aws-runtime-bridge 1.3.0 → 1.3.2

package/README.md

@@ -1,77 +1,75 @@
-# aws-runtime-bridge
-
-AgentsWorkStudio 机器实例运行时桥接服务，用于在实例上管理 Agent 运行时、终端、配置与回调通信。
-
-## 全局安装
-
-从 npm 包安装时：
-
-```bash
-npm install -g aws-runtime-bridge
-```
-
-安装脚本会在 macOS、Linux 与常见 Unix 平台自动为 CLI 入口补齐可执行权限；Windows 平台无需 chmod，会自动跳过该步骤。
-
-从当前仓库安装时：
-
-```bash
-cd aws-runtime-bridge
-npm install
-npm run build
-npm install -g .
-```
-
-## 启动
-
-首次运行 `awsb` / `aws-bridge` 时，如果不存在 `~/.aws-bridge/config.json`，CLI 会进入交互式配置引导；也可以在提示中选择跳过。跳过时仍会创建配置文件并自动生成随机 `connectionKey`，终端会输出该密钥，请保存后在 server/面板连接此 Bridge 时使用。非交互环境（如 systemd、CI、Docker 后台启动）不会阻塞等待输入，也会自动生成 `connectionKey` 并跳过引导。
-
-引导会生成类似下面的配置：
-
-```json
-{
-  "connectionKey": "gkmzjaznX55..",
-  "autoRegisterTargets": [
-    {
-      "serverUrl": "http://127.0.0.1:8080",
-      "instanceName": "至强主机",
-      "userKey": "aws_live_crh_g0GGrg5IntODg1sFwnas7qf4yGrcwoisDWPBtd8",
-      "registerIp": "127.0.0.1"
-    }
-  ]
-}
-```
-
-如需在交互式终端中也强制跳过引导，可设置 `AWS_BRIDGE_SKIP_SETUP=true`；此时仍会生成随机 `connectionKey`。
-
-```bash
-AWS_RUNTIME_BRIDGE_PORT=18081 \
-AWS_RUNTIME_SCHEDULER_BASE_URL=http://your-server-host:7380 \
-AWS_RUNTIME_CALLBACK_TOKEN=replace-with-a-long-random-runtime-callback-token \
-AWS_RUNTIME_HOME_DIR=/opt/agentswork/runtime-home \
-aws-bridge
-```
-
-`aws-runtime-bridge` 命令仍作为兼容别名保留。安装 `aws-runtime-bridge` 后，包内会随附
-`aws-client-agent-mcp` 的编译产物；bridge 启动时只负责准备该 MCP 产物，不再在 Agent 启动时默认动态注入 `aws-mcp`。
-
-请在面板中为目标运行时安装/配置 MCP；这样 Claude Code、Codex、OpenCode、PTY 等不同启动模式都走一致的持久化 MCP 配置链路。
-
-如需使用自定义 MCP 可执行文件，可设置：
-
-```bash
-AWS_CLIENT_AGENT_MCP_COMMAND=/absolute/path/to/aws-client-agent-mcp \
-AWS_CLIENT_AGENT_MCP_ARGS='[]' \
-aws-bridge
-```
-
-## 关键环境变量
-
-| 变量名 | 说明 | 默认值 |
-| --- | --- | --- |
-| `AWS_RUNTIME_BRIDGE_PORT` | Bridge HTTP 端口 | `18081` |
-| `AWS_RUNTIME_SCHEDULER_BASE_URL` | aws-mcp-server 地址 | `http://localhost:8080` |
-| `AWS_RUNTIME_CALLBACK_TOKEN` | 后端调用 bridge 的回调 Token | 无，生产必须显式设置 |
-| `AWS_RUNTIME_HOME_DIR` | Bridge 管理配置与状态的主目录 | 当前用户 Home |
-| `AWS_RUNTIME_CORS_ORIGINS` | 允许访问 bridge 的来源，逗号分隔 | 本地开发地址 |
-
-生产环境中，`AWS_RUNTIME_SCHEDULER_BASE_URL` 必须填写机器实例可访问的 `aws-mcp-server` 地址，不能使用容器内的 `localhost`。
+# aws-runtime-bridge
+
+AgentsWorkStudio 机器实例运行时桥接服务，用于在实例上管理 Agent 运行时、终端、配置与回调通信。
+
+## 全局安装
+
+从 npm 包安装时：
+
+```bash
+npm install -g aws-runtime-bridge
+```
+
+安装脚本会在 macOS、Linux 与常见 Unix 平台自动为 CLI 入口补齐可执行权限；Windows 平台无需 chmod，会自动跳过该步骤。
+
+从当前仓库安装时：
+
+```bash
+cd aws-runtime-bridge
+npm install
+npm run build
+npm install -g .
+```
+
+## 启动
+
+首次运行 `awsb` / `aws-bridge` 时，如果不存在 `~/.aws-bridge/config.json`，CLI 会进入交互式配置引导；也可以在提示中选择跳过。跳过时仍会创建配置文件并自动生成随机 `connectionKey`，终端会输出该密钥，请保存后在 server/面板连接此 Bridge 时使用。非交互环境（如 systemd、CI、Docker 后台启动）不会阻塞等待输入，也会自动生成 `connectionKey` 并跳过引导。
+
+引导会生成类似下面的配置：
+
+```json
+{
+  "connectionKey": "gkmzjaznX55..",
+  "autoRegisterTargets": [
+    {
+      "serverUrl": "http://127.0.0.1:8080",
+      "instanceName": "至强主机",
+      "userKey": "aws_live_crh_g0GGrg5IntODg1sFwnas7qf4yGrcwoisDWPBtd8",
+      "registerIp": "127.0.0.1"
+    }
+  ]
+}
+```
+
+如需在交互式终端中也强制跳过引导，可设置 `AWS_BRIDGE_SKIP_SETUP=true`；此时仍会生成随机 `connectionKey`。
+
+```bash
+AWS_RUNTIME_BRIDGE_PORT=18081 \
+AWS_RUNTIME_SCHEDULER_BASE_URL=http://your-server-host:7380 \
+AWS_RUNTIME_HOME_DIR=/opt/agentswork/runtime-home \
+aws-bridge
+```
+
+`aws-runtime-bridge` 命令仍作为兼容别名保留。安装 `aws-runtime-bridge` 后，包内会随附
+`aws-client-agent-mcp` 的编译产物；bridge 启动时只负责准备该 MCP 产物，不再在 Agent 启动时默认动态注入 `aws-mcp`。
+
+请在面板中为目标运行时安装/配置 MCP；这样 Claude Code、Codex、OpenCode、PTY 等不同启动模式都走一致的持久化 MCP 配置链路。
+
+如需使用自定义 MCP 可执行文件，可设置：
+
+```bash
+AWS_CLIENT_AGENT_MCP_COMMAND=/absolute/path/to/aws-client-agent-mcp \
+AWS_CLIENT_AGENT_MCP_ARGS='[]' \
+aws-bridge
+```
+
+## 关键环境变量
+
+| 变量名 | 说明 | 默认值 |
+| --- | --- | --- |
+| `AWS_RUNTIME_BRIDGE_PORT` | Bridge HTTP 端口 | `18081` |
+| `AWS_RUNTIME_SCHEDULER_BASE_URL` | aws-mcp-server 地址 | `http://localhost:8080` |
+| `AWS_RUNTIME_HOME_DIR` | Bridge 管理配置与状态的主目录 | 当前用户 Home |
+| `AWS_RUNTIME_CORS_ORIGINS` | 允许访问 bridge 的来源，逗号分隔 | 本地开发地址 |
+
+生产环境中，`AWS_RUNTIME_SCHEDULER_BASE_URL` 必须填写机器实例可访问的 `aws-mcp-server` 地址，不能使用容器内的 `localhost`。

