aws-runtime-bridge 1.0.1 → 1.0.2

package/dist/services/auto-register.d.ts

@@ -55,6 +55,12 @@ export declare function autoRegister(customConfig?: Partial<AutoRegisterConfig>)
 /**
  * 注销实例
  */
+export declare function requestRuntimeAccessTokenRefresh(): Promise<{
+    success: boolean;
+    runtimeAccessToken?: string;
+    updated?: boolean;
+    error?: string;
+}>;
 export declare function unregister(): Promise<boolean>;
 /**
  * 获取注册状态

package/dist/services/auto-register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auto-register.d.ts","sourceRoot":"","sources":["../../src/services/auto-register.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAoCH;;GAEG;AACH,UAAU,kBAAkB;IAC1B,eAAe;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sBAAsB;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAwJD;;;;;;GAMG;AACH,wBAAgB,UAAU,IAAI,kBAAkB,CAuC/C;AA2KD;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAyE/F;AAED;;GAEG;AACH,wBAAsB,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAuBnD;AAED;;GAEG;AACH,wBAAgB,oBAAoB;gBA5dtB,OAAO;iBACN,MAAM;kBACL,IAAI;YACV,MAAM;EA2df;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAEtC;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAElD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA2D/G"}
+{"version":3,"file":"auto-register.d.ts","sourceRoot":"","sources":["../../src/services/auto-register.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA4CH;;GAEG;AACH,UAAU,kBAAkB;IAC1B,eAAe;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sBAAsB;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAiKD;;;;;;GAMG;AACH,wBAAgB,UAAU,IAAI,kBAAkB,CAuC/C;AAuLD;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAChC,YAAY,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GACzC,OAAO,CAAC,OAAO,CAAC,CAmHlB;AAED;;GAEG;AACH,wBAAsB,gCAAgC,IAAI,OAAO,CAAC;IAChE,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAoED;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAuBnD;AAED;;GAEG;AACH,wBAAgB,oBAAoB;gBAxmBtB,OAAO;iBACN,MAAM;kBACL,IAAI;YACV,MAAM;EAumBf;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAEtC;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAElD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CA0ED"}

package/dist/services/auto-register.js

@@ -7,12 +7,13 @@
  * 1. 环境变量
  * 2. 用户目录下的 .aws-bridge/config.json 文件
  */
-import axios from 'axios';
-import os from 'node:os';
-import path from 'node:path';
-import fs from 'node:fs';
-import { logger } from '../utils/logger.js';
-import { schedulerBaseUrl, runtimeToken } from '../config.js';
+import axios from "axios";
+import os from "node:os";
+import path from "node:path";
+import fs from "node:fs";
+import { logger } from "../utils/logger.js";
+import { schedulerBaseUrl, runtimeToken } from "../config.js";
+import { getRuntimeAccessToken, getRuntimeBindingPublicState, saveRuntimeBinding, } from "./runtime-binding.js";
 // 默认配置
 const DEFAULT_CONFIG = {
     enabled: false,
@@ -27,7 +28,7 @@ let registrationState = {
  */
 function getConfigFilePath() {
     const homeDir = os.homedir();
-    return path.join(homeDir, '.aws-bridge', 'config.json');
+    return path.join(homeDir, ".aws-bridge", "config.json");
 }
 /**
  * 确保配置文件存在，如果不存在则创建空配置文件
@@ -46,7 +47,7 @@ function ensureConfigFile() {
         }
         // 创建空配置文件
         const emptyConfig = {};
-        fs.writeFileSync(configPath, JSON.stringify(emptyConfig, null, 2), 'utf-8');
+        fs.writeFileSync(configPath, JSON.stringify(emptyConfig, null, 2), "utf-8");
         logger.info(`[AutoRegister] 已创建配置文件: ${configPath}`);
         logger.info(`[AutoRegister] 要启用自动注册，请编辑配置文件设置 tenantId 和 userKey`);
         return true;
@@ -84,7 +85,7 @@ function loadConfigFromFile() {
