aws-runtime-bridge 1.9.66 → 1.9.71

package/dist/services/runtime-binding.js

@@ -117,15 +117,14 @@ function normalizeRuntimeTokenServerUrl(serverBaseUrl) {
     }
     return raw.replace(/\/+$/, "").toLowerCase();
 }
-export function buildRuntimeTokenKey(userId, serverBaseUrl) {
-    const normalizedUserId = String(userId || "").trim();
+export function buildRuntimeTokenKey(serverBaseUrl) {
     const serverUrl = normalizeRuntimeTokenServerUrl(serverBaseUrl);
-    if (!normalizedUserId || !serverUrl) {
-        throw new Error("userId and serverBaseUrl are required to build runtime token key");
+    if (!serverUrl) {
+        throw new Error("serverBaseUrl is required to build runtime token key");
     }
     return crypto
         .createHash("md5")
-        .update(`${normalizedUserId}:${serverUrl}`, "utf8")
+        .update(serverUrl, "utf8")
         .digest("hex");
 }
 function loadRuntimeTokenStore() {
@@ -168,30 +167,30 @@ export function saveScopedRuntimeAccessToken(input) {
     if (accessToken.length < 16) {
         throw new Error("accessToken must be at least 16 characters");
     }
-    const key = buildRuntimeTokenKey(input.userId, input.serverBaseUrl);
+    const key = buildRuntimeTokenKey(input.serverBaseUrl);
     const tokens = loadRuntimeTokenStore();
     tokens.set(key, accessToken);
     saveRuntimeTokenStore(tokens);
     return key;
 }
-export function getScopedRuntimeAccessToken(userId, serverBaseUrl) {
-    if (!userId || !serverBaseUrl) {
+export function getScopedRuntimeAccessToken(serverBaseUrl) {
+    if (!serverBaseUrl) {
         return undefined;
     }
     try {
-        const key = buildRuntimeTokenKey(userId, serverBaseUrl);
+        const key = buildRuntimeTokenKey(serverBaseUrl);
         return loadRuntimeTokenStore().get(key);
     }
     catch {
         return undefined;
     }
 }
-export function clearScopedRuntimeAccessToken(userId, serverBaseUrl) {
-    if (!userId || !serverBaseUrl) {
+export function clearScopedRuntimeAccessToken(serverBaseUrl) {
+    if (!serverBaseUrl) {
         return false;
     }
     try {
-        const key = buildRuntimeTokenKey(userId, serverBaseUrl);
+        const key = buildRuntimeTokenKey(serverBaseUrl);
         const tokens = loadRuntimeTokenStore();
         const removed = tokens.delete(key);
         if (removed) {
@@ -256,8 +255,8 @@ export function validateRuntimeBindingToken(token) {
     }
     return validateRuntimeTokenStore(candidate);
 }
-export function getRuntimeAccessToken(userId, serverBaseUrl) {
-    const scopedToken = getScopedRuntimeAccessToken(userId, serverBaseUrl);
+export function getRuntimeAccessToken(serverBaseUrl) {
+    const scopedToken = getScopedRuntimeAccessToken(serverBaseUrl);
     if (scopedToken) {
         return scopedToken;
     }
@@ -306,9 +305,8 @@ export function saveRuntimeBinding(input) {
         encoding: "utf8",
         mode: 0o600,
     });
-    if (next.userId && next.schedulerBaseUrl) {
+    if (next.schedulerBaseUrl) {
         const key = saveScopedRuntimeAccessToken({
-            userId: next.userId,
             serverBaseUrl: next.schedulerBaseUrl,
             accessToken,
         });

package/dist/services/runtime-lifecycle-policy.d.ts

@@ -4,6 +4,7 @@ export interface GracefulShutdownPlan {
     terminateResidualProcesses: boolean;
     unregisterInstance: boolean;
     clearPersistedSessions: boolean;
+    stopTunnelClient: boolean;
 }
 /**
  * Build shutdown side-effect policy from the requested restart mode.

