@team-work/sandbox-client 0.1.1-beta.0

package/dist/cli/update-cmd.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildUpdateCommand = buildUpdateCommand;
+const commander_1 = require("commander");
+const self_update_js_1 = require("../update/self-update.js");
+/** `tw update`：自更新 CLI 本身 */
+function buildUpdateCommand() {
+    const cmd = new commander_1.Command('update');
+    cmd.description('自更新 tw CLI（npm i -g）').action(() => {
+        const result = (0, self_update_js_1.selfUpdate)();
+        console.log(result.message);
+        process.exit(result.changed ? 0 : 0);
+    });
+    return cmd;
+}
+//# sourceMappingURL=update-cmd.js.map

package/dist/cli/update-cmd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-cmd.js","sourceRoot":"","sources":["../../src/cli/update-cmd.ts"],"names":[],"mappings":";;AAKA,gDAQC;AAbD,yCAAoC;AAEpC,6DAAsD;AAEtD,6BAA6B;AAC7B,SAAgB,kBAAkB;IAChC,MAAM,GAAG,GAAG,IAAI,mBAAO,CAAC,QAAQ,CAAC,CAAC;IAClC,GAAG,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE;QAClD,MAAM,MAAM,GAAG,IAAA,2BAAU,GAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/client/frames.d.ts

@@ -0,0 +1,111 @@
+/**
+ * ws 帧类型定义，严格对齐 sandbox 服务端 src/common/interfaces.ts。
+ * CLI → server：CliFrame；server → CLI：ServerToCliFrame。
+ * 传输格式：UTF-8 文本帧，每帧一个 JSON 对象，按 `type` 字段区分。
+ */
+/** 机器画像，对齐 sandbox SandboxConfig */
+export interface SandboxConfig {
+    ip: string;
+    os: string;
+    cpu: string;
+    memory: number;
+    storage: number;
+    cliVersion: string;
+}
+export interface HelloFrame {
+    type: 'hello';
+    sandboxId: string;
+    privateKey: string;
+}
+export interface ReportFrame {
+    type: 'report';
+    config: SandboxConfig;
+}
+export interface PingFrame {
+    type: 'ping';
+}
+export interface RpcResultFrame {
+    type: 'rpc-result';
+    reqId: string;
+    ok: boolean;
+    data?: unknown;
+    error?: string;
+}
+export interface RpcStreamFrame {
+    type: 'rpc-stream';
+    reqId: string;
+    stream: 'stdout' | 'stderr';
+    data: string;
+}
+export interface RpcEndFrame {
+    type: 'rpc-end';
+    reqId: string;
+    exitCode?: number;
+}
+export interface TerminalDataFrame {
+    type: 'terminal.data';
+    sessionId: string;
+    data: string;
+}
+export interface TerminalExitFrame {
+    type: 'terminal.exit';
+    sessionId: string;
+    exitCode: number;
+}
+export type CliFrame = HelloFrame | ReportFrame | PingFrame | RpcResultFrame | RpcStreamFrame | RpcEndFrame | TerminalDataFrame | TerminalExitFrame;
+export interface HelloAckFrame {
+    type: 'hello-ack';
+    ok: boolean;
+    error?: string;
+}
+export interface ReportAckFrame {
+    type: 'report-ack';
+    ok: boolean;
+}
+export interface PongFrame {
+    type: 'pong';
+}
+export interface RpcFrame {
+    type: 'rpc';
+    reqId: string;
+    action: string;
+    params: Record<string, unknown>;
+}
+export interface TerminalOpenFrame {
+    type: 'terminal.open';
+    sessionId: string;
+    cols: number;
+    rows: number;
+}
+export interface TerminalInputFrame {
+    type: 'terminal.input';
+    sessionId: string;
+    data: string;
+}
+export interface TerminalResizeFrame {
+    type: 'terminal.resize';
+    sessionId: string;
+    cols: number;
+    rows: number;
+}
+export interface TerminalCloseFrame {
+    type: 'terminal.close';
+    sessionId: string;
+}
+export type ServerToCliFrame = HelloAckFrame | ReportAckFrame | PongFrame | RpcFrame | TerminalOpenFrame | TerminalInputFrame | TerminalResizeFrame | TerminalCloseFrame;
+export declare function serializeFrame(frame: CliFrame): string;
+export declare function parseServerFrame(text: string): ServerToCliFrame | null;
+export interface DirEntry {
+    name: string;
+    isDir: boolean;
+    size: number;
+}
+export interface StatResult {
+    size: number;
+    isDir: boolean;
+    mtime: number;
+}
+export interface OkPathResult {
+    ok: true;
+    path: string;
+}

package/dist/client/frames.js

@@ -0,0 +1,22 @@
+"use strict";
+/**
+ * ws 帧类型定义，严格对齐 sandbox 服务端 src/common/interfaces.ts。
+ * CLI → server：CliFrame；server → CLI：ServerToCliFrame。
+ * 传输格式：UTF-8 文本帧，每帧一个 JSON 对象，按 `type` 字段区分。
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.serializeFrame = serializeFrame;
+exports.parseServerFrame = parseServerFrame;
+// ───────── 序列化 ─────────
+function serializeFrame(frame) {
+    return JSON.stringify(frame);
+}
+function parseServerFrame(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=frames.js.map

package/dist/client/frames.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frames.js","sourceRoot":"","sources":["../../src/client/frames.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAuHH,wCAEC;AAED,4CAMC;AAZD,0BAA0B;AAE1B,SAAgB,cAAc,CAAC,KAAe;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAgB,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/client/handshake.d.ts

@@ -0,0 +1,7 @@
+import { WebSocket } from 'ws';
+import { Logger } from '../logging/logger.js';
+/**
+ * 握手编排：hello → hello-ack → report → report-ack。
+ * 返回 authed；鉴权失败/超时 reject。
+ */
+export declare function handshake(ws: WebSocket, sandboxId: string, privateKey: string, logger: Logger): Promise<boolean>;

package/dist/client/handshake.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handshake = handshake;
+const frames_js_1 = require("./frames.js");
+const report_js_1 = require("../system/report.js");
+const protocol_js_1 = require("./protocol.js");
+/**
+ * 握手编排：hello → hello-ack → report → report-ack。
+ * 返回 authed；鉴权失败/超时 reject。
+ */
+function handshake(ws, sandboxId, privateKey, logger) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const authTimer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            reject(new Error('auth timeout'));
+        }, protocol_js_1.AUTH_TIMEOUT_MS);
+        const onMessage = (raw) => {
+            let text;
+            if (Buffer.isBuffer(raw))
+                text = raw.toString('utf8');
+            else if (Array.isArray(raw))
+                text = Buffer.concat(raw).toString('utf8');
+            else if (typeof raw === 'string')
+                text = raw;
+            else
+                text = Buffer.from(raw).toString('utf8');
+            let frame;
+            try {
+                frame = JSON.parse(text);
+            }
+            catch {
+                return;
+            }
+            if (frame.type === 'hello-ack') {
+                if (frame.ok) {
+                    // 进入 report 阶段
+                    const report = { type: 'report', config: (0, report_js_1.collectConfig)() };
+                    ws.send((0, frames_js_1.serializeFrame)(report), (err) => {
+                        if (err)
+                            logger.error({ err: err.message }, 'send report failed');
+                    });
+                }
+                else {
+                    settled = true;
+                    clearTimeout(authTimer);
+                    ws.off('message', onMessage);
+                    reject(new Error(frame.error || 'hello-ack ok=false'));
+                }
+                return;
+            }
+            if (frame.type === 'report-ack') {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(authTimer);
+                ws.off('message', onMessage);
+                resolve(true);
+            }
+        };
+        ws.on('message', onMessage);
+        // 发 hello
+        const hello = { type: 'hello', sandboxId, privateKey };
+        ws.send((0, frames_js_1.serializeFrame)(hello), (err) => {
+            if (err && !settled) {
+                settled = true;
+                clearTimeout(authTimer);
+                reject(new Error(`send hello failed: ${err.message}`));
+            }
+        });
+        // 提前 close
+        ws.once('close', () => {
+            if (!settled) {
+                settled = true;
+                clearTimeout(authTimer);
+                reject(new Error('socket closed during handshake'));
+            }
+        });
+    });
+}
+//# sourceMappingURL=handshake.js.map