             logger.debug(`[AutoRegister] 配置文件不存在: ${configPath}`);
             return null;
         }
-        const content = fs.readFileSync(configPath, 'utf-8');
+        const content = fs.readFileSync(configPath, "utf-8");
         const config = JSON.parse(content);
         logger.info(`[AutoRegister] 从配置文件加载配置: ${configPath}`);
         return {
@@ -110,7 +111,7 @@ function loadConfigFromFile() {
  */
 function loadConfigFromEnv() {
     const envConfig = {};
-    if (process.env.AWS_AUTO_REGISTER === 'true') {
+    if (process.env.AWS_AUTO_REGISTER === "true") {
         envConfig.enabled = true;
     }
     if (process.env.AWS_TENANT_ID) {
@@ -167,15 +168,15 @@ export function loadConfig() {
     // 否则，如果配置文件存在（无论是否有内容），则启用自动注册
     let enabled = false;
     if (process.env.AWS_AUTO_REGISTER !== undefined) {
-        enabled = process.env.AWS_AUTO_REGISTER === 'true';
+        enabled = process.env.AWS_AUTO_REGISTER === "true";
     }
     else if (fileConfig) {
         enabled = true;
     }
     return {
         enabled,
-        tenantId: merged.tenantId || '', // 保持为空字符串，后续会通过userKey自动推导
-        userKey: merged.userKey || '',
+        tenantId: merged.tenantId || "", // 保持为空字符串，后续会通过userKey自动推导
+        userKey: merged.userKey || "",
         instanceName,
         projectName: merged.projectName,
         roleName: merged.roleName,
@@ -197,7 +198,7 @@ function getAllLocalIpAddresses() {
             continue;
         for (const net of nets) {
             // 跳过内部和非 IPv4 地址
-            if (net.family === 'IPv4' && !net.internal) {
+            if (net.family === "IPv4" && !net.internal) {
                 addresses.push({
                     address: net.address,
                     netmask: net.netmask,
@@ -212,7 +213,7 @@ function getAllLocalIpAddresses() {
  * 将 IP 地址转换为整数
  */
 function ipToInt(ip) {
-    const parts = ip.split('.').map(Number);
+    const parts = ip.split(".").map(Number);
     return (parts[0] << 24) + (parts[1] << 16) + (parts[2] << 8) + parts[3];
 }
 /**
@@ -231,8 +232,8 @@ function extractIpFromUrl(url) {
     try {
         const urlObj = new URL(url);
         // 如果是主机名，尝试解析
-        if (urlObj.hostname === 'localhost' || urlObj.hostname === '127.0.0.1') {
-            return '127.0.0.1';
+        if (urlObj.hostname === "localhost" || urlObj.hostname === "127.0.0.1") {
+            return "127.0.0.1";
         }
         // 检查是否是有效的 IP 地址
         const ipPattern = /^(\d{1,3}\.){3}\d{1,3}$/;
@@ -258,8 +259,8 @@ function extractIpFromUrl(url) {
 function getPreferredIpAddress(schedulerUrl) {
     const allIps = getAllLocalIpAddresses();
     if (allIps.length === 0) {
-        logger.warn('[AutoRegister] 未找到任何非内部 IP 地址，使用 127.0.0.1');
-        return '127.0.0.1';
+        logger.warn("[AutoRegister] 未找到任何非内部 IP 地址，使用 127.0.0.1");
+        return "127.0.0.1";
     }
     // 尝试从调度中心 URL 提取 IP
     const schedulerIp = extractIpFromUrl(schedulerUrl);
@@ -274,7 +275,7 @@ function getPreferredIpAddress(schedulerUrl) {
         logger.warn(`[AutoRegister] 未找到与调度中心 (${schedulerIp}) 同子网的 IP，使用第一个可用 IP`);
     }
     else {
-        logger.info('[AutoRegister] 无法解析调度中心 IP，使用第一个可用 IP');
+        logger.info("[AutoRegister] 无法解析调度中心 IP，使用第一个可用 IP");
     }
     // 回退：返回第一个非内部 IP
     return allIps[0].address;
@@ -305,12 +306,12 @@ async function doRegister(config) {
     };
     logger.info(`[AutoRegister] 正在注册实例: ${instanceName}`);
     logger.info(`[AutoRegister] 调度中心: ${schedulerBaseUrl}`);
-    logger.info(`[AutoRegister] 用户 Key: ${config.userKey ? '****' + config.userKey.slice(-4) : '(未设置)'}`);
-    logger.info(`[AutoRegister] 租户 ID: ${config.tenantId || '(自动推导)'}`);
+    logger.info(`[AutoRegister] 用户 Key: ${config.userKey ? "****" + config.userKey.slice(-4) : "(未设置)"}`);