package/dist/config.d.ts

@@ -7,19 +7,13 @@
 export declare const port: number;
 /** 调度器基础 URL */
 export declare const schedulerBaseUrl: string;
-/** 默认运行时回调 Token */
-export declare const DEFAULT_RUNTIME_CALLBACK_TOKEN = "agentswork-runtime-callback";
 /** Node 环境 */
 export declare const nodeEnv: string;
-/** 运行时回调 Token */
-export declare const runtimeToken: string;
-/** 是否显式允许本地开发使用默认 Token */
-export declare const allowDefaultRuntimeToken: boolean;
 /** 是否允许浏览宿主机任意目录（默认关闭，仅建议本地排障启用） */
 export declare const allowHostFileBrowser: boolean;
 /** CORS 允许来源列表，默认仅允许本机开发前端 */
 export declare const allowedCorsOrigins: string[];
-/** 验证生产环境必须设置 Token */
+/** Runtime bridge no longer supports global callback tokens. */
 export declare function validateProductionToken(): void;
 /** 获取运行时主目录 */
 export declare function getRuntimeHomeDir(): string;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,WAAW;AACX,eAAO,MAAM,IAAI,EAAE,MAElB,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,gBAAgB,EAAE,MACwC,CAAC;AAExE,oBAAoB;AACpB,eAAO,MAAM,8BAA8B,gCAAgC,CAAC;AAE5E,cAAc;AACd,eAAO,MAAM,OAAO,EAAE,MAA8C,CAAC;AAErE,kBAAkB;AAClB,eAAO,MAAM,YAAY,EAAE,MAC+C,CAAC;AAE3E,2BAA2B;AAC3B,eAAO,MAAM,wBAAwB,EAAE,OACiB,CAAC;AAEzD,oCAAoC;AACpC,eAAO,MAAM,oBAAoB,EAAE,OACiB,CAAC;AAErD,8BAA8B;AAC9B,eAAO,MAAM,kBAAkB,EAAE,MAAM,EAMC,CAAC;AAEzC,uBAAuB;AACvB,wBAAgB,uBAAuB,IAAI,IAAI,CAc9C;AAED,eAAe;AACf,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,8CAA8C;AAC9C,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAK/D;AAED,2BAA2B;AAC3B,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAKlE;AAED,0BAA0B;AAC1B,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAK9D;AAED,yBAAyB;AACzB,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAKjE;AAED,sBAAsB;AACtB,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAK9D;AAED,yBAAyB;AACzB,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAK7D;AAED,4BAA4B;AAC5B,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAKhE;AAED;;GAEG;AAEH,yBAAyB;AACzB,eAAO,MAAM,oBAAoB,QAEhC,CAAC;AAEF,0CAA0C;AAC1C,eAAO,MAAM,sBAAsB,EACrB,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE1C,eAAe;AACf,eAAO,MAAM,mBAAmB,SACiB,CAAC;AAElD,iCAAiC;AACjC,eAAO,MAAM,2BAA2B,QAEvC,CAAC;AAEF,0CAA0C;AAC1C,eAAO,MAAM,oBAAoB,QAEhC,CAAC;AAEF,qCAAqC;AACrC,eAAO,MAAM,uBAAuB,QAEnC,CAAC;AAEF;;GAEG;AAEH,eAAe;AACf,eAAO,MAAM,qBAAqB,SAA2C,CAAC;AAE9E,YAAY;AACZ,eAAO,MAAM,uBAAuB,QAAkC,CAAC;AAEvE,iBAAiB;AACjB,eAAO,MAAM,sBAAsB,QAAiC,CAAC;AAErE,oBAAoB;AACpB,eAAO,MAAM,2BAA2B,QAAsC,CAAC;AAE/E,WAAW;AACX,eAAO,MAAM,0BAA0B,QAAqC,CAAC;AAE7E,WAAW;AACX,eAAO,MAAM,uBAAuB,QAAkC,CAAC;AAEvE,aAAa;AACb,eAAO,MAAM,4BAA4B,QACH,CAAC;AAEvC,kCAAkC;AAClC,eAAO,MAAM,wBAAwB,QAC4B,CAAC;AAElE,aAAa;AACb,eAAO,MAAM,yBAAyB,QAErC,CAAC;AAEF,iBAAiB;AACjB,eAAO,MAAM,4BAA4B,QAExC,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,WAAW;AACX,eAAO,MAAM,IAAI,EAAE,MAElB,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,gBAAgB,EAAE,MACwC,CAAC;AAExE,cAAc;AACd,eAAO,MAAM,OAAO,EAAE,MAA8C,CAAC;AAErE,oCAAoC;AACpC,eAAO,MAAM,oBAAoB,EAAE,OACiB,CAAC;AAErD,8BAA8B;AAC9B,eAAO,MAAM,kBAAkB,EAAE,MAAM,EAMC,CAAC;AAEzC,gEAAgE;AAChE,wBAAgB,uBAAuB,IAAI,IAAI,CAAG;AAElD,eAAe;AACf,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,8CAA8C;AAC9C,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAK/D;AAED,2BAA2B;AAC3B,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAKlE;AAED,0BAA0B;AAC1B,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAK9D;AAED,yBAAyB;AACzB,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAKjE;AAED,sBAAsB;AACtB,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAK9D;AAED,yBAAyB;AACzB,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAK7D;AAED,4BAA4B;AAC5B,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAKhE;AAED;;GAEG;AAEH,yBAAyB;AACzB,eAAO,MAAM,oBAAoB,QAEhC,CAAC;AAEF,0CAA0C;AAC1C,eAAO,MAAM,sBAAsB,EACrB,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE1C,eAAe;AACf,eAAO,MAAM,mBAAmB,SACiB,CAAC;AAElD,iCAAiC;AACjC,eAAO,MAAM,2BAA2B,QAEvC,CAAC;AAEF,0CAA0C;AAC1C,eAAO,MAAM,oBAAoB,QAEhC,CAAC;AAEF,qCAAqC;AACrC,eAAO,MAAM,uBAAuB,QAEnC,CAAC;AAEF;;GAEG;AAEH,eAAe;AACf,eAAO,MAAM,qBAAqB,SAA2C,CAAC;AAE9E,YAAY;AACZ,eAAO,MAAM,uBAAuB,QAAkC,CAAC;AAEvE,iBAAiB;AACjB,eAAO,MAAM,sBAAsB,QAAiC,CAAC;AAErE,oBAAoB;AACpB,eAAO,MAAM,2BAA2B,QAAsC,CAAC;AAE/E,WAAW;AACX,eAAO,MAAM,0BAA0B,QAAqC,CAAC;AAE7E,WAAW;AACX,eAAO,MAAM,uBAAuB,QAAkC,CAAC;AAEvE,aAAa;AACb,eAAO,MAAM,4BAA4B,QACH,CAAC;AAEvC,kCAAkC;AAClC,eAAO,MAAM,wBAAwB,QAC4B,CAAC;AAElE,aAAa;AACb,eAAO,MAAM,yBAAyB,QAErC,CAAC;AAEF,iBAAiB;AACjB,eAAO,MAAM,4BAA4B,QAExC,CAAC"}

