aws-runtime-bridge 1.0.2 → 1.1.0

package/dist/services/process-registry.js

@@ -7,7 +7,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { promises as fs } from 'node:fs';
 import { createLogger } from '../utils/logger.js';
-import { ensureDir } from '../utils/file-utils.js';
+import { atomicWriteJsonFile, withFileLock } from '../utils/file-utils.js';
 const log = createLogger('process-registry');
 /**
  * 获取持久化注册表文件路径
@@ -47,15 +47,17 @@ export class ProcessRegistry {
     async persist() {
         const filePath = getProcessRegistryFile();
         try {
-            await ensureDir(path.dirname(filePath));
             const records = Array.from(this.records.values());
-            await fs.writeFile(filePath, JSON.stringify(records, null, 2), 'utf-8');
+            await atomicWriteJsonFile(filePath, records);
             log.debug(`[persist] 已持久化 ${records.length} 条进程记录`);
         }
         catch (error) {
             log.error('[persist] 持久化失败:', error);
         }
     }
+    async mutate(operation) {
+        return withFileLock(getProcessRegistryFile(), async () => operation());
+    }
     /**
      * 注册新进程
      *
@@ -63,19 +65,21 @@ export class ProcessRegistry {
      * @returns 是否注册成功
      */
     async register(record) {
-        const fullRecord = {
-            ...record,
-            createdAt: new Date().toISOString(),
-        };
-        // 如果已存在相同 agentId，先移除旧的映射
-        const existing = this.records.get(record.agentId);
-        if (existing) {
-            this.pidToAgentId.delete(existing.pid);
-        }
-        this.records.set(record.agentId, fullRecord);
-        this.pidToAgentId.set(record.pid, record.agentId);
-        log.info(`[register] 注册进程: agentId=${record.agentId}, pid=${record.pid}, mode=${record.mode}, state=${record.state}`);
-        await this.persist();
+        await this.mutate(async () => {
+            const fullRecord = {
+                ...record,
+                createdAt: new Date().toISOString(),
+            };
+            // 如果已存在相同 agentId，先移除旧的映射
+            const existing = this.records.get(record.agentId);
+            if (existing) {
+                this.pidToAgentId.delete(existing.pid);
+            }
+            this.records.set(record.agentId, fullRecord);
+            this.pidToAgentId.set(record.pid, record.agentId);
+            log.info(`[register] 注册进程: agentId=${record.agentId}, pid=${record.pid}, mode=${record.mode}, state=${record.state}`);
+            await this.persist();
+        });
     }
     /**
      * 更新进程记录
@@ -85,20 +89,22 @@ export class ProcessRegistry {
      * @returns 是否更新成功
      */
     async update(agentId, updates) {
-        const record = this.records.get(agentId);
-        if (!record) {
-            log.warn(`[update] 未找到进程: agentId=${agentId}`);
-            return false;
-        }
-        // 如果更新包含 pid，需要更新 pid 映射
-        if (updates.pid !== undefined && updates.pid !== record.pid) {
-            this.pidToAgentId.delete(record.pid);
-            this.pidToAgentId.set(updates.pid, agentId);
-        }
-        Object.assign(record, updates);
-        log.debug(`[update] 更新进程: agentId=${agentId}, updates=${JSON.stringify(updates)}`);
-        await this.persist();
-        return true;
+        return this.mutate(async () => {
+            const record = this.records.get(agentId);
+            if (!record) {
+                log.warn(`[update] 未找到进程: agentId=${agentId}`);
+                return false;
+            }
+            // 如果更新包含 pid，需要更新 pid 映射
+            if (updates.pid !== undefined && updates.pid !== record.pid) {
+                this.pidToAgentId.delete(record.pid);
+                this.pidToAgentId.set(updates.pid, agentId);
+            }
+            Object.assign(record, updates);