package/dist/services/runtime-lifecycle-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-lifecycle-policy.d.ts","sourceRoot":"","sources":["../../src/services/runtime-lifecycle-policy.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,0BAA0B,EAAE,OAAO,CAAC;IACpC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,gBAAgB,EAAE,OAAO,GACxB,oBAAoB,CAUtB;AAED;;;;GAIG;AACH,wBAAgB,uCAAuC,CACrD,gBAAgB,EAAE,OAAO,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAMT;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAET"}
+{"version":3,"file":"runtime-lifecycle-policy.d.ts","sourceRoot":"","sources":["../../src/services/runtime-lifecycle-policy.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,0BAA0B,EAAE,OAAO,CAAC;IACpC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,sBAAsB,EAAE,OAAO,CAAC;IAChC,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,gBAAgB,EAAE,OAAO,GACxB,oBAAoB,CAWtB;AAED;;;;GAIG;AACH,wBAAgB,uCAAuC,CACrD,gBAAgB,EAAE,OAAO,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAMT;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAET"}

package/dist/services/runtime-lifecycle-policy.js

@@ -11,6 +11,7 @@ export function buildGracefulShutdownPlan(preserveSessions) {
         terminateResidualProcesses: shouldCleanRuntimeState,
         unregisterInstance: shouldCleanRuntimeState,
         clearPersistedSessions: shouldCleanRuntimeState,
+        stopTunnelClient: shouldCleanRuntimeState,
     };
 }
 /**

package/dist/services/session-output.js

@@ -20,7 +20,7 @@ import { getRuntimeAccessToken } from "./runtime-binding.js";
 export const bridgeEventBuffer = new RingBuffer(2000);
 function runtimeAuthHeaders(options, callbackBaseUrl = resolveRuntimeCallbackBaseUrl(options)) {
     const token = options?.runtimeAccessToken ||
-        getRuntimeAccessToken(undefined, callbackBaseUrl) ||
+        getRuntimeAccessToken(callbackBaseUrl) ||
         getRuntimeAccessToken();
     return token ? { "X-Runtime-Token": token } : undefined;
 }

package/dist/services/startup-config-wizard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"startup-config-wizard.d.ts","sourceRoot":"","sources":["../../src/services/startup-config-wizard.ts"],"names":[],"mappings":"AAuBA,UAAU,QAAQ;IAChB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,KAAK,IAAI,IAAI,CAAC;CACf;AAED,UAAU,0BAA0B;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,qBAAqB,CAAC,EAAE,MAAM,MAAM,CAAC;CACtC;AAED,MAAM,MAAM,yBAAyB,GACjC,QAAQ,GACR,SAAS,GACT,YAAY,GACZ,SAAS,GACT,iBAAiB,GACjB,QAAQ,CAAC;AAoKb,wBAAsB,mBAAmB,CACvC,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,yBAAyB,CAAC,CAiDpC;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,yBAAyB,CAAC,CA0BpC"}
+{"version":3,"file":"startup-config-wizard.d.ts","sourceRoot":"","sources":["../../src/services/startup-config-wizard.ts"],"names":[],"mappings":"AAuBA,UAAU,QAAQ;IAChB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,KAAK,IAAI,IAAI,CAAC;CACf;AAED,UAAU,0BAA0B;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,qBAAqB,CAAC,EAAE,MAAM,MAAM,CAAC;CACtC;AAED,MAAM,MAAM,yBAAyB,GACjC,QAAQ,GACR,SAAS,GACT,YAAY,GACZ,SAAS,GACT,iBAAiB,GACjB,QAAQ,CAAC;AAgLb,wBAAsB,mBAAmB,CACvC,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,yBAAyB,CAAC,CAiDpC;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,yBAAyB,CAAC,CA0BpC"}

package/dist/services/startup-config-wizard.js

@@ -80,22 +80,28 @@ async function collectStartupConfig(prompt, existingConfig = {}) {
     const existingTarget = existingConfig.autoRegisterTargets?.[0] || {};
     const defaultServerUrl = "http://127.0.0.1:8080";
     const defaultInstanceName = os.hostname() || "AgentsWork Runtime Bridge";
-    const defaultRegisterIp = "127.0.0.1";
+    const defaultRegisterAddr = "127.0.0.1";
+    // 读取已有 registerAddr；若老配置只有 registerIp 则迁移过来
+    const existingRegisterAddr = existingTarget.registerAddr ||
+        existingTarget.registerIp ||
+        defaultRegisterAddr;
     const connectionKey = await askRequired(prompt, "connectionKey（面板连接 Bridge 的密钥）", existingConfig.connectionKey);
     const serverUrl = await askOptional(prompt, "serverUrl（调度中心地址）", existingTarget.serverUrl || defaultServerUrl);
     const instanceName = await askOptional(prompt, "instanceName（实例名称）", existingTarget.instanceName || defaultInstanceName);
     const userKey = await askRequired(prompt, "userKey（用户 API Key）", existingTarget.userKey);
-    const registerIp = await askOptional(prompt, "registerIp（Bridge 对外访问 IP）", existingTarget.registerIp || defaultRegisterIp);
+    const registerAddr = await askOptional(prompt, "registerAddr（Bridge 对外访问地址，支持 host:port / 纯 host / 完整 URL）", existingRegisterAddr);
+    // 显式剥离老 registerIp 字段，避免输出中两字段共存
+    const { registerIp: _legacyRegisterIp, ...targetWithoutRegisterIp } = existingTarget;
     return {
         ...existingConfig,
         connectionKey,
         autoRegisterTargets: [
             {
-                ...existingTarget,
+                ...targetWithoutRegisterIp,
                 serverUrl,
                 instanceName,
                 userKey,
-                registerIp,
+                registerAddr,
             },
         ],
     };

package/dist/services/tunnel-client.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Bridge 反向隧道客户端
+ *
+ * 当 bridge 位于 NAT/内网（无公网），server 有公网时：bridge 注册虚拟隧道地址
+ *（形如 http(s)://server/tunnel/{instanceId}），注册成功后通过本客户端主动连出到
+ * server 的 /ws/bridge-tunnel，server 对 bridge 的 HTTP/WebSocket 调用均经此隧道转发。
+ *
+ * 多 server 支持：autoRegisterTargets 配置多个 server 时，每个 server 注册成功后
+ * 各自建立一条独立隧道，按归一化 serverUrl 为 key 并存于 tunnels Map，互不干扰；
+ * 同一 server 重复注册（重试/token 轮换）时先拆旧隧道再以最新 instanceId 重建。
+ *
+ * 协议帧格式见 BridgeTunnelService（server 端）。
+ */
+/**
+ * 启动（或重启）到指定 server 的隧道。
+ * 同一 serverUrl 已存在隧道时先拆旧重建，不同 serverUrl 的隧道并存。
+ */
+export declare function startTunnelClient(serverUrl: string, instanceId: string): void;
+/** 停止全部隧道（graceful shutdown 用） */
+export declare function stopTunnelClient(): void;
+//# sourceMappingURL=tunnel-client.d.ts.map

package/dist/services/tunnel-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel-client.d.ts","sourceRoot":"","sources":["../../src/services/tunnel-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAgGH;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAuB7E;AAED,kCAAkC;AAClC,wBAAgB,gBAAgB,IAAI,IAAI,CAMvC"}

package/dist/services/tunnel-client.js

@@ -0,0 +1,398 @@
+/**
+ * Bridge 反向隧道客户端
+ *
+ * 当 bridge 位于 NAT/内网（无公网），server 有公网时：bridge 注册虚拟隧道地址
+ *（形如 http(s)://server/tunnel/{instanceId}），注册成功后通过本客户端主动连出到
+ * server 的 /ws/bridge-tunnel，server 对 bridge 的 HTTP/WebSocket 调用均经此隧道转发。
+ *
+ * 多 server 支持：autoRegisterTargets 配置多个 server 时，每个 server 注册成功后
+ * 各自建立一条独立隧道，按归一化 serverUrl 为 key 并存于 tunnels Map，互不干扰；
+ * 同一 server 重复注册（重试/token 轮换）时先拆旧隧道再以最新 instanceId 重建。
+ *
+ * 协议帧格式见 BridgeTunnelService（server 端）。
+ */
+import axios, { AxiosError } from "axios";
+import WebSocket from "ws";
+import { getRuntimeAccessToken, normalizeSchedulerBaseUrl, } from "./runtime-binding.js";
+import { loadConfigs, loadPrimaryLifecycleConfig } from "./auto-register.js";
+import { logger } from "../utils/logger.js";
+import { port } from "../config.js";
+const PING_INTERVAL_MS = 15_000;
+const RECONNECT_DELAY_MS = 5_000;
+/** 本地 WS open 前的消息排队上限，防止异常情况下队列无限增长 */
+const MAX_PENDING_WS_MESSAGES = 200;
+/** server 端鉴权失败的关闭码（见 BridgeTunnelWebSocketHandler.CLOSE_AUTH_FAILED） */
+const CLOSE_CODE_AUTH_FAILED = 4001;
+/** 活跃隧道：key = 归一化 serverUrl，value = 该 server 的独立隧道状态 */
+const tunnels = new Map();
+function resolveTunnelEndpoint(state) {
+    const targetUrl = state.serverUrl;
+    const instanceId = state.instanceId;
+    if (!targetUrl || !instanceId) {
+        return null;
+    }
+    try {
+        const base = new URL(targetUrl);
+        const wsProto = base.protocol === "https:" ? "wss:" : "ws:";
+        const scopedToken = getRuntimeAccessToken(targetUrl);
+        // userKey 回退必须按触发注册的 server 匹配，避免多 target 时错用第一个 target 的凭据
+        const matchedConfig = loadConfigs().find((item) => normalizeSchedulerBaseUrl(item.serverUrl) === targetUrl) || loadPrimaryLifecycleConfig();
+        const runtimeAccessToken = scopedToken || matchedConfig.userKey;
+        if (scopedToken) {
+            logger.debug("[TunnelClient] 使用 runtime access token 连接隧道");
+        }
+        else if (matchedConfig.userKey) {
+            logger.warn("[TunnelClient] getRuntimeAccessToken 返回空，回退到 userKey（非 runtime token，鉴权可能失败）: targetUrl=", targetUrl);
+        }
+        if (!runtimeAccessToken) {
+            logger.warn("[TunnelClient] 缺少 runtime token，无法建立隧道: targetUrl=", targetUrl);
+            return null;
+        }
+        // token 走 X-Runtime-Token 握手头，不进 URL，避免写入 server access log
+        const query = new URLSearchParams({ instanceId });
+        return {
+            url: `${wsProto}//${base.host}/ws/bridge-tunnel?${query.toString()}`,
+            token: runtimeAccessToken,
+        };
+    }
+    catch (e) {
+        logger.warn("[TunnelClient] 无法解析 serverUrl:", String(e));
+        return null;
+    }
+}
+/**
+ * 启动（或重启）到指定 server 的隧道。
+ * 同一 serverUrl 已存在隧道时先拆旧重建，不同 serverUrl 的隧道并存。
+ */
+export function startTunnelClient(serverUrl, instanceId) {
+    const normalized = normalizeSchedulerBaseUrl(serverUrl);
+    if (!normalized) {
+        logger.warn("[TunnelClient] serverUrl 无效，无法启动隧道:", serverUrl);
+        return;
+    }
+    // 同一 server 已有隧道：先拆掉，避免重复注册导致同 server 多连接并存、
+    // 旧连接的 close 回调误清掉新连接的本地流
+    const existing = tunnels.get(normalized);
+    if (existing) {
+        existing.shuttingDown = true;
+        teardownConnection(existing);
+        tunnels.delete(normalized);
+    }
+    const state = {
+        serverUrl: normalized,
+        instanceId,
+        streams: new Map(),
+        shuttingDown: false,
+    };
+    tunnels.set(normalized, state);
+    connect(state);
+}
+/** 停止全部隧道（graceful shutdown 用） */
+export function stopTunnelClient() {
+    for (const state of tunnels.values()) {
+        state.shuttingDown = true;
+        teardownConnection(state);
+    }
+    tunnels.clear();
+}
+/**
+ * 拆除指定隧道连接：清定时器、关闭全部本地流、关闭隧道 WS。
+ * 关闭前移除隧道 WS 的事件监听，防止其 close/error 回调再次触发
+ * cleanup/scheduleReconnect 干扰后续新连接。
+ */
+function teardownConnection(state) {
+    if (state.timer) {
+        clearInterval(state.timer);
+        state.timer = undefined;
+    }
+    if (state.reconnectTimer) {
+        clearTimeout(state.reconnectTimer);
+        state.reconnectTimer = undefined;
+    }
+    for (const [id, stream] of state.streams.entries()) {
+        try {
+            stream.ws.close(1000, "tunnel client stopped");
+        }
+        catch {
+            // ignore
+        }
+        state.streams.delete(id);
+    }
+    if (state.ws) {
+        state.ws.removeAllListeners();
+        try {
+            state.ws.close(1000, "tunnel client stopped");
+        }
+        catch {
+            // ignore
+        }
+        state.ws = undefined;
+    }
+}
+function connect(state) {
+    if (state.shuttingDown)
+        return;
+    const instanceId = state.instanceId;
+    if (!instanceId) {
+        return;
+    }
+    const endpoint = resolveTunnelEndpoint(state);
+    if (!endpoint) {
+        scheduleReconnect(state);
+        return;
+    }
+    logger.info("[TunnelClient] 连接隧道服务端:", endpoint.url);
+    const ws = new WebSocket(endpoint.url, {
+        handshakeTimeout: 15_000,
+        headers: { "X-Runtime-Token": endpoint.token },
+    });
+    state.ws = ws;
+    ws.on("open", () => {
+        logger.info("[TunnelClient] 隧道连接已建立: server=", state.serverUrl, "instanceId=", instanceId);
+        state.reconnectTimer && clearTimeout(state.reconnectTimer);
+        state.reconnectTimer = undefined;
+        state.timer = setInterval(() => {
+            if (ws.readyState === WebSocket.OPEN) {
+                ws.send(JSON.stringify({ t: "ping" }));
+            }
+        }, PING_INTERVAL_MS);
+    });
+    ws.on("unexpected-response", (req, res) => {
+        logger.error("[TunnelClient] 服务端拒绝连接（非 101 响应）: server=", state.serverUrl, "statusCode=", res.statusCode, "statusMessage=", res.statusMessage);
+    });
+    ws.on("upgrade", (res) => {
+        logger.debug("[TunnelClient] 收到升级响应: statusCode=", res.statusCode);
+    });
+    ws.on("message", (raw) => {
+        let text;
+        if (typeof raw === "string") {
+            text = raw;
+        }
+        else if (Buffer.isBuffer(raw)) {
+            text = raw.toString("utf-8");
+        }
+        else {
+            text = Buffer.from(raw).toString("utf-8");
+        }
+        try {
+            const msg = JSON.parse(text);
+            handleMessage(state, msg);
+        }
+        catch (e) {
+            logger.warn("[TunnelClient] 解析隧道消息失败:", String(e));
+        }
+    });
+    ws.on("close", (code, reason) => {
+        logger.warn("[TunnelClient] 隧道连接关闭: server=", state.serverUrl, "code=", code, "reason=", String(reason));
+        cleanup(state);
+        if (code === CLOSE_CODE_AUTH_FAILED) {
+            // 鉴权失败：继续重连只会每 5s 刷一次鉴权失败日志。
+            // 停止自动重连，等下次注册成功（autoRegisterSingle）显式重启隧道。
+            logger.warn("[TunnelClient] 鉴权失败（4001），停止自动重连；待重新注册后再启动隧道: server=", state.serverUrl);
+            return;
+        }
+        scheduleReconnect(state);
+    });
+    ws.on("error", (err) => {
+        logger.warn("[TunnelClient] 隧道连接错误: server=", state.serverUrl, "err=", err.message, "code=", err.code);
+        cleanup(state);
+        scheduleReconnect(state);
+    });
+}
+function cleanup(state) {
+    if (state.timer) {
+        clearInterval(state.timer);
+        state.timer = undefined;
+    }
+    // 关闭本地 WS 流
+    for (const [id, stream] of state.streams.entries()) {
+        try {
+            stream.ws.close(1011, "tunnel disconnected");
+        }
+        catch {
+            // ignore
+        }
+        state.streams.delete(id);
+    }
+    state.ws = undefined;
+}
+function scheduleReconnect(state) {
+    if (state.shuttingDown || state.reconnectTimer)
+        return;
+    state.reconnectTimer = setTimeout(() => {
+        state.reconnectTimer = undefined;
+        connect(state);
+    }, RECONNECT_DELAY_MS);
+}
+function handleMessage(state, msg) {
+    switch (msg.t) {
+        case "req":
+            handleHttpRequest(state, msg);
+            break;
+        case "wsopen":
+            handleWsOpen(state, msg);
+            break;
+        case "wsmsg":
+            handleWsMessage(state, msg);
+            break;
+        case "wsclose":
+            handleWsClose(state, msg);
+            break;
+        case "ping":
+            // server 端心跳探测，回复 pong 保持连接活跃
+            sendJson(state, { t: "pong" });
+            break;
+        case "pong":
+            break;
+        default:
+            logger.debug("[TunnelClient] 未知消息类型: t=", msg.t);
+    }
+}
+async function handleHttpRequest(state, msg) {
+    const id = msg.id;
+    const method = msg.method || "GET";
+    const path = msg.path || "/";
+    const localUrl = `http://127.0.0.1:${port}${path}`;
+    try {
+        const bodyBuffer = msg.body ? Buffer.from(msg.body, "base64") : undefined;
+        const headers = {};
+        if (msg.headers) {
+            for (const [key, values] of Object.entries(msg.headers)) {
