aws-runtime-bridge 1.9.70 → 1.9.72

package/dist/services/auto-register.js

@@ -7,13 +7,14 @@
  * 1. 环境变量
  * 2. 用户目录下的 .aws-bridge/config.json 文件
  */
+import { v4 as uuidv4 } from "uuid";
 import axios from "axios";
 import os from "node:os";
 import path from "node:path";
 import fs from "node:fs";
 import { logger } from "../utils/logger.js";
 import { schedulerBaseUrl } from "../config.js";
-import { clearRuntimeBinding, clearScopedRuntimeAccessToken, getRuntimeAccessToken, getRuntimeBindingPublicState, loadRuntimeBinding, normalizeSchedulerBaseUrl, saveRuntimeBinding, saveScopedRuntimeAccessToken, } from "./runtime-binding.js";
+import { clearRuntimeBinding, clearScopedRuntimeAccessToken, getRuntimeAccessToken, getRuntimeBindingPublicState, getScopedRuntimeAccessToken, loadRuntimeBinding, normalizeSchedulerBaseUrl, saveRuntimeBinding, saveScopedRuntimeAccessToken, } from "./runtime-binding.js";
 const DEFAULT_CONFIG = {
     enabled: false,
     serverUrl: schedulerBaseUrl,
@@ -29,6 +30,56 @@ let cachedConfiguredConnectionKeys = [];
 export function getConfiguredConnectionKeys() {
     return [...cachedConfiguredConnectionKeys];
 }
+/** 注册失败后的后台重试默认间隔（毫秒），可用 AWS_REGISTER_BACKGROUND_RETRY_INTERVAL 覆盖 */
+const DEFAULT_BACKGROUND_RETRY_INTERVAL_MS = 30_000;
+function getBackgroundRetryIntervalMs() {
+    const raw = Number(process.env.AWS_REGISTER_BACKGROUND_RETRY_INTERVAL);
+    return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_BACKGROUND_RETRY_INTERVAL_MS;
+}
+/** 后台重试定时器：key = 归一化 serverUrl，保证同一 target 只有一个重试循环 */
+const backgroundRetryTimers = new Map();
+/**
+ * 调度后台注册重试。
+ * bridge 先于 server 启动（或 server 临时不可用）时，前台重试耗尽后转入后台
+ * 持续重试，直到与调度中心建立连接为止。
+ */
+function scheduleBackgroundRegisterRetry(config) {
+    const rawServerUrl = config.serverUrl || schedulerBaseUrl;
+    const key = normalizeSchedulerBaseUrl(rawServerUrl) || rawServerUrl;
+    if (backgroundRetryTimers.has(key)) {
+        return;
+    }
+    const timer = setTimeout(() => {
+        backgroundRetryTimers.delete(key);
+        void retryRegisterInBackground(config, key);
+    }, getBackgroundRetryIntervalMs());
+    // unref：后台重试不应阻止进程退出（优雅关闭/测试进程）
+    timer.unref?.();
+    backgroundRetryTimers.set(key, timer);
+}
+/**
+ * 后台重试注册：每次触发时重新从 config.json 读取该 target 的最新配置
+ *（运行期间修改配置可生效）。失败由 autoRegisterSingle 末尾自动调度下一次；
+ * 配置被禁用/删除（enabled=false 或无 userKey）时自然终止重试循环。
+ */
+async function retryRegisterInBackground(config, key) {
+    try {
+        const fresh = loadConfigs().find((item) => (normalizeSchedulerBaseUrl(item.serverUrl || schedulerBaseUrl) ||
+            (item.serverUrl || schedulerBaseUrl)) === key) || config;
+        await autoRegisterSingle(fresh, { backgroundRetry: true });
+    }
+    catch (error) {
+        logger.warn(`[AutoRegister] 后台重试注册异常: ${error.message}`);
+        scheduleBackgroundRegisterRetry(config);
+    }
+}
+/** 停止所有后台注册重试（优雅关闭/测试清理用） */
+export function cancelBackgroundRegisterRetries() {
+    for (const timer of backgroundRetryTimers.values()) {
+        clearTimeout(timer);
+    }
+    backgroundRetryTimers.clear();
+}
 function normalizeOptionalString(value) {
     if (value == null) {
         return undefined;
@@ -73,12 +124,14 @@ function normalizeTargetConfig(source) {
         userKey: normalizeOptionalString(source.userKey),
         connectionKey,
         instanceName: normalizeOptionalString(source.instanceName),
+        instanceId: normalizeOptionalString(source.instanceId),
         projectName: normalizeOptionalString(source.projectName),
         roleName: normalizeOptionalString(source.roleName),
         workspacePath: normalizeOptionalString(source.workspacePath),
         registerAddr: normalizeOptionalString(source.registerAddr),
         registerIp: normalizeOptionalString(source.registerIp),
         virtualIp: normalizeOptionalString(source.virtualIp),
+        tunnel: normalizeOptionalBoolean(source.tunnel),
         preferSameLanIp: normalizeOptionalBoolean(source.preferSameLanIp),
         maxRetries: normalizeOptionalNumber(source.maxRetries),
         retryInterval: normalizeOptionalNumber(source.retryInterval),
@@ -263,12 +316,15 @@ export function loadConfig() {
         userKey: merged.userKey || "",
         connectionKey: merged.connectionKey,
         instanceName,
+        instanceId: merged.instanceId,
         projectName: merged.projectName,
         roleName: merged.roleName,
         workspacePath: merged.workspacePath,
         registerAddr: merged.registerAddr,
         registerIp: merged.registerIp,
         virtualIp: merged.virtualIp,
+        // 保留三态（true/false/undefined）：isTunnelConfig 依赖 undefined 走向后兼容判定
+        tunnel: typeof merged.tunnel === "boolean" ? merged.tunnel : undefined,
         preferSameLanIp: merged.preferSameLanIp !== false,
         maxRetries: merged.maxRetries,
         retryInterval: merged.retryInterval,
@@ -298,12 +354,15 @@ export function loadConfigs() {
             userKey: merged.userKey || "",
             connectionKey: merged.connectionKey,
             instanceName: merged.instanceName || os.hostname(),
+            instanceId: merged.instanceId,
             projectName: merged.projectName,
             roleName: merged.roleName,
             workspacePath: merged.workspacePath,
             registerAddr: merged.registerAddr,
             registerIp: merged.registerIp,
             virtualIp: merged.virtualIp,
+            // 保留三态（true/false/undefined）：isTunnelConfig 依赖 undefined 走向后兼容判定
+            tunnel: typeof merged.tunnel === "boolean" ? merged.tunnel : undefined,
             preferSameLanIp: merged.preferSameLanIp !== false,
             maxRetries: merged.maxRetries,
             retryInterval: merged.retryInterval,
@@ -421,8 +480,45 @@ function getPreferredIpAddress(schedulerUrl) {
 function getLocalIpAddress(targetServerUrl = schedulerBaseUrl) {
     return getPreferredIpAddress(targetServerUrl);
 }
+export function isTunnelConfig(config) {
+    const check = config || loadConfig();
+    if (!check.enabled || !check.userKey) {
+        return false;
+    }
+    // 显式 tunnel=true → 隧道模式
+    if (check.tunnel === true) {
+        return true;
+    }
+    // 显式 tunnel=false → 直连模式（用于 loopback 等不需要隧道的场景）
+    if (check.tunnel === false) {
+        return false;
+    }
+    // 未显式设置 tunnel：保持向后兼容——无 registerAddr/registerIp/virtualIp 即为隧道模式。
+    // 隧道模式下 bridge 位于 NAT/内网，没有可直接访问的地址，由 server 反向代理。
+    return !check.registerAddr && !check.registerIp && !check.virtualIp;
+}
 function resolveRuntimeBridgeBaseUrl(config) {
     const port = process.env.AWS_RUNTIME_BRIDGE_PORT || 18081;
+    // 隧道模式：bridge 位于 NAT/内网，通过 WebSocket 反向连出到 server，
+    // server 经 /tunnel/<instanceId>/ 虚拟路径反向调用 bridge。
+    // 触发条件见 isTunnelConfig()：显式 tunnel=true，或未填地址且未显式 tunnel=false。
+    // 此时 config.instanceId 必须已由 autoRegisterSingle 预声明（见 callers）。
+    if (isTunnelConfig(config)) {
+        const targetServerUrl = config.serverUrl || schedulerBaseUrl;
+        try {
+            const url = new URL(targetServerUrl);
+            // 隧道模式下 instanceId 必须已设，否则视为配置错误，降级到 localIp
+            if (!config.instanceId) {
+                logger.warn("[AutoRegister] 隧道模式但缺少 instanceId，降级为直连模式");
+            }
+            else {
+                return `${url.protocol}//${url.host}/tunnel/${config.instanceId}`;
+            }
+        }
+        catch {
+            logger.warn("[AutoRegister] serverUrl 解析失败，降级为直连模式");
+        }
+    }
     const localIp = config.preferSameLanIp === false
         ? "127.0.0.1"
         : getLocalIpAddress(config.serverUrl || schedulerBaseUrl);
@@ -436,15 +532,47 @@ function resolveRuntimeBridgeBaseUrl(config) {
         return raw;
     }
     // 未带协议：统一补 http://；末尾无 :port 时补默认端口
-    // - IPv4/host:port → 原样使用
-    // - 纯 IPv4/host → 追加默认端口
-    // - IPv6 必须用完整 URL 形式（http://[::1]:port）才能正确解析
     const hasTrailingPort = /:[0-9]+$/.test(raw);
     return hasTrailingPort ? `http://${raw}` : `http://${raw}:${port}`;
 }
-function loadPrimaryLifecycleConfig() {
+export function loadPrimaryLifecycleConfig() {
     return loadConfigs()[0] || loadConfig();
 }
+/**
+ * 通过入站 runtime token 反查其所属调度中心地址。
+ *
+ * 场景：调度中心发起 /runtime/start 时，请求头 X-Runtime-Token 携带的是该 server
+ * 签发给本 bridge 的实例 token（RuntimeBridgeService.resolveRuntimeBridgeAuthToken）。
+ * bridge 本地 scoped token store（runtime-tokens.properties）按 serverUrl 存储这些
+ * 实例 token，因此匹配命中即可确定来源 server，避免多 autoRegisterTargets 时回退到
+ * DEFAULT_SCHEDULER_BASE_URL（localhost:8080）导致回调打错服务器。
+ *
+ * 候选来源：所有 autoRegisterTargets 的 serverUrl + binding.json 的 schedulerBaseUrl。
+ * 仅在 launch body 未显式携带 schedulerBaseUrl 时作为兜底使用。
+ */
+export function resolveSchedulerBaseUrlFromToken(token) {
+    const candidate = String(token || "").trim();
+    if (!candidate) {
+        return undefined;
+    }
+    const urls = [];
+    for (const config of loadConfigs()) {
+        if (config?.serverUrl) {
+            urls.push(config.serverUrl);
+        }
+    }
+    const binding = loadRuntimeBinding();
+    if (binding.schedulerBaseUrl) {
+        urls.push(binding.schedulerBaseUrl);
+    }
+    for (const url of urls) {
+        const scoped = getScopedRuntimeAccessToken(url);
+        if (scoped && scoped === candidate) {
+            return normalizeSchedulerBaseUrl(url);
+        }
+    }
+    return undefined;
+}
 function resolveRegisteredSchedulerBaseUrl(instanceId) {
     if (!instanceId) {
         return undefined;
@@ -479,6 +607,7 @@ async function doRegister(config) {
     const request = {
         tenantId: config.tenantId,
         userKey: config.userKey,
+        instanceId: config.instanceId,
         instanceName,
         hostname: os.hostname(),
         virtualIp: config.registerAddr || config.registerIp || config.virtualIp,
@@ -500,13 +629,61 @@ async function doRegister(config) {
     });
     return response.data;
 }
+/** 串行化 config.json 回写，避免并行注册时并发写入冲突 */
+let configWriteBackChain = Promise.resolve();
+/**
+ * 将 server 返回的 instanceId 回写到 config.json 对应 target。
+ * 回写策略：读 → 找到 serverUrl 匹配的 target → 更新 instanceId → 写回。
+ * 仅在值变化时写入，避免不必要的文件 I/O。多 target 并行注册时通过 Promise 链串行化。
+ */
+function writeBackInstanceInfoToConfig(targetServerUrl, instanceId) {
+    const task = configWriteBackChain.then(() => {
+        const configPath = getAutoRegisterConfigFilePath();
+        if (!fs.existsSync(configPath)) {
+            return;
+        }
+        const raw = fs.readFileSync(configPath, "utf-8");
+        const config = JSON.parse(raw);
+        const normalizedTargetUrl = normalizeSchedulerBaseUrl(targetServerUrl);
+        if (!normalizedTargetUrl) {
+            return;
+        }
+        let changed = false;
+        const updateTarget = (target) => {
+            const url = normalizeSchedulerBaseUrl(String(target.serverUrl || target.schedulerBaseUrl || ""));
+            if (url !== normalizedTargetUrl) {
+                return;
+            }
+            if (instanceId && target.instanceId !== instanceId) {
+                target.instanceId = instanceId;
+                changed = true;
+            }
+        };
+        if (Array.isArray(config.autoRegisterTargets)) {
+            for (const target of config.autoRegisterTargets) {
+                if (target && typeof target === "object" && !Array.isArray(target)) {
+                    updateTarget(target);
+                }
+            }
+        }
+        else {
+            updateTarget(config);
+        }
+        if (changed) {
+            fs.writeFileSync(configPath, JSON.stringify(config, null, 2), "utf-8");
+            logger.info(`[AutoRegister] 已回写 instanceId 到 config.json (serverUrl=${targetServerUrl})`);
+        }
+    });
+    configWriteBackChain = task.catch(() => { });
+    return task;
+}
 /**
  * 执行注销请求
  */
 async function doUnregister(instanceId) {
     const targetServerUrl = resolveLifecycleSchedulerBaseUrl(loadPrimaryLifecycleConfig(), instanceId);
     const binding = loadRuntimeBinding();
-    const runtimeAccessToken = getRuntimeAccessToken(binding.userId, targetServerUrl);
+    const runtimeAccessToken = getRuntimeAccessToken(targetServerUrl);
     if (!runtimeAccessToken) {
         throw new Error("runtimeAccessToken is required to unregister bridge instance");
     }
@@ -540,7 +717,7 @@ export async function autoRegister(customConfig) {
     }
     return autoRegisterSingle(configs[0] || loadConfig());
 }
-async function autoRegisterSingle(config) {
+async function autoRegisterSingle(config, options) {
     // 检查是否启用
     if (!config.enabled) {
         logger.info("[AutoRegister] 自动注册未启用");
@@ -552,8 +729,16 @@ async function autoRegisterSingle(config) {
         logger.error("[AutoRegister] 缺少用户 Key（在配置文件中设置 userKey 或设置环境变量 AWS_USER_KEY）");
         return false;
     }
+    // ★ 隧道模式：在注册前预声明 instanceId，确保 URL 与注册 request 中的 instanceId 一致
+    const isTunnel = isTunnelConfig(config);
+    if (isTunnel && !config.instanceId) {
+        // 用 uuid 前 12 位确保唯一可读
+        config = { ...config, instanceId: `bridge-${uuidv4().replace(/-/g, "").slice(0, 12)}` };
+        logger.info(`[AutoRegister] 隧道模式：已预声明 instanceId=${config.instanceId}`);
+    }
     // tenantId 现在是可选的，如果没有提供，后端会根据 userKey 自动推导
-    const maxRetries = config.maxRetries ?? 3;
+    // 后台重试每轮只尝试 1 次，避免每个间隔内刷出一串重试日志
+    const maxRetries = options?.backgroundRetry ? 1 : (config.maxRetries ?? 3);
     const retryInterval = config.retryInterval ?? 2000;
     // 重试循环
     for (let attempt = 1; attempt <= maxRetries; attempt++) {
@@ -581,6 +766,12 @@ async function autoRegisterSingle(config) {
                             schedulerBaseUrl: response.serverUