agent-tower 0.5.3 → 0.5.4-beta.1

package/dist/services/access-auth.service.js

@@ -0,0 +1,385 @@
+import { promisify } from 'node:util';
+import { createHmac, randomBytes, scrypt as scryptCallback, timingSafeEqual, } from 'node:crypto';
+import { ServiceError, ValidationError } from '../errors.js';
+import { getEventBus } from '../core/container.js';
+import { prisma } from '../utils/index.js';
+import { PREVIEW_ACCESS_TOKEN_VERSION } from '../utils/preview-path.js';
+const scrypt = promisify(scryptCallback);
+export const ACCESS_AUTH_COOKIE_NAME = 'agent-tower-access';
+export const ACCESS_AUTH_SESSION_MAX_AGE_SECONDS = 7 * 24 * 60 * 60;
+const SETTINGS_ID = 'singleton';
+const PASSWORD_HASH_PREFIX = 'scrypt:v1';
+const SESSION_TOKEN_PREFIX = 'v1';
+const PASSWORD_KEY_LENGTH = 64;
+const MIN_PASSWORD_LENGTH = 8;
+const MAX_FAILED_LOGIN_ATTEMPTS = 5;
+const LOGIN_ATTEMPT_WINDOW_MS = 15 * 60 * 1000;
+const LOGIN_COOLDOWN_MS = 60 * 1000;
+const PREVIEW_ACCESS_TOKEN_TTL_MS = 10 * 60 * 1000;
+const loginAttempts = new Map();
+let nowMs = () => Date.now();
+let sessionSecretGeneration = 0;
+let onBeforeValidateSessionTokenWithGeneration = null;
+export class AccessAuthError extends ServiceError {
+    constructor(message, code, statusCode = 400) {
+        super(message, code, statusCode);
+        this.name = 'AccessAuthError';
+    }
+}
+function newSecret() {
+    return randomBytes(32).toString('base64url');
+}
+function toSafeSettings(settings) {
+    return {
+        enabled: settings.enabled,
+        passwordConfigured: Boolean(settings.passwordHash),
+        passwordUpdatedAt: settings.passwordUpdatedAt?.toISOString() ?? null,
+    };
+}
+function assertPasswordInput(password, field = 'Password') {
+    if (password.length < MIN_PASSWORD_LENGTH) {
+        throw new ValidationError(`${field} must be at least ${MIN_PASSWORD_LENGTH} characters`);
+    }
+}
+function normalizeLoginIdentifier(identifier) {
+    const value = identifier?.trim();
+    return value ? value.slice(0, 128) : 'global';
+}
+function getActiveLoginAttempt(key, now) {
+    const entry = loginAttempts.get(key);
+    if (!entry)
+        return null;
+    if (now - entry.lastFailedAtMs > LOGIN_ATTEMPT_WINDOW_MS && entry.lockedUntilMs <= now) {
+        loginAttempts.delete(key);
+        return null;
+    }
+    return entry;
+}
+function assertLoginNotRateLimited(key) {
+    const now = nowMs();
+    const entry = getActiveLoginAttempt(key, now);
+    if (entry && entry.lockedUntilMs > now) {
+        throw new AccessAuthError('Too many login attempts. Try again later.', 'ACCESS_AUTH_RATE_LIMITED', 429);
+    }
+}
+function recordLoginFailure(key) {
+    const now = nowMs();
+    const entry = getActiveLoginAttempt(key, now);
+    const failedCount = (entry?.failedCount ?? 0) + 1;
+    loginAttempts.set(key, {
+        failedCount,
+        lastFailedAtMs: now,
+        lockedUntilMs: failedCount >= MAX_FAILED_LOGIN_ATTEMPTS ? now + LOGIN_COOLDOWN_MS : 0,
+    });
+}
+function recordLoginSuccess(key) {
+    loginAttempts.delete(key);
+}
+function splitCookieHeader(cookieHeader) {
+    const result = new Map();
+    if (!cookieHeader)
+        return result;
+    for (const part of cookieHeader.split(';')) {
+        const [rawName, ...rawValue] = part.trim().split('=');
+        if (!rawName)
+            continue;
+        result.set(rawName, decodeURIComponent(rawValue.join('=')));
+    }
+    return result;
+}
+function signSessionPayload(secret, expiresAtMs, nonce) {
+    return createHmac('sha256', secret)
+        .update(`${SESSION_TOKEN_PREFIX}.${expiresAtMs}.${nonce}`)
+        .digest('base64url');
+}
+function encodePreviewWorkspaceId(workspaceId) {
+    return Buffer.from(workspaceId, 'utf8').toString('base64url');
+}
+function signPreviewAccessPayload(secret, workspaceId, expiresAtMs, nonce) {
+    return createHmac('sha256', secret)
+        .update(`${PREVIEW_ACCESS_TOKEN_VERSION}.${encodePreviewWorkspaceId(workspaceId)}.${expiresAtMs}.${nonce}`)
+        .digest('base64url');
+}
+function isSecureRequest(request) {
+    const forwardedProto = request.headers['x-forwarded-proto'];
+    if (typeof forwardedProto === 'string' && forwardedProto.split(',')[0]?.trim() === 'https') {
+        return true;
+    }
+    return request.protocol === 'https';
+}
+async function hashPassword(password) {
+    assertPasswordInput(password);
+    const salt = randomBytes(16).toString('base64url');
+    const key = await scrypt(password, salt, PASSWORD_KEY_LENGTH);
+    return `${PASSWORD_HASH_PREFIX}:${salt}:${key.toString('base64url')}`;
+}
+async function verifyPassword(password, passwordHash) {
+    if (!passwordHash)
+        return false;
+    const [scheme, version, salt, expected] = passwordHash.split(':');
+    if (`${scheme}:${version}` !== PASSWORD_HASH_PREFIX || !salt || !expected)
+        return false;
+    const actualKey = await scrypt(password, salt, PASSWORD_KEY_LENGTH);
+    const expectedKey = Buffer.from(expected, 'base64url');
+    if (actualKey.length !== expectedKey.length)
+        return false;
+    return timingSafeEqual(actualKey, expectedKey);
+}
+async function ensureSettings() {
+    const existing = await prisma.accessAuthSettings.findUnique({
+        where: { id: SETTINGS_ID },
+    });
+    if (existing)
+        return existing;
+    return prisma.accessAuthSettings.upsert({
+        where: { id: SETTINGS_ID },
+        create: {
+            id: SETTINGS_ID,
+            enabled: false,
+            sessionSecret: newSecret(),
+        },
+        update: {},
+    });
+}
+function notifySessionSecretRotated() {
+    sessionSecretGeneration += 1;