package/dist/config.js

@@ -5,19 +5,12 @@
  */
 import os from "node:os";
 import path from "node:path";
-import { logger } from "./utils/logger.js";
 /** 服务端口 */
 export const port = Number(process.env.AWS_RUNTIME_BRIDGE_PORT || 18081);
 /** 调度器基础 URL */
 export const schedulerBaseUrl = process.env.AWS_RUNTIME_SCHEDULER_BASE_URL || "http://localhost:8080";
-/** 默认运行时回调 Token */
-export const DEFAULT_RUNTIME_CALLBACK_TOKEN = "agentswork-runtime-callback";
 /** Node 环境 */
 export const nodeEnv = process.env.NODE_ENV || "development";
-/** 运行时回调 Token */
-export const runtimeToken = process.env.AWS_RUNTIME_CALLBACK_TOKEN || DEFAULT_RUNTIME_CALLBACK_TOKEN;
-/** 是否显式允许本地开发使用默认 Token */
-export const allowDefaultRuntimeToken = process.env.AWS_ALLOW_DEFAULT_RUNTIME_TOKEN === "true";
 /** 是否允许浏览宿主机任意目录（默认关闭，仅建议本地排障启用） */
 export const allowHostFileBrowser = process.env.AWS_ALLOW_HOST_FILE_BROWSER === "true";
 /** CORS 允许来源列表，默认仅允许本机开发前端 */
@@ -26,17 +19,8 @@ export const allowedCorsOrigins = String(process.env.AWS_RUNTIME_CORS_ORIGINS ||
     .split(",")
     .map((origin) => origin.trim())
     .filter((origin) => origin.length > 0);
-/** 验证生产环境必须设置 Token */
-export function validateProductionToken() {
-    if (!process.env.AWS_RUNTIME_CALLBACK_TOKEN) {
-        if (allowDefaultRuntimeToken) {
-            logger.warn("[runtime-bridge] AWS_RUNTIME_CALLBACK_TOKEN not set, using default development token");
-            return;
-        }
-        logger.info("[runtime-bridge] AWS_RUNTIME_CALLBACK_TOKEN not set; starting in unpaired mode. " +
-            "Sensitive APIs require a panel/server issued runtime access token after pairing.");
-    }
-}
+/** Runtime bridge no longer supports global callback tokens. */
+export function validateProductionToken() { }
 /** 获取运行时主目录 */
 export function getRuntimeHomeDir() {
     return String(process.env.AWS_RUNTIME_HOME_DIR || "").trim() || os.homedir();