+    logger.info(`[AutoRegister] 租户 ID: ${config.tenantId || "(自动推导)"}`);
     const response = await axios.post(`${schedulerBaseUrl}/api/instances/register`, request, {
         headers: {
-            'Content-Type': 'application/json',
-            'X-Runtime-Token': runtimeToken,
+            "Content-Type": "application/json",
+            "X-Runtime-Token": runtimeToken,
         },
         timeout: 10000,
     });
@@ -322,8 +323,8 @@ async function doRegister(config) {
 async function doUnregister(instanceId) {
     const response = await axios.post(`${schedulerBaseUrl}/api/instances/unregister`, { instanceId }, {
         headers: {
-            'Content-Type': 'application/json',
-            'X-Runtime-Token': runtimeToken,
+            "Content-Type": "application/json",
+            "X-Runtime-Token": runtimeToken,
         },
         timeout: 10000,
     });
@@ -348,13 +349,13 @@ export async function autoRegister(customConfig) {
     };
     // 检查是否启用
     if (!config.enabled) {
-        logger.info('[AutoRegister] 自动注册未启用');
-        logger.info('[AutoRegister] 要启用自动注册，请创建配置文件 ~/.aws-bridge/config.json 或设置环境变量 AWS_AUTO_REGISTER=true');
+        logger.info("[AutoRegister] 自动注册未启用");
+        logger.info("[AutoRegister] 要启用自动注册，请创建配置文件 ~/.aws-bridge/config.json 或设置环境变量 AWS_AUTO_REGISTER=true");
         return false;
     }
     // 验证必填字段（userKey 为必填，tenantId 现在可选）
     if (!config.userKey) {
-        logger.error('[AutoRegister] 缺少用户 Key（在配置文件中设置 userKey 或设置环境变量 AWS_USER_KEY）');
+        logger.error("[AutoRegister] 缺少用户 Key（在配置文件中设置 userKey 或设置环境变量 AWS_USER_KEY）");
         return false;
     }
     // tenantId 现在是可选的，如果没有提供，后端会根据 userKey 自动推导
@@ -372,7 +373,26 @@ export async function autoRegister(customConfig) {
                 logger.info(`[AutoRegister] ✓ 注册成功！`);
                 logger.info(`[AutoRegister]   实例 ID: ${response.instanceId}`);
                 logger.info(`[AutoRegister]   消息: ${response.message}`);
-                logger.info(`[AutoRegister]   更新: ${response.isUpdate ? '是' : '否'}`);
+                logger.info(`[AutoRegister]   更新: ${response.isUpdate ? "是" : "否"}`);
+                if (response.runtimeAccessToken) {
+                    try {
+                        saveRuntimeBinding({
+                            accessToken: response.runtimeAccessToken,
+                            instanceId: response.instanceId,
+                            schedulerBaseUrl: response.serverUrl || schedulerBaseUrl,
+                        });
+                        logger.info("[AutoRegister] 已保存调度中心下发的 runtime access token");
+                    }
+                    catch (error) {
+                        const err = error;
+                        logger.error(`[AutoRegister] 保存 runtime access token 失败: ${err.message}`);
+                        registrationState.error = err.message;
+                        return false;
+                    }
+                }
+                else {
+                    logger.warn("[AutoRegister] 注册响应未包含 runtime access token，MCP 将只能使用兼容的静态内部密钥访问调度中心");
+                }
                 return true;
             }
             else {
@@ -382,25 +402,27 @@ export async function autoRegister(customConfig) {
         }
         catch (error) {
             const err = error;
-            const message = err.response?.data ? JSON.stringify(err.response.data) : err.message;
+            const message = err.response?.data
+                ? JSON.stringify(err.response.data)
+                : err.message;
             logger.error(`[AutoRegister] 注册请求失败 (尝试 ${attempt}/${maxRetries}): ${message}`);
             registrationState.error = message;