package/dist/client/handshake.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handshake.js","sourceRoot":"","sources":["../../src/client/handshake.ts"],"names":[],"mappings":";;AAWA,8BAwEC;AAhFD,2CAAsE;AACtE,mDAAoD;AACpD,+CAAgD;AAEhD;;;GAGG;AACH,SAAgB,SAAS,CACvB,EAAa,EACb,SAAiB,EACjB,UAAkB,EAClB,MAAc;IAEd,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAChC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QACpC,CAAC,EAAE,6BAAe,CAAC,CAAC;QAEpB,MAAM,SAAS,GAAG,CAAC,GAAY,EAAE,EAAE;YACjC,IAAI,IAAY,CAAC;YACjB,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;iBACjD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;gBAAE,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;iBACnE,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,IAAI,GAAG,GAAG,CAAC;;gBACxC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAkB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAE7D,IAAI,KAAsD,CAAC;YAC3D,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/B,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;oBACb,eAAe;oBACf,MAAM,MAAM,GAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAA,yBAAa,GAAE,EAAE,CAAC;oBACxE,EAAE,CAAC,IAAI,CAAC,IAAA,0BAAc,EAAC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE;wBACtC,IAAI,GAAG;4BAAE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,oBAAoB,CAAC,CAAC;oBACpE,CAAC,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,OAAO,GAAG,IAAI,CAAC;oBACf,YAAY,CAAC,SAAS,CAAC,CAAC;oBACxB,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;oBAC7B,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,oBAAoB,CAAC,CAAC,CAAC;gBACzD,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAChC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,SAAS,CAAC,CAAC;gBACxB,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC;QAEF,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAE5B,UAAU;QACV,MAAM,KAAK,GAAe,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;QACnE,EAAE,CAAC,IAAI,CAAC,IAAA,0BAAc,EAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE;YACrC,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,SAAS,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,WAAW;QACX,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,SAAS,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;YACtD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/client/protocol.d.ts

@@ -0,0 +1,36 @@
+/**
+ * 协议常量，严格对齐 sandbox 服务端 src/common/constants.ts。
+ */
+/** ws 关闭码 */
+export declare const WS_CLOSE_CODE: {
+    readonly AUTH_FAILED: 4001;
+    readonly KILLED: 4002;
+    readonly SESSION_INVALID: 4003;
+    readonly SANDBOX_OFFLINE: 4004;
+    readonly INTERNAL_ERROR: 4500;
+};
+/** RPC action 字符串，对齐 sandbox RpcAction 枚举 */
+export declare const RpcAction: {
+    readonly READ_FILE: "read_file";
+    readonly WRITE_FILE: "write_file";
+    readonly LIST_DIR: "list_dir";
+    readonly MAKE_DIR: "make_dir";
+    readonly REMOVE: "remove";
+    readonly STAT: "stat";
+    readonly EXEC_SHELL: "exec_shell";
+    readonly UPLOAD_FILE: "upload_file";
+    readonly DOWNLOAD_FILE: "download_file";
+};
+export type RpcActionType = (typeof RpcAction)[keyof typeof RpcAction];
+/** 心跳间隔（sandbox 约 90s 超时，25s 留余量） */
+export declare const PING_INTERVAL_MS = 25000;
+/** 心跳超时：连续 2 个 ping 周期未收到 pong 即判定失联（50s） */
+export declare const PONG_TIMEOUT_MS: number;
+/** 连续未收到 pong 的重连阈值 */
+export declare const MAX_MISSED_PONG = 3;
+/** 鉴权超时（sandbox 侧 10s） */
+export declare const AUTH_TIMEOUT_MS = 12000;
+/** 首次连接失败立即退出；运行中断线重连 */
+export declare const MAX_RECONNECT_ATTEMPTS = 10;
+/** 指数退避：1→2→4→8→…→60s 封顶 */
+export declare const MAX_RECONNECT_DELAY_MS = 60000;

