IACrD,IACE,OAAO,WAAW,CAAC,WAAW,KAAK,QAAQ;QAC3C,OAAO,WAAW,CAAC,eAAe,KAAK,QAAQ;QAC/C,OAAO,WAAW,CAAC,YAAY,KAAK,QAAQ;QAC5C,OAAO,WAAW,CAAC,UAAU,KAAK,QAAQ,EAC1C,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qDAAqD,EAAE,CAAC;IAC1F,CAAC;IACD,MAAM,eAAe,GAAG,kBAAkB,CAAC,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC1E,IAAI,eAAe;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IACvE,OAAO;QACL,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,eAAe,EAAE,WAAW,CAAC,eAAe;QAC5C,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,UAAU,EAAE,WAAW,CAAC,UAAU;KACnC,CAAC;AACJ,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,oBAAoB,CAAC,IAAa;IACtD,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,iBAAiB,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC;IACvF,eAAe;IACf,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;QAE1C,IAAA,wBAAQ,EAAC,KAAK,EAAE;YACd,KAAK;YACL,qBAAqB;YACrB,GAAG,iBAAiB,CAAC,WAAW;YAChC,UAAU,EAAE,MAAM;YAClB,UAAU,EAAE,MAAM;SACnB,EAAE;YACD,OAAO,EAAE,KAAK;YACd,GAAG,EAAE,iBAAiB,CAAC,GAAG;SAC3B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC3B,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,CAAC,OAAO;iBAC1C,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC7C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;oBAC9C,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAC;oBAC3E,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC;oBACN,OAAO,EAAE,IAAI;oBACb,kCAAkC;oBAClC,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;iBACtD,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,8BAA8B;iBACtC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,WAAW,CAC/B,IAAa,EACb,kBAA0B,IAAI;IAE9B,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC5E,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,iBAAiB,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC;IACvF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;QAE1C,IAAA,wBAAQ,EAAC,KAAK,EAAE;YACd,KAAK;YACL,mBAAmB;YACnB,GAAG,iBAAiB,CAAC,WAAW;YAChC,UAAU,EAAE,MAAM;YAClB,oBAAoB,EAAE,MAAM,CAAC,eAAe,CAAC;YAC7C,UAAU,EAAE,MAAM;SACnB,EAAE;YACD,OAAO,EAAE,KAAK;YACd,GAAG,EAAE,iBAAiB,CAAC,GAAG;SAC3B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC3B,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,CAAC,OAAO;iBAC1C,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC7C,OAAO,CAAC,uBAAuB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,8BAA8B;iBACtC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AAClE,KAAK,UAAU,aAAa,CACjC,IAAa,EACb,OAAe,EACf,kBAA0B,IAAI;IAE9B,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;IAClF,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,iBAAiB,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC;IACvF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;IAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,IAAI,cAAc,OAAO,CAAC,GAAG,EAAE,CAAC;IACxE,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjF,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,IAAA,wBAAQ,EAAC,KAAK,EAAE;YACd,KAAK;YACL,aAAa;YACb,YAAY,EAAE,OAAO;YACrB,qBAAqB,EAAE,WAAW;YAClC,GAAG,cAAc;YACjB,GAAG,iBAAiB,CAAC,WAAW;YAChC,UAAU,EAAE,MAAM;YAClB,oBAAoB,EAAE,MAAM,CAAC,eAAe,CAAC;YAC7C,UAAU,EAAE,MAAM;SACnB,EAAE;YACD,OAAO,EAAE,KAAK;YACd,GAAG,EAAE,iBAAiB,CAAC,GAAG;SAC3B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC3B,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACvE,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC7C,OAAO,CAAC,uBAAuB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,oBAAoB;IACxC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAA,wBAAQ,EAAC,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE;YAC7B,OAAO,EAAE,IAAI;SACd,EAAE,CAAC,KAAK,EAAE,EAAE;YACX,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/services/auth/index.d.ts

@@ -2,5 +2,5 @@
  * orion code - Auth 服务入口
  */
 export { AuthService, getAuthService, resetAuthService, SecureStorage, getSecureStorage, type AuthConfig, type ApiKeyAuth, type OAuthAuth, type AwsAuth, } from './auth';
-export { verifyAwsCredentials, getStsToken, checkAwsCliAvailable, type StsResult, } from './aws';
+export { verifyAwsCredentials, getStsToken, assumeAwsRole, checkAwsCliAvailable, type StsResult, } from './aws';
 //# sourceMappingURL=index.d.ts.map

package/dist/services/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/auth/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,OAAO,GACb,MAAM,QAAQ,CAAC;AAEhB,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,oBAAoB,EACpB,KAAK,SAAS,GACf,MAAM,OAAO,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/auth/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,OAAO,GACb,MAAM,QAAQ,CAAC;AAEhB,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,oBAAoB,EACpB,KAAK,SAAS,GACf,MAAM,OAAO,CAAC"}

package/dist/services/auth/index.js

@@ -3,7 +3,7 @@
  * orion code - Auth 服务入口
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.checkAwsCliAvailable = exports.getStsToken = exports.verifyAwsCredentials = exports.getSecureStorage = exports.SecureStorage = exports.resetAuthService = exports.getAuthService = exports.AuthService = void 0;
+exports.checkAwsCliAvailable = exports.assumeAwsRole = exports.getStsToken = exports.verifyAwsCredentials = exports.getSecureStorage = exports.SecureStorage = exports.resetAuthService = exports.getAuthService = exports.AuthService = void 0;
 var auth_1 = require("./auth");
 Object.defineProperty(exports, "AuthService", { enumerable: true, get: function () { return auth_1.AuthService; } });
 Object.defineProperty(exports, "getAuthService", { enumerable: true, get: function () { return auth_1.getAuthService; } });
@@ -13,5 +13,6 @@ Object.defineProperty(exports, "getSecureStorage", { enumerable: true, get: func
 var aws_1 = require("./aws");
 Object.defineProperty(exports, "verifyAwsCredentials", { enumerable: true, get: function () { return aws_1.verifyAwsCredentials; } });
 Object.defineProperty(exports, "getStsToken", { enumerable: true, get: function () { return aws_1.getStsToken; } });
+Object.defineProperty(exports, "assumeAwsRole", { enumerable: true, get: function () { return aws_1.assumeAwsRole; } });
 Object.defineProperty(exports, "checkAwsCliAvailable", { enumerable: true, get: function () { return aws_1.checkAwsCliAvailable; } });
 //# sourceMappingURL=index.js.map

package/dist/services/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/auth/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,+BAUgB;AATd,mGAAA,WAAW,OAAA;AACX,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,qGAAA,aAAa,OAAA;AACb,wGAAA,gBAAgB,OAAA;AAOlB,6BAKe;AAJb,2GAAA,oBAAoB,OAAA;AACpB,kGAAA,WAAW,OAAA;AACX,2GAAA,oBAAoB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/auth/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,+BAUgB;AATd,mGAAA,WAAW,OAAA;AACX,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,qGAAA,aAAa,OAAA;AACb,wGAAA,gBAAgB,OAAA;AAOlB,6BAMe;AALb,2GAAA,oBAAoB,OAAA;AACpB,kGAAA,WAAW,OAAA;AACX,oGAAA,aAAa,OAAA;AACb,2GAAA,oBAAoB,OAAA"}

package/dist/services/auto-fix/autoFixConfig.d.ts

@@ -26,8 +26,5 @@ export interface AutoFixTrigger {
     filePattern?: string;
 }
 export declare const DEFAULT_AUTOFIX_CONFIG: AutoFixConfig;
-/**
- * 检测项目配置
- */
 export declare function detectAutoFixConfig(projectPath: string): AutoFixConfig;
 //# sourceMappingURL=autoFixConfig.d.ts.map

