aws-runtime-bridge 1.9.70 → 1.9.71

package/dist/services/tunnel-client.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Bridge 反向隧道客户端
+ *
+ * 当 bridge 位于 NAT/内网（无公网），server 有公网时：bridge 注册虚拟隧道地址
+ *（形如 http(s)://server/tunnel/{instanceId}），注册成功后通过本客户端主动连出到
+ * server 的 /ws/bridge-tunnel，server 对 bridge 的 HTTP/WebSocket 调用均经此隧道转发。
+ *
+ * 多 server 支持：autoRegisterTargets 配置多个 server 时，每个 server 注册成功后
+ * 各自建立一条独立隧道，按归一化 serverUrl 为 key 并存于 tunnels Map，互不干扰；
+ * 同一 server 重复注册（重试/token 轮换）时先拆旧隧道再以最新 instanceId 重建。
+ *
+ * 协议帧格式见 BridgeTunnelService（server 端）。
+ */
+/**
+ * 启动（或重启）到指定 server 的隧道。
+ * 同一 serverUrl 已存在隧道时先拆旧重建，不同 serverUrl 的隧道并存。
+ */
+export declare function startTunnelClient(serverUrl: string, instanceId: string): void;
+/** 停止全部隧道（graceful shutdown 用） */
+export declare function stopTunnelClient(): void;
+//# sourceMappingURL=tunnel-client.d.ts.map

package/dist/services/tunnel-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel-client.d.ts","sourceRoot":"","sources":["../../src/services/tunnel-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAgGH;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAuB7E;AAED,kCAAkC;AAClC,wBAAgB,gBAAgB,IAAI,IAAI,CAMvC"}