package/dist/client/protocol.js

@@ -0,0 +1,39 @@
+"use strict";
+/**
+ * 协议常量，严格对齐 sandbox 服务端 src/common/constants.ts。
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_RECONNECT_DELAY_MS = exports.MAX_RECONNECT_ATTEMPTS = exports.AUTH_TIMEOUT_MS = exports.MAX_MISSED_PONG = exports.PONG_TIMEOUT_MS = exports.PING_INTERVAL_MS = exports.RpcAction = exports.WS_CLOSE_CODE = void 0;
+/** ws 关闭码 */
+exports.WS_CLOSE_CODE = {
+    AUTH_FAILED: 4001,
+    KILLED: 4002,
+    SESSION_INVALID: 4003,
+    SANDBOX_OFFLINE: 4004,
+    INTERNAL_ERROR: 4500,
+};
+/** RPC action 字符串，对齐 sandbox RpcAction 枚举 */
+exports.RpcAction = {
+    READ_FILE: 'read_file',
+    WRITE_FILE: 'write_file',
+    LIST_DIR: 'list_dir',
+    MAKE_DIR: 'make_dir',
+    REMOVE: 'remove',
+    STAT: 'stat',
+    EXEC_SHELL: 'exec_shell',
+    UPLOAD_FILE: 'upload_file',
+    DOWNLOAD_FILE: 'download_file',
+};
+/** 心跳间隔（sandbox 约 90s 超时，25s 留余量） */
+exports.PING_INTERVAL_MS = 25_000;
+/** 心跳超时：连续 2 个 ping 周期未收到 pong 即判定失联（50s） */
+exports.PONG_TIMEOUT_MS = exports.PING_INTERVAL_MS * 2;
+/** 连续未收到 pong 的重连阈值 */
+exports.MAX_MISSED_PONG = 3;
+/** 鉴权超时（sandbox 侧 10s） */
+exports.AUTH_TIMEOUT_MS = 12_000;
+/** 首次连接失败立即退出；运行中断线重连 */
+exports.MAX_RECONNECT_ATTEMPTS = 10;
+/** 指数退避：1→2→4→8→…→60s 封顶 */
+exports.MAX_RECONNECT_DELAY_MS = 60_000;
+//# sourceMappingURL=protocol.js.map

package/dist/client/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../src/client/protocol.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,aAAa;AACA,QAAA,aAAa,GAAG;IAC3B,WAAW,EAAE,IAAI;IACjB,MAAM,EAAE,IAAI;IACZ,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,IAAI;IACrB,cAAc,EAAE,IAAI;CACZ,CAAC;AAEX,6CAA6C;AAChC,QAAA,SAAS,GAAG;IACvB,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,YAAY;IACxB,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE,YAAY;IACxB,WAAW,EAAE,aAAa;IAC1B,aAAa,EAAE,eAAe;CACtB,CAAC;AAIX,qCAAqC;AACxB,QAAA,gBAAgB,GAAG,MAAM,CAAC;AAEvC,6CAA6C;AAChC,QAAA,eAAe,GAAG,wBAAgB,GAAG,CAAC,CAAC;AAEpD,uBAAuB;AACV,QAAA,eAAe,GAAG,CAAC,CAAC;AAEjC,0BAA0B;AACb,QAAA,eAAe,GAAG,MAAM,CAAC;AAEtC,yBAAyB;AACZ,QAAA,sBAAsB,GAAG,EAAE,CAAC;AAEzC,4BAA4B;AACf,QAAA,sBAAsB,GAAG,MAAM,CAAC"}