+    getEventBus().emit('access-auth:session-secret-rotated', {
+        generation: sessionSecretGeneration,
+    });
+}
+function extractAccessAuthCookie(cookieHeader) {
+    return splitCookieHeader(cookieHeader).get(ACCESS_AUTH_COOKIE_NAME) ?? null;
+}
+function createSessionToken(settings) {
+    const expiresAtMs = Date.now() + ACCESS_AUTH_SESSION_MAX_AGE_SECONDS * 1000;
+    const nonce = randomBytes(16).toString('base64url');
+    const signature = signSessionPayload(settings.sessionSecret, expiresAtMs, nonce);
+    return `${SESSION_TOKEN_PREFIX}.${expiresAtMs}.${nonce}.${signature}`;
+}
+function createPreviewAccessToken(settings, workspaceId) {
+    const expiresAtMs = nowMs() + PREVIEW_ACCESS_TOKEN_TTL_MS;
+    const nonce = randomBytes(16).toString('base64url');
+    const encodedWorkspaceId = encodePreviewWorkspaceId(workspaceId);
+    const signature = signPreviewAccessPayload(settings.sessionSecret, workspaceId, expiresAtMs, nonce);
+    return `${PREVIEW_ACCESS_TOKEN_VERSION}.${encodedWorkspaceId}.${expiresAtMs}.${nonce}.${signature}`;
+}
+function validateSessionToken(token, settings) {
+    if (!settings.enabled || !settings.passwordHash || !token)
+        return !settings.enabled;
+    const [version, rawExpiresAt, nonce, signature] = token.split('.');
+    if (version !== SESSION_TOKEN_PREFIX || !rawExpiresAt || !nonce || !signature)
+        return false;
+    const expiresAtMs = Number(rawExpiresAt);
+    if (!Number.isFinite(expiresAtMs) || expiresAtMs <= Date.now())
+        return false;
+    const expected = signSessionPayload(settings.sessionSecret, expiresAtMs, nonce);
+    const actualBuffer = Buffer.from(signature);
+    const expectedBuffer = Buffer.from(expected);
+    if (actualBuffer.length !== expectedBuffer.length)
+        return false;
+    return timingSafeEqual(actualBuffer, expectedBuffer);
+}
+function validatePreviewAccessToken(token, workspaceId, settings) {
+    if (!token)
+        return false;
+    const [version, encodedWorkspaceId, rawExpiresAt, nonce, signature] = token.split('.');
+    if (version !== PREVIEW_ACCESS_TOKEN_VERSION
+        || encodedWorkspaceId !== encodePreviewWorkspaceId(workspaceId)
+        || !rawExpiresAt
+        || !nonce
+        || !signature) {
+        return false;
+    }
+    const expiresAtMs = Number(rawExpiresAt);
+    if (!Number.isFinite(expiresAtMs) || expiresAtMs <= nowMs())
+        return false;
+    const expected = signPreviewAccessPayload(settings.sessionSecret, workspaceId, expiresAtMs, nonce);
+    const actualBuffer = Buffer.from(signature);
+    const expectedBuffer = Buffer.from(expected);
+    if (actualBuffer.length !== expectedBuffer.length)
+        return false;
+    return timingSafeEqual(actualBuffer, expectedBuffer);
+}
+export const AccessAuthService = {
+    cookieName: ACCESS_AUTH_COOKIE_NAME,
+    getCookieOptions(request, maxAge = ACCESS_AUTH_SESSION_MAX_AGE_SECONDS) {
+        return {
+            httpOnly: true,
+            sameSite: 'lax',
+            secure: isSecureRequest(request),
+            path: '/',
+            maxAge,
+        };
+    },
+    getClearCookieOptions(request) {
+        return {
+            httpOnly: true,
+            sameSite: 'lax',
+            secure: isSecureRequest(request),
+            path: '/',
+        };
+    },
+    extractCookieFromHeader: extractAccessAuthCookie,
+    async getSettings() {
+        return toSafeSettings(await ensureSettings());
+    },
+    async getPublicStatus(cookieToken) {
+        const settings = await ensureSettings();
+        return {
+            enabled: settings.enabled,
+            authenticated: settings.enabled ? validateSessionToken(cookieToken, settings) : true,
+        };
+    },
+    async isEnabled() {
+        const settings = await ensureSettings();
+        return settings.enabled;
+    },
+    async validateSessionToken(cookieToken) {
+        const settings = await ensureSettings();
+        return validateSessionToken(cookieToken, settings);
+    },
+    async validateSessionTokenWithGeneration(cookieToken) {
+        const generation = sessionSecretGeneration;
+        const settings = await ensureSettings();
+        onBeforeValidateSessionTokenWithGeneration?.();
+        const valid = validateSessionToken(cookieToken, settings)
+            && generation === sessionSecretGeneration;
+        return { valid, generation };
+    },
+    getSessionSecretGeneration() {
+        return sessionSecretGeneration;
+    },
+    async createPreviewAccessToken(workspaceId) {
+        const settings = await ensureSettings();
+        return createPreviewAccessToken(settings, workspaceId);
+    },
+    async validatePreviewAccessToken(token, workspaceId) {
+        const settings = await ensureSettings();
+        return validatePreviewAccessToken(token, workspaceId, settings);
+    },
+    async login(password, identifier) {
+        const settings = await ensureSettings();
+        if (!settings.enabled) {
+            return {
+                status: { enabled: false, authenticated: true },
+                sessionToken: null,
+            };
+        }
+        const loginKey = normalizeLoginIdentifier(identifier);
+        assertLoginNotRateLimited(loginKey);
+        if (!await verifyPassword(password, settings.passwordHash)) {
+            recordLoginFailure(loginKey);
+            throw new AccessAuthError('Invalid access password', 'ACCESS_AUTH_INVALID_PASSWORD', 401);
+        }
+        recordLoginSuccess(loginKey);
+        return {
+            status: { enabled: true, authenticated: true },
+            sessionToken: createSessionToken(settings),
+        };