+            log.debug(`[update] 更新进程: agentId=${agentId}, updates=${JSON.stringify(updates)}`);
+            await this.persist();
+            return true;
+        });
     }
     /**
      * 通过 agentId 获取进程记录
@@ -164,16 +170,18 @@ export class ProcessRegistry {
      * @returns 是否标记成功
      */
     async markOrphaned(agentId) {
-        const record = this.records.get(agentId);
-        if (!record) {
-            log.warn(`[markOrphaned] 未找到进程: agentId=${agentId}`);
-            return false;
-        }
-        record.state = 'orphaned';
-        record.orphanedAt = new Date().toISOString();
-        log.info(`[markOrphaned] 标记进程为孤儿: agentId=${agentId}, orphanedAt=${record.orphanedAt}`);
-        await this.persist();
-        return true;
+        return this.mutate(async () => {
+            const record = this.records.get(agentId);
+            if (!record) {
+                log.warn(`[markOrphaned] 未找到进程: agentId=${agentId}`);
+                return false;
+            }
+            record.state = 'orphaned';
+            record.orphanedAt = new Date().toISOString();
+            log.info(`[markOrphaned] 标记进程为孤儿: agentId=${agentId}, orphanedAt=${record.orphanedAt}`);
+            await this.persist();
+            return true;
+        });
     }
     /**
      * 标记进程为终止状态
@@ -182,15 +190,17 @@ export class ProcessRegistry {
      * @returns 是否标记成功
      */
     async markTerminated(agentId) {
-        const record = this.records.get(agentId);
-        if (!record) {
-            log.warn(`[markTerminated] 未找到进程: agentId=${agentId}`);
-            return false;
-        }
-        record.state = 'terminated';
-        log.info(`[markTerminated] 标记进程为终止: agentId=${agentId}`);
-        await this.persist();
-        return true;
+        return this.mutate(async () => {
+            const record = this.records.get(agentId);
+            if (!record) {
+                log.warn(`[markTerminated] 未找到进程: agentId=${agentId}`);
+                return false;
+            }
+            record.state = 'terminated';
+            log.info(`[markTerminated] 标记进程为终止: agentId=${agentId}`);
+            await this.persist();
+            return true;
+        });
     }
     /**
      * 移除进程记录
@@ -199,16 +209,18 @@ export class ProcessRegistry {
      * @returns 是否移除成功
      */
     async remove(agentId) {
-        const record = this.records.get(agentId);
-        if (!record) {
-            log.warn(`[remove] 未找到进程: agentId=${agentId}`);
-            return false;
-        }
-        this.records.delete(agentId);
-        this.pidToAgentId.delete(record.pid);
-        log.info(`[remove] 移除进程: agentId=${agentId}, pid=${record.pid}`);
-        await this.persist();
-        return true;
+        return this.mutate(async () => {
+            const record = this.records.get(agentId);
+            if (!record) {
+                log.warn(`[remove] 未找到进程: agentId=${agentId}`);
+                return false;
+            }
+            this.records.delete(agentId);
+            this.pidToAgentId.delete(record.pid);
+            log.info(`[remove] 移除进程: agentId=${agentId}, pid=${record.pid}`);
+            await this.persist();
+            return true;
+        });
     }
     /**
      * 更新进程心跳时间
@@ -217,15 +229,17 @@ export class ProcessRegistry {
      * @returns 是否更新成功
      */
     async updateHeartbeat(agentId) {
-        const record = this.records.get(agentId);
-        if (!record) {
-            log.warn(`[updateHeartbeat] 未找到进程: agentId=${agentId}`);
-            return false;
-        }
-        record.lastHeartbeat = new Date().toISOString();
-        log.debug(`[updateHeartbeat] 更新心跳: agentId=${agentId}, lastHeartbeat=${record.lastHeartbeat}`);
-        await this.persist();
-        return true;
+        return this.mutate(async () => {
