aws-runtime-bridge 1.0.1 → 1.0.3

package/dist/routes/runtime-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-binding.d.ts","sourceRoot":"","sources":["../../src/routes/runtime-binding.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,oBAAoB,4CAAW,CAAC;AAkL7C,wBAAgB,6BAA6B,IAAI,IAAI,CAapD"}

package/dist/routes/runtime-binding.js

@@ -0,0 +1,159 @@
+import { Router } from "express";
+import { clearRuntimeBinding, getRuntimeAccessToken, getRuntimeBindingPublicState, getRuntimePairingCode, hasRuntimeBinding, saveRuntimeBinding, validateRuntimeBindingToken, validateRuntimePairingCode, } from "../services/runtime-binding.js";
+import { validateToken } from "../middleware/auth.js";
+import { runtimeToken } from "../config.js";
+import { requestRuntimeAccessTokenRefresh } from "../services/auto-register.js";
+import { createLogger } from "../utils/logger.js";
+const log = createLogger("runtime-binding-route");
+export const runtimeBindingRouter = Router();
+function extractRuntimeToken(req) {
+    const headerToken = req.header("X-Runtime-Token");
+    if (headerToken) {
+        return headerToken.trim();
+    }
+    const authorization = req.header("Authorization") || "";
+    const bearerMatch = authorization.match(/^Bearer\s+(.+)$/i);
+    return bearerMatch?.[1]?.trim() || "";
+}
+runtimeBindingRouter.get("/binding/status", (_req, res) => {
+    const state = getRuntimeBindingPublicState();
+    res.json({
+        ok: true,
+        ...state,
+        pairingRequired: !state.paired,
+    });
+});
+runtimeBindingRouter.post("/binding/pair", (req, res) => {
+    const { accessToken, instanceId, userId, schedulerBaseUrl, pairingCode } = req.body || {};
+    const existingBinding = hasRuntimeBinding();
+    const currentRuntimeToken = extractRuntimeToken(req);
+    if (existingBinding) {
+        const canRotate = validateRuntimeBindingToken(currentRuntimeToken);
+        if (!canRotate) {
+            res.status(401).json({
+                error: "unauthorized",
+                message: "Bridge is already paired. Provide the current runtime token to rotate binding.",
+            });
+            return;
+        }
+    }
+    else if (!validateRuntimePairingCode(pairingCode)) {
+        res.status(401).json({
+            error: "invalid_pairing_code",
+            message: "Invalid pairing code. Read the current pairing code from the bridge console and try again.",
+        });
+        return;
+    }
+    try {
+        saveRuntimeBinding({
+            accessToken: String(accessToken || ""),
+            instanceId: instanceId ? String(instanceId) : undefined,
+            userId: userId ? String(userId) : undefined,
+            schedulerBaseUrl: schedulerBaseUrl ? String(schedulerBaseUrl) : undefined,
+        });
+        log.info(`[runtime-bridge] paired with instanceId=${instanceId || "unknown"}`);
+        res.json({
+            ok: true,
+            ...getRuntimeBindingPublicState(),
+        });
+    }
+    catch (error) {
+        const err = error;
+        res
+            .status(400)
+            .json({ error: err.message || "pair runtime bridge failed" });
+    }
+});
+function isLoopbackRequest(req) {
+    const ip = req.ip || req.socket.remoteAddress || "";
+    return ip === "127.0.0.1" || ip === "::1" || ip === "::ffff:127.0.0.1";
+}
+runtimeBindingRouter.post("/binding/request-token", async (req, res) => {
+    if (!isLoopbackRequest(req)) {
+        res.status(403).json({ ok: false, error: "loopback request required" });
+        return;
+    }
+    const { userId, serverUrl, schedulerBaseUrl } = req.body || {};
+    const scopedToken = getRuntimeAccessToken(userId, serverUrl || schedulerBaseUrl);
+    if (scopedToken) {
+        res.json({
+            ok: true,
+            runtimeAccessToken: scopedToken,
+            updated: false,
+        });
+        return;
+    }
+    const result = await requestRuntimeAccessTokenRefresh();
+    if (!result.success || !result.runtimeAccessToken) {
+        res.status(400).json({
+            ok: false,
+            error: result.error || "request runtime token failed",
+        });
+        return;
+    }
+    res.json({
+        ok: true,
+        runtimeAccessToken: result.runtimeAccessToken,
+        updated: result.updated,
+    });
+});
+runtimeBindingRouter.post("/binding/issue", (req, res) => {
+    const currentRuntimeToken = extractRuntimeToken(req);
+    const authorizedByScheduler = currentRuntimeToken === runtimeToken;
+    const authorizedByCurrentBinding = validateRuntimeBindingToken(currentRuntimeToken);
+    if (!authorizedByScheduler && !authorizedByCurrentBinding) {
+        res.status(401).json({ error: "unauthorized" });
+        return;
+    }
+    const { accessToken, instanceId, userId, schedulerBaseUrl } = req.body || {};
+    const nextToken = String(accessToken || "").trim();
+    if (!nextToken) {
+        res.status(400).json({ error: "accessToken is required" });
+        return;
+    }
+    try {
+        const previousToken = getRuntimeAccessToken();
+        const updated = previousToken !== nextToken;
+        if (updated) {
+            saveRuntimeBinding({
+                accessToken: nextToken,
+                instanceId: instanceId ? String(instanceId) : undefined,
+                userId: userId ? String(userId) : undefined,
+                schedulerBaseUrl: schedulerBaseUrl
+                    ? String(schedulerBaseUrl)
+                    : undefined,
+            });
+            log.info(`[runtime-bridge] runtime token redispatched and updated: instanceId=${instanceId || "unknown"}`);
+        }
+        else {
+            log.info(`[runtime-bridge] runtime token redispatched but unchanged: instanceId=${instanceId || "unknown"}`);
+        }
+        res.json({
+            ok: true,
+            updated,
+            ...getRuntimeBindingPublicState(),
+        });
+    }
+    catch (error) {
+        const err = error;
+        res
+            .status(400)
+            .json({ error: err.message || "issue runtime token failed" });
+    }
+});
+runtimeBindingRouter.post("/binding/unpair", validateToken, (_req, res) => {
+    clearRuntimeBinding();
+    res.json({
+        ok: true,
+        ...getRuntimeBindingPublicState(),
+    });
+});
+export function logRuntimeBindingStartupState() {
+    const state = getRuntimeBindingPublicState();
+    if (state.paired) {
+        log.info(`[runtime-bridge] runtime binding loaded: instanceId=${state.instanceId || "unknown"}`);
+        return;
+    }
+    log.info("[runtime-bridge] bridge is unpaired; sensitive APIs will reject requests until paired");
+    log.info(`[runtime-bridge] pairing code: ${getRuntimePairingCode()}`);
+}