+    },
+    async updateSettings(input) {
+        const current = await ensureSettings();
+        const wantsDisable = input.enabled === false;
+        const wantsEnable = input.enabled === true;
+        const newPassword = input.newPassword;
+        const currentPassword = input.currentPassword ?? '';
+        if (current.enabled && (wantsDisable || newPassword)) {
+            if (!currentPassword || !await verifyPassword(currentPassword, current.passwordHash)) {
+                throw new AccessAuthError('Current password is incorrect', 'ACCESS_AUTH_INVALID_CURRENT_PASSWORD', 401);
+            }
+        }
+        if (!current.enabled && wantsEnable && !newPassword) {
+            throw new ValidationError('New password is required when enabling access password');
+        }
+        if (newPassword) {
+            assertPasswordInput(newPassword, 'New password');
+        }
+        if (wantsDisable) {
+            const settings = await prisma.accessAuthSettings.update({
+                where: { id: SETTINGS_ID },
+                data: {
+                    enabled: false,
+                    passwordHash: null,
+                    sessionSecret: newSecret(),
+                },
+            });
+            notifySessionSecretRotated();
+            return {
+                settings: toSafeSettings(settings),
+                sessionToken: null,
+                clearSession: true,
+            };
+        }
+        if (wantsEnable || newPassword) {
+            const passwordHash = newPassword ? await hashPassword(newPassword) : current.passwordHash;
+            if (!passwordHash) {
+                throw new ValidationError('New password is required');
+            }
+            const settings = await prisma.accessAuthSettings.update({
+                where: { id: SETTINGS_ID },
+                data: {
+                    enabled: wantsEnable || current.enabled,
+                    passwordHash,
+                    passwordUpdatedAt: new Date(),
+                    sessionSecret: newSecret(),
+                },
+            });
+            notifySessionSecretRotated();
+            return {
+                settings: toSafeSettings(settings),
+                sessionToken: createSessionToken(settings),
+                clearSession: false,
+            };
+        }
+        return {
+            settings: toSafeSettings(current),
+            sessionToken: null,
+            clearSession: false,
+        };
+    },
+    async disableForRecovery() {
+        await prisma.accessAuthSettings.upsert({
+            where: { id: SETTINGS_ID },
+            create: {
+                id: SETTINGS_ID,
+                enabled: false,
+                passwordHash: null,
+                sessionSecret: newSecret(),
+            },
+            update: {
+                enabled: false,
+                passwordHash: null,
+                sessionSecret: newSecret(),
+            },
+        });
+        notifySessionSecretRotated();
+    },
+    __test: {
+        MIN_PASSWORD_LENGTH,
+        MAX_FAILED_LOGIN_ATTEMPTS,
+        LOGIN_COOLDOWN_MS,
+        PREVIEW_ACCESS_TOKEN_TTL_MS,
+        hashPassword,
+        verifyPassword,
+        validateSessionToken,
+        createSessionToken,
+        createPreviewAccessToken,
+        validatePreviewAccessToken,
+        resetSessionSecretGeneration() {
+            sessionSecretGeneration = 0;
+            onBeforeValidateSessionTokenWithGeneration = null;
+        },
+        notifySessionSecretRotated,
+        setBeforeValidateSessionTokenWithGenerationHook(hook) {
+            onBeforeValidateSessionTokenWithGeneration = hook;
+        },
+        resetLoginRateLimit() {
+            loginAttempts.clear();
+            nowMs = () => Date.now();
+        },
+        setLoginRateLimitClock(clock) {
+            nowMs = clock;
+        },
+    },
+};
+//# sourceMappingURL=access-auth.service.js.map

package/dist/services/access-auth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-auth.service.js","sourceRoot":"","sources":["../../src/services/access-auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,UAAU,EACV,WAAW,EACX,MAAM,IAAI,cAAc,EACxB,eAAe,GAChB,MAAM,aAAa,CAAC;AAOrB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AAExE,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;AAEzC,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAC5D,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEpE,MAAM,WAAW,GAAG,WAAW,CAAC;AAChC,MAAM,oBAAoB,GAAG,WAAW,CAAC;AACzC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAClC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,yBAAyB,GAAG,CAAC,CAAC;AACpC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAkBnD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA6B,CAAC;AAC3D,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;AAC7B,IAAI,uBAAuB,GAAG,CAAC,CAAC;AAChC,IAAI,0CAA0C,GAAwB,IAAI,CAAC;AAE3E,MAAM,OAAO,eAAgB,SAAQ,YAAY;IAC/C,YAAY,OAAe,EAAE,IAAY,EAAE,UAAU,GAAG,GAAG;QACzD,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,SAAS,SAAS;IAChB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,cAAc,CAAC,QAAkC;IACxD,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,kBAAkB,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;QAClD,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,EAAE,WAAW,EAAE,IAAI,IAAI;KACrE,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB,EAAE,KAAK,GAAG,UAAU;IAC/D,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QAC1C,MAAM,IAAI,eAAe,CAAC,GAAG,KAAK,qBAAqB,mBAAmB,aAAa,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,UAAmB;IACnD,MAAM,KAAK,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC;IACjC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAChD,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW,EAAE,GAAW;IACrD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,GAAG,GAAG,KAAK,CAAC,cAAc,GAAG,uBAAuB,IAAI,KAAK,CAAC,aAAa,IAAI,GAAG,EAAE,CAAC;QACvF,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAW;IAC5C,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;IACpB,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,KAAK,IAAI,KAAK,CAAC,aAAa,GAAG,GAAG,EAAE,CAAC;QACvC,MAAM,IAAI,eAAe,CAAC,2CAA2C,EAAE,0BAA0B,EAAE,GAAG,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;IACpB,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAClD,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE;QACrB,WAAW;QACX,cAAc,EAAE,GAAG;QACnB,aAAa,EAAE,WAAW,IAAI,yBAAyB,CAAC,CAAC,CAAC,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;KACtF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,iBAAiB,CAAC,YAAqB;IAC9C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,IAAI,CAAC,YAAY;QAAE,OAAO,MAAM,CAAC;IAEjC,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc,EAAE,WAAmB,EAAE,KAAa;IAC5E,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;SAChC,MAAM,CAAC,GAAG,oBAAoB,IAAI,WAAW,IAAI,KAAK,EAAE,CAAC;SACzD,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,wBAAwB,CAAC,WAAmB;IACnD,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAAc,EACd,WAAmB,EACnB,WAAmB,EACnB,KAAa;IAEb,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;SAChC,MAAM,CAAC,GAAG,4BAA4B,IAAI,wBAAwB,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,KAAK,EAAE,CAAC;SAC1G,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,eAAe,CAAC,OAAuB;IAC9C,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5D,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAgB;IAC1C,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,mBAAmB,CAAW,CAAC;IACxE,OAAO,GAAG,oBAAoB,IAAI,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,YAA2B;IACzE,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAEhC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,GAAG,MAAM,IAAI,OAAO,EAAE,KAAK,oBAAoB,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAExF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,mBAAmB,CAAW,CAAC;IAC9E,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACvD,IAAI,SAAS,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,cAAc;IAC3B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC;QAC1D,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE;KAC3B,CAAC,CAAC;IACH,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,OAAO,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC;QACtC,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE;QAC1B,MAAM,EAAE;YACN,EAAE,EAAE,WAAW;YACf,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,SAAS,EAAE;SAC3B;QACD,MAAM,EAAE,EAAE;KACX,CAAC,CAAC;AACL,CAAC;AAED,SAAS,0BAA0B;IACjC,uBAAuB,IAAI,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,IAAI,CAAC,oCAAoC,EAAE;QACvD,UAAU,EAAE,uBAAuB;KACpC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,uBAAuB,CAAC,YAAqB;IACpD,OAAO,iBAAiB,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC;AAC9E,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAkC;IAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,mCAAmC,GAAG,IAAI,CAAC;IAC5E,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,aAAa,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IACjF,OAAO,GAAG,oBAAoB,IAAI,WAAW,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAkC,EAAE,WAAmB;IACvF,MAAM,WAAW,GAAG,KAAK,EAAE,GAAG,2BAA2B,CAAC;IAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,wBAAwB,CAAC,QAAQ,CAAC,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IACpG,OAAO,GAAG,4BAA4B,IAAI,kBAAkB,IAAI,WAAW,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;AACtG,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAoB,EAAE,QAAkC;IACpF,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAEpF,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnE,IAAI,OAAO,KAAK,oBAAoB,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAE5F,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAE7E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,aAAa,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IAChF,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,YAAY,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,0BAA0B,CACjC,KAAoB,EACpB,WAAmB,EACnB,QAAkC;IAElC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEzB,MAAM,CAAC,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvF,IACE,OAAO,KAAK,4BAA4B;WACrC,kBAAkB,KAAK,wBAAwB,CAAC,WAAW,CAAC;WAC5D,CAAC,YAAY;WACb,CAAC,KAAK;WACN,CAAC,SAAS,EACb,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAE1E,MAAM,QAAQ,GAAG,wBAAwB,CAAC,QAAQ,CAAC,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IACnG,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,YAAY,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,UAAU,EAAE,uBAAuB;IAEnC,gBAAgB,CAAC,OAAuB,EAAE,MAAM,GAAG,mCAAmC;QACpF,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAc;YACxB,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC;YAChC,IAAI,EAAE,GAAG;YACT,MAAM;SACP,CAAC;IACJ,CAAC;IAED,qBAAqB,CAAC,OAAuB;QAC3C,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAc;YACxB,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC;YAChC,IAAI,EAAE,GAAG;SACV,CAAC;IACJ,CAAC;IAED,uBAAuB,EAAE,uBAAuB;IAEhD,KAAK,CAAC,WAAW;QACf,OAAO,cAAc,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAA0B;QAC9C,MAAM,QAAQ,GAAG,MAAM,cAAc,EAAE,CAAC;QACxC,OAAO;YACL,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;SACrF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,QAAQ,GAAG,MAAM,cAAc,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,WAA0B;QACnD,MAAM,QAAQ,GAAG