+            const record = this.records.get(agentId);
+            if (!record) {
+                log.warn(`[updateHeartbeat] 未找到进程: agentId=${agentId}`);
+                return false;
+            }
+            record.lastHeartbeat = new Date().toISOString();
+            log.debug(`[updateHeartbeat] 更新心跳: agentId=${agentId}, lastHeartbeat=${record.lastHeartbeat}`);
+            await this.persist();
+            return true;
+        });
     }
     /**
      * 更新进程健康状态
@@ -235,15 +249,17 @@ export class ProcessRegistry {
      * @returns 是否更新成功
      */
     async updateHealth(agentId, health) {
-        const record = this.records.get(agentId);
-        if (!record) {
-            log.warn(`[updateHealth] 未找到进程: agentId=${agentId}`);
-            return false;
-        }
-        record.healthStatus = health;
-        log.debug(`[updateHealth] 更新健康状态: agentId=${agentId}, health=${JSON.stringify(health)}`);
-        await this.persist();
-        return true;
+        return this.mutate(async () => {
+            const record = this.records.get(agentId);
+            if (!record) {
+                log.warn(`[updateHealth] 未找到进程: agentId=${agentId}`);
+                return false;
+            }
+            record.healthStatus = health;
+            log.debug(`[updateHealth] 更新健康状态: agentId=${agentId}, health=${JSON.stringify(health)}`);
+            await this.persist();
+            return true;
+        });
     }
     /**
      * 从持久化会话重建注册表
@@ -251,30 +267,32 @@ export class ProcessRegistry {
      * @param sessions - 持久化会话数组
      */
     async rebuildFromPersisted(sessions) {
-        log.info(`[rebuildFromPersisted] 从 ${sessions.length} 个持久化会话重建注册表`);
-        this.records.clear();
-        this.pidToAgentId.clear();
-        for (const session of sessions) {
-            if (!session.pid) {
-                log.warn(`[rebuildFromPersisted] 跳过无 PID 的会话: agentId=${session.agentId}`);
-                continue;
+        await this.mutate(async () => {
+            log.info(`[rebuildFromPersisted] 从 ${sessions.length} 个持久化会话重建注册表`);
+            this.records.clear();
+            this.pidToAgentId.clear();
+            for (const session of sessions) {
+                if (!session.pid) {
+                    log.warn(`[rebuildFromPersisted] 跳过无 PID 的会话: agentId=${session.agentId}`);
+                    continue;
+                }
+                const record = {
+                    agentId: session.agentId,
+                    sessionId: session.sessionId,
+                    pid: session.pid,
+                    mode: session.mode || 'sdk',
+                    state: 'unknown', // 重建时状态未知，需要外部检测
+                    workspacePath: session.workspacePath || '',
+                    command: session.command || '',
+                    createdAt: new Date().toISOString(),
+                };
+                this.records.set(record.agentId, record);
+                this.pidToAgentId.set(record.pid, record.agentId);
+                log.debug(`[rebuildFromPersisted] 重建进程记录: agentId=${record.agentId}, pid=${record.pid}`);
             }
-            const record = {
-                agentId: session.agentId,
-                sessionId: session.sessionId,
-                pid: session.pid,
-                mode: session.mode || 'sdk',
-                state: 'unknown', // 重建时状态未知，需要外部检测
-                workspacePath: session.workspacePath || '',
-                command: session.command || '',
-                createdAt: new Date().toISOString(),
-            };
-            this.records.set(record.agentId, record);
-            this.pidToAgentId.set(record.pid, record.agentId);
-            log.debug(`[rebuildFromPersisted] 重建进程记录: agentId=${record.agentId}, pid=${record.pid}`);
-        }
-        log.info(`[rebuildFromPersisted] 重建完成，共 ${this.records.size} 条记录`);