package/dist/routes/terminal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"terminal.d.ts","sourceRoot":"","sources":["../../src/routes/terminal.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EAEL,KAAK,oBAAoB,EAM1B,MAAM,qBAAqB,CAAC;AAc7B,eAAO,MAAM,cAAc,4CAAW,CAAC;AAIvC,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAGD,eAAO,MAAM,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAa,CAAC;AAEnE,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAE7D"}
+{"version":3,"file":"terminal.d.ts","sourceRoot":"","sources":["../../src/routes/terminal.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EAEL,KAAK,oBAAoB,EAM1B,MAAM,qBAAqB,CAAC;AAa7B,eAAO,MAAM,cAAc,4CAAW,CAAC;AAIvC,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAGD,eAAO,MAAM,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAa,CAAC;AAEnE,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAE7D"}

package/dist/routes/terminal.js

@@ -10,7 +10,6 @@ import { v4 as uuidv4 } from 'uuid';
 import { adapterRegistry, registerSdkProviders, resolveSdkProviderIdByCommand, } from '../adapter/index.js';
 import { validateToken } from '../middleware/auth.js';
 import { getAgentProcessManager } from '../services/agent-process-manager.js';
-import { AWS_MCP_SERVER_NAME, buildAwsMcpServerConfig } from '../services/aws-client-agent-mcp.js';
 import { findClaudeCodeProcesses } from '../services/process-detector.js';
 import { flushSessionOutput, scheduleOutputFlush, sendQuestionRequest, sendStatus, sessions } from '../services/session-output.js';
 import { loadPersistedSessions, removePersistedSession, removePersistedSessionByAgentId, savePersistedSessions, upsertPersistedSession, } from '../services/terminal-persistence.js';
@@ -196,13 +195,9 @@ async function startSdkSession(req, res) {
             workingDirectory: workspacePath,
             autoAccept: Boolean(autoAccept),
             initialPrompt,
-            // MCP 配置
+            // MCP 配置：不再默认注入 aws-mcp；由用户在面板中安装/配置
             mcpConfigPath,
-            extraMcpServers: {
-                // 默认加载 aws-mcp（用于 Agent 间通信）
-                [AWS_MCP_SERVER_NAME]: buildAwsMcpServerConfig({ agentId, workspacePath }),
-                ...(extraMcpServers || {}),
-            },
+            extraMcpServers: extraMcpServers || {},
         };
         // 存储会话信息
         sdkSessions.set(sessionId, {

package/dist/routes/terminal.test.js

@@ -1,6 +1,5 @@
 import { describe, expect, it } from 'vitest';
 import { SDK_PROVIDER_DEFINITIONS } from '../adapter/SdkProviderSpi.js';
-import { AWS_MCP_SERVER_NAME } from '../services/aws-client-agent-mcp.js';
 import { resolveSdkProviderId } from './terminal.js';
 describe('terminal route validation', () => {
     it('requires agentId and workspacePath for start', () => {
@@ -64,9 +63,6 @@ describe('terminal configuration', () => {
         const env = buildTerminalEnv('agent-123', { PATH: '/usr/bin' });
         expect(env.AWS_AGENT_ID).toBe('agent-123');
     });
-    it('uses aws-mcp as the default injected MCP server name', () => {
-        expect(AWS_MCP_SERVER_NAME).toBe('aws-mcp');
-    });
 });
 describe('resolveSdkProviderId', () => {
     it('exposes codex through the SDK provider SPI', () => {

package/dist/services/auto-register.d.ts

@@ -25,7 +25,9 @@ interface AutoRegisterConfig {
     roleName?: string;
     /** 工作空间路径 */
     workspacePath?: string;
-    /** 虚拟 IP（EasyTier） */
+    /** 注册 IP（优先用于生成 runtimeBridgeBaseUrl） */
+    registerIp?: string;
+    /** 虚拟 IP（EasyTier，兼容旧配置） */
     virtualIp?: string;
     /** 注册重试次数 */
     maxRetries?: number;
@@ -55,6 +57,12 @@ export declare function autoRegister(customConfig?: Partial<AutoRegisterConfig>)
 /**
  * 注销实例
  */
+export declare function requestRuntimeAccessTokenRefresh(): Promise<{
+    success: boolean;
+    runtimeAccessToken?: string;
+    updated?: boolean;
+    error?: string;
+}>;
 export declare function unregister(): Promise<boolean>;
 /**
  * 获取注册状态

package/dist/services/auto-register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auto-register.d.ts","sourceRoot":"","sources":["../../src/services/auto-register.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAoCH;;GAEG;AACH,UAAU,kBAAkB;IAC1B,eAAe;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sBAAsB;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAwJD;;;;;;GAMG;AACH,wBAAgB,UAAU,IAAI,kBAAkB,CAuC/C;AA2KD;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAyE/F;AAED;;GAEG;AACH,wBAAsB,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAuBnD;AAED;;GAEG;AACH,wBAAgB,oBAAoB;gBA5dtB,OAAO;iBACN,MAAM;kBACL,IAAI;YACV,MAAM;EA2df;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAEtC;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAElD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA2D/G"}
+{"version":3,"file":"auto-register.d.ts","sourceRoot":"","sources":["../../src/services/auto-register.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA6CH;;GAEG;AACH,UAAU,kBAAkB;IAC1B,eAAe;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAsKD;;;;;;GAMG;AACH,wBAAgB,UAAU,IAAI,kBAAkB,CAwC/C;AAuLD;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAChC,YAAY,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GACzC,OAAO,CAAC,OAAO,CAAC,CAoHlB;AAED;;GAEG;AACH,wBAAsB,gCAAgC,IAAI,OAAO,CAAC;IAChE,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAoED;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAuBnD;AAED;;GAEG;AACH,wBAAgB,oBAAoB;gBA/mBtB,OAAO;iBACN,MAAM;kBACL,IAAI;YACV,MAAM;EA8mBf;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAEtC;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAElD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CA0ED"}

package/dist/services/auto-register.js

@@ -7,12 +7,13 @@
  * 1. 环境变量
  * 2. 用户目录下的 .aws-bridge/config.json 文件
  */
-import axios from 'axios';
-import os from 'node:os';
-import path from 'node:path';
-import fs from 'node:fs';
-import { logger } from '../utils/logger.js';
-import { schedulerBaseUrl, runtimeToken } from '../config.js';
+import axios from "axios";
+import os from "node:os";
+import path from "node:path";
+import fs from "node:fs";
+import { logger } from "../utils/logger.js";
+import { schedulerBaseUrl, runtimeToken } from "../config.js";
+import { getRuntimeAccessToken, getRuntimeBindingPublicState, saveRuntimeBinding, } from "./runtime-binding.js";
 // 默认配置
 const DEFAULT_CONFIG = {
     enabled: false,
@@ -27,7 +28,7 @@ let registrationState = {
  */
 function getConfigFilePath() {
     const homeDir = os.homedir();
-    return path.join(homeDir, '.aws-bridge', 'config.json');
+    return path.join(homeDir, ".aws-bridge", "config.json");
 }
 /**
  * 确保配置文件存在，如果不存在则创建空配置文件
@@ -46,7 +47,7 @@ function ensureConfigFile() {
         }
         // 创建空配置文件
         const emptyConfig = {};
-        fs.writeFileSync(configPath, JSON.stringify(emptyConfig, null, 2), 'utf-8');
+        fs.writeFileSync(configPath, JSON.stringify(emptyConfig, null, 2), "utf-8");
         logger.info(`[AutoRegister] 已创建配置文件: ${configPath}`);
         logger.info(`[AutoRegister] 要启用自动注册，请编辑配置文件设置 tenantId 和 userKey`);
         return true;
@@ -70,7 +71,8 @@ function ensureConfigFile() {
  *   "projectName": "default",     // 可选
  *   "roleName": "Bridge",          // 可选
  *   "workspacePath": "/path/to/workspace",  // 可选
- *   "virtualIp": "10.144.144.1", // 可选
+ *   "registerIp": "192.168.1.25", // 可选，优先作为注册 IP
+ *   "virtualIp": "10.144.144.1", // 可选，兼容 EasyTier 虚拟 IP
  *   "maxRetries": 5,              // 可选
  *   "retryInterval": 5000          // 可选
  * }
@@ -84,7 +86,7 @@ function loadConfigFromFile() {
             logger.debug(`[AutoRegister] 配置文件不存在: ${configPath}`);
             return null;
         }
-        const content = fs.readFileSync(configPath, 'utf-8');
+        const content = fs.readFileSync(configPath, "utf-8");
         const config = JSON.parse(content);
         logger.info(`[AutoRegister] 从配置文件加载配置: ${configPath}`);
         return {
@@ -94,6 +96,7 @@ function loadConfigFromFile() {
             projectName: config.projectName,
             roleName: config.roleName,
             workspacePath: config.workspacePath,
+            registerIp: config.registerIp,
             virtualIp: config.virtualIp,
             maxRetries: config.maxRetries,
             retryInterval: config.retryInterval,
@@ -110,7 +113,7 @@ function loadConfigFromFile() {
  */
 function loadConfigFromEnv() {
     const envConfig = {};
-    if (process.env.AWS_AUTO_REGISTER === 'true') {
+    if (process.env.AWS_AUTO_REGISTER === "true") {
         envConfig.enabled = true;
     }
     if (process.env.AWS_TENANT_ID) {
@@ -131,6 +134,9 @@ function loadConfigFromEnv() {
     if (process.env.AWS_WORKSPACE_PATH) {
         envConfig.workspacePath = process.env.AWS_WORKSPACE_PATH;
     }
+    if (process.env.AWS_REGISTER_IP) {
+        envConfig.registerIp = process.env.AWS_REGISTER_IP;
+    }
     if (process.env.AWS_VIRTUAL_IP) {
         envConfig.virtualIp = process.env.AWS_VIRTUAL_IP;
     }
@@ -167,19 +173,20 @@ export function loadConfig() {
     // 否则，如果配置文件存在（无论是否有内容），则启用自动注册
     let enabled = false;
     if (process.env.AWS_AUTO_REGISTER !== undefined) {
-        enabled = process.env.AWS_AUTO_REGISTER === 'true';
+        enabled = process.env.AWS_AUTO_REGISTER === "true";
     }
     else if (fileConfig) {
         enabled = true;
     }
     return {
         enabled,
-        tenantId: merged.tenantId || '', // 保持为空字符串，后续会通过userKey自动推导
-        userKey: merged.userKey || '',
+        tenantId: merged.tenantId || "", // 保持为空字符串，后续会通过userKey自动推导
+        userKey: merged.userKey || "",
         instanceName,
         projectName: merged.projectName,
         roleName: merged.roleName,
         workspacePath: merged.workspacePath,
+        registerIp: merged.registerIp,
         virtualIp: merged.virtualIp,
         maxRetries: merged.maxRetries,
         retryInterval: merged.retryInterval,
@@ -197,7 +204,7 @@ function getAllLocalIpAddresses() {
             continue;
         for (const net of nets) {
             // 跳过内部和非 IPv4 地址
-            if (net.family === 'IPv4' && !net.internal) {
+            if (net.family === "IPv4" && !net.internal) {
                 addresses.push({
                     address: net.address,
                     netmask: net.netmask,
@@ -212,7 +219,7 @@ function getAllLocalIpAddresses() {
  * 将 IP 地址转换为整数
  */
 function ipToInt(ip) {
-    const parts = ip.split('.').map(Number);
+    const parts = ip.split(".").map(Number);
     return (parts[0] << 24) + (parts[1] << 16) + (parts[2] << 8) + parts[3];
 }
 /**
@@ -231,8 +238,8 @@ function extractIpFromUrl(url) {
     try {
         const urlObj = new URL(url);
         // 如果是主机名，尝试解析
-        if (urlObj.hostname === 'localhost' || urlObj.hostname === '127.0.0.1') {
-            return '127.0.0.1';
+        if (urlObj.hostname === "localhost" || urlObj.hostname === "127.0.0.1") {
+            return "127.0.0.1";
         }
         // 检查是否是有效的 IP 地址
         const ipPattern = /^(\d{1,3}\.){3}\d{1,3}$/;
@@ -258,8 +265,8 @@ function extractIpFromUrl(url) {
 function getPreferredIpAddress(schedulerUrl) {
     const allIps = getAllLocalIpAddresses();
     if (allIps.length === 0) {
-        logger.warn('[AutoRegister] 未找到任何非内部 IP 地址，使用 127.0.0.1');
-        return '127.0.0.1';
+        logger.warn("[AutoRegister] 未找到任何非内部 IP 地址，使用 127.0.0.1");
+        return "127.0.0.1";
     }
     // 尝试从调度中心 URL 提取 IP
     const schedulerIp = extractIpFromUrl(schedulerUrl);
@@ -274,7 +281,7 @@ function getPreferredIpAddress(schedulerUrl) {
         logger.warn(`[AutoRegister] 未找到与调度中心 (${schedulerIp}) 同子网的 IP，使用第一个可用 IP`);
     }
     else {
-        logger.info('[AutoRegister] 无法解析调度中心 IP，使用第一个可用 IP');
+        logger.info("[AutoRegister] 无法解析调度中心 IP，使用第一个可用 IP");
     }
     // 回退：返回第一个非内部 IP
     return allIps[0].address;
@@ -297,20 +304,20 @@ async function doRegister(config) {
         userKey: config.userKey,
         instanceName,
         hostname: os.hostname(),
-        virtualIp: config.virtualIp,
-        runtimeBridgeBaseUrl: `http://${config.virtualIp || localIp}:${port}`,
+        virtualIp: config.registerIp || config.virtualIp,
+        runtimeBridgeBaseUrl: `http://${config.registerIp || config.virtualIp || localIp}:${port}`,
         workspacePath: config.workspacePath,
         projectName: config.projectName,
         roleName: config.roleName,
     };
     logger.info(`[AutoRegister] 正在注册实例: ${instanceName}`);
     logger.info(`[AutoRegister] 调度中心: ${schedulerBaseUrl}`);
-    logger.info(`[AutoRegister] 用户 Key: ${config.userKey ? '****' + config.userKey.slice(-4) : '(未设置)'}`);
-    logger.info(`[AutoRegister] 租户 ID: ${config.tenantId || '(自动推导)'}`);
+    logger.info(`[AutoRegister] 用户 Key: ${config.userKey ? "****" + config.userKey.slice(-4) : "(未设置)"}`);
+    logger.info(`[AutoRegister] 租户 ID: ${config.tenantId || "(自动推导)"}`);
     const response = await axios.post(`${schedulerBaseUrl}/api/instances/register`, request, {
         headers: {
-            'Content-Type': 'application/json',
-            'X-Runtime-Token': runtimeToken,
+            "Content-Type": "application/json",
+            "X-Runtime-Token": runtimeToken,
         },
         timeout: 10000,
     });
@@ -322,8 +329,8 @@ async function doRegister(config) {
 async function doUnregister(instanceId) {
     const response = await axios.post(`${schedulerBaseUrl}/api/instances/unregister`, { instanceId }, {
         headers: {
-            'Content-Type': 'application/json',
-            'X-Runtime-Token': runtimeToken,
+            "Content-Type": "application/json",
+            "X-Runtime-Token": runtimeToken,
         },
         timeout: 10000,
     });
@@ -348,13 +355,13 @@ export async function autoRegister(customConfig) {
     };
     // 检查是否启用
     if (!config.enabled) {
-        logger.info('[AutoRegister] 自动注册未启用');
-        logger.info('[AutoRegister] 要启用自动注册，请创建配置文件 ~/.aws-bridge/config.json 或设置环境变量 AWS_AUTO_REGISTER=true');
+        logger.info("[AutoRegister] 自动注册未启用");
+        logger.info("[AutoRegister] 要启用自动注册，请创建配置文件 ~/.aws-bridge/config.json 或设置环境变量 AWS_AUTO_REGISTER=true");
         return false;
     }
     // 验证必填字段（userKey 为必填，tenantId 现在可选）
     if (!config.userKey) {
-        logger.error('[AutoRegister] 缺少用户 Key（在配置文件中设置 userKey 或设置环境变量 AWS_USER_KEY）');
+        logger.error("[AutoRegister] 缺少用户 Key（在配置文件中设置 userKey 或设置环境变量 AWS_USER_KEY）");
         return false;
     }
     // tenantId 现在是可选的，如果没有提供，后端会根据 userKey 自动推导
@@ -372,7 +379,27 @@ export async function autoRegister(customConfig) {
                 logger.info(`[AutoRegister] ✓ 注册成功！`);
                 logger.info(`[AutoRegister]   实例 ID: ${response.instanceId}`);
                 logger.info(`[AutoRegister]   消息: ${response.message}`);
-                logger.info(`[AutoRegister]   更新: ${response.isUpdate ? '是' : '否'}`);
+                logger.info(`[AutoRegister]   更新: ${response.isUpdate ? "是" : "否"}`);
+                if (response.runtimeAccessToken) {
+                    try {
+                        saveRuntimeBinding({
+                            accessToken: response.runtimeAccessToken,
+                            instanceId: response.instanceId,
+                            userId: response.userId,
+                            schedulerBaseUrl: response.serverUrl || schedulerBaseUrl,
+                        });
+                        logger.info("[AutoRegister] 已保存调度中心下发的 runtime access token");
+                    }
+                    catch (error) {
+                        const err = error;
+                        logger.error(`[AutoRegister] 保存 runtime access token 失败: ${err.message}`);
+                        registrationState.error = err.message;
+                        return false;
+                    }
+                }
+                else {
+                    logger.warn("[AutoRegister] 注册响应未包含 runtime access token，MCP 将只能使用兼容的静态内部密钥访问调度中心");
+                }
                 return true;
             }
             else {
@@ -382,25 +409,27 @@ export async function autoRegister(customConfig) {
         }
         catch (error) {
             const err = error;
-            const message = err.response?.data ? JSON.stringify(err.response.data) : err.message;
+            const message = err.response?.data
+                ? JSON.stringify(err.response.data)
+                : err.message;
             logger.error(`[AutoRegister] 注册请求失败 (尝试 ${attempt}/${maxRetries}): ${message}`);
             registrationState.error = message;
         }
         // 如果不是最后一次尝试，等待后重试
         if (attempt < maxRetries) {
             logger.info(`[AutoRegister] ${retryInterval / 1000} 秒后重试...`);
-            await new Promise(resolve => setTimeout(resolve, retryInterval));
+            await new Promise((resolve) => setTimeout(resolve, retryInterval));
         }
     }
     logger.error(`[AutoRegister] ✗ 注册失败，已达最大重试次数`);
     logger.error(`[AutoRegister] ========================================`);
     logger.error(`[AutoRegister] 自动注册已启用但注册失败，实例无法正常工作`);
     logger.error(`[AutoRegister] 请检查以下配置：`);
-    logger.error(`[AutoRegister]   - 用户 Key (userKey): ${config.userKey ? '****' + config.userKey.slice(-4) : '(未设置)'}`);
-    logger.error(`[AutoRegister]   - 租户 ID (tenantId): ${config.tenantId || '(可选，将自动推导)'}`);
-    logger.error(`[AutoRegister]   - 实例名 (instanceName): ${config.instanceName || '(使用主机名)'}`);
+    logger.error(`[AutoRegister]   - 用户 Key (userKey): ${config.userKey ? "****" + config.userKey.slice(-4) : "(未设置)"}`);
+    logger.error(`[AutoRegister]   - 租户 ID (tenantId): ${config.tenantId || "(可选，将自动推导)"}`);
+    logger.error(`[AutoRegister]   - 实例名 (instanceName): ${config.instanceName || "(使用主机名)"}`);
     logger.error(`[AutoRegister]   - 调度中心地址: ${schedulerBaseUrl}`);
-    logger.error(`[AutoRegister]   - 最后错误: ${registrationState.error || '未知'}`);
+    logger.error(`[AutoRegister]   - 最后错误: ${registrationState.error || "未知"}`);
     logger.error(`[AutoRegister] ========================================`);
     logger.error(`[AutoRegister] 配置来源：~/.aws-bridge/config.json 或环境变量`);
     return false;
@@ -408,9 +437,64 @@ export async function autoRegister(customConfig) {
 /**
  * 注销实例
  */
+export async function requestRuntimeAccessTokenRefresh() {
+    const config = loadConfig();
+    if (!config.userKey) {
+        return {
+            success: false,
