aws-runtime-bridge 1.9.175 → 1.9.179

package/dist/services/process-registry.d.ts

@@ -1,13 +1,23 @@
 
 
+
+
+
+
+
+
 export type ProcessState = 'creating' | 'running' | 'stopping' | 'orphaned' | 'terminated' | 'unknown';
 
+
+
 export interface HealthStatus {
     cpu: number;
     memoryMB: number;
     status: string;
 }
 
+
+
 export interface ProcessRecord {
     agentId: string;
     sessionId: string;
@@ -23,6 +33,8 @@ export interface ProcessRecord {
     metadata?: Record<string, unknown>;
 }
 
+
+
 export interface PersistedSessionInput {
     agentId: string;
     sessionId: string;
@@ -32,57 +44,165 @@ export interface PersistedSessionInput {
     mode?: 'sdk';
 }
 
+
+
+
+
 export declare function getProcessRegistryFile(): string;
 
+
+
+
+
 export declare class ProcessRegistry {
     private static instance;
     private readonly records;
     private readonly pidToAgentId;
     
+
+
     private constructor();
     
+
+
+
+
     static getInstance(): ProcessRegistry;
     
+
+
     private persist;
     private mutate;
     
+
+
+
+
+
     register(record: Omit<ProcessRecord, 'createdAt'>): Promise<void>;
     
+
+
+
+
+
+
     update(agentId: string, updates: Partial<ProcessRecord>): Promise<boolean>;
     
+
+
+
+
+
     get(agentId: string): ProcessRecord | undefined;
     
+
+
+
+
+
     getByPid(pid: number): ProcessRecord | undefined;
     
+
+
+
+
     getAll(): ProcessRecord[];
     
+
+
+
+
+
     getByState(state: ProcessState): ProcessRecord[];
     
+
+
+
+
+
     isManaged(agentId: string): boolean;
     
+
+
+
+
+
     isManagedByPid(pid: number): boolean;
     
+
+
+
+
+
     markOrphaned(agentId: string): Promise<boolean>;
     
+
+
+
+
+
     markTerminated(agentId: string): Promise<boolean>;
     
+
+
+
+
+
     remove(agentId: string): Promise<boolean>;
     
+
+
+
+
+
     updateHeartbeat(agentId: string): Promise<boolean>;
     
+
+
+
+
+
+
     updateHealth(agentId: string, health: HealthStatus): Promise<boolean>;
     
+
+
+
+
     rebuildFromPersisted(sessions: PersistedSessionInput[]): Promise<void>;
     
+
+
+
+
     exportState(): ProcessRecord[];
     
+
+
+
+
     getStats(): Record<ProcessState | 'total', number>;
     
+
+
     clear(): Promise<void>;
 }
 
+
+
+
+
 export declare function getProcessRegistry(): ProcessRegistry;
 
+
+
+
+
 export declare function loadPersistedProcessRegistry(): Promise<ProcessRecord[]>;
 
+
+
+
+
 export declare function savePersistedProcessRegistry(records: ProcessRecord[]): Promise<void>;

package/dist/services/process-top.d.ts

@@ -4,6 +4,9 @@ export interface ProcessTopSample {
     pid: number;
     name: string;
     
+
+
+
     value: number;
     readBytesPerSecond?: number;
     writeBytesPerSecond?: number;
@@ -50,4 +53,7 @@ export declare function parseLsofConnectionCounts(output: string): Map<number, {
 
 export declare function parseJsonRows<T>(stdout: string): T[];
 
+
+
+
 export declare function collectProcessTop(resource: ProcessTopResource, limit: number): Promise<ProcessTopSnapshot>;