-        await this.persist();
+            log.info(`[rebuildFromPersisted] 重建完成，共 ${this.records.size} 条记录`);
+            await this.persist();
+        });
     }
     /**
      * 导出所有进程记录用于持久化
@@ -308,11 +326,13 @@ export class ProcessRegistry {
      * 清空所有进程记录
      */
     async clear() {
-        const count = this.records.size;
-        this.records.clear();
-        this.pidToAgentId.clear();
-        log.info(`[clear] 清空所有进程记录: ${count} 条`);
-        await this.persist();
+        await this.mutate(async () => {
+            const count = this.records.size;
+            this.records.clear();
+            this.pidToAgentId.clear();
+            log.info(`[clear] 清空所有进程记录: ${count} 条`);
+            await this.persist();
+        });
     }
 }
 ProcessRegistry.instance = null;
@@ -348,7 +368,8 @@ export async function loadPersistedProcessRegistry() {
  */
 export async function savePersistedProcessRegistry(records) {
     const filePath = getProcessRegistryFile();
-    await ensureDir(path.dirname(filePath));
-    await fs.writeFile(filePath, JSON.stringify(records, null, 2), 'utf-8');
-    log.debug(`[savePersistedProcessRegistry] 保存了 ${records.length} 条进程记录`);
+    await withFileLock(filePath, async () => {
+        await atomicWriteJsonFile(filePath, records);
+        log.debug(`[savePersistedProcessRegistry] 保存了 ${records.length} 条进程记录`);
+    });
 }

package/dist/services/runtime-binding.d.ts

@@ -1,6 +1,7 @@
 export type RuntimeBindingState = {
     status: "unpaired" | "paired";
     instanceId?: string;
+    userId?: string;
     schedulerBaseUrl?: string;
     /**
      * Plain runtime access token issued by the scheduler.
@@ -15,17 +16,26 @@ export type RuntimeBindingState = {
 };
 export declare function getRuntimePairingCode(): string;
 export declare function getRuntimeBindingFilePath(): string;
+export declare function getRuntimeTokenStoreFilePath(): string;
+export declare function buildRuntimeTokenKey(userId: unknown, serverBaseUrl: unknown): string;
+export declare function saveScopedRuntimeAccessToken(input: {
+    userId: string;
+    serverBaseUrl: string;
+    accessToken: string;
+}): string;
+export declare function getScopedRuntimeAccessToken(userId: unknown, serverBaseUrl: unknown): string | undefined;
 export declare function loadRuntimeBinding(): RuntimeBindingState;
 export declare function getRuntimeBindingPublicState(): Omit<RuntimeBindingState, "tokenHash" | "accessToken"> & {
     paired: boolean;
 };
 export declare function hasRuntimeBinding(): boolean;
 export declare function validateRuntimeBindingToken(token: unknown): boolean;
-export declare function getRuntimeAccessToken(): string | undefined;
+export declare function getRuntimeAccessToken(userId?: unknown, serverBaseUrl?: unknown): string | undefined;
 export declare function validateRuntimePairingCode(code: unknown): boolean;
 export declare function saveRuntimeBinding(input: {
     accessToken: string;
     instanceId?: string;
+    userId?: string;
     schedulerBaseUrl?: string;
 }): RuntimeBindingState;
 export declare function clearRuntimeBinding(): void;

package/dist/services/runtime-binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-binding.d.ts","sourceRoot":"","sources":["../../src/services/runtime-binding.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAuCF,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,wBAAgB,kBAAkB,IAAI,mBAAmB,CAWxD;AAED,wBAAgB,4BAA4B,IAAI,IAAI,CAClD,mBAAmB,EACnB,WAAW,GAAG,aAAa,CAC5B,GAAG;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAWtB;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAG3C;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAYnE;AAED,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,SAAS,CAM1D;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAEjE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,mBAAmB,CA6BtB;AAED,wBAAgB,mBAAmB,IAAI,IAAI,CAkB1C"}