+            error: "userKey is required for runtime token refresh",
+        };
+    }
+    const state = getRuntimeBindingPublicState();
+    const localIp = getLocalIpAddress();
+    const runtimeBridgePort = process.env.AWS_RUNTIME_BRIDGE_PORT || 18081;
+    const runtimeBridgeBaseUrl = `http://${config.registerIp || config.virtualIp || localIp}:${runtimeBridgePort}`;
+    try {
+        const response = await axios.post(`${schedulerBaseUrl}/api/instances/runtime-tokens/refresh`, {
+            tenantId: config.tenantId,
+            userKey: config.userKey,
+            instanceId: state.instanceId,
+            instanceName: config.instanceName,
+            runtimeBridgeBaseUrl,
+        }, {
+            headers: {
+                "Content-Type": "application/json",
+                "X-Runtime-Token": runtimeToken,
+            },
+            timeout: 10000,
+        });
+        if (!response.data.success || !response.data.runtimeAccessToken) {
+            return {
+                success: false,
+                error: response.data.message ||
+                    "scheduler did not return runtimeAccessToken",
+            };
+        }
+        const previousToken = getRuntimeAccessToken();
+        const updated = previousToken !== response.data.runtimeAccessToken;
+        saveRuntimeBinding({
+            accessToken: response.data.runtimeAccessToken,
+            instanceId: state.instanceId,
+            userId: response.data.userId || config.userKey,
+            schedulerBaseUrl,
+        });
+        return {
+            success: true,
+            runtimeAccessToken: response.data.runtimeAccessToken,
+            updated,
+        };
+    }
+    catch (error) {
+        const err = error;
+        const message = err.response?.data
+            ? JSON.stringify(err.response.data)
+            : err.message;
+        return { success: false, error: message };
+    }
+}
 export async function unregister() {
     if (!registrationState.registered || !registrationState.instanceId) {
-        logger.info('[AutoRegister] 实例未注册，无需注销');
+        logger.info("[AutoRegister] 实例未注册，无需注销");
         return true;
     }
     try {
@@ -474,20 +558,20 @@ export async function bridgeRestartCleanup() {
     if (config.enabled) {
         const localIp = getLocalIpAddress();
         const port = process.env.AWS_RUNTIME_BRIDGE_PORT || 18081;
-        requestBody.runtimeBridgeBaseUrl = `http://${config.virtualIp || localIp}:${port}`;
+        requestBody.runtimeBridgeBaseUrl = `http://${config.registerIp || config.virtualIp || localIp}:${port}`;
     }
     if (!requestBody.instanceId && !requestBody.runtimeBridgeBaseUrl) {
-        logger.info('[AutoRegister] Bridge 重启清理：没有 instanceId 或 runtimeBridgeBaseUrl，跳过清理');
+        logger.info("[AutoRegister] Bridge 重启清理：没有 instanceId 或 runtimeBridgeBaseUrl，跳过清理");
         return { success: true, agentCount: 0 };
     }
     try {
         logger.info(`[AutoRegister] Bridge 重启清理：正在通知调度中心...`);
-        logger.info(`[AutoRegister]   instanceId: ${requestBody.instanceId || '(无)'}`);
-        logger.info(`[AutoRegister]   runtimeBridgeBaseUrl: ${requestBody.runtimeBridgeBaseUrl || '(无)'}`);
+        logger.info(`[AutoRegister]   instanceId: ${requestBody.instanceId || "(无)"}`);
+        logger.info(`[AutoRegister]   runtimeBridgeBaseUrl: ${requestBody.runtimeBridgeBaseUrl || "(无)"}`);
         const response = await axios.post(`${schedulerBaseUrl}/api/instances/bridge-restart-cleanup`, requestBody, {
             headers: {
-                'Content-Type': 'application/json',
-                'X-Runtime-Token': runtimeToken,
+                "Content-Type": "application/json",
+                "X-Runtime-Token": runtimeToken,
             },
             timeout: 10000,
         });
@@ -503,7 +587,9 @@ export async function bridgeRestartCleanup() {
     }
     catch (error) {
         const err = error;
-        const message = err.response?.data ? JSON.stringify(err.response.data) : err.message;
+        const message = err.response?.data
+            ? JSON.stringify(err.response.data)
+            : err.message;
         logger.warn(`[AutoRegister] Bridge 重启清理请求失败：${message}`);
         return { success: false, error: message };
     }

package/dist/services/aws-client-agent-mcp.d.ts

@@ -15,7 +15,7 @@ export interface ResolveAwsClientAgentMcpCommandOptions {
     release?: () => string | null;
 }
 export interface AwsMcpPreparedInfo extends AwsMcpCommandSpec {
-    source: 'override' | 'bundled' | 'global';
+    source: "override" | "bundled" | "global";
 }
 export declare function getReleasedMcpDistPath(): string;
 export declare function releaseBundledAwsClientAgentMcp(): string | null;

package/dist/services/aws-client-agent-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aws-client-agent-mcp.d.ts","sourceRoot":"","sources":["../../src/services/aws-client-agent-mcp.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAqB7C,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,sCAAsC;IACrD,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;CAC3C;AAeD,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAMD,wBAAgB,+BAA+B,IAAI,MAAM,GAAG,IAAI,CAoB/D;AA6CD,wBAAgB,+BAA+B,CAAC,OAAO,GAAE,sCAA2C,GAAG,kBAAkB,CAExH;AAED,wBAAgB,gCAAgC,CAAC,OAAO,GAAE,sCAA2C,GAAG,kBAAkB,CAuBzH;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,uBAAuB,GAAG,kBAAkB,CAe1F;AAED,wBAAgB,+BAA+B,IAAI,IAAI,CAUtD"}
+{"version":3,"file":"aws-client-agent-mcp.d.ts","sourceRoot":"","sources":["../../src/services/aws-client-agent-mcp.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAuB7C,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,sCAAsC;IACrD,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;CAC3C;AAqBD,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAMD,wBAAgB,+BAA+B,IAAI,MAAM,GAAG,IAAI,CAsB/D;AA2ED,wBAAgB,+BAA+B,CAC7C,OAAO,GAAE,sCAA2C,GACnD,kBAAkB,CAEpB;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,GAAE,sCAA2C,GACnD,kBAAkB,CA+BpB;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,uBAAuB,GAC7B,kBAAkB,CAwBpB;AAED,wBAAgB,+BAA+B,IAAI,IAAI,CAgBtD"}