,MAAM,cAAc,EAAE,CAAC;QACxC,OAAO,oBAAoB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,kCAAkC,CACtC,WAA0B;QAE1B,MAAM,UAAU,GAAG,uBAAuB,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,cAAc,EAAE,CAAC;QACxC,0CAA0C,EAAE,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,EAAE,QAAQ,CAAC;eACpD,UAAU,KAAK,uBAAuB,CAAC;QAC5C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC/B,CAAC;IAED,0BAA0B;QACxB,OAAO,uBAAuB,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,WAAmB;QAChD,MAAM,QAAQ,GAAG,MAAM,cAAc,EAAE,CAAC;QACxC,OAAO,wBAAwB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,0BAA0B,CAAC,KAAoB,EAAE,WAAmB;QACxE,MAAM,QAAQ,GAAG,MAAM,cAAc,EAAE,CAAC;QACxC,OAAO,0BAA0B,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,KAAK,CACT,QAAgB,EAChB,UAAmB;QAEnB,MAAM,QAAQ,GAAG,MAAM,cAAc,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO;gBACL,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;gBAC/C,YAAY,EAAE,IAAI;aACnB,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QACtD,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAEpC,IAAI,CAAC,MAAM,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3D,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC7B,MAAM,IAAI,eAAe,CAAC,yBAAyB,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAC;QAC5F,CAAC;QAED,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;YAC9C,YAAY,EAAE,kBAAkB,CAAC,QAAQ,CAAC;SAC3C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAoC;QAKvD,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;QACvC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC;QAC7C,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;QAC3C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QACtC,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC;QAEpD,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,cAAc,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBACrF,MAAM,IAAI,eAAe,CAAC,+BAA+B,EAAE,sCAAsC,EAAE,GAAG,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;YACpD,MAAM,IAAI,eAAe,CAAC,wDAAwD,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,mBAAmB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC;gBACtD,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE;gBAC1B,IAAI,EAAE;oBACJ,OAAO,EAAE,KAAK;oBACd,YAAY,EAAE,IAAI;oBAClB,aAAa,EAAE,SAAS,EAAE;iBAC3B;aACF,CAAC,CAAC;YACH,0BAA0B,EAAE,CAAC;YAC7B,OAAO;gBACL,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC;gBAClC,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,IAAI;aACnB,CAAC;QACJ,CAAC;QAED,IAAI,WAAW,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;YAC1F,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,eAAe,CAAC,0BAA0B,CAAC,CAAC;YACxD,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC;gBACtD,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE;gBAC1B,IAAI,EAAE;oBACJ,OAAO,EAAE,WAAW,IAAI,OAAO,CAAC,OAAO;oBACvC,YAAY;oBACZ,iBAAiB,EAAE,IAAI,IAAI,EAAE;oBAC7B,aAAa,EAAE,SAAS,EAAE;iBAC3B;aACF,CAAC,CAAC;YACH,0BAA0B,EAAE,CAAC;YAE7B,OAAO;gBACL,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC;gBAClC,YAAY,EAAE,kBAAkB,CAAC,QAAQ,CAAC;gBAC1C,YAAY,EAAE,KAAK;aACpB,CAAC;QACJ,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC;YACjC,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,KAAK;SACpB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB;QACtB,MAAM,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC;YACrC,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE;YAC1B,MAAM,EAAE;gBACN,EAAE,EAAE,WAAW;gBACf,OAAO,EAAE,KAAK;gBACd,YAAY,EAAE,IAAI;gBAClB,aAAa,EAAE,SAAS,EAAE;aAC3B;YACD,MAAM,EAAE;gBACN,OAAO,EAAE,KAAK;gBACd,YAAY,EAAE,IAAI;gBAClB,aAAa,EAAE,SAAS,EAAE;aAC3B;SACF,CAAC,CAAC;QACH,0BAA0B,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,EAAE;QACN,mBAAmB;QACnB,yBAAyB;QACzB,iBAAiB;QACjB,2BAA2B;QAC3B,YAAY;QACZ,cAAc;QACd,oBAAoB;QACpB,kBAAkB;QAClB,wBAAwB;QACxB,0BAA0B;QAC1B,4BAA4B;YAC1B,uBAAuB,GAAG,CAAC,CAAC;YAC5B,0CAA0C,GAAG,IAAI,CAAC;QACpD,CAAC;QACD,0BAA0B;QAC1B,+CAA+C,CAAC,IAAyB;YACvE,0CAA0C,GAAG,IAAI,CAAC;QACpD,CAAC;QACD,mBAAmB;YACjB,aAAa,CAAC,KAAK,EAAE,CAAC;YACtB,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,CAAC;QACD,sBAAsB,CAAC,KAAmB;YACxC,KAAK,GAAG,KAAK,CAAC;QAChB,CAAC;KACF;CACF,CAAC"}

package/dist/services/mcp-config.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-config.service.d.ts","sourceRoot":"","sources":["../../src/services/mcp-config.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAwB,MAAM,qBAAqB,CAAC;AA0BnF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;CACtB,GAAG,iBAAiB,CA2BpB"}
+{"version":3,"file":"mcp-config.service.d.ts","sourceRoot":"","sources":["../../src/services/mcp-config.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAwB,MAAM,qBAAqB,CAAC;AA0BnF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;CACtB,GAAG,iBAAiB,CAiCpB"}

package/dist/services/mcp-config.service.js

@@ -1,5 +1,5 @@
 import path from 'node:path';
-import { getDefaultDataDir } from '../utils/data-dir.js';
+import { INTERNAL_API_TOKEN_ENV, requireInternalApiTokenFromEnv } from '../utils/internal-api-token.js';
 const SERVER_NAME = 'agent-tower';
 function resolveRuntimeMode(env) {
     return env.AGENT_TOWER_DESKTOP_RUNTIME_MODE === 'packaged' ? 'desktop-packaged' : 'workspace';
@@ -27,8 +27,14 @@ export function buildMcpConfigResponse(options) {
         ? env.AGENT_TOWER_NODE_RUNTIME || process.execPath
         : env.AGENT_TOWER_DESKTOP_NODE || process.execPath;
     const configEnv = {
-        AGENT_TOWER_DATA_DIR: env.AGENT_TOWER_DATA_DIR || getDefaultDataDir(),
+        [INTERNAL_API_TOKEN_ENV]: requireInternalApiTokenFromEnv(env),
     };
+    if (env.AGENT_TOWER_URL) {
+        configEnv.AGENT_TOWER_URL = env.AGENT_TOWER_URL;
+    }
+    if (env.AGENT_TOWER_PORT) {