package/dist/middleware/auth.d.ts

@@ -1,14 +1,14 @@
 /**
  * Token 验证中间件
  *
- * 验证请求头中的 X-Runtime-Token 是否与配置的 runtimeToken 匹配
+ * 验证请求头中的 X-Runtime-Token 是否为已配对的 connectionKey 或 runtime binding token。
  */
 import type { Request, Response, NextFunction } from "express";
 /**
  * Token 验证中间件
  * 检查请求头中的 X-Runtime-Token 或 Authorization: Bearer 是否有效。
  *
- * 优先支持面板/服务器绑定时写入的动态令牌；仍兼容环境变量配置的静态令牌。
+ * 支持面板/服务器绑定时写入的动态令牌和 bridge 实例 connectionKey。
  */
 export declare function validateToken(req: Request, res: Response, next: NextFunction): void;
 //# sourceMappingURL=auth.d.ts.map

package/dist/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAmC/D;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,GACjB,IAAI,CAqBN"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AA8B/D;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,GACjB,IAAI,CAmBN"}

package/dist/middleware/auth.js

@@ -1,9 +1,8 @@
 /**
  * Token 验证中间件
  *
- * 验证请求头中的 X-Runtime-Token 是否与配置的 runtimeToken 匹配
+ * 验证请求头中的 X-Runtime-Token 是否为已配对的 connectionKey 或 runtime binding token。
  */
-import { allowDefaultRuntimeToken, runtimeToken } from "../config.js";
 import { hasRuntimeBinding, validateRuntimeBindingToken, } from "../services/runtime-binding.js";
 import { getConfiguredConnectionKeys } from "../services/auto-register.js";
 function extractRuntimeToken(req) {
@@ -22,16 +21,13 @@ function validateConfiguredToken(token) {
     if (getConfiguredConnectionKeys().includes(token)) {
         return true;
     }
-    if (process.env.AWS_RUNTIME_CALLBACK_TOKEN) {
-        return token === runtimeToken;
-    }
-    return allowDefaultRuntimeToken && token === runtimeToken;
+    return false;
 }
 /**
  * Token 验证中间件
  * 检查请求头中的 X-Runtime-Token 或 Authorization: Bearer 是否有效。
  *
- * 优先支持面板/服务器绑定时写入的动态令牌；仍兼容环境变量配置的静态令牌。
+ * 支持面板/服务器绑定时写入的动态令牌和 bridge 实例 connectionKey。
  */
 export function validateToken(req, res, next) {
     const token = extractRuntimeToken(req);
@@ -39,9 +35,7 @@ export function validateToken(req, res, next) {
         next();
         return;
     }
-    if (!hasRuntimeBinding() &&
-        !process.env.AWS_RUNTIME_CALLBACK_TOKEN &&
-        !allowDefaultRuntimeToken) {
+    if (!hasRuntimeBinding()) {
         res.status(401).json({
             error: "runtime_bridge_unpaired",
             message: "Runtime bridge is not paired. Add this instance from the panel first.",

package/dist/routes/instance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../src/routes/instance.ts"],"names":[],"mappings":"AA4BA,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,GAC/D,IAAI,CAEN;AAED,eAAO,MAAM,cAAc,4CAAW,CAAC;AAyBvC,wBAAgB,4BAA4B,CAAC,gBAAgB,EAAE,MAAM,GAAG;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE;QACJ,EAAE,EAAE,OAAO,CAAC;QACZ,aAAa,CAAC,EAAE,SAAS,CAAC;QAC1B,oBAAoB,EAAE,OAAO,CAAC;QAC9B,qBAAqB,EAAE,OAAO,CAAC;QAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAqCA"}
+{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../src/routes/instance.ts"],"names":[],"mappings":"AA6BA,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,GAC/D,IAAI,CAEN;AAED,eAAO,MAAM,cAAc,4CAAW,CAAC;AAyBvC,wBAAgB,4BAA4B,CAAC,gBAAgB,EAAE,MAAM,GAAG;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE;QACJ,EAAE,EAAE,OAAO,CAAC;QACZ,aAAa,CAAC,EAAE,SAAS,CAAC;QAC1B,oBAAoB,EAAE,OAAO,CAAC;QAC9B,qBAAqB,EAAE,OAAO,CAAC;QAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAqCA"}

package/dist/routes/instance.js

@@ -2,7 +2,8 @@ import { Router } from "express";
 import axios from "axios";
 import { createHash, timingSafeEqual } from "node:crypto";
 import { validateToken } from "../middleware/auth.js";
-import { schedulerBaseUrl, runtimeToken } from "../config.js";
+import { schedulerBaseUrl } from "../config.js";
+import { getRuntimeAccessToken } from "../services/runtime-binding.js";
 import { loadInstanceState, saveInstanceState, } from "../services/instance-state.js";
 import { initInstance } from "../services/instance-init-service.js";
 import { discoverCcSwitchConfiguredItems, loadCcSwitchSdk } from "../services/cc-switch-sdk.js";
@@ -84,7 +85,12 @@ instanceRouter.get("/connection-check", (req, res) => {
 });
 instanceRouter.get("/ping", validateToken, async (_req, res) => {
     try {
-        const schedulerResponse = await axios.get(`${schedulerBaseUrl}/api/runtime/ping`, { headers: { "X-Runtime-Token": runtimeToken } });
+        const runtimeAccessToken = getRuntimeAccessToken(undefined, schedulerBaseUrl) || getRuntimeAccessToken();
+        if (!runtimeAccessToken) {
+            res.status(401).json({ ok: false, error: "runtime_access_token_required" });
+            return;
+        }
+        const schedulerResponse = await axios.get(`${schedulerBaseUrl}/api/runtime/ping`, { headers: { "X-Runtime-Token": runtimeAccessToken } });
         res.json({
             ok: true,
             runtimeBridge: "healthy",

package/dist/routes/properties.test.js

@@ -41,10 +41,10 @@ describe('properties file operations', () => {
             }
             return result;
         };
-        const props = parseProperties(`
-# Comment
-agent.role.name=Backend Developer
-project.workspace.path=/home/project
+        const props = parseProperties(`
+# Comment
+agent.role.name=Backend Developer
+project.workspace.path=/home/project
     `);
         expect(props['agent.role.name']).toBe('Backend Developer');
         expect(props['project.workspace.path']).toBe('/home/project');

package/dist/routes/runtime-binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-binding.d.ts","sourceRoot":"","sources":["../../src/routes/runtime-binding.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,oBAAoB,4CAAW,CAAC;AAgO7C,wBAAgB,6BAA6B,IAAI,IAAI,CAapD"}
+{"version":3,"file":"runtime-binding.d.ts","sourceRoot":"","sources":["../../src/routes/runtime-binding.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,oBAAoB,4CAAW,CAAC;AAsN7C,wBAAgB,6BAA6B,IAAI,IAAI,CAapD"}

package/dist/routes/runtime-binding.js

@@ -1,7 +1,6 @@
 import { Router } from "express";
 import { clearRuntimeBinding, getRuntimeAccessToken, getRuntimeBindingPublicState, getRuntimePairingCode, hasRuntimeBinding, saveRuntimeBinding, validateRuntimeBindingToken, validateRuntimePairingCode, } from "../services/runtime-binding.js";
 import { validateToken } from "../middleware/auth.js";
-import { runtimeToken } from "../config.js";
 import { requestRuntimeAccessTokenRefresh, requestRuntimeAccessTokenRefreshForServer } from "../services/auto-register.js";
 import { claimMcpLaunchBinding, getMcpLaunchQueueSize } from "../services/mcp-launch-binding-queue.js";
 import { createLogger } from "../utils/logger.js";
@@ -74,9 +73,9 @@ runtimeBindingRouter.post("/binding/request-token", async (req, res) => {
         res.status(403).json({ ok: false, error: "loopback request required" });
         return;
     }
-    const { userId, serverUrl, schedulerBaseUrl } = req.body || {};
+    const { userId, serverUrl, schedulerBaseUrl, forceRefresh } = req.body || {};
     const scopedToken = getRuntimeAccessToken(userId, serverUrl || schedulerBaseUrl);
-    if (scopedToken) {
+    if (scopedToken && forceRefresh !== true) {
         res.json({
             ok: true,
             runtimeAccessToken: scopedToken,
@@ -137,14 +136,7 @@ runtimeBindingRouter.post("/binding/claim-agent", (req, res) => {
         remainingQueueSize: getMcpLaunchQueueSize(workspacePath),
     });
 });
-runtimeBindingRouter.post("/binding/issue", (req, res) => {
-    const currentRuntimeToken = extractRuntimeToken(req);
-    const authorizedByScheduler = currentRuntimeToken === runtimeToken;
-    const authorizedByCurrentBinding = validateRuntimeBindingToken(currentRuntimeToken);
-    if (!authorizedByScheduler && !authorizedByCurrentBinding) {
-        res.status(401).json({ error: "unauthorized" });
-        return;
-    }
+runtimeBindingRouter.post("/binding/issue", validateToken, (req, res) => {
     const { accessToken, instanceId, userId, schedulerBaseUrl } = req.body || {};
     const nextToken = String(accessToken || "").trim();
     if (!nextToken) {

package/dist/services/auto-register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auto-register.d.ts","sourceRoot":"","sources":["../../src/services/auto-register.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAiDH;;GAEG;AACH,UAAU,kBAAkB;IAC1B,eAAe;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mCAAmC;IACnC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAwBD,wBAAgB,2BAA2B,IAAI,MAAM,EAAE,CAEtD;AAiED;;GAEG;AACH,wBAAgB,6BAA6B,IAAI,MAAM,CAGtD;AAyJD;;;;;;GAMG;AACH,wBAAgB,UAAU,IAAI,kBAAkB,CA2C/C;AAED,wBAAgB,WAAW,IAAI,kBAAkB,EAAE,CA0ClD;AA4OD;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAChC,YAAY,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GACzC,OAAO,CAAC,OAAO,CAAC,CAalB;AAyHD;;GAEG;AACH,wBAAsB,gCAAgC,IAAI,OAAO,CAAC;IAChE,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAqED;AAED,wBAAsB,yCAAyC,CAC7D,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CA2ED;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAuBnD;AAED;;GAEG;AACH,wBAAgB,oBAAoB;gBA14BtB,OAAO;iBACN,MAAM;mBACJ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;kBACvB,IAAI;YACV,MAAM;EAw4Bf;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAEtC;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAElD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CA2ED"}
+{"version":3,"file":"auto-register.d.ts","sourceRoot":"","sources":["../../src/services/auto-register.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAmDH;;GAEG;AACH,UAAU,kBAAkB;IAC1B,eAAe;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mCAAmC;IACnC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAwBD,wBAAgB,2BAA2B,IAAI,MAAM,EAAE,CAEtD;AAiED;;GAEG;AACH,wBAAgB,6BAA6B,IAAI,MAAM,CAGtD;AAyJD;;;;;;GAMG;AACH,wBAAgB,UAAU,IAAI,kBAAkB,CA2C/C;AAED,wBAAgB,WAAW,IAAI,kBAAkB,EAAE,CA0ClD;AAgPD;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAChC,YAAY,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GACzC,OAAO,CAAC,OAAO,CAAC,CAalB;AAyHD;;GAEG;AACH,wBAAsB,gCAAgC,IAAI,OAAO,CAAC;IAChE,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAoED;AAED,wBAAsB,yCAAyC,CAC7D,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CA0ED;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAgCnD;AAED;;GAEG;AACH,wBAAgB,oBAAoB;gBAr5BtB,OAAO;iBACN,MAAM;mBACJ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;kBACvB,IAAI;YACV,MAAM;EAm5Bf;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAEtC;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAElD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CA0ED"}