+                if (values && values.length > 0) {
+                    headers[key] = values[0];
+                }
+            }
+        }
+        const response = await axios.request({
+            url: localUrl,
+            method,
+            headers,
+            data: bodyBuffer,
+            timeout: 120_000,
+            responseType: "arraybuffer",
+            validateStatus: () => true,
+        });
+        const respHeaders = {};
+        for (const [key, val] of Object.entries(response.headers)) {
+            if (val === undefined)
+                continue;
+            respHeaders[key] = Array.isArray(val) ? val : [String(val)];
+        }
+        const bodyBase64 = Buffer.isBuffer(response.data)
+            ? response.data.toString("base64")
+            : "";
+        sendJson(state, {
+            t: "res",
+            id,
+            status: response.status,
+            headers: respHeaders,
+            body: bodyBase64 || null,
+        });
+    }
+    catch (err) {
+        const errorMsg = err instanceof AxiosError ? err.message : String(err);
+        logger.warn("[TunnelClient] 本地转发失败:", method, path, "->", errorMsg);
+        sendJson(state, {
+            t: "res",
+            id,
+            status: 502,
+            headers: { "content-type": ["text/plain; charset=utf-8"] },
+            body: Buffer.from(errorMsg).toString("base64"),
+        });
+    }
+}
+function handleWsOpen(state, msg) {
+    const id = msg.id;
+    const path = msg.path || "/";
+    const localWsUrl = `ws://127.0.0.1:${port}${path}`;
+    let localWs;
+    try {
+        localWs = new WebSocket(localWsUrl, { handshakeTimeout: 10_000 });
+    }
+    catch (e) {
+        logger.warn("[TunnelClient] 本地 WS 连接失败:", String(e));
+        sendJson(state, { t: "wsclose", id, code: 1011, reason: "local ws connect failed" });
+        return;
+    }
+    const stream = { ws: localWs, pending: [] };
+    state.streams.set(id, stream);
+    localWs.on("open", () => {
+        // 先 flush open 前排队消息（保持到达顺序），再通知 server 流已就绪
+        for (const item of stream.pending) {
+            sendToLocal(stream, item.data, item.bin);
+        }
+        stream.pending = [];
+        sendJson(state, { t: "wsopened", id });
+    });
+    localWs.on("message", (data, isBinary) => {
+        // ws 库通过第二参数 isBinary 区分文本/二进制帧；data 类型始终是 Buffer。
+        const buffer = Buffer.isBuffer(data) ? data : Buffer.from(data);
+        sendJson(state, {
+            t: "wsmsg",
+            id,
+            bin: isBinary,
+            d: buffer.toString("base64"),
+        });
+    });
+    localWs.on("close", (code, reason) => {
+        state.streams.delete(id);
+        sendJson(state, { t: "wsclose", id, code, reason: String(reason) });
+    });
+    localWs.on("error", (err) => {
+        logger.warn("[TunnelClient] 本地 WS 错误: id=", id, "err=", err.message);
+        state.streams.delete(id);
+        try {
+            localWs.close(1011, err.message);
+        }
+        catch {
+            // ignore
+        }
+        sendJson(state, { t: "wsclose", id, code: 1011, reason: err.message });
+    });
+}
+function sendToLocal(stream, data, bin) {
+    if (bin) {
+        stream.ws.send(data);
+    }
+    else {
+        stream.ws.send(data.toString("utf-8"));
+    }
+}
+function handleWsMessage(state, msg) {
+    const stream = state.streams.get(msg.id);
+    if (!stream)
+        return;
+    const data = msg.d ? Buffer.from(msg.d, "base64") : Buffer.alloc(0);
+    if (stream.ws.readyState !== WebSocket.OPEN) {
+        // 本地 WS 尚未 open：排队等待，避免 PTY 打开瞬间的输入被丢弃
+        if (stream.pending.length >= MAX_PENDING_WS_MESSAGES) {
+            stream.pending.shift();
+            logger.warn("[TunnelClient] 本地 WS 未就绪，排队消息超上限，丢弃最旧一条: id=", msg.id);
+        }
+        stream.pending.push({ data, bin: Boolean(msg.bin) });
+        return;
+    }
+    sendToLocal(stream, data, Boolean(msg.bin));
+}
+function handleWsClose(state, msg) {
+    const stream = state.streams.get(msg.id);
+    if (!stream)
+        return;
+    state.streams.delete(msg.id);
+    try {
+        stream.ws.close(msg.code ?? 1000, msg.reason || "");
+    }
+    catch {
+        // ignore
+    }
+}
+function sendJson(state, payload) {
+    if (!state.ws || state.ws.readyState !== WebSocket.OPEN)
+        return;
+    try {
+        state.ws.send(JSON.stringify(payload));
+    }
+    catch (e) {
+        logger.warn("[TunnelClient] sendJson 失败:", String(e));
+    }
+}