         }
         // 如果不是最后一次尝试，等待后重试
         if (attempt < maxRetries) {
             logger.info(`[AutoRegister] ${retryInterval / 1000} 秒后重试...`);
-            await new Promise(resolve => setTimeout(resolve, retryInterval));
+            await new Promise((resolve) => setTimeout(resolve, retryInterval));
         }
     }
     logger.error(`[AutoRegister] ✗ 注册失败，已达最大重试次数`);
     logger.error(`[AutoRegister] ========================================`);
     logger.error(`[AutoRegister] 自动注册已启用但注册失败，实例无法正常工作`);
     logger.error(`[AutoRegister] 请检查以下配置：`);
-    logger.error(`[AutoRegister]   - 用户 Key (userKey): ${config.userKey ? '****' + config.userKey.slice(-4) : '(未设置)'}`);
-    logger.error(`[AutoRegister]   - 租户 ID (tenantId): ${config.tenantId || '(可选，将自动推导)'}`);
-    logger.error(`[AutoRegister]   - 实例名 (instanceName): ${config.instanceName || '(使用主机名)'}`);
+    logger.error(`[AutoRegister]   - 用户 Key (userKey): ${config.userKey ? "****" + config.userKey.slice(-4) : "(未设置)"}`);
+    logger.error(`[AutoRegister]   - 租户 ID (tenantId): ${config.tenantId || "(可选，将自动推导)"}`);
+    logger.error(`[AutoRegister]   - 实例名 (instanceName): ${config.instanceName || "(使用主机名)"}`);
     logger.error(`[AutoRegister]   - 调度中心地址: ${schedulerBaseUrl}`);
-    logger.error(`[AutoRegister]   - 最后错误: ${registrationState.error || '未知'}`);
+    logger.error(`[AutoRegister]   - 最后错误: ${registrationState.error || "未知"}`);
     logger.error(`[AutoRegister] ========================================`);
     logger.error(`[AutoRegister] 配置来源：~/.aws-bridge/config.json 或环境变量`);
     return false;
@@ -408,9 +430,65 @@ export async function autoRegister(customConfig) {
 /**
  * 注销实例
  */
+export async function requestRuntimeAccessTokenRefresh() {
+    const config = loadConfig();
+    if (!config.userKey) {
+        return {
+            success: false,
+            error: "userKey is required for runtime token refresh",
+        };
+    }
+    const state = getRuntimeBindingPublicState();
+    const localIp = getLocalIpAddress();
+    const runtimeBridgePort = process.env.AWS_RUNTIME_BRIDGE_PORT || 18081;
+    const runtimeBridgeBaseUrl = `http://${config.virtualIp || localIp}:${runtimeBridgePort}`;
+    try {
+        const response = await axios.post(`${schedulerBaseUrl}/api/instances/runtime-tokens/refresh`, {
+            tenantId: config.tenantId,
+            userKey: config.userKey,
+            instanceId: state.instanceId,
+            instanceName: config.instanceName,
+            runtimeBridgeBaseUrl,
+        }, {
+            headers: {
+                "Content-Type": "application/json",
+                "X-Runtime-Token": runtimeToken,
+            },
+            timeout: 10000,
+        });
+        if (!response.data.success || !response.data.runtimeAccessToken) {
+            return {
+                success: false,
+                error: response.data.message ||
+                    "scheduler did not return runtimeAccessToken",
+            };
+        }
+        const previousToken = getRuntimeAccessToken();
+        const updated = previousToken !== response.data.runtimeAccessToken;
+        if (updated) {
+            saveRuntimeBinding({
+                accessToken: response.data.runtimeAccessToken,
+                instanceId: state.instanceId,
+                schedulerBaseUrl,
+            });
+        }
+        return {
+            success: true,
+            runtimeAccessToken: response.data.runtimeAccessToken,
+            updated,
+        };
+    }
+    catch (error) {
+        const err = error;
+        const message = err.response?.data
+            ? JSON.stringify(err.response.data)
+            : err.message;
+        return { success: false, error: message };