package/dist/services/tunnel-client.js

@@ -0,0 +1,398 @@
+/**
+ * Bridge 反向隧道客户端
+ *
+ * 当 bridge 位于 NAT/内网（无公网），server 有公网时：bridge 注册虚拟隧道地址
+ *（形如 http(s)://server/tunnel/{instanceId}），注册成功后通过本客户端主动连出到
+ * server 的 /ws/bridge-tunnel，server 对 bridge 的 HTTP/WebSocket 调用均经此隧道转发。
+ *
+ * 多 server 支持：autoRegisterTargets 配置多个 server 时，每个 server 注册成功后
+ * 各自建立一条独立隧道，按归一化 serverUrl 为 key 并存于 tunnels Map，互不干扰；
+ * 同一 server 重复注册（重试/token 轮换）时先拆旧隧道再以最新 instanceId 重建。
+ *
+ * 协议帧格式见 BridgeTunnelService（server 端）。
+ */
+import axios, { AxiosError } from "axios";
+import WebSocket from "ws";
+import { getRuntimeAccessToken, normalizeSchedulerBaseUrl, } from "./runtime-binding.js";
+import { loadConfigs, loadPrimaryLifecycleConfig } from "./auto-register.js";
+import { logger } from "../utils/logger.js";
+import { port } from "../config.js";
+const PING_INTERVAL_MS = 15_000;
+const RECONNECT_DELAY_MS = 5_000;
+/** 本地 WS open 前的消息排队上限，防止异常情况下队列无限增长 */
+const MAX_PENDING_WS_MESSAGES = 200;
+/** server 端鉴权失败的关闭码（见 BridgeTunnelWebSocketHandler.CLOSE_AUTH_FAILED） */
+const CLOSE_CODE_AUTH_FAILED = 4001;
+/** 活跃隧道：key = 归一化 serverUrl，value = 该 server 的独立隧道状态 */
+const tunnels = new Map();
+function resolveTunnelEndpoint(state) {
+    const targetUrl = state.serverUrl;
+    const instanceId = state.instanceId;
+    if (!targetUrl || !instanceId) {
+        return null;
+    }
+    try {
+        const base = new URL(targetUrl);
+        const wsProto = base.protocol === "https:" ? "wss:" : "ws:";
+        const scopedToken = getRuntimeAccessToken(targetUrl);
+        // userKey 回退必须按触发注册的 server 匹配，避免多 target 时错用第一个 target 的凭据
+        const matchedConfig = loadConfigs().find((item) => normalizeSchedulerBaseUrl(item.serverUrl) === targetUrl) || loadPrimaryLifecycleConfig();
+        const runtimeAccessToken = scopedToken || matchedConfig.userKey;
+        if (scopedToken) {
+            logger.debug("[TunnelClient] 使用 runtime access token 连接隧道");
+        }
+        else if (matchedConfig.userKey) {
+            logger.warn("[TunnelClient] getRuntimeAccessToken 返回空，回退到 userKey（非 runtime token，鉴权可能失败）: targetUrl=", targetUrl);
+        }
+        if (!runtimeAccessToken) {
+            logger.warn("[TunnelClient] 缺少 runtime token，无法建立隧道: targetUrl=", targetUrl);
+            return null;
+        }
+        // token 走 X-Runtime-Token 握手头，不进 URL，避免写入 server access log
+        const query = new URLSearchParams({ instanceId });
+        return {
+            url: `${wsProto}//${base.host}/ws/bridge-tunnel?${query.toString()}`,
+            token: runtimeAccessToken,
+        };
+    }
+    catch (e) {
+        logger.warn("[TunnelClient] 无法解析 serverUrl:", String(e));
+        return null;
+    }
+}
+/**
+ * 启动（或重启）到指定 server 的隧道。
+ * 同一 serverUrl 已存在隧道时先拆旧重建，不同 serverUrl 的隧道并存。
+ */
+export function startTunnelClient(serverUrl, instanceId) {
+    const normalized = normalizeSchedulerBaseUrl(serverUrl);
+    if (!normalized) {
+        logger.warn("[TunnelClient] serverUrl 无效，无法启动隧道:", serverUrl);
+        return;
+    }
+    // 同一 server 已有隧道：先拆掉，避免重复注册导致同 server 多连接并存、
+    // 旧连接的 close 回调误清掉新连接的本地流
+    const existing = tunnels.get(normalized);
+    if (existing) {
+        existing.shuttingDown = true;
+        teardownConnection(existing);
+        tunnels.delete(normalized);
+    }
+    const state = {
+        serverUrl: normalized,
+        instanceId,
+        streams: new Map(),
+        shuttingDown: false,
+    };
+    tunnels.set(normalized, state);
+    connect(state);
+}
+/** 停止全部隧道（graceful shutdown 用） */
+export function stopTunnelClient() {
+    for (const state of tunnels.values()) {
+        state.shuttingDown = true;
+        teardownConnection(state);
+    }
+    tunnels.clear();
+}
+/**
+ * 拆除指定隧道连接：清定时器、关闭全部本地流、关闭隧道 WS。
+ * 关闭前移除隧道 WS 的事件监听，防止其 close/error 回调再次触发
+ * cleanup/scheduleReconnect 干扰后续新连接。
+ */
+function teardownConnection(state) {
+    if (state.timer) {
+        clearInterval(state.timer);
+        state.timer = undefined;
+    }
+    if (state.reconnectTimer) {
+        clearTimeout(state.reconnectTimer);
+        state.reconnectTimer = undefined;
+    }
+    for (const [id, stream] of state.streams.entries()) {
+        try {
+            stream.ws.close(1000, "tunnel client stopped");
+        }
+        catch {
+            // ignore
+        }
+        state.streams.delete(id);
+    }
+    if (state.ws) {
+        state.ws.removeAllListeners();
+        try {
+            state.ws.close(1000, "tunnel client stopped");
+        }
+        catch {
+            // ignore
+        }
+        state.ws = undefined;
+    }
+}
+function connect(state) {
+    if (state.shuttingDown)
+        return;
+    const instanceId = state.instanceId;
+    if (!instanceId) {
+        return;
+    }
+    const endpoint = resolveTunnelEndpoint(state);
+    if (!endpoint) {
+        scheduleReconnect(state);
+        return;
+    }
+    logger.info("[TunnelClient] 连接隧道服务端:", endpoint.url);
+    const ws = new WebSocket(endpoint.url, {
+        handshakeTimeout: 15_000,
+        headers: { "X-Runtime-Token": endpoint.token },
+    });
+    state.ws = ws;
+    ws.on("open", () => {
+        logger.info("[TunnelClient] 隧道连接已建立: server=", state.serverUrl, "instanceId=", instanceId);
+        state.reconnectTimer && clearTimeout(state.reconnectTimer);
+        state.reconnectTimer = undefined;
+        state.timer = setInterval(() => {
+            if (ws.readyState === WebSocket.OPEN) {
+                ws.send(JSON.stringify({ t: "ping" }));
+            }
+        }, PING_INTERVAL_MS);
+    });
+    ws.on("unexpected-response", (req, res) => {
+        logger.error("[TunnelClient] 服务端拒绝连接（非 101 响应）: server=", state.serverUrl, "statusCode=", res.statusCode, "statusMessage=", res.statusMessage);
+    });
+    ws.on("upgrade", (res) => {
+        logger.debug("[TunnelClient] 收到升级响应: statusCode=", res.statusCode);
+    });
+    ws.on("message", (raw) => {
+        let text;
+        if (typeof raw === "string") {
+            text = raw;
+        }
+        else if (Buffer.isBuffer(raw)) {
+            text = raw.toString("utf-8");
+        }
+        else {
+            text = Buffer.from(raw).toString("utf-8");
+        }
+        try {
+            const msg = JSON.parse(text);
+            handleMessage(state, msg);
+        }
+        catch (e) {
+            logger.warn("[TunnelClient] 解析隧道消息失败:", String(e));
+        }
+    });
+    ws.on("close", (code, reason) => {
+        logger.warn("[TunnelClient] 隧道连接关闭: server=", state.serverUrl, "code=", code, "reason=", String(reason));
+        cleanup(state);
+        if (code === CLOSE_CODE_AUTH_FAILED) {
+            // 鉴权失败：继续重连只会每 5s 刷一次鉴权失败日志。