package/dist/client/ws-client.d.ts

@@ -0,0 +1,48 @@
+import { Logger } from '../logging/logger.js';
+import { CliFrame } from './frames.js';
+import { WsState } from '../instance/types.js';
+export type ExitReason = 'auth-failed' | 'reconnect-exhausted' | 'signal' | 'kicked';
+export interface WsClientOptions {
+    serverUrl: string;
+    sandboxId: string;
+    privateKey: string;
+    logger: Logger;
+    onWsState?: (s: WsState) => void;
+}
+/**
+ * WS 客户端 + 重连状态机 + 心跳。
+ *
+ * 状态：
+ *   CONNECTING → AUTHING → CONNECTED → (断线) → RECONNECTING → CONNECTING ...
+ *   首次建连/鉴权失败 → 立即退出（spec：连接失败就退出）
+ *   运行中断线 → 指数退避重连，最多 MAX_RECONNECT_ATTEMPTS 次
+ */
+export declare class WsClient {
+    private ws;
+    private terminal;
+    private heartbeatTimer;
+    private missedPong;
+    private pongDeadline;
+    private firstAttempt;
+    private authed;
+    private shuttingDown;
+    private opts;
+    constructor(opts: WsClientOptions);
+    /**
+     * 主循环，resolve 时表示应退出。
+     * 失败计数器：连续失败累加，成功连接（'closed' = 曾 authed 后断开）重置为 0。
+     * - 首次建连/鉴权失败 → 立即 exit（spec：连接失败就退出）
+     * - 运行中断线 → 指数退避重连，连续失败超 MAX_RECONNECT_ATTEMPTS 则退出
+     */
+    run(): Promise<ExitReason>;
+    /** 优雅关闭 */
+    shutdown(): void;
+    private setState;
+    private connectOnce;
+    private onMessage;
+    private dispatch;
+    private send;
+    private startHeartbeat;
+    private stopHeartbeat;
+}
+export type { CliFrame };