+    }
+}
 export async function unregister() {
     if (!registrationState.registered || !registrationState.instanceId) {
-        logger.info('[AutoRegister] 实例未注册，无需注销');
+        logger.info("[AutoRegister] 实例未注册，无需注销");
         return true;
     }
     try {
@@ -477,17 +555,17 @@ export async function bridgeRestartCleanup() {
         requestBody.runtimeBridgeBaseUrl = `http://${config.virtualIp || localIp}:${port}`;
     }
     if (!requestBody.instanceId && !requestBody.runtimeBridgeBaseUrl) {
-        logger.info('[AutoRegister] Bridge 重启清理：没有 instanceId 或 runtimeBridgeBaseUrl，跳过清理');
+        logger.info("[AutoRegister] Bridge 重启清理：没有 instanceId 或 runtimeBridgeBaseUrl，跳过清理");
         return { success: true, agentCount: 0 };
     }
     try {
         logger.info(`[AutoRegister] Bridge 重启清理：正在通知调度中心...`);
-        logger.info(`[AutoRegister]   instanceId: ${requestBody.instanceId || '(无)'}`);
-        logger.info(`[AutoRegister]   runtimeBridgeBaseUrl: ${requestBody.runtimeBridgeBaseUrl || '(无)'}`);
+        logger.info(`[AutoRegister]   instanceId: ${requestBody.instanceId || "(无)"}`);
+        logger.info(`[AutoRegister]   runtimeBridgeBaseUrl: ${requestBody.runtimeBridgeBaseUrl || "(无)"}`);
         const response = await axios.post(`${schedulerBaseUrl}/api/instances/bridge-restart-cleanup`, requestBody, {
             headers: {
-                'Content-Type': 'application/json',
-                'X-Runtime-Token': runtimeToken,
+                "Content-Type": "application/json",
+                "X-Runtime-Token": runtimeToken,
             },
             timeout: 10000,
         });
@@ -503,7 +581,9 @@ export async function bridgeRestartCleanup() {
     }
     catch (error) {
         const err = error;
-        const message = err.response?.data ? JSON.stringify(err.response.data) : err.message;
+        const message = err.response?.data
+            ? JSON.stringify(err.response.data)
+            : err.message;
         logger.warn(`[AutoRegister] Bridge 重启清理请求失败：${message}`);
         return { success: false, error: message };
     }

package/dist/services/aws-client-agent-mcp.d.ts

@@ -15,7 +15,7 @@ export interface ResolveAwsClientAgentMcpCommandOptions {
     release?: () => string | null;
 }
 export interface AwsMcpPreparedInfo extends AwsMcpCommandSpec {
-    source: 'override' | 'bundled' | 'global';
+    source: "override" | "bundled" | "global";
 }
 export declare function getReleasedMcpDistPath(): string;
 export declare function releaseBundledAwsClientAgentMcp(): string | null;

package/dist/services/aws-client-agent-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aws-client-agent-mcp.d.ts","sourceRoot":"","sources":["../../src/services/aws-client-agent-mcp.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAqB7C,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,sCAAsC;IACrD,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;CAC3C;AAeD,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAMD,wBAAgB,+BAA+B,IAAI,MAAM,GAAG,IAAI,CAoB/D;AA6CD,wBAAgB,+BAA+B,CAAC,OAAO,GAAE,sCAA2C,GAAG,kBAAkB,CAExH;AAED,wBAAgB,gCAAgC,CAAC,OAAO,GAAE,sCAA2C,GAAG,kBAAkB,CAuBzH;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,uBAAuB,GAAG,kBAAkB,CAe1F;AAED,wBAAgB,+BAA+B,IAAI,IAAI,CAUtD"}
+{"version":3,"file":"aws-client-agent-mcp.d.ts","sourceRoot":"","sources":["../../src/services/aws-client-agent-mcp.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAuB7C,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,sCAAsC;IACrD,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;CAC3C;AAqBD,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAMD,wBAAgB,+BAA+B,IAAI,MAAM,GAAG,IAAI,CAsB/D;AA2ED,wBAAgB,+BAA+B,CAC7C,OAAO,GAAE,sCAA2C,GACnD,kBAAkB,CAEpB;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,GAAE,sCAA2C,GACnD,kBAAkB,CA+BpB;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,uBAAuB,GAC7B,kBAAkB,CAwBpB;AAED,wBAAgB,+BAA+B,IAAI,IAAI,CAgBtD"}