package/dist/services/auto-register.js

@@ -12,8 +12,8 @@ import os from "node:os";
 import path from "node:path";
 import fs from "node:fs";
 import { logger } from "../utils/logger.js";
-import { schedulerBaseUrl, runtimeToken } from "../config.js";
-import { getRuntimeAccessToken, getRuntimeBindingPublicState, loadRuntimeBinding, normalizeSchedulerBaseUrl, saveRuntimeBinding, saveScopedRuntimeAccessToken, } from "./runtime-binding.js";
+import { schedulerBaseUrl } from "../config.js";
+import { clearRuntimeBinding, clearScopedRuntimeAccessToken, getRuntimeAccessToken, getRuntimeBindingPublicState, loadRuntimeBinding, normalizeSchedulerBaseUrl, saveRuntimeBinding, saveScopedRuntimeAccessToken, } from "./runtime-binding.js";
 // 默认配置
 const DEFAULT_CONFIG = {
     enabled: false,
@@ -466,7 +466,6 @@ async function doRegister(config) {
     const response = await axios.post(`${targetServerUrl}/api/instances/register`, request, {
         headers: {
             "Content-Type": "application/json",
-            "X-Runtime-Token": runtimeToken,
         },
         timeout: 10000,
     });
@@ -477,10 +476,15 @@ async function doRegister(config) {
  */
 async function doUnregister(instanceId) {
     const targetServerUrl = resolveLifecycleSchedulerBaseUrl(loadPrimaryLifecycleConfig(), instanceId);
+    const binding = loadRuntimeBinding();
+    const runtimeAccessToken = getRuntimeAccessToken(binding.userId, targetServerUrl);
+    if (!runtimeAccessToken) {
+        throw new Error("runtimeAccessToken is required to unregister bridge instance");
+    }
     const response = await axios.post(`${targetServerUrl}/api/instances/unregister`, { instanceId }, {
         headers: {
             "Content-Type": "application/json",
-            "X-Runtime-Token": runtimeToken,
+            "X-Runtime-Token": runtimeAccessToken,
         },
         timeout: 10000,
     });
@@ -557,7 +561,7 @@ async function autoRegisterSingle(config) {
                     }
                 }
                 else {
-                    logger.warn("[AutoRegister] 注册响应未包含 runtime access token，MCP 将只能使用兼容的静态内部密钥访问调度中心");
+                    logger.warn("[AutoRegister] 注册响应未包含 runtime access token，MCP 将无法访问调度中心，请检查 server 的 bridge 实例 token 颁发逻辑");
                 }
                 return true;
             }
@@ -619,7 +623,6 @@ export async function requestRuntimeAccessTokenRefresh() {
         }, {
             headers: {
                 "Content-Type": "application/json",
-                "X-Runtime-Token": runtimeToken,
             },
             timeout: 10000,
         });
@@ -678,7 +681,6 @@ export async function requestRuntimeAccessTokenRefreshForServer(serverBaseUrl) {
         }, {
             headers: {
                 "Content-Type": "application/json",
-                "X-Runtime-Token": runtimeToken,
             },
             timeout: 10000,
         });
@@ -720,6 +722,12 @@ export async function unregister() {
         const response = await doUnregister(registrationState.instanceId);
         if (response.success) {
             logger.info(`[AutoRegister] ✓ 注销成功: ${registrationState.instanceId}`);
+            const targetServerUrl = resolveLifecycleSchedulerBaseUrl(loadPrimaryLifecycleConfig(), registrationState.instanceId);
+            const binding = loadRuntimeBinding();
+            if (binding.userId) {
+                clearScopedRuntimeAccessToken(binding.userId, targetServerUrl);
+            }
+            clearRuntimeBinding();
             registrationState.registered = false;
             registrationState.instanceId = undefined;
             return true;
@@ -791,7 +799,6 @@ export async function bridgeRestartCleanup() {
         const response = await axios.post(`${targetServerUrl}/api/instances/bridge-restart-cleanup`, requestBody, {
             headers: {
                 "Content-Type": "application/json",
-                "X-Runtime-Token": runtimeToken,
             },
             timeout: 10000,
         });

package/dist/services/auto-register.test.js

@@ -94,6 +94,10 @@ describe("auto-register scheduler URL selection", () => {
         expect(post.mock.calls[1]?.[0]).toBe("http://127.0.0.1:7380/api/instances/bridge-restart-cleanup");
         expect(post.mock.calls[2]?.[0]).toBe("http://127.0.0.1:7380/api/instances/runtime-tokens/refresh");
         expect(post.mock.calls[3]?.[0]).toBe("http://127.0.0.1:7380/api/instances/unregister");
+        expect(post.mock.calls[3]?.[2]?.headers?.["X-Runtime-Token"]).toBe("refreshed-token-123456");
+        const { getRuntimeAccessToken, loadRuntimeBinding } = await import("./runtime-binding.js");
+        expect(getRuntimeAccessToken("user-1", "http://127.0.0.1:7380")).toBeUndefined();
+        expect(loadRuntimeBinding().status).toBe("unpaired");
     });
     it("uses the registered target URL instead of the first configured target", async () => {
         const runtimeHome = createRuntimeHome();