package/dist/client/ws-client.js

@@ -0,0 +1,272 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WsClient = void 0;
+const ws_1 = require("ws");
+const frames_js_1 = require("./frames.js");
+const protocol_js_1 = require("./protocol.js");
+const handshake_js_1 = require("./handshake.js");
+const router_js_1 = require("../handlers/rpc/router.js");
+const manager_js_1 = require("../handlers/terminal/manager.js");
+const router_js_2 = require("../handlers/terminal/router.js");
+/**
+ * WS 客户端 + 重连状态机 + 心跳。
+ *
+ * 状态：
+ *   CONNECTING → AUTHING → CONNECTED → (断线) → RECONNECTING → CONNECTING ...
+ *   首次建连/鉴权失败 → 立即退出（spec：连接失败就退出）
+ *   运行中断线 → 指数退避重连，最多 MAX_RECONNECT_ATTEMPTS 次
+ */
+class WsClient {
+    ws = null;
+    terminal = null;
+    heartbeatTimer = null;
+    missedPong = 0;
+    pongDeadline = 0;
+    firstAttempt = true;
+    authed = false;
+    shuttingDown = false;
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    /**
+     * 主循环，resolve 时表示应退出。
+     * 失败计数器：连续失败累加，成功连接（'closed' = 曾 authed 后断开）重置为 0。
+     * - 首次建连/鉴权失败 → 立即 exit（spec：连接失败就退出）
+     * - 运行中断线 → 指数退避重连，连续失败超 MAX_RECONNECT_ATTEMPTS 则退出
+     */
+    async run() {
+        let attempts = 0;
+        while (true) {
+            if (this.shuttingDown)
+                return 'signal';
+            if (attempts === 0) {
+                this.setState(this.firstAttempt ? 'connecting' : 'reconnecting');
+            }
+            else {
+                const delay = Math.min(protocol_js_1.MAX_RECONNECT_DELAY_MS, 1000 * 2 ** (attempts - 1));
+                this.setState('reconnecting');
+                this.opts.logger.info({ attempt: attempts, delayMs: delay }, 'reconnect attempt');
+                await sleep(delay);
+                if (this.shuttingDown)
+                    return 'signal';
+            }
+            const result = await this.connectOnce();
+            if (this.shuttingDown)
+                return 'signal';
+            if (result === 'auth-failed') {
+                if (this.firstAttempt)
+                    return 'auth-failed';
+                attempts++;
+                if (attempts > protocol_js_1.MAX_RECONNECT_ATTEMPTS)
+                    return 'reconnect-exhausted';
+                continue;
+            }
+            if (result === 'closed') {
+                // 曾成功 authed 后断开：重置失败计数，开启新一轮重连
+                this.firstAttempt = false;
+                attempts = 0;
+                continue;
+            }
+        }
+    }
+    /** 优雅关闭 */
+    shutdown() {
+        this.shuttingDown = true;
+        this.setState('exiting');
+        this.stopHeartbeat();
+        this.terminal?.closeAll();
+        if (this.ws) {
+            try {
+                this.ws.close();
+            }
+            catch {
+                // ignore
+            }
+        }
+    }
+    // ───── 内部 ─────
+    setState(s) {
+        this.opts.onWsState?.(s);
+    }
+    connectOnce() {
+        return new Promise((resolve) => {
+            let ws;
+            try {
+                ws = new ws_1.WebSocket(this.opts.serverUrl);
+            }
+            catch (err) {
+                this.opts.logger.error({ err: err instanceof Error ? err.message : String(err) }, 'ws create failed');
+                resolve('auth-failed');
+                return;
+            }
+            this.ws = ws;
+            this.setState(this.firstAttempt ? 'connecting' : 'reconnecting');
+            let settled = false;
+            const cleanup = () => {
+                // 握手阶段失败/超时：关闭并清理，避免泄漏残留监听
+                try {
+                    ws.close();
+                }
+                catch {
+                    // 已关闭则忽略
+                }
+                ws.removeAllListeners();
+            };
+            const done = (r) => {
+                if (settled)
+                    return;
+                settled = true;
+                // auth-failed 与 signal 需要主动清理；closed 时 ws 已关
+                if (r !== 'closed')
+                    cleanup();
+                resolve(r);
+            };
+            const onOpen = () => {
+                this.setState('authing');
+                (0, handshake_js_1.handshake)(ws, this.opts.sandboxId, this.opts.privateKey, this.opts.logger)
+                    .then((ok) => {
+                    if (!ok) {
+                        done('auth-failed');
+                        return;
+                    }
+                    this.authed = true;
+                    this.firstAttempt = false;
+                    this.setState('connected');
+                    this.startHeartbeat(ws);
+                    // 注册业务消息处理
+                    this.terminal = new manager_js_1.TerminalManager((f) => this.send(ws, f), this.opts.logger);
+                    ws.on('message', (raw) => this.onMessage(ws, raw));
+                    ws.once('close', () => {
+                        this.stopHeartbeat();