+        configEnv.AGENT_TOWER_PORT = env.AGENT_TOWER_PORT;
+    }
     if (runtimeMode === 'desktop-packaged' && env.ELECTRON_RUN_AS_NODE === '1') {
         configEnv.ELECTRON_RUN_AS_NODE = '1';
     }

package/dist/services/mcp-config.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-config.service.js","sourceRoot":"","sources":["../../src/services/mcp-config.service.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,MAAM,WAAW,GAAG,aAAa,CAAC;AAElC,SAAS,kBAAkB,CAAC,GAAsB;IAChD,OAAO,GAAG,CAAC,gCAAgC,KAAK,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC;AAChG,CAAC;AAED,SAAS,eAAe,CAAC,GAAsB,EAAE,WAAmB;IAClE,OAAO,GAAG,CAAC,qBAAqB,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,IAAc,EAAE,GAA2B;IACnF,MAAM,YAAY,GAAG;QACnB,OAAO;QACP,IAAI;QACJ,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,UAAU,EAAE;YACV,CAAC,WAAW,CAAC,EAAE,YAAY;SAC5B;KACF,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACd,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAGtC;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,WAAW,KAAK,kBAAkB;QAChD,CAAC,CAAC,GAAG,CAAC,wBAAwB,IAAI,OAAO,CAAC,QAAQ;QAClD,CAAC,CAAC,GAAG,CAAC,wBAAwB,IAAI,OAAO,CAAC,QAAQ,CAAC;IACrD,MAAM,SAAS,GAA2B;QACxC,oBAAoB,EAAE,GAAG,CAAC,oBAAoB,IAAI,iBAAiB,EAAE;KACtE,CAAC;IAEF,IAAI,WAAW,KAAK,kBAAkB,IAAI,GAAG,CAAC,oBAAoB,KAAK,GAAG,EAAE,CAAC;QAC3E,SAAS,CAAC,oBAAoB,GAAG,GAAG,CAAC;IACvC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAE7D,OAAO;QACL,UAAU,EAAE,WAAW;QACvB,WAAW;QACX,OAAO;QACP,IAAI;QACJ,GAAG,EAAE,SAAS;QACd,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAgC;QAC7D,UAAU;KACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"mcp-config.service.js","sourceRoot":"","sources":["../../src/services/mcp-config.service.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,sBAAsB,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAExG,MAAM,WAAW,GAAG,aAAa,CAAC;AAElC,SAAS,kBAAkB,CAAC,GAAsB;IAChD,OAAO,GAAG,CAAC,gCAAgC,KAAK,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC;AAChG,CAAC;AAED,SAAS,eAAe,CAAC,GAAsB,EAAE,WAAmB;IAClE,OAAO,GAAG,CAAC,qBAAqB,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,IAAc,EAAE,GAA2B;IACnF,MAAM,YAAY,GAAG;QACnB,OAAO;QACP,IAAI;QACJ,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,UAAU,EAAE;YACV,CAAC,WAAW,CAAC,EAAE,YAAY;SAC5B;KACF,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACd,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAGtC;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,WAAW,KAAK,kBAAkB;QAChD,CAAC,CAAC,GAAG,CAAC,wBAAwB,IAAI,OAAO,CAAC,QAAQ;QAClD,CAAC,CAAC,GAAG,CAAC,wBAAwB,IAAI,OAAO,CAAC,QAAQ,CAAC;IACrD,MAAM,SAAS,GAA2B;QACxC,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,GAAG,CAAC;KAC9D,CAAC;IACF,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;QACxB,SAAS,CAAC,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC;IAClD,CAAC;IACD,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACzB,SAAS,CAAC,gBAAgB,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACpD,CAAC;IAED,IAAI,WAAW,KAAK,kBAAkB,IAAI,GAAG,CAAC,oBAAoB,KAAK,GAAG,EAAE,CAAC;QAC3E,SAAS,CAAC,oBAAoB,GAAG,GAAG,CAAC;IACvC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAE7D,OAAO;QACL,UAAU,EAAE,WAAW;QACvB,WAAW;QACX,OAAO;QACP,IAAI;QACJ,GAAG,EAAE,SAAS;QACd,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAgC;QAC7D,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/services/mcp-config.service.test.js

@@ -10,13 +10,18 @@ describe('mcp-config service', () => {
                 AGENT_TOWER_NODE_RUNTIME: 'C:\\Program Files\\Agent Tower\\resources\\runtime\\node\\node.exe',
                 AGENT_TOWER_MCP_ENTRY: '/app/Resources/runtime/server/dist/mcp/index.js',
                 AGENT_TOWER_DATA_DIR: '/Users/test/.agent-tower',
+                AGENT_TOWER_URL: 'http://127.0.0.1:12580',
+                AGENT_TOWER_PORT: '12580',
+                AGENT_TOWER_INTERNAL_TOKEN: 'test-internal-token',
             },
         });
         expect(config.runtimeMode).toBe('desktop-packaged');
         expect(config.command).toBe('C:\\Program Files\\Agent Tower\\resources\\runtime\\node\\node.exe');
         expect(config.args).toEqual(['/app/Resources/runtime/server/dist/mcp/index.js']);
         expect(config.env).toEqual({
-            AGENT_TOWER_DATA_DIR: '/Users/test/.agent-tower',
+            AGENT_TOWER_INTERNAL_TOKEN: 'test-internal-token',
+            AGENT_TOWER_URL: 'http://127.0.0.1:12580',
+            AGENT_TOWER_PORT: '12580',
         });
         expect(config.configJson).toContain('/app/Resources/runtime/server/dist/mcp/index.js');
         expect(config.configJson).not.toContain('agent-tower-mcp');
@@ -29,12 +34,13 @@ describe('mcp-config service', () => {
                 AGENT_TOWER_NODE_RUNTIME: '/app/Contents/MacOS/Agent Tower',
                 AGENT_TOWER_MCP_ENTRY: '/app/Resources/runtime/server/dist/mcp/index.js',
                 AGENT_TOWER_DATA_DIR: '/Users/test/.agent-tower',
+                AGENT_TOWER_INTERNAL_TOKEN: 'test-internal-token',
                 ELECTRON_RUN_AS_NODE: '1',
             },
         });
         expect(config.command).toBe('/app/Contents/MacOS/Agent Tower');
         expect(config.env).toEqual({
-            AGENT_TOWER_DATA_DIR: '/Users/test/.agent-tower',
+            AGENT_TOWER_INTERNAL_TOKEN: 'test-internal-token',
             ELECTRON_RUN_AS_NODE: '1',
         });
     });
@@ -44,15 +50,24 @@ describe('mcp-config service', () => {
             serverDistDir,
             env: {
                 AGENT_TOWER_DATA_DIR: '/tmp/agent-tower-desktop-dev/data',
+                AGENT_TOWER_URL: 'http://127.0.0.1:42232',
+                AGENT_TOWER_INTERNAL_TOKEN: 'test-internal-token',
             },
         });