+{"version":3,"file":"runtime-binding.d.ts","sourceRoot":"","sources":["../../src/services/runtime-binding.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAoDF,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAoBD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,OAAO,GACrB,MAAM,CAYR;AAsCD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,MAAM,CAWT;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,OAAO,GACrB,MAAM,GAAG,SAAS,CAUpB;AAcD,wBAAgB,kBAAkB,IAAI,mBAAmB,CAWxD;AAED,wBAAgB,4BAA4B,IAAI,IAAI,CAClD,mBAAmB,EACnB,WAAW,GAAG,aAAa,CAC5B,GAAG;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAWtB;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAG3C;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAcnE;AAED,wBAAgB,qBAAqB,CACnC,MAAM,CAAC,EAAE,OAAO,EAChB,aAAa,CAAC,EAAE,OAAO,GACtB,MAAM,GAAG,SAAS,CAWpB;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAEjE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,mBAAmB,CAuCtB;AAED,wBAAgB,mBAAmB,IAAI,IAAI,CAkB1C"}

package/dist/services/runtime-binding.js

@@ -18,6 +18,9 @@ function bindingDir() {
 function bindingFile() {
     return path.join(bindingDir(), "binding.json");
 }
+function tokenStoreFile() {
+    return path.join(bindingDir(), "runtime-tokens.properties");
+}
 function hashToken(token) {
     return crypto
         .createHash(TOKEN_HASH_ALGORITHM)
@@ -32,6 +35,14 @@ function safeEqual(a, b) {
     }
     return crypto.timingSafeEqual(left, right);
 }
+function safeTextEqual(a, b) {
+    const left = Buffer.from(a, "utf8");
+    const right = Buffer.from(b, "utf8");
+    if (left.length !== right.length) {
+        return false;
+    }
+    return crypto.timingSafeEqual(left, right);
+}
 function normalizeToken(token) {
     return String(token || "").trim();
 }
@@ -41,6 +52,106 @@ export function getRuntimePairingCode() {
 export function getRuntimeBindingFilePath() {
     return bindingFile();
 }
+export function getRuntimeTokenStoreFilePath() {
+    return tokenStoreFile();
+}
+function normalizeServerIp(serverBaseUrl) {
+    const raw = String(serverBaseUrl || "").trim();
+    if (!raw) {
+        return "";
+    }
+    try {
+        return new URL(raw).hostname.toLowerCase();
+    }
+    catch {
+        return raw
+            .replace(/^wss?:\/\//i, "")
+            .replace(/^https?:\/\//i, "")
+            .split("/")[0]
+            .split(":")[0]
+            .toLowerCase();
+    }
+}
+export function buildRuntimeTokenKey(userId, serverBaseUrl) {
+    const normalizedUserId = String(userId || "").trim();
+    const serverIp = normalizeServerIp(serverBaseUrl);
+    if (!normalizedUserId || !serverIp) {
+        throw new Error("userId and serverBaseUrl are required to build runtime token key");
+    }
+    return crypto
+        .createHash("md5")
+        .update(`${normalizedUserId}:${serverIp}`, "utf8")
+        .digest("hex");
+}
+function loadRuntimeTokenStore() {
+    const result = new Map();
+    try {
+        const content = fs.readFileSync(tokenStoreFile(), "utf8");
+        for (const line of content.split(/\r?\n/)) {
+            const trimmed = line.trim();
+            if (!trimmed || trimmed.startsWith("#")) {
+                continue;
+            }
+            const separatorIndex = trimmed.indexOf("=");
+            if (separatorIndex <= 0) {
+                continue;
+            }
+            const key = trimmed.slice(0, separatorIndex).trim();
+            const token = trimmed.slice(separatorIndex + 1).trim();
+            if (key && token) {
+                result.set(key, token);
+            }
+        }
+    }
+    catch {
+        // Missing token store is valid for an unpaired bridge.