package/dist/services/request-identity.d.ts

@@ -0,0 +1,77 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+import type { Request } from "express";
+import { type UserScope } from "./user-scope.js";
+export type RequestIdentitySource = "connection-key" | "runtime-token" | "loopback" | "panel-session" | "untrusted";
+export interface RequestIdentity {
+    source: RequestIdentitySource;
+    
+    target?: {
+        serverUrl: string;
+        tenantId?: string;
+        userId?: string;
+        credentialId?: string;
+        instanceId?: string;
+    };
+    
+    scope: UserScope | null;
+}
+export declare function isLoopbackRequest(req: Request): boolean;
+
+
+
+
+
+
+
+export declare function resolveCredentialIdentity(req: Request, token: string): RequestIdentity;
+
+
+
+
+export declare function readTargetSelectors(req: Request): {
+    serverUrl?: string;
+    instanceId?: string;
+    credentialId?: string;
+    identity?: string;
+};
+
+
+
+
+
+
+
+
+
+
+
+
+export declare function constrainScopeToTarget(requested: UserScope | null, targetTenantId?: string, targetUserId?: string): UserScope | null;
+
+
+
+
+
+
+export declare function findConfiguredTarget(selectors: ReturnType<typeof readTargetSelectors>): {
+    serverUrl: string;
+    tenantId?: string;
+    userId?: string;
+    credentialId?: string;
+    instanceId?: string;
+} | undefined;

package/dist/services/request-identity.js

@@ -0,0 +1,2 @@
+import{findConfigsByConnectionKey as S,getConfiguredConnectionKeys as p,loadConfigs as o}from"./auto-register.js";import{getScopedRuntimeAccessToken as U,validateRuntimeBindingToken as y}from"./runtime-binding.js";import{normalizeUserScope as c}from"./user-scope.js";const v=new Set(["127.0.0.1","::1","::ffff:127.0.0.1"]);function b(e){const n=e.ip||e.socket.remoteAddress||"";return v.has(n)}function B(e,n){const i=String(n||"").trim();if(!i)return{source:"untrusted",scope:null};if(p().includes(i)){const t=f(e),r=S(i);let d=r.length===1?r[0]:void 0;if(!d){const a=h(t);a&&(d=r.find(g=>u(g.serverUrl)===a.serverUrl))}const s=d?I(d,t):void 0;return s?{source:"connection-key",target:s,scope:m(l(e),s.tenantId,s.userId)}:{source:"connection-key",scope:null}}if(y(i)){for(const t of o()){const r=U(t.serverUrl,t.credentialId||t.userKey);if(!r||r!==i)continue;const d=I(t,f(e));return{source:"runtime-token",target:d,scope:m(l(e),d.tenantId,d.userId)}}return{source:"runtime-token",scope:null}}return{source:"untrusted",scope:null}}function l(e){const n=e.body??{};return c(e.header("X-Tenant-Id")??n.tenantId,e.header("X-User-Id")??n.ownerUserId??n.userId)}function I(e,n){return(!n.serverUrl||u(e.serverUrl)===u(n.serverUrl))&&(!n.instanceId||String(e.instanceId||"").trim()===n.instanceId)&&(!n.credentialId||String(e.credentialId||e.userKey||e.serverUrl||"").trim()===n.credentialId)?{serverUrl:u(e.serverUrl),tenantId:String(e.tenantId||"").trim()||void 0,userId:String(e.userId||"").trim()||void 0,credentialId:String(e.credentialId||"").trim()||void 0,instanceId:String(e.instanceId||"").trim()||void 0}:{serverUrl:u(e.serverUrl),tenantId:void 0,userId:void 0}}function f(e){const n=e.body??{},i=(...t)=>{for(const r of t){const d=String(r??"").trim();if(d)return d}};return{serverUrl:i(e.header("X-Scheduler-Base-Url"),n.serverUrl),instanceId:i(e.header("X-Bridge-Instance-Id"),n.instanceId),credentialId:i(e.header("X-Bridge-Credential-Id"),n.credentialId),identity:i(e.header("X-Bridge-Target-Identity"),n.targetIdentity)}}function m(e,n,i){const t=String(n||"").trim(),r=String(i||"").trim();return t?e?e.tenantId!==t||r&&e.userId!==r?null:e:r?c(t,r):null:null}function h(e){const i=o().filter(r=>!(e.serverUrl&&u(r.serverUrl)!==u(e.serverUrl)||e.instanceId&&String(r.instanceId||"").trim()!==e.instanceId||e.credentialId&&String(r.credentialId||"").trim()!==e.credentialId&&String(r.userKey||"").trim()!==e.credentialId||e.identity&&String(r.credentialId||r.userKey||"").trim()!==e.identity));if(i.length!==1)return;const t=i[0];return{serverUrl:u(String(t.serverUrl||"")),tenantId:String(t.tenantId||"").trim()||void 0,userId:String(t.userId||"").trim()||void 0,credentialId:String(t.credentialId||"").trim()||void 0,instanceId:String(t.instanceId||"").trim()||void 0}}function u(e){const n=String(e??"").trim();if(!n)return"";try{return new URL(n).origin.toLowerCase()}catch{return n.replace(/\/+$/,"").toLowerCase()}}export{m as constrainScopeToTarget,h as findConfiguredTarget,b as isLoopbackRequest,f as readTargetSelectors,B as resolveCredentialIdentity};
+

package/dist/services/request-invalid-dump.d.ts

@@ -18,4 +18,8 @@ export declare function resetInvalidRequestDumpStateForTest(): void;
 
 export declare function getInvalidRequestDumpDir(): string;
 
+
+
+
+
 export declare function dumpInvalidProviderRequest(input: InvalidProviderRequestDumpInput): Promise<string | null>;

package/dist/services/ring-buffer.d.ts

@@ -1,4 +1,9 @@
 
+
+
+
+
+
 export interface RingBufferEntry<T> {
     data: T;
     readonly timestamp: number;
@@ -6,6 +11,10 @@ export interface RingBufferEntry<T> {
 }
 export type RingBufferSlice<T> = readonly RingBufferEntry<T>[];
 
+
+
+
+
 export declare class RingBuffer<T> {
     private readonly entries;
     private readonly capacity;
@@ -13,21 +22,45 @@ export declare class RingBuffer<T> {
     private totalAppended;
     constructor(capacity: number);
     
+
+
+
+
     append(item: T): RingBufferEntry<T>;
     
+
+
+
+
+
+
+
+
+
     appendOrMerge(item: T, condition: (lastEntry: RingBufferEntry<T>) => boolean, merge: (last: T, next: T) => T): RingBufferEntry<T>;
     
+
+
     slice(): RingBufferSlice<T>;
     
+
+
     get size(): number;
     
+
+
     getLastN(n: number): RingBufferSlice<T>;
     
+
+
+
     getSinceIndex(index: number): {
         entries: RingBufferSlice<T>;
         nextIndex: number;
         oldestIndex: number;
     };
     
+
+
     clear(): void;
 }

package/dist/services/runtime-binding.d.ts

@@ -4,37 +4,89 @@ export type RuntimeBindingState = {
     userId?: string;
     schedulerBaseUrl?: string;
     
+
+
+
+
     accessToken?: string;
     tokenHash?: string;
     createdAt?: string;
     updatedAt?: string;
     revokedAt?: string;
 };
+
+
+
+
 export declare function normalizeSchedulerBaseUrl(value: unknown): string | undefined;
 export declare function getRuntimePairingCode(): string;
 export declare function getRuntimeBindingFilePath(): string;
 export declare function getRuntimeTokenStoreFilePath(): string;
-export declare function buildRuntimeTokenKey(serverBaseUrl: unknown): string;
+
+
+
+
+
+
+
+export declare function buildLegacyRuntimeTokenKey(serverBaseUrl: unknown): string;
+
+
+
+
+
+
+export declare function buildRuntimeTokenKey(serverBaseUrl: unknown, userKey?: unknown): string;
 export declare function saveScopedRuntimeAccessToken(input: {
     serverBaseUrl: string;
     accessToken: string;
+    
+    userKey?: string;
 }): string;
-export declare function getScopedRuntimeAccessToken(serverBaseUrl: unknown): string | undefined;
-export declare function clearScopedRuntimeAccessToken(serverBaseUrl: unknown): boolean;
+
+export declare function getScopedRuntimeAccessToken(serverBaseUrl: unknown, userKey?: unknown): string | undefined;
+
+export declare function listScopedRuntimeAccessTokens(serverBaseUrl: unknown): Array<{
+    userKeyFingerprint: string;
+    accessToken: string;
+}>;
+export declare function clearScopedRuntimeAccessToken(serverBaseUrl: unknown, userKey?: unknown): boolean;
 export declare function loadRuntimeBinding(): RuntimeBindingState;
 export declare function getRuntimeBindingPublicState(): Omit<RuntimeBindingState, "tokenHash" | "accessToken"> & {
     paired: boolean;
 };
 export declare function hasRuntimeBinding(): boolean;
 export declare function validateRuntimeBindingToken(token: unknown): boolean;
-export declare function getRuntimeAccessToken(serverBaseUrl?: unknown): string | undefined;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+export declare function getRuntimeAccessToken(serverBaseUrl?: unknown, userKey?: unknown): string | undefined;
 export declare function validateRuntimePairingCode(code: unknown): boolean;
 export declare function saveRuntimeBinding(input: {
     accessToken: string;
     instanceId?: string;
     userId?: string;
     schedulerBaseUrl?: string;
+    
+
+
+
+    userKey?: string;
 }): RuntimeBindingState;
 export declare function clearRuntimeBinding(): void;
 