package/dist/services/aws-client-agent-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aws-client-agent-mcp.d.ts","sourceRoot":"","sources":["../../src/services/aws-client-agent-mcp.ts"],"names":[],"mappings":"AAyBA,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAsB7C,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,sCAAsC;IACrD,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,sCAAsC;IACrD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAaD,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;CAC3C;AAuBD,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAgLD,wBAAgB,+BAA+B,CAC7C,OAAO,GAAE,sCAA2C,GACnD,MAAM,GAAG,IAAI,CAoDf;AA2ED,wBAAgB,+BAA+B,CAC7C,OAAO,GAAE,sCAA2C,GACnD,kBAAkB,CAEpB;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,GAAE,sCAA2C,GACnD,kBAAkB,CAsBpB;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,uBAAuB,GAC7B,kBAAkB,CA0BpB;AAED,wBAAgB,+BAA+B,IAAI,IAAI,CAgBtD"}
+{"version":3,"file":"aws-client-agent-mcp.d.ts","sourceRoot":"","sources":["../../src/services/aws-client-agent-mcp.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAqB7C,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,sCAAsC;IACrD,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,sCAAsC;IACrD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAaD,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;CAC3C;AAuBD,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAgLD,wBAAgB,+BAA+B,CAC7C,OAAO,GAAE,sCAA2C,GACnD,MAAM,GAAG,IAAI,CAoDf;AA2ED,wBAAgB,+BAA+B,CAC7C,OAAO,GAAE,sCAA2C,GACnD,kBAAkB,CAEpB;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,GAAE,sCAA2C,GACnD,kBAAkB,CAsBpB;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,uBAAuB,GAC7B,kBAAkB,CAsBpB;AAED,wBAAgB,+BAA+B,IAAI,IAAI,CAgBtD"}

package/dist/services/aws-client-agent-mcp.js

@@ -4,7 +4,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { getRuntimeHomeDir, port, schedulerBaseUrl } from "../config.js";
 import { logger } from "../utils/logger.js";
-import { getRuntimeAccessToken, loadRuntimeBinding, normalizeSchedulerBaseUrl, } from "./runtime-binding.js";
+import { loadRuntimeBinding, normalizeSchedulerBaseUrl, } from "./runtime-binding.js";
 export const AWS_MCP_SERVER_NAME = "aws-mcp";
 const AWS_MCP_ALLOWED_ENV_KEYS = [
     "AWS_PROJECT_NAME",
@@ -12,7 +12,6 @@ const AWS_MCP_ALLOWED_ENV_KEYS = [
     "AWS_ROLE_NAME",
     "AWS_SERVER_URL",
     "AWS_MCP_HTTP_URL",
-    "AWS_RUNTIME_ACCESS_TOKEN",
     "AWS_RUNTIME_BRIDGE_BASE_URL",
     "AWS_HEARTBEAT_INTERVAL",
     "AWS_HEARTBEAT_TIMEOUT",
@@ -285,7 +284,6 @@ export function buildAwsMcpServerConfig(input) {
     const env = getStringEnv();
     const command = getAwsClientAgentMcpPreparedInfo();
     const effectiveSchedulerBaseUrl = resolveSchedulerBaseUrlForMcp();
-    const issuedRuntimeAccessToken = getRuntimeAccessToken();
     return {
         command: command.command,
         args: command.args,
@@ -297,9 +295,6 @@ export function buildAwsMcpServerConfig(input) {
             AWS_MCP_HTTP_URL: env.AWS_MCP_HTTP_URL || toMcpHttpUrl(effectiveSchedulerBaseUrl),
             AWS_RUNTIME_BRIDGE_BASE_URL: env.AWS_RUNTIME_BRIDGE_BASE_URL || `http://127.0.0.1:${port}`,
             AWS_MCP_CLAIM_LAUNCH_BINDING: env.AWS_MCP_CLAIM_LAUNCH_BINDING || "true",
-            ...(issuedRuntimeAccessToken
-                ? { AWS_RUNTIME_ACCESS_TOKEN: issuedRuntimeAccessToken }
-                : {}),
         },
     };
 }

package/dist/services/aws-client-agent-mcp.test.js

@@ -197,7 +197,6 @@ describe('aws-client-agent-mcp service', () => {
     });
     it('builds aws-mcp server config with inferred scheduler urls', async () => {
         process.env.AWS_CLIENT_AGENT_MCP_COMMAND = 'aws-client-agent-mcp';
-        process.env.AWS_RUNTIME_CALLBACK_TOKEN = 'secret-runtime-token';
         process.env.CUSTOM_SECRET = 'should-not-leak';
         process.env.AWS_RUNTIME_HOME_DIR = mkdtempSync(path.join(os.tmpdir(), 'aws-mcp-config-'));
         process.env.AWS_RUNTIME_SCHEDULER_BASE_URL = '';
@@ -213,7 +212,6 @@ describe('aws-client-agent-mcp service', () => {
         expect(config.env.AWS_WORKSPACE_PATH).toBe('/workspace/demo');
         expect(config.env.AWS_SERVER_URL).toBe('ws://localhost:8080/ws/agent');
         expect(config.env.AWS_MCP_HTTP_URL).toBe('http://localhost:8080/mcp/call');
-        expect(config.env.AWS_RUNTIME_CALLBACK_TOKEN).toBeUndefined();
         expect(config.env.CUSTOM_SECRET).toBeUndefined();
     });
     it('repairs duplicated scheduler ports when building MCP URLs', async () => {