+            // 停止自动重连，等下次注册成功（autoRegisterSingle）显式重启隧道。
+            logger.warn("[TunnelClient] 鉴权失败（4001），停止自动重连；待重新注册后再启动隧道: server=", state.serverUrl);
+            return;
+        }
+        scheduleReconnect(state);
+    });
+    ws.on("error", (err) => {
+        logger.warn("[TunnelClient] 隧道连接错误: server=", state.serverUrl, "err=", err.message, "code=", err.code);
+        cleanup(state);
+        scheduleReconnect(state);
+    });
+}
+function cleanup(state) {
+    if (state.timer) {
+        clearInterval(state.timer);
+        state.timer = undefined;
+    }
+    // 关闭本地 WS 流
+    for (const [id, stream] of state.streams.entries()) {
+        try {
+            stream.ws.close(1011, "tunnel disconnected");
+        }
+        catch {
+            // ignore
+        }
+        state.streams.delete(id);
+    }
+    state.ws = undefined;
+}
+function scheduleReconnect(state) {
+    if (state.shuttingDown || state.reconnectTimer)
+        return;
+    state.reconnectTimer = setTimeout(() => {
+        state.reconnectTimer = undefined;
+        connect(state);
+    }, RECONNECT_DELAY_MS);
+}
+function handleMessage(state, msg) {
+    switch (msg.t) {
+        case "req":
+            handleHttpRequest(state, msg);
+            break;
+        case "wsopen":
+            handleWsOpen(state, msg);
+            break;
+        case "wsmsg":
+            handleWsMessage(state, msg);
+            break;
+        case "wsclose":
+            handleWsClose(state, msg);
+            break;
+        case "ping":
+            // server 端心跳探测，回复 pong 保持连接活跃
+            sendJson(state, { t: "pong" });
+            break;
+        case "pong":
+            break;
+        default:
+            logger.debug("[TunnelClient] 未知消息类型: t=", msg.t);
+    }
+}
+async function handleHttpRequest(state, msg) {
+    const id = msg.id;
+    const method = msg.method || "GET";
+    const path = msg.path || "/";
+    const localUrl = `http://127.0.0.1:${port}${path}`;
+    try {
+        const bodyBuffer = msg.body ? Buffer.from(msg.body, "base64") : undefined;
+        const headers = {};
+        if (msg.headers) {
+            for (const [key, values] of Object.entries(msg.headers)) {
+                if (values && values.length > 0) {
+                    headers[key] = values[0];
+                }
+            }
+        }
+        const response = await axios.request({
+            url: localUrl,
+            method,
+            headers,
+            data: bodyBuffer,
+            timeout: 120_000,
+            responseType: "arraybuffer",
+            validateStatus: () => true,
+        });
+        const respHeaders = {};
+        for (const [key, val] of Object.entries(response.headers)) {
+            if (val === undefined)
+                continue;
+            respHeaders[key] = Array.isArray(val) ? val : [String(val)];
+        }
+        const bodyBase64 = Buffer.isBuffer(response.data)
+            ? response.data.toString("base64")
+            : "";
+        sendJson(state, {
+            t: "res",
+            id,
+            status: response.status,
+            headers: respHeaders,
+            body: bodyBase64 || null,
+        });
+    }
+    catch (err) {
+        const errorMsg = err instanceof AxiosError ? err.message : String(err);
+        logger.warn("[TunnelClient] 本地转发失败:", method, path, "->", errorMsg);
+        sendJson(state, {
+            t: "res",
+            id,
+            status: 502,
+            headers: { "content-type": ["text/plain; charset=utf-8"] },
+            body: Buffer.from(errorMsg).toString("base64"),
+        });
+    }
+}
+function handleWsOpen(state, msg) {
+    const id = msg.id;
+    const path = msg.path || "/";
+    const localWsUrl = `ws://127.0.0.1:${port}${path}`;
+    let localWs;
+    try {
+        localWs = new WebSocket(localWsUrl, { handshakeTimeout: 10_000 });
+    }
+    catch (e) {
+        logger.warn("[TunnelClient] 本地 WS 连接失败:", String(e));
+        sendJson(state, { t: "wsclose", id, code: 1011, reason: "local ws connect failed" });
+        return;
+    }
+    const stream = { ws: localWs, pending: [] };
+    state.streams.set(id, stream);
+    localWs.on("open", () => {
+        // 先 flush open 前排队消息（保持到达顺序），再通知 server 流已就绪
+        for (const item of stream.pending) {
+            sendToLocal(stream, item.data, item.bin);
+        }
+        stream.pending = [];
+        sendJson(state, { t: "wsopened", id });
+    });
+    localWs.on("message", (data, isBinary) => {
+        // ws 库通过第二参数 isBinary 区分文本/二进制帧；data 类型始终是 Buffer。
+        const buffer = Buffer.isBuffer(data) ? data : Buffer.from(data);
+        sendJson(state, {
+            t: "wsmsg",
+            id,
+            bin: isBinary,
+            d: buffer.toString("base64"),
+        });
+    });
+    localWs.on("close", (code, reason) => {
+        state.streams.delete(id);
+        sendJson(state, { t: "wsclose", id, code, reason: String(reason) });
+    });
+    localWs.on("error", (err) => {
+        logger.warn("[TunnelClient] 本地 WS 错误: id=", id, "err=", err.message);
+        state.streams.delete(id);
+        try {
+            localWs.close(1011, err.message);
+        }
+        catch {
+            // ignore
+        }
+        sendJson(state, { t: "wsclose", id, code: 1011, reason: err.message });
+    });
+}
+function sendToLocal(stream, data, bin) {
+    if (bin) {
+        stream.ws.send(data);
+    }
+    else {
+        stream.ws.send(data.toString("utf-8"));
+    }
+}
+function handleWsMessage(state, msg) {
+    const stream = state.streams.get(msg.id);
+    if (!stream)
+        return;
+    const data = msg.d ? Buffer.from(msg.d, "base64") : Buffer.alloc(0);
+    if (stream.ws.readyState !== WebSocket.OPEN) {
+        // 本地 WS 尚未 open：排队等待，避免 PTY 打开瞬间的输入被丢弃
+        if (stream.pending.length >= MAX_PENDING_WS_MESSAGES) {
+            stream.pending.shift();
+            logger.warn("[TunnelClient] 本地 WS 未就绪，排队消息超上限，丢弃最旧一条: id=", msg.id);
+        }
+        stream.pending.push({ data, bin: Boolean(msg.bin) });
+        return;
+    }
+    sendToLocal(stream, data, Boolean(msg.bin));
+}
+function handleWsClose(state, msg) {
+    const stream = state.streams.get(msg.id);
+    if (!stream)
+        return;
+    state.streams.delete(msg.id);
+    try {
+        stream.ws.close(msg.code ?? 1000, msg.reason || "");
+    }
+    catch {
+        // ignore
+    }
+}
+function sendJson(state, payload) {
+    if (!state.ws || state.ws.readyState !== WebSocket.OPEN)
+        return;
+    try {
+        state.ws.send(JSON.stringify(payload));
+    }
+    catch (e) {
+        logger.warn("[TunnelClient] sendJson 失败:", String(e));
+    }
+}