+
+
+
 export declare function migrateOldBindingDir(): void;

package/dist/services/runtime-binding.js

@@ -1,6 +1,6 @@
-import m from"node:crypto";import o from"node:fs";import u from"node:path";import{getRuntimeHomeDir as w}from"../config.js";import{createLogger as R}from"../utils/logger.js";const g=R("runtime-binding"),b="sha256",x=v();function v(){const e=m.randomInt(0,1e6);return String(e).padStart(6,"0").replace(/(\d{3})(\d{3})/,"$1-$2")}function a(){return u.join(w(),".aws-bridge")}function p(){return u.join(a(),"binding.json")}function S(){return u.join(a(),"runtime-tokens.properties")}function T(e){return m.createHash(b).update(e,"utf8").digest("hex")}function $(e,t){const n=Buffer.from(e,"hex"),r=Buffer.from(t,"hex");return n.length!==r.length?!1:m.timingSafeEqual(n,r)}function H(e,t){const n=Buffer.from(e,"utf8"),r=Buffer.from(t,"utf8");return n.length!==r.length?!1:m.timingSafeEqual(n,r)}function d(e){return String(e||"").trim()}function I(e){return e.replace(/^((?:https?|wss?):\/\/(?:\[[^\]]+\]|[^/:?#]+):\d+):\d+(?=\/|$)/i,"$1")}function U(e){const t=e.toLowerCase();return t==="localhost"||t==="::1"||t==="[::1]"?"127.0.0.1":t}function f(e){const t=d(e);if(!t)return;const n=I(t);try{const r=new URL(n);return r.protocol==="ws:"?r.protocol="http:":r.protocol==="wss:"?r.protocol="https:":r.protocol=r.protocol.toLowerCase(),r.hostname=U(r.hostname),r.origin}catch{return n.replace(/\/+$/,"")}}function z(){return x}function L(){return p()}function N(){return S()}function F(e){const t=f(e);if(t)return t;const n=String(e||"").trim();return n?n.replace(/\/+$/,"").toLowerCase():""}function y(e){const t=F(e);if(!t)throw new Error("serverBaseUrl is required to build runtime token key");return m.createHash("md5").update(t,"utf8").digest("hex")}function k(){const e=new Map;try{const t=o.readFileSync(S(),"utf8");for(const n of t.split(/\r?\n/)){const r=n.trim();if(!r||r.startsWith("#"))continue;const i=r.indexOf("=");if(i<=0)continue;const s=r.slice(0,i).trim(),c=r.slice(i+1).trim();s&&c&&e.set(s,c)}}catch{}return e}function B(e){o.mkdirSync(a(),{recursive:!0});const t=[...e.entries()].sort(([n],[r])=>n.localeCompare(r)).map(([n,r])=>`${n}=${r}`);o.writeFileSync(S(),`${t.join(`
+import m from"node:crypto";import c from"node:fs";import a from"node:path";import{getRuntimeHomeDir as T}from"../config.js";import{createLogger as U}from"../utils/logger.js";import{normalizeSchedulerUrl as F}from"../utils/scheduler-url.js";import{buildTargetKey as I,fingerprintUserKey as H}from"../utils/target-identity.js";const g=U("runtime-binding"),A="sha256",b=K();function K(){const e=m.randomInt(0,1e6);return String(e).padStart(6,"0").replace(/(\d{3})(\d{3})/,"$1-$2")}function d(){return a.join(T(),".aws-bridge")}function h(){return a.join(d(),"binding.json")}function S(){return a.join(d(),"runtime-tokens.properties")}function w(e){return m.createHash(A).update(e,"utf8").digest("hex")}function E(e,n){const t=Buffer.from(e,"hex"),r=Buffer.from(n,"hex");return t.length!==r.length?!1:m.timingSafeEqual(t,r)}function O(e,n){const t=Buffer.from(e,"utf8"),r=Buffer.from(n,"utf8");return t.length!==r.length?!1:m.timingSafeEqual(t,r)}function p(e){return String(e||"").trim()}function f(e){return F(e)}function M(){return b}function W(){return h()}function G(){return S()}function y(e){const n=f(e);if(n)return n;const t=String(e||"").trim();return t?t.replace(/\/+$/,"").toLowerCase():""}function R(e){const n=y(e);if(!n)throw new Error("serverBaseUrl is required to build runtime token key");return m.createHash("md5").update(n,"utf8").digest("hex")}function x(e,n){const t=y(e);if(!t)throw new Error("serverBaseUrl is required to build runtime token key");return I(t,n)}function k(){const e=new Map;try{const n=c.readFileSync(S(),"utf8");for(const t of n.split(/\r?\n/)){const r=t.trim();if(!r||r.startsWith("#"))continue;const i=r.indexOf("=");if(i<=0)continue;const o=r.slice(0,i).trim(),s=r.slice(i+1).trim();o&&s&&e.set(o,s)}}catch{}return e}function B(e){c.mkdirSync(d(),{recursive:!0});const n=[...e.entries()].sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${t}=${r}`);c.writeFileSync(S(),`${n.join(`
 `)}
-`,{encoding:"utf8",mode:384})}function A(e){const t=d(e.accessToken);if(t.length<16)throw new Error("accessToken must be at least 16 characters");const n=y(e.serverBaseUrl),r=k();return r.set(n,t),B(r),n}function O(e){if(e)try{const t=y(e);return k().get(t)}catch{return}}function _(e){if(!e)return!1;try{const t=y(e),n=k(),r=n.delete(t);return r&&B(n),r}catch{return!1}}function j(e){if(!e)return!1;for(const t of k().values())if(H(e,t))return!0;return!1}function l(){try{const e=o.readFileSync(p(),"utf8"),t=JSON.parse(e);if(t?.status==="paired"&&t.tokenHash)return{...t,schedulerBaseUrl:f(t.schedulerBaseUrl)||t.schedulerBaseUrl}}catch{}return{status:"unpaired"}}function J(){const e=l(),t={...e};return delete t.tokenHash,delete t.accessToken,{...t,paired:e.status==="paired"}}function K(){const e=l();return e.status==="paired"&&!!e.tokenHash}function M(e){const t=d(e);if(!t)return!1;const n=l();return n.status==="paired"&&n.tokenHash&&$(T(t),n.tokenHash)?!0:j(t)}function G(e){const t=O(e);if(t)return t;const n=l();if(n.status==="paired"){if(e){const r=f(e),i=f(n.schedulerBaseUrl);return r&&i&&r===i&&d(n.accessToken)||void 0}return d(n.accessToken)||void 0}}function W(e){return String(e||"").trim()===x}function Q(e){const t=d(e.accessToken);if(t.length<16)throw new Error("accessToken must be at least 16 characters");const n=l(),r=f(e.schedulerBaseUrl)||f(n.schedulerBaseUrl),i=new Date().toISOString(),s={status:"paired",instanceId:e.instanceId?String(e.instanceId):n.instanceId,userId:e.userId?String(e.userId):n.userId,schedulerBaseUrl:r,accessToken:t,tokenHash:T(t),createdAt:n.createdAt||i,updatedAt:i};if(o.mkdirSync(a(),{recursive:!0}),o.writeFileSync(p(),`${JSON.stringify(s,null,2)}
-`,{encoding:"utf8",mode:384}),s.schedulerBaseUrl){const c=A({serverBaseUrl:s.schedulerBaseUrl,accessToken:t});g.info(`[runtime-bridge] scoped runtime token saved: key=${c}`)}return g.info(`[runtime-bridge] runtime binding saved: ${p()}`),s}function V(){const t={...l(),status:"unpaired",accessToken:void 0,tokenHash:void 0,revokedAt:new Date().toISOString(),updatedAt:new Date().toISOString()};o.mkdirSync(a(),{recursive:!0}),o.writeFileSync(p(),`${JSON.stringify(t,null,2)}
-`,{encoding:"utf8",mode:384}),g.info("[runtime-bridge] runtime binding cleared")}function X(){const e=w(),t=u.join(e,".agentswork","runtime-bridge"),n=a();if(t===n||!o.existsSync(t))return;const r=["binding.json","runtime-tokens.properties"];let i=0;for(const s of r){const c=u.join(t,s),h=u.join(n,s);if(o.existsSync(c)&&!o.existsSync(h)){o.mkdirSync(n,{recursive:!0}),o.copyFileSync(c,h);try{o.chmodSync(h,384)}catch{}i++,g.info(`[runtime-bridge] \u5DF2\u8FC1\u79FB ${c} \u2192 ${h}`)}}i>0&&g.info(`[runtime-bridge] \u5DF2\u8FC1\u79FB ${i} \u4E2A\u914D\u7F6E\u6587\u4EF6\u4ECE ${t} \u5230 ${n}`)}export{y as buildRuntimeTokenKey,V as clearRuntimeBinding,_ as clearScopedRuntimeAccessToken,G as getRuntimeAccessToken,L as getRuntimeBindingFilePath,J as getRuntimeBindingPublicState,z as getRuntimePairingCode,N as getRuntimeTokenStoreFilePath,O as getScopedRuntimeAccessToken,K as hasRuntimeBinding,l as loadRuntimeBinding,X as migrateOldBindingDir,f as normalizeSchedulerBaseUrl,Q as saveRuntimeBinding,A as saveScopedRuntimeAccessToken,M as validateRuntimeBindingToken,W as validateRuntimePairingCode};
+`,{encoding:"utf8",mode:384})}function j(e){const n=p(e.accessToken);if(n.length<16)throw new Error("accessToken must be at least 16 characters");const t=x(e.serverBaseUrl,e.userKey),r=k();return r.set(t,n),B(r),t}function D(e,n){if(e)try{const t=k(),r=x(e,n),i=t.get(r);if(i)return i;if(!!String(n||"").trim())return;const s=v(e);return s.length===1?s[0].accessToken:s.length>1?void 0:t.get(R(e))}catch{return}}function v(e){const n=y(e);if(!n)return[];const t=[],r=`${n}#`;for(const[i,o]of k().entries())i.startsWith(r)&&t.push({userKeyFingerprint:i.slice(r.length),accessToken:o});return t}function Q(e,n){if(!e)return!1;try{const t=k(),r=t.delete(x(e,n)),i=String(n||"").trim()?!1:t.delete(R(e));return(r||i)&&B(t),r||i}catch{return!1}}function q(e){if(!e)return!1;for(const n of k().values())if(O(e,n))return!0;return!1}function l(){try{const e=c.readFileSync(h(),"utf8"),n=JSON.parse(e);if(n?.status==="paired"&&n.tokenHash)return{...n,schedulerBaseUrl:f(n.schedulerBaseUrl)||n.schedulerBaseUrl}}catch{}return{status:"unpaired"}}function V(){const e=l(),n={...e};return delete n.tokenHash,delete n.accessToken,{...n,paired:e.status==="paired"}}function X(){const e=l();return e.status==="paired"&&!!e.tokenHash}function Y(e){const n=p(e);if(!n)return!1;const t=l();return t.status==="paired"&&t.tokenHash&&E(w(n),t.tokenHash)?!0:q(n)}function Z(e,n){const t=D(e,n);if(t)return t;const r=l();if(r.status==="paired"){if(e){const i=f(e),o=f(r.schedulerBaseUrl);if(i&&o&&i===o){if(String(n||"").trim()){const s=v(i),u=new Set(s.map($=>$.userKeyFingerprint));if(u.size>1&&!u.has(H(n)))return}return p(r.accessToken)||void 0}return}return p(r.accessToken)||void 0}}function ee(e){return String(e||"").trim()===b}function ne(e){const n=p(e.accessToken);if(n.length<16)throw new Error("accessToken must be at least 16 characters");const t=l(),r=f(e.schedulerBaseUrl)||f(t.schedulerBaseUrl),i=new Date().toISOString(),o={status:"paired",instanceId:e.instanceId?String(e.instanceId):t.instanceId,userId:e.userId?String(e.userId):t.userId,schedulerBaseUrl:r,accessToken:n,tokenHash:w(n),createdAt:t.createdAt||i,updatedAt:i};if(c.mkdirSync(d(),{recursive:!0}),c.writeFileSync(h(),`${JSON.stringify(o,null,2)}
+`,{encoding:"utf8",mode:384}),o.schedulerBaseUrl){const s=j({serverBaseUrl:o.schedulerBaseUrl,accessToken:n,userKey:e.userKey});g.info(`[runtime-bridge] scoped runtime token saved: key=${s}`+(e.userKey?` (userKey=****${String(e.userKey).slice(-4)})`:""))}return g.info(`[runtime-bridge] runtime binding saved: ${h()}`),o}function te(){const n={...l(),status:"unpaired",accessToken:void 0,tokenHash:void 0,revokedAt:new Date().toISOString(),updatedAt:new Date().toISOString()};c.mkdirSync(d(),{recursive:!0}),c.writeFileSync(h(),`${JSON.stringify(n,null,2)}
+`,{encoding:"utf8",mode:384}),g.info("[runtime-bridge] runtime binding cleared")}function re(){const e=T(),n=a.join(e,".agentswork","runtime-bridge"),t=d();if(n===t||!c.existsSync(n))return;const r=["binding.json","runtime-tokens.properties"];let i=0;for(const o of r){const s=a.join(n,o),u=a.join(t,o);if(c.existsSync(s)&&!c.existsSync(u)){c.mkdirSync(t,{recursive:!0}),c.copyFileSync(s,u);try{c.chmodSync(u,384)}catch{}i++,g.info(`[runtime-bridge] \u5DF2\u8FC1\u79FB ${s} \u2192 ${u}`)}}i>0&&g.info(`[runtime-bridge] \u5DF2\u8FC1\u79FB ${i} \u4E2A\u914D\u7F6E\u6587\u4EF6\u4ECE ${n} \u5230 ${t}`)}export{R as buildLegacyRuntimeTokenKey,x as buildRuntimeTokenKey,te as clearRuntimeBinding,Q as clearScopedRuntimeAccessToken,Z as getRuntimeAccessToken,W as getRuntimeBindingFilePath,V as getRuntimeBindingPublicState,M as getRuntimePairingCode,G as getRuntimeTokenStoreFilePath,D as getScopedRuntimeAccessToken,X as hasRuntimeBinding,v as listScopedRuntimeAccessTokens,l as loadRuntimeBinding,re as migrateOldBindingDir,f as normalizeSchedulerBaseUrl,ne as saveRuntimeBinding,j as saveScopedRuntimeAccessToken,Y as validateRuntimeBindingToken,ee as validateRuntimePairingCode};
 