package/dist/services/orphan-monitor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orphan-monitor.d.ts","sourceRoot":"","sources":["../../src/services/orphan-monitor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAyBH;;GAEG;AACH,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,gBAAgB,GAChB,sBAAsB,GACtB,kBAAkB,GAClB,qBAAqB,GACrB,cAAc,CAAC;AAEnB;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,cAAc,CAA2C;IACjE,OAAO,CAAC,OAAO,CAAkB;IAEjC;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB5B;;OAEG;IACH,IAAI,IAAI,IAAI;IASZ;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA0E3B;;OAEG;YACW,oBAAoB;IA8BlC;;OAEG;YACW,iBAAiB;IAgC/B;;OAEG;YACW,eAAe;IA0B7B;;OAEG;YACW,mBAAmB;IAsBjC;;OAEG;YACW,iBAAiB;IAwC/B;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,IAAI;IAIrD;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,IAAI;IAOtD;;OAEG;IACH,OAAO,CAAC,IAAI;IAUZ;;OAEG;IACH,SAAS,IAAI;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE;CAO3E;AAKD;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAKhD;AAED;;GAEG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAGxD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAGxC"}
+{"version":3,"file":"orphan-monitor.d.ts","sourceRoot":"","sources":["../../src/services/orphan-monitor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAyBH;;GAEG;AACH,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,gBAAgB,GAChB,sBAAsB,GACtB,kBAAkB,GAClB,qBAAqB,GACrB,cAAc,CAAC;AAEnB;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,cAAc,CAA2C;IACjE,OAAO,CAAC,OAAO,CAAkB;IAEjC;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB5B;;OAEG;IACH,IAAI,IAAI,IAAI;IASZ;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA0E3B;;OAEG;YACW,oBAAoB;IA8BlC;;OAEG;YACW,iBAAiB;IAgC/B;;OAEG;YACW,eAAe;IA0B7B;;OAEG;YACW,mBAAmB;IAsBjC;;OAEG;YACW,iBAAiB;IA8C/B;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,IAAI;IAIrD;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,IAAI;IAOtD;;OAEG;IACH,OAAO,CAAC,IAAI;IAUZ;;OAEG;IACH,SAAS,IAAI;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE;CAO3E;AAKD;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAKhD;AAED;;GAEG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAGxD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAGxC"}

package/dist/services/orphan-monitor.js

@@ -6,7 +6,8 @@
 import { createLogger } from '../utils/logger.js';
 import { loadPersistedSessions, savePersistedSessions } from './terminal-persistence.js';
 import { detectOrphanProcesses, checkAllSessionsHealth, terminateProcessTree, waitForProcessExit } from './process-detector.js';
-import { ORPHAN_SCAN_INTERVAL, ORPHAN_AUTO_CLEAN_MODE, ORPHAN_SCAN_ENABLED, schedulerBaseUrl, runtimeToken } from '../config.js';
+import { ORPHAN_SCAN_INTERVAL, ORPHAN_AUTO_CLEAN_MODE, ORPHAN_SCAN_ENABLED, schedulerBaseUrl } from '../config.js';
+import { getRuntimeAccessToken } from './runtime-binding.js';
 const logger = createLogger('orphan-monitor');
 /**
  * 孤儿进程监控器
@@ -227,11 +228,16 @@ export class OrphanMonitor {
             return;
         }
         try {
+            const runtimeAccessToken = getRuntimeAccessToken(undefined, schedulerBaseUrl) || getRuntimeAccessToken();
+            if (!runtimeAccessToken) {
+                logger.debug(`缺少 runtimeAccessToken，跳过上报: ${eventType}`);
+                return;
+            }
             const response = await fetch(`${schedulerBaseUrl}/api/runtime/orphan-event`, {
                 method: 'POST',
                 headers: {
                     'Content-Type': 'application/json',
-                    'Authorization': `Bearer ${runtimeToken}`,
+                    'Authorization': `Bearer ${runtimeAccessToken}`,
                 },
                 body: JSON.stringify({
                     agentId,

package/dist/services/runtime-binding.d.ts

@@ -25,6 +25,7 @@ export declare function saveScopedRuntimeAccessToken(input: {
     accessToken: string;
 }): string;
 export declare function getScopedRuntimeAccessToken(userId: unknown, serverBaseUrl: unknown): string | undefined;
+export declare function clearScopedRuntimeAccessToken(userId: unknown, serverBaseUrl: unknown): boolean;
 export declare function loadRuntimeBinding(): RuntimeBindingState;
 export declare function getRuntimeBindingPublicState(): Omit<RuntimeBindingState, "tokenHash" | "accessToken"> & {
     paired: boolean;

package/dist/services/runtime-binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-binding.d.ts","sourceRoot":"","sources":["../../src/services/runtime-binding.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AA2DF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAqB5E;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAoBD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,OAAO,GACrB,MAAM,CAYR;AAsCD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,MAAM,CAWT;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,OAAO,GACrB,MAAM,GAAG,SAAS,CAUpB;AAcD,wBAAgB,kBAAkB,IAAI,mBAAmB,CAgBxD;AAED,wBAAgB,4BAA4B,IAAI,IAAI,CAClD,mBAAmB,EACnB,WAAW,GAAG,aAAa,CAC5B,GAAG;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAWtB;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAG3C;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAcnE;AAED,wBAAgB,qBAAqB,CACnC,MAAM,CAAC,EAAE,OAAO,EAChB,aAAa,CAAC,EAAE,OAAO,GACtB,MAAM,GAAG,SAAS,CAepB;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAEjE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,mBAAmB,CAwCtB;AAED,wBAAgB,mBAAmB,IAAI,IAAI,CAkB1C"}
+{"version":3,"file":"runtime-binding.d.ts","sourceRoot":"","sources":["../../src/services/runtime-binding.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AA2DF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAqB5E;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAiCD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,OAAO,GACrB,MAAM,CAYR;AAsCD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,MAAM,CAWT;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,OAAO,GACrB,MAAM,GAAG,SAAS,CAUpB;AAED,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,OAAO,GACrB,OAAO,CAeT;AAcD,wBAAgB,kBAAkB,IAAI,mBAAmB,CAgBxD;AAED,wBAAgB,4BAA4B,IAAI,IAAI,CAClD,mBAAmB,EACnB,WAAW,GAAG,aAAa,CAC5B,GAAG;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAWtB;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAG3C;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAcnE;AAED,wBAAgB,qBAAqB,CACnC,MAAM,CAAC,EAAE,OAAO,EAChB,aAAa,CAAC,EAAE,OAAO,GACtB,MAAM,GAAG,SAAS,CAepB;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAEjE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,mBAAmB,CAwCtB;AAED,wBAAgB,mBAAmB,IAAI,IAAI,CAkB1C"}