package/dist/services/workspaceTaskChangeWatcher.js

@@ -376,7 +376,7 @@ async function flushChange(fullPath) {
 async function sendChangeRecord(ctx, record, cacheKey) {
     try {
         const callbackBaseUrl = resolveSchedulerBaseUrl().url;
-        const runtimeAccessToken = getRuntimeAccessToken(undefined, callbackBaseUrl) || getRuntimeAccessToken();
+        const runtimeAccessToken = getRuntimeAccessToken(callbackBaseUrl) || getRuntimeAccessToken();
         if (!runtimeAccessToken) {
             log.warn('Cannot send change record: no auth token');
             return;

package/dist/utils/file-utils.js

@@ -87,7 +87,7 @@ export async function downloadSkillZip(skillPackage, targetDir) {
         ? String(skillPackage.fileName).trim()
         : 'skill-package.zip';
     const outputPath = path.join(targetDir, fileName);
-    const runtimeAccessToken = getRuntimeAccessToken(undefined, schedulerBaseUrl) || getRuntimeAccessToken();
+    const runtimeAccessToken = getRuntimeAccessToken(schedulerBaseUrl) || getRuntimeAccessToken();
     if (!runtimeAccessToken) {
         throw new Error('runtime access token is required to download skill package');
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aws-runtime-bridge",
-  "version": "1.9.70",
+  "version": "1.9.71",
   "description": "AgentsWorkStudio runtime bridge service for machine-level agent runtime integration",
   "type": "module",
   "main": "dist/index.js",