         expect(config.runtimeMode).toBe('workspace');
         expect(config.command).toBe(process.execPath);
         expect(config.args).toEqual([path.join(serverDistDir, 'mcp/index.js')]);
         expect(config.env).toEqual({
-            AGENT_TOWER_DATA_DIR: '/tmp/agent-tower-desktop-dev/data',
+            AGENT_TOWER_INTERNAL_TOKEN: 'test-internal-token',
+            AGENT_TOWER_URL: 'http://127.0.0.1:42232',
         });
         expect(config.configJson).not.toContain('agent-tower-mcp');
     });
+    it('fails clearly when internal token env is missing', () => {
+        expect(() => buildMcpConfigResponse({
+            serverDistDir: '/repo/packages/server/dist',
+            env: {},
+        })).toThrow('AGENT_TOWER_INTERNAL_TOKEN is required');
+    });
 });
 //# sourceMappingURL=mcp-config.service.test.js.map

package/dist/services/mcp-config.service.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-config.service.test.js","sourceRoot":"","sources":["../../src/services/mcp-config.service.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAEhE,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,MAAM,GAAG,sBAAsB,CAAC;YACpC,aAAa,EAAE,oCAAoC;YACnD,GAAG,EAAE;gBACH,gCAAgC,EAAE,UAAU;gBAC5C,wBAAwB,EAAE,oEAAoE;gBAC9F,qBAAqB,EAAE,iDAAiD;gBACxE,oBAAoB,EAAE,0BAA0B;aAC5B;SACvB,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QACnD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAA;QACjG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAA;QAChF,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YACzB,oBAAoB,EAAE,0BAA0B;SACjD,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,iDAAiD,CAAC,CAAA;QACtF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,MAAM,GAAG,sBAAsB,CAAC;YACpC,aAAa,EAAE,oCAAoC;YACnD,GAAG,EAAE;gBACH,gCAAgC,EAAE,UAAU;gBAC5C,wBAAwB,EAAE,iCAAiC;gBAC3D,qBAAqB,EAAE,iDAAiD;gBACxE,oBAAoB,EAAE,0BAA0B;gBAChD,oBAAoB,EAAE,GAAG;aACL;SACvB,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAA;QAC9D,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YACzB,oBAAoB,EAAE,0BAA0B;YAChD,oBAAoB,EAAE,GAAG;SAC1B,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAA;QAChE,MAAM,MAAM,GAAG,sBAAsB,CAAC;YACpC,aAAa;YACb,GAAG,EAAE;gBACH,oBAAoB,EAAE,mCAAmC;aACrC;SACvB,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC7C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,CAAA;QACvE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YACzB,oBAAoB,EAAE,mCAAmC;SAC1D,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"mcp-config.service.test.js","sourceRoot":"","sources":["../../src/services/mcp-config.service.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAEhE,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,MAAM,GAAG,sBAAsB,CAAC;YACpC,aAAa,EAAE,oCAAoC;YACnD,GAAG,EAAE;gBACH,gCAAgC,EAAE,UAAU;gBAC5C,wBAAwB,EAAE,oEAAoE;gBAC9F,qBAAqB,EAAE,iDAAiD;gBACxE,oBAAoB,EAAE,0BAA0B;gBAChD,eAAe,EAAE,wBAAwB;gBACzC,gBAAgB,EAAE,OAAO;gBACzB,0BAA0B,EAAE,qBAAqB;aAC7B;SACvB,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QACnD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAA;QACjG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAA;QAChF,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YACzB,0BAA0B,EAAE,qBAAqB;YACjD,eAAe,EAAE,wBAAwB;YACzC,gBAAgB,EAAE,OAAO;SAC1B,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,iDAAiD,CAAC,CAAA;QACtF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,MAAM,GAAG,sBAAsB,CAAC;YACpC,aAAa,EAAE,oCAAoC;YACnD,GAAG,EAAE;gBACH,gCAAgC,EAAE,UAAU;gBAC5C,wBAAwB,EAAE,iCAAiC;gBAC3D,qBAAqB,EAAE,iDAAiD;gBACxE,oBAAoB,EAAE,0BAA0B;gBAChD,0BAA0B,EAAE,qBAAqB;gBACjD,oBAAoB,EAAE,GAAG;aACL;SACvB,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAA;QAC9D,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YACzB,0BAA0B,EAAE,qBAAqB;YACjD,oBAAoB,EAAE,GAAG;SAC1B,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAA;QAChE,MAAM,MAAM,GAAG,sBAAsB,CAAC;YACpC,aAAa;YACb,GAAG,EAAE;gBACH,oBAAoB,EAAE,mCAAmC;gBACzD,eAAe,EAAE,wBAAwB;gBACzC,0BAA0B,EAAE,qBAAqB;aAC7B;SACvB,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC7C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,CAAA;QACvE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YACzB,0BAA0B,EAAE,qBAAqB;YACjD,eAAe,EAAE,wBAAwB;SAC1C,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC;YAClC,aAAa,EAAE,4BAA4B;YAC3C,GAAG,EAAE,EAAuB;SAC7B,CAAC,CAAC,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/services/member-heartbeat-scheduler.d.ts

@@ -0,0 +1,33 @@
+import type { EventBus } from '../core/event-bus.js';
+import type { SessionManager } from './session-manager.js';
+import { TeamReconcilerService } from './team-reconciler.service.js';
+export interface MemberHeartbeatSchedulerDeps {
+    eventBus: EventBus;
+    sessionManager: SessionManager;
+    tickIntervalMs?: number;
+    reconciler?: TeamReconcilerService;
+}
+/**
+ * TeamRun 成员心跳 watchdog。
+ *
+ * 现有 TeamRun 调度完全事件驱动（依赖 PTY 退出事件），无法发现“进程仍在但无任何进展”的卡死成员，
+ * 也没有任何地方周期调用 reconcileDueRoomReplyReminders。该调度器以固定 tick 周期承担三件事：
+ *  1. 首扫回收 server 重启后脱管的 RUNNING invocation（reconcileOrphanInvocations）；
+ *  2. 唤醒/释放长时间无 session:patch 进展的 RUNNING 成员（reconcileStalledInvocations）；
+ *  3. 推进到期的 room reply 补催（reconcileDueRoomReplyReminders）。
+ *
+ * 唤醒与补催复用同一 reconciler 状态机（统一计数/退避/释放闭环）。
+ */
+export declare class MemberHeartbeatScheduler {
+    private timer;
+    private initialScanTimer;
+    private running;
+    private orphanScanDone;
+    private readonly tickIntervalMs;
+    private readonly reconciler;
+    constructor(deps: MemberHeartbeatSchedulerDeps);
+    start(): void;
+    stop(): void;
+    private tick;
+}
+//# sourceMappingURL=member-heartbeat-scheduler.d.ts.map