package/dist/services/aws-client-agent-mcp.js

@@ -1,49 +1,52 @@
-import { cpSync, existsSync, mkdirSync } from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { getRuntimeHomeDir, schedulerBaseUrl } from '../config.js';
-import { logger } from '../utils/logger.js';
-export const AWS_MCP_SERVER_NAME = 'aws-mcp';
+import { cpSync, existsSync, mkdirSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { getRuntimeHomeDir, port, schedulerBaseUrl } from "../config.js";
+import { getRuntimeAccessToken, loadRuntimeBinding, } from "./runtime-binding.js";
+import { logger } from "../utils/logger.js";
+export const AWS_MCP_SERVER_NAME = "aws-mcp";
 const AWS_MCP_ALLOWED_ENV_KEYS = [
-    'AWS_INTERNAL_API_KEY',
-    'AWS_PROJECT_NAME',
-    'AWS_PROMPT',
-    'AWS_ROLE_NAME',
-    'AWS_SERVER_URL',
-    'AWS_MCP_HTTP_URL',
-    'AWS_HEARTBEAT_INTERVAL',
-    'AWS_HEARTBEAT_TIMEOUT',
-    'PATH',
-    'HOME',
-    'USERPROFILE',
-    'TMP',
-    'TEMP',
-    'SystemRoot',
-    'COMSPEC',
-    'PATHEXT',
-    'WINDIR',
+    "AWS_INTERNAL_API_KEY",
+    "AWS_PROJECT_NAME",
+    "AWS_PROMPT",
+    "AWS_ROLE_NAME",
+    "AWS_SERVER_URL",
+    "AWS_MCP_HTTP_URL",
+    "AWS_RUNTIME_ACCESS_TOKEN",
+    "AWS_RUNTIME_BRIDGE_BASE_URL",
+    "AWS_HEARTBEAT_INTERVAL",
+    "AWS_HEARTBEAT_TIMEOUT",
+    "PATH",
+    "HOME",
+    "USERPROFILE",
+    "TMP",
+    "TEMP",
+    "SystemRoot",
+    "COMSPEC",
+    "PATHEXT",
+    "WINDIR",
 ];
 function getPackageRoot() {
     const currentFile = fileURLToPath(import.meta.url);
-    return path.resolve(path.dirname(currentFile), '..', '..');
+    return path.resolve(path.dirname(currentFile), "..", "..");
 }
 function getBundledEntryPath() {
-    return path.join(getPackageRoot(), 'package', 'aws-client-agent-mcp', 'dist', 'index.js');
+    return path.join(getPackageRoot(), "package", "aws-client-agent-mcp", "dist", "index.js");
 }
 function getReleasedMcpRoot() {
-    return path.join(getRuntimeHomeDir(), '.aws-bridge', 'mcp');
+    return path.join(getRuntimeHomeDir(), ".aws-bridge", "mcp");
 }
 export function getReleasedMcpDistPath() {
-    return path.join(getReleasedMcpRoot(), 'dist');
+    return path.join(getReleasedMcpRoot(), "dist");
 }
 function getReleasedEntryPath() {
-    return path.join(getReleasedMcpDistPath(), 'index.js');
+    return path.join(getReleasedMcpDistPath(), "index.js");
 }
 export function releaseBundledAwsClientAgentMcp() {
     const bundledDist = path.dirname(getBundledEntryPath());
     const releasedDist = getReleasedMcpDistPath();
-    const releasedEntry = path.join(releasedDist, 'index.js');
-    if (!existsSync(path.join(bundledDist, 'index.js'))) {
+    const releasedEntry = path.join(releasedDist, "index.js");
+    if (!existsSync(path.join(bundledDist, "index.js"))) {
         return null;
     }
     if (!existsSync(releasedEntry)) {
@@ -58,67 +61,90 @@ export function releaseBundledAwsClientAgentMcp() {
     return releasedEntry;
 }
 function getStringEnv() {
-    return Object.fromEntries(Object.entries(process.env).filter((entry) => typeof entry[1] === 'string'));
+    return Object.fromEntries(Object.entries(process.env).filter((entry) => typeof entry[1] === "string"));
 }
 function getAllowedAwsMcpEnv(baseEnv) {
     return Object.fromEntries(AWS_MCP_ALLOWED_ENV_KEYS.flatMap((key) => {
         const value = baseEnv[key];
-        return typeof value === 'string' && value.length > 0 ? [[key, value]] : [];
+        return typeof value === "string" && value.length > 0
+            ? [[key, value]]
+            : [];
     }));
 }
 function parseAwsClientAgentMcpArgs(raw) {
     try {
         const parsed = JSON.parse(raw);
-        if (Array.isArray(parsed) && parsed.every((value) => typeof value === 'string')) {
+        if (Array.isArray(parsed) &&
+            parsed.every((value) => typeof value === "string")) {
             return parsed;
         }
     }
     catch (error) {
         logger.warn(`[runtime-bridge] AWS_CLIENT_AGENT_MCP_ARGS 不是合法 JSON，已忽略: ${error instanceof Error ? error.message : String(error)}`);
     }
-    logger.warn('[runtime-bridge] AWS_CLIENT_AGENT_MCP_ARGS 必须是 string[] JSON，已忽略');
+    logger.warn("[runtime-bridge] AWS_CLIENT_AGENT_MCP_ARGS 必须是 string[] JSON，已忽略");
     return [];
 }
 function toWebSocketUrl(baseUrl) {
-    const url = new URL('/ws/agent', baseUrl);
-    if (url.protocol === 'https:') {
-        url.protocol = 'wss:';
+    const url = new URL("/ws/agent", baseUrl);
+    if (url.protocol === "https:") {
+        url.protocol = "wss:";
     }
     else {
-        url.protocol = 'ws:';
+        url.protocol = "ws:";
     }
     return url.toString();
 }
 function toMcpHttpUrl(baseUrl) {
-    return new URL('/mcp/call', baseUrl).toString();
+    return new URL("/mcp/call", baseUrl).toString();
+}
+function resolveSchedulerBaseUrlForMcp() {
+    const envSchedulerBaseUrl = String(process.env.AWS_RUNTIME_SCHEDULER_BASE_URL || "").trim();
+    if (envSchedulerBaseUrl) {
+        return envSchedulerBaseUrl;
+    }
+    const binding = loadRuntimeBinding();
+    const pairedSchedulerBaseUrl = String(binding.schedulerBaseUrl || "").trim();
+    if (binding.status === "paired" && pairedSchedulerBaseUrl) {
+        return pairedSchedulerBaseUrl;
+    }
+    return schedulerBaseUrl;
 }
 export function resolveAwsClientAgentMcpCommand(options = {}) {
     return getAwsClientAgentMcpPreparedInfo(options);
 }
 export function getAwsClientAgentMcpPreparedInfo(options = {}) {
-    const overrideCommand = String(process.env.AWS_CLIENT_AGENT_MCP_COMMAND || '').trim();
+    const overrideCommand = String(process.env.AWS_CLIENT_AGENT_MCP_COMMAND || "").trim();
     if (overrideCommand) {
         return {
-            source: 'override',
+            source: "override",
             command: overrideCommand,
-            args: process.env.AWS_CLIENT_AGENT_MCP_ARGS ? parseAwsClientAgentMcpArgs(process.env.AWS_CLIENT_AGENT_MCP_ARGS) : [],
+            args: process.env.AWS_CLIENT_AGENT_MCP_ARGS
+                ? parseAwsClientAgentMcpArgs(process.env.AWS_CLIENT_AGENT_MCP_ARGS)
+                : [],
         };
     }
     const exists = options.exists || existsSync;
     const releasedEntry = getReleasedEntryPath();
     if (exists(releasedEntry)) {
-        return { source: 'bundled', command: process.execPath, args: [releasedEntry] };
+        return {
+            source: "bundled",
+            command: process.execPath,
+            args: [releasedEntry],
+        };
     }
     const release = options.release || releaseBundledAwsClientAgentMcp;
     const released = release();
     if (released && exists(released)) {
-        return { source: 'bundled', command: process.execPath, args: [released] };
+        return { source: "bundled", command: process.execPath, args: [released] };
     }
-    return { source: 'global', command: 'aws-client-agent-mcp', args: [] };
+    return { source: "global", command: "aws-client-agent-mcp", args: [] };
 }
 export function buildAwsMcpServerConfig(input) {
     const env = getStringEnv();
     const command = getAwsClientAgentMcpPreparedInfo();
+    const effectiveSchedulerBaseUrl = resolveSchedulerBaseUrlForMcp();
+    const issuedRuntimeAccessToken = getRuntimeAccessToken();