package/dist/services/workspaceTaskChangeWatcher.js

@@ -376,7 +376,7 @@ async function flushChange(fullPath) {
 async function sendChangeRecord(ctx, record, cacheKey) {
     try {
         const callbackBaseUrl = resolveSchedulerBaseUrl().url;
-        const runtimeAccessToken = getRuntimeAccessToken(undefined, callbackBaseUrl) || getRuntimeAccessToken();
+        const runtimeAccessToken = getRuntimeAccessToken(callbackBaseUrl) || getRuntimeAccessToken();
         if (!runtimeAccessToken) {
             log.warn('Cannot send change record: no auth token');
             return;

package/dist/utils/file-utils.js

@@ -87,7 +87,7 @@ export async function downloadSkillZip(skillPackage, targetDir) {
         ? String(skillPackage.fileName).trim()
         : 'skill-package.zip';
     const outputPath = path.join(targetDir, fileName);
-    const runtimeAccessToken = getRuntimeAccessToken(undefined, schedulerBaseUrl) || getRuntimeAccessToken();
+    const runtimeAccessToken = getRuntimeAccessToken(schedulerBaseUrl) || getRuntimeAccessToken();
     if (!runtimeAccessToken) {
         throw new Error('runtime access token is required to download skill package');
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aws-runtime-bridge",
-  "version": "1.9.66",
+  "version": "1.9.71",
   "description": "AgentsWorkStudio runtime bridge service for machine-level agent runtime integration",
   "type": "module",
   "main": "dist/index.js",