package/dist/services/auto-fix/autoFixConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"autoFixConfig.d.ts","sourceRoot":"","sources":["../../../src/services/auto-fix/autoFixConfig.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,MAAM,WAAW,aAAa;IAC5B,WAAW;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW;IACX,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW;IACX,IAAI,EAAE,WAAW,GAAG,YAAY,GAAG,QAAQ,GAAG,WAAW,CAAC;IAC1D,iBAAiB;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAMD,eAAO,MAAM,sBAAsB,EAAE,aAYpC,CAAC;AAEF;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,CA6BtE"}
+{"version":3,"file":"autoFixConfig.d.ts","sourceRoot":"","sources":["../../../src/services/auto-fix/autoFixConfig.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,MAAM,WAAW,aAAa;IAC5B,WAAW;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW;IACX,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW;IACX,IAAI,EAAE,WAAW,GAAG,YAAY,GAAG,QAAQ,GAAG,WAAW,CAAC;IAC1D,iBAAiB;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAMD,eAAO,MAAM,sBAAsB,EAAE,aAYpC,CAAC;AAoBF,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,CAgCtE"}

package/dist/services/auto-fix/autoFixConfig.js

@@ -26,12 +26,30 @@ exports.DEFAULT_AUTOFIX_CONFIG = {
 /**
  * 检测项目配置
  */
+/**
+ * Deep-ish copy of the default config.
+ *
+ * A bare `{ ...DEFAULT_AUTOFIX_CONFIG }` shares the `triggers` array between
+ * every caller, and returning the singleton itself let `AutoFixRunner.setEnabled`
+ * mutate the module-level default process-wide (every Runner constructed
+ * afterwards inherited the disabled state).
+ */
+function cloneDefaultConfig() {
+    return {
+        ...exports.DEFAULT_AUTOFIX_CONFIG,
+        triggers: exports.DEFAULT_AUTOFIX_CONFIG.triggers.map(trigger => ({ ...trigger })),
+    };
+}
 function detectAutoFixConfig(projectPath) {
     // 尝试读取 package.json
     try {
         const pkgPath = (0, path_1.join)(projectPath, 'package.json');
         const pkg = JSON.parse((0, fs_1.readFileSync)(pkgPath, 'utf-8'));
-        const config = { ...exports.DEFAULT_AUTOFIX_CONFIG };
+        const config = cloneDefaultConfig();
+        // Detection must clear the command when the script is absent: the field is
+        // pre-populated from the defaults, so skipping the branch left
+        // `npm run lint` in place and the runner reported "Missing script: lint"
+        // as a lint failure for a linter the project does not have.
         // 检测 lint 命令
         if (pkg.scripts?.lint) {
             config.lintCommand = 'npm run lint';
@@ -39,18 +57,17 @@ function detectAutoFixConfig(projectPath) {
         else if (pkg.scripts?.eslint) {
             config.lintCommand = 'npm run eslint';
         }
-        // 检测 test 命令
-        if (pkg.scripts?.test) {
-            config.testCommand = 'npm test';
+        else {
+            config.lintCommand = undefined;
         }
+        // 检测 test 命令
+        config.testCommand = pkg.scripts?.test ? 'npm test' : undefined;
         // 检测 build 命令
-        if (pkg.scripts?.build) {
-            config.buildCommand = 'npm run build';
-        }
+        config.buildCommand = pkg.scripts?.build ? 'npm run build' : undefined;
         return config;
     }
     catch {
-        return exports.DEFAULT_AUTOFIX_CONFIG;
+        return cloneDefaultConfig();
     }
 }
 // ============================================================================

