@qoniai/qoni 0.5.0 → 0.5.1

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.5.1 - 2026-09-23
+
+### Fixed
+
+- Recheck access-key scope policy at token exchange before every SDK product
+  operation, including repeated calls with the same delegation token. Removing
+  a scope now blocks the next SDK operation instead of leaving a cached product
+  token usable until expiry.
+
 ## 0.5.0 - 2026-09-17
 
 ### Added

package/README.md

@@ -788,6 +788,9 @@ Common first-run errors:
 - Keep Qoni AK/SK on trusted servers only.
 - Do not expose delegation tokens to untrusted clients.
 - Request the smallest useful scope set for each Agent action.
+- Product methods exchange the delegation token on every call, so a change to
+  the access key's allowed scopes is checked before the next SDK operation.
+  Product tokens already obtained outside the SDK remain valid until expiry.
 - Prefer `interactive` mode for browser control, site login, long-running monitors, and sensitive artifacts.
 - Store `auditId`, `requestId`, and `traceId` with product logs when later investigation matters.
 - Rotate AK/SK through Qoni Console if a credential might have been exposed.

package/README.zh-CN.md

@@ -717,6 +717,8 @@ try {
 - AK/SK 只保存在可信服务端。
 - 不要把 delegation token 暴露给不可信客户端。
 - 每次 Agent 行动只申请必要 scope。
+- SDK 的产品方法每次调用前都会重新兑换 delegation token，因此 AccessKey 的 scope
+  变更会在下一次 SDK 调用前重新校验。已经在 SDK 外取得的产品 token 仍会持续有效至过期。
 - 浏览器接管、站点登录、长期监控、敏感产物访问优先使用 `interactive`。
 - 在业务日志中记录 `auditId`、`requestId`、`traceId`，方便后续审计。
 - 如果怀疑 AK/SK 泄露，应在 Qoni Console 中轮换密钥。

package/dist/index.cjs

@@ -2114,7 +2114,6 @@ var Qoni = class {
   secretKey;
   host;
   runtimeConfigPromise;
-  productTokenCache = /* @__PURE__ */ new Map();
   genAuthAdminTokenCache;
   gumem;
   genauth;
@@ -2585,9 +2584,6 @@ var Qoni = class {
     const runtimeToken = requiredRuntimeToken(token);
     if (!isQoniDelegationToken(runtimeToken)) return runtimeToken;
     const scopes = [...requiredScopes || []].sort();
-    const cacheKey = [service, runtimeToken, scopes.join(" ")].join(":");
-    const cached = this.productTokenCache.get(cacheKey);
-    if (cached && cached.expiresAt > Date.now() + 3e4) return cached.token;
     const response = await this.signedPost("/api/v3/eak/token-exchange", {
       subjectToken: runtimeToken,
       resource: service === "gumem" ? "gumem" : "webagent",
@@ -2602,10 +2598,6 @@ var Qoni = class {
         "Qoni product token exchange response did not include an access token"
       );
     }
-    this.productTokenCache.set(cacheKey, {
-      token: accessToken,
-      expiresAt: Date.now() + Math.max(0, readExpiresIn(payload) ?? 3600) * 1e3
-    });
     return accessToken;
   }
   async genauthAdminTokenFor() {