+                        this.terminal?.closeAll();
+                        this.terminal = null;
+                        this.authed = false;
+                        if (this.shuttingDown)
+                            done('signal');
+                        else
+                            done('closed');
+                    });
+                })
+                    .catch((err) => {
+                    this.opts.logger.error({ err: err instanceof Error ? err.message : String(err) }, 'handshake failed');
+                    done('auth-failed');
+                });
+            };
+            ws.once('open', onOpen);
+            ws.once('error', (err) => {
+                this.opts.logger.warn({ err: err.message }, 'ws error');
+                if (!this.authed)
+                    done('auth-failed');
+                // 已 authed 的运行中错误会触发 close，由 close 处理
+            });
+            ws.once('close', () => {
+                // 握手前就 close
+                if (!this.authed)
+                    done('auth-failed');
+            });
+        });
+    }
+    onMessage(ws, raw) {
+        let text;
+        if (Buffer.isBuffer(raw))
+            text = raw.toString('utf8');
+        else if (Array.isArray(raw))
+            text = Buffer.concat(raw).toString('utf8');
+        else if (typeof raw === 'string')
+            text = raw;
+        else
+            text = Buffer.from(raw).toString('utf8');
+        const frame = (0, frames_js_1.parseServerFrame)(text);
+        if (!frame) {
+            this.opts.logger.warn({ text: text.slice(0, 200) }, 'invalid frame');
+            return;
+        }
+        this.dispatch(ws, frame);
+    }
+    dispatch(ws, frame) {
+        const send = (f) => this.send(ws, f);
+        switch (frame.type) {
+            case 'pong':
+                this.missedPong = 0;
+                return;
+            case 'rpc':
+                (0, router_js_1.handleRpc)(frame, send, this.opts.logger);
+                return;
+            case 'terminal.open':
+            case 'terminal.input':
+            case 'terminal.resize':
+            case 'terminal.close':
+                if (this.terminal)
+                    (0, router_js_2.handleTerminalFrame)(frame, this.terminal);
+                return;
+            case 'hello-ack':
+            case 'report-ack':
+                // 握手阶段已处理，理论上不会再到这
+                return;
+            default:
+                this.opts.logger.warn({ type: frame.type }, 'unknown frame type, ignore');
+        }
+    }
+    send(ws, frameStr) {
+        if (ws.readyState !== ws_1.WebSocket.OPEN)
+            return;
+        ws.send(frameStr, (err) => {
+            if (err)
+                this.opts.logger.warn({ err: err.message }, 'send frame failed');
+        });
+    }
+    startHeartbeat(ws) {
+        this.missedPong = 0;
+        this.pongDeadline = 0;
+        this.heartbeatTimer = setInterval(() => {
+            if (ws.readyState !== ws_1.WebSocket.OPEN)
+                return;
+            // 半开连接兜底：服务端进程消失但 TCP 无 FIN 时，ws.send 的 callback 永不回调，
+            // missedPong 计数停滞、close 永不触发 → 卡死。用 terminate() 强制关底层 TCP（发 RST），
+            // 必然触发 close → 进入重连。上一轮 ping 超过 PONG_TIMEOUT_MS 未回即判定失联。
+            if (this.pongDeadline > 0 && Date.now() > this.pongDeadline) {
+                this.opts.logger.warn({ deadline: this.pongDeadline }, 'pong timeout, force terminate socket');
+                try {
+                    ws.terminate();
+                }
+                catch {
+                    // ignore
+                }
+                return;
+            }
+            const ping = { type: 'ping' };
+            ws.send((0, frames_js_1.serializeFrame)(ping), (err) => {
+                if (err) {
+                    this.opts.logger.warn({ err: err.message }, 'ping send failed');
+                    return;
+                }
+                // 兜底：ping 已发出但服务端无响应，50s 后强制 terminate 触发重连
+                this.pongDeadline = Date.now() + protocol_js_1.PONG_TIMEOUT_MS;
+            });
+            this.missedPong++;
+            if (this.missedPong >= protocol_js_1.MAX_MISSED_PONG) {
+                this.opts.logger.warn({ missed: this.missedPong }, 'too many missed pongs, force reconnect');
+                // 主动断开触发 close → 重连
+                try {
+                    ws.close(protocol_js_1.WS_CLOSE_CODE.KILLED, 'heartbeat timeout');
+                }
+                catch {
+                    // ignore
+                }
+            }
+        }, protocol_js_1.PING_INTERVAL_MS);
+    }
+    stopHeartbeat() {
+        if (this.heartbeatTimer) {
+            clearInterval(this.heartbeatTimer);
+            this.heartbeatTimer = null;
+        }
+        this.pongDeadline = 0;
+    }
+}
+exports.WsClient = WsClient;
+function sleep(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
+//# sourceMappingURL=ws-client.js.map