package/dist/services/auto-fix/autoFixConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"autoFixConfig.js","sourceRoot":"","sources":["../../../src/services/auto-fix/autoFixConfig.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAmDH,kDA6BC;AAlDD,+EAA+E;AAC/E,OAAO;AACP,+EAA+E;AAElE,QAAA,sBAAsB,GAAkB;IACnD,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,cAAc;IAC3B,WAAW,EAAE,UAAU;IACvB,YAAY,EAAE,eAAe;IAC7B,OAAO,EAAE,KAAK;IACd,cAAc,EAAE,CAAC;IACjB,QAAQ,EAAE;QACR,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE;QAC7C,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE;QAC9C,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE;KAC9C;CACF,CAAC;AAEF;;GAEG;AACH,SAAgB,mBAAmB,CAAC,WAAmB;IACrD,oBAAoB;IACpB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAA,WAAI,EAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAkB,EAAE,GAAG,8BAAsB,EAAE,CAAC;QAE5D,aAAa;QACb,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;YACtB,MAAM,CAAC,WAAW,GAAG,cAAc,CAAC;QACtC,CAAC;aAAM,IAAI,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YAC/B,MAAM,CAAC,WAAW,GAAG,gBAAgB,CAAC;QACxC,CAAC;QAED,aAAa;QACb,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;YACtB,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC;QAClC,CAAC;QAED,cAAc;QACd,IAAI,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACvB,MAAM,CAAC,YAAY,GAAG,eAAe,CAAC;QACxC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,8BAAsB,CAAC;IAChC,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E,+BAA4B;AAC5B,2BAAkC"}
+{"version":3,"file":"autoFixConfig.js","sourceRoot":"","sources":["../../../src/services/auto-fix/autoFixConfig.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAkEH,kDAgCC;AApED,+EAA+E;AAC/E,OAAO;AACP,+EAA+E;AAElE,QAAA,sBAAsB,GAAkB;IACnD,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,cAAc;IAC3B,WAAW,EAAE,UAAU;IACvB,YAAY,EAAE,eAAe;IAC7B,OAAO,EAAE,KAAK;IACd,cAAc,EAAE,CAAC;IACjB,QAAQ,EAAE;QACR,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE;QAC7C,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE;QAC9C,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE;KAC9C;CACF,CAAC;AAEF;;GAEG;AACH;;;;;;;GAOG;AACH,SAAS,kBAAkB;IACzB,OAAO;QACL,GAAG,8BAAsB;QACzB,QAAQ,EAAE,8BAAsB,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED,SAAgB,mBAAmB,CAAC,WAAmB;IACrD,oBAAoB;IACpB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAA,WAAI,EAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAkB,kBAAkB,EAAE,CAAC;QAEnD,2EAA2E;QAC3E,+DAA+D;QAC/D,yEAAyE;QACzE,4DAA4D;QAE5D,aAAa;QACb,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;YACtB,MAAM,CAAC,WAAW,GAAG,cAAc,CAAC;QACtC,CAAC;aAAM,IAAI,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YAC/B,MAAM,CAAC,WAAW,GAAG,gBAAgB,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC;QACjC,CAAC;QAED,aAAa;QACb,MAAM,CAAC,WAAW,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QAEhE,cAAc;QACd,MAAM,CAAC,YAAY,GAAG,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;QAEvE,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E,+BAA4B;AAC5B,2BAAkC"}

package/dist/services/auto-fix/autoFixHook.d.ts

@@ -16,5 +16,12 @@ export declare function shouldTriggerAutoFix(toolName: string, args: Record<stri
  * AutoFix Hook 处理器
  */
 export declare function autoFixHook(event: QueryEvent, triggers: AutoFixTrigger[]): Promise<void>;
+declare function matchesPattern(path: string, pattern?: string): boolean;
 export { autoFixHook as postToolHook };
+/**
+ * Internals exposed for unit tests only. Not part of the public API.
+ */
+export declare const __testables: {
+    matchesPattern: typeof matchesPattern;
+};
 //# sourceMappingURL=autoFixHook.d.ts.map

package/dist/services/auto-fix/autoFixHook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"autoFixHook.d.ts","sourceRoot":"","sources":["../../../src/services/auto-fix/autoFixHook.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAMtD;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,QAAQ,EAAE,cAAc,EAAE,GACzB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CA0BvC;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,cAAc,EAAE,GACzB,OAAO,CAAC,IAAI,CAAC,CA8Bf;AA6BD,OAAO,EAAE,WAAW,IAAI,YAAY,EAAE,CAAC"}
+{"version":3,"file":"autoFixHook.d.ts","sourceRoot":"","sources":["../../../src/services/auto-fix/autoFixHook.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAMtD;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,QAAQ,EAAE,cAAc,EAAE,GACzB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CA0BvC;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,cAAc,EAAE,GACzB,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAMD,iBAAS,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAqB/D;AAMD,OAAO,EAAE,WAAW,IAAI,YAAY,EAAE,CAAC;AAEvC;;GAEG;AACH,eAAO,MAAM,WAAW;;CAAqB,CAAC"}