     return {
         command: command.command,
         args: command.args,
@@ -126,15 +152,21 @@ export function buildAwsMcpServerConfig(input) {
             ...getAllowedAwsMcpEnv(env),
             AWS_AGENT_ID: input.agentId,
             AWS_WORKSPACE_PATH: input.workspacePath,
-            AWS_SERVER_URL: env.AWS_SERVER_URL || toWebSocketUrl(schedulerBaseUrl),
-            AWS_MCP_HTTP_URL: env.AWS_MCP_HTTP_URL || toMcpHttpUrl(schedulerBaseUrl),
+            AWS_SERVER_URL: env.AWS_SERVER_URL || toWebSocketUrl(effectiveSchedulerBaseUrl),
+            AWS_MCP_HTTP_URL: env.AWS_MCP_HTTP_URL || toMcpHttpUrl(effectiveSchedulerBaseUrl),
+            AWS_RUNTIME_BRIDGE_BASE_URL: env.AWS_RUNTIME_BRIDGE_BASE_URL || `http://127.0.0.1:${port}`,
+            ...(issuedRuntimeAccessToken
+                ? { AWS_RUNTIME_ACCESS_TOKEN: issuedRuntimeAccessToken }
+                : {}),
         },
     };
 }
 export function ensureAwsClientAgentMcpReleased() {
     const prepared = getAwsClientAgentMcpPreparedInfo();
-    const commandLine = prepared.args[0] ? `${prepared.command} ${prepared.args.join(' ')}` : prepared.command;
-    if (prepared.source === 'global') {
+    const commandLine = prepared.args[0]
+        ? `${prepared.command} ${prepared.args.join(" ")}`
+        : prepared.command;
+    if (prepared.source === "global") {
         logger.warn(`[runtime-bridge] ${AWS_MCP_SERVER_NAME} MCP 未找到 bundled 产物，启动时将回退到 PATH 命令: ${commandLine}`);
         return;
     }

package/dist/services/runtime-binding.d.ts

@@ -0,0 +1,32 @@
+export type RuntimeBindingState = {
+    status: "unpaired" | "paired";
+    instanceId?: string;
+    schedulerBaseUrl?: string;
+    /**
+     * Plain runtime access token issued by the scheduler.
+     * Stored locally with 0600 permissions so child MCP processes can authenticate
+     * scheduler calls without exposing the token in public status APIs.
+     */
+    accessToken?: string;
+    tokenHash?: string;
+    createdAt?: string;
+    updatedAt?: string;
+    revokedAt?: string;
+};
+export declare function getRuntimePairingCode(): string;
+export declare function getRuntimeBindingFilePath(): string;
+export declare function loadRuntimeBinding(): RuntimeBindingState;
+export declare function getRuntimeBindingPublicState(): Omit<RuntimeBindingState, "tokenHash" | "accessToken"> & {
+    paired: boolean;
+};
+export declare function hasRuntimeBinding(): boolean;
+export declare function validateRuntimeBindingToken(token: unknown): boolean;
+export declare function getRuntimeAccessToken(): string | undefined;
+export declare function validateRuntimePairingCode(code: unknown): boolean;
+export declare function saveRuntimeBinding(input: {
+    accessToken: string;
+    instanceId?: string;
+    schedulerBaseUrl?: string;
+}): RuntimeBindingState;
+export declare function clearRuntimeBinding(): void;
+//# sourceMappingURL=runtime-binding.d.ts.map

package/dist/services/runtime-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-binding.d.ts","sourceRoot":"","sources":["../../src/services/runtime-binding.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAuCF,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,wBAAgB,kBAAkB,IAAI,mBAAmB,CAWxD;AAED,wBAAgB,4BAA4B,IAAI,IAAI,CAClD,mBAAmB,EACnB,WAAW,GAAG,aAAa,CAC5B,GAAG;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAWtB;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAG3C;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAYnE;AAED,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,SAAS,CAM1D;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAEjE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,mBAAmB,CA6BtB;AAED,wBAAgB,mBAAmB,IAAI,IAAI,CAkB1C"}