package/dist/services/runtime-lifecycle-policy.d.ts

@@ -8,8 +8,25 @@ export interface GracefulShutdownPlan {
     stopTunnelClient: boolean;
 }
 
+
+
+
+
+
+
+
+
+
 export declare function buildGracefulShutdownPlan(preserveSessions: boolean): GracefulShutdownPlan;
 
+
+
+
+
 export declare function shouldCleanupPersistedSessionsOnStartup(preserveSessions: boolean, env?: NodeJS.ProcessEnv): boolean;
 
+
+
+
+
 export declare function shouldAutoCleanOrphanProcesses(env?: NodeJS.ProcessEnv): boolean;

package/dist/services/runtime-resources-snapshot.d.ts

@@ -1,3 +1,29 @@
 
 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 export declare function buildRuntimeResourcesSnapshot(agentId: string | undefined): Promise<string | null>;

package/dist/services/sdk-tool-file-change-recorder.d.ts

@@ -1,9 +1,18 @@
 import { type ProviderEvent } from "../adapter/types.js";
 
+
+
+
 export declare function onSdkToolUseStart(sessionId: string, toolUseId: string | undefined, toolInput: Record<string, unknown> | undefined, toolName?: string, workspacePath?: string): void;
 
+
+
+
 export declare function forgetSession(sessionId: string): void;
 
+
+
+
 export declare function onSdkToolUseEnd(event: ProviderEvent, entry: {
     sessionId: string;
     agentId: string;