package/dist/services/member-heartbeat-scheduler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"member-heartbeat-scheduler.d.ts","sourceRoot":"","sources":["../../src/services/member-heartbeat-scheduler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAMrE,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,QAAQ,CAAC;IACnB,cAAc,EAAE,cAAc,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,qBAAqB,CAAC;CACpC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,KAAK,CAA+C;IAC5D,OAAO,CAAC,gBAAgB,CAA8C;IACtE,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAwB;gBAEvC,IAAI,EAAE,4BAA4B;IAU9C,KAAK,IAAI,IAAI;IAuBb,IAAI,IAAI,IAAI;YAYE,IAAI;CAoBnB"}

package/dist/services/member-heartbeat-scheduler.js

@@ -0,0 +1,83 @@
+import { TeamReconcilerService } from './team-reconciler.service.js';
+const DEFAULT_TICK_INTERVAL_MS = 30_000;
+// 首扫延迟：让其它服务先完成初始化，再回收 server 重启遗留的 orphan invocation。
+const INITIAL_SCAN_DELAY_MS = 10_000;
+/**
+ * TeamRun 成员心跳 watchdog。
+ *
+ * 现有 TeamRun 调度完全事件驱动（依赖 PTY 退出事件），无法发现“进程仍在但无任何进展”的卡死成员，
+ * 也没有任何地方周期调用 reconcileDueRoomReplyReminders。该调度器以固定 tick 周期承担三件事：
+ *  1. 首扫回收 server 重启后脱管的 RUNNING invocation（reconcileOrphanInvocations）；
+ *  2. 唤醒/释放长时间无 session:patch 进展的 RUNNING 成员（reconcileStalledInvocations）；
+ *  3. 推进到期的 room reply 补催（reconcileDueRoomReplyReminders）。
+ *
+ * 唤醒与补催复用同一 reconciler 状态机（统一计数/退避/释放闭环）。
+ */
+export class MemberHeartbeatScheduler {
+    timer = null;
+    initialScanTimer = null;
+    running = false;
+    orphanScanDone = false;
+    tickIntervalMs;
+    reconciler;
+    constructor(deps) {
+        this.tickIntervalMs = deps.tickIntervalMs ?? DEFAULT_TICK_INTERVAL_MS;
+        // watchdog 用轮询驱动续催/唤醒，因此 reconciler 关闭内部 setTimeout，避免与轮询重复触发。
+        this.reconciler = deps.reconciler ?? new TeamReconcilerService({
+            eventBus: deps.eventBus,
+            sessionMessenger: deps.sessionManager,
+            scheduleReminders: false,
+        });
+    }
+    start() {
+        if (this.timer) {
+            return;
+        }
+        console.log(`[MemberHeartbeatScheduler] Started (interval: ${this.tickIntervalMs / 1000}s)`);
+        this.timer = setInterval(() => {
+            this.tick().catch((err) => {
+                console.error('[MemberHeartbeatScheduler] Tick failed:', err);
+            });
+        }, this.tickIntervalMs);
+        this.timer.unref?.();
+        this.initialScanTimer = setTimeout(() => {
+            this.initialScanTimer = null;
+            this.tick().catch((err) => {
+                console.error('[MemberHeartbeatScheduler] Initial tick failed:', err);
+            });
+        }, INITIAL_SCAN_DELAY_MS);
+        this.initialScanTimer.unref?.();
+    }
+    stop() {
+        if (this.initialScanTimer) {
+            clearTimeout(this.initialScanTimer);
+            this.initialScanTimer = null;
+        }
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = null;
+            console.log('[MemberHeartbeatScheduler] Stopped');
+        }
+    }
+    async tick() {
+        if (this.running) {
+            return;
+        }
+        this.running = true;
+        try {
+            // 首扫：先回收 server 重启后脱管（内存无 pipeline）的 RUNNING invocation，避免永久占用成员。
+            if (!this.orphanScanDone) {
+                this.orphanScanDone = true;
+                await this.reconciler.reconcileOrphanInvocations();
+            }
+            // 唤醒/释放长时间无进展的 RUNNING 成员。
+            await this.reconciler.reconcileStalledInvocations();
+            // 推进到期的 room reply 补催（同时修复重启后 reminder 丢失、无人周期调用的问题）。
+            await this.reconciler.reconcileDueRoomReplyReminders();
+        }
+        finally {
+            this.running = false;
+        }
+    }
+}
+//# sourceMappingURL=member-heartbeat-scheduler.js.map

package/dist/services/member-heartbeat-scheduler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"member-heartbeat-scheduler.js","sourceRoot":"","sources":["../../src/services/member-heartbeat-scheduler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,uDAAuD;AACvD,MAAM,qBAAqB,GAAG,MAAM,CAAC;AASrC;;;;;;;;;;GAUG;AACH,MAAM,OAAO,wBAAwB;IAC3B,KAAK,GAA0C,IAAI,CAAC;IACpD,gBAAgB,GAAyC,IAAI,CAAC;IAC9D,OAAO,GAAG,KAAK,CAAC;IAChB,cAAc,GAAG,KAAK,CAAC;IACd,cAAc,CAAS;IACvB,UAAU,CAAwB;IAEnD,YAAY,IAAkC;QAC5C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC;QACtE,+DAA+D;QAC/D,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,qBAAqB,CAAC;YAC7D,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,cAAc;YACrC,iBAAiB,EAAE,KAAK;SACzB,CAAC,CAAC;IACL,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,iDAAiD,IAAI,CAAC,cAAc,GAAG,IAAI,IAAI,CAAC,CAAC;QAE7F,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACxB,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAC;YAChE,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACvB,IAAI,CAAC,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;QAEjD,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,GAAG,EAAE;YACtC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACxB,OAAO,CAAC,KAAK,CAAC,iDAAiD,EAAE,GAAG,CAAC,CAAC;YACxE,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,qBAAqB,CAAC,CAAC;QACzB,IAAI,CAAC,gBAA2C,CAAC,KAAK,EAAE,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACpC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC/B,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpB,IAAI,CAAC;YACH,kEAAkE;YAClE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBACzB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC3B,MAAM,IAAI,CAAC,UAAU,CAAC,0BAA0B,EAAE,CAAC;YACrD,CAAC;YACD,2BAA2B;YAC3B,MAAM,IAAI,CAAC,UAAU,CAAC,2BAA2B,EAAE,CAAC;YACpD,sDAAsD;YACtD,MAAM,IAAI,CAAC,UAAU,CAAC,8BAA8B,EAAE,CAAC;QACzD,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;CACF"}