+    }
+    return result;
+}
+function saveRuntimeTokenStore(tokens) {
+    fs.mkdirSync(bindingDir(), { recursive: true });
+    const lines = [...tokens.entries()]
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, token]) => `${key}=${token}`);
+    fs.writeFileSync(tokenStoreFile(), `${lines.join("\n")}\n`, {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+}
+export function saveScopedRuntimeAccessToken(input) {
+    const accessToken = normalizeToken(input.accessToken);
+    if (accessToken.length < 16) {
+        throw new Error("accessToken must be at least 16 characters");
+    }
+    const key = buildRuntimeTokenKey(input.userId, input.serverBaseUrl);
+    const tokens = loadRuntimeTokenStore();
+    tokens.set(key, accessToken);
+    saveRuntimeTokenStore(tokens);
+    return key;
+}
+export function getScopedRuntimeAccessToken(userId, serverBaseUrl) {
+    if (!userId || !serverBaseUrl) {
+        return undefined;
+    }
+    try {
+        const key = buildRuntimeTokenKey(userId, serverBaseUrl);
+        return loadRuntimeTokenStore().get(key);
+    }
+    catch {
+        return undefined;
+    }
+}
+function validateRuntimeTokenStore(token) {
+    if (!token) {
+        return false;
+    }
+    for (const storedToken of loadRuntimeTokenStore().values()) {
+        if (safeTextEqual(token, storedToken)) {
+            return true;
+        }
+    }
+    return false;
+}
 export function loadRuntimeBinding() {
     try {
         const raw = fs.readFileSync(bindingFile(), "utf8");
@@ -72,12 +183,18 @@ export function validateRuntimeBindingToken(token) {
         return false;
     }
     const state = loadRuntimeBinding();
-    if (state.status !== "paired" || !state.tokenHash) {
-        return false;
+    if (state.status === "paired" && state.tokenHash) {
+        if (safeEqual(hashToken(candidate), state.tokenHash)) {
+            return true;
+        }
     }
-    return safeEqual(hashToken(candidate), state.tokenHash);
+    return validateRuntimeTokenStore(candidate);
 }
-export function getRuntimeAccessToken() {
+export function getRuntimeAccessToken(userId, serverBaseUrl) {
+    const scopedToken = getScopedRuntimeAccessToken(userId, serverBaseUrl);
+    if (scopedToken) {
+        return scopedToken;
+    }
     const state = loadRuntimeBinding();
     if (state.status !== "paired") {
         return undefined;
@@ -99,6 +216,7 @@ export function saveRuntimeBinding(input) {
         instanceId: input.instanceId
             ? String(input.instanceId)
             : previous.instanceId,
+        userId: input.userId ? String(input.userId) : previous.userId,
         schedulerBaseUrl: input.schedulerBaseUrl
             ? String(input.schedulerBaseUrl)
             : previous.schedulerBaseUrl,
@@ -112,6 +230,14 @@ export function saveRuntimeBinding(input) {
         encoding: "utf8",
         mode: 0o600,
     });
+    if (next.userId && next.schedulerBaseUrl) {
+        const key = saveScopedRuntimeAccessToken({
+            userId: next.userId,
+            serverBaseUrl: next.schedulerBaseUrl,
+            accessToken,
+        });
+        log.info(`[runtime-bridge] scoped runtime token saved: key=${key}`);
+    }
     log.info(`[runtime-bridge] runtime binding saved: ${bindingFile()}`);
     return next;
 }

package/dist/services/terminal-persistence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"terminal-persistence.d.ts","sourceRoot":"","sources":["../../src/services/terminal-persistence.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAKpD;;;;GAIG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAUzE;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAIvF;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CASrF;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB7E;AAED;;;;;GAKG;AACH,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAGvC;AAED;;;;;GAKG;AACH,wBAAsB,+BAA+B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBpF"}
+{"version":3,"file":"terminal-persistence.d.ts","sourceRoot":"","sources":["../../src/services/terminal-persistence.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AA6BpD;;;;GAIG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAOzE;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAKvF;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWrF;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB7E;AAED;;;;;GAKG;AACH,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAGvC;AAED;;;;;GAKG;AACH,wBAAsB,+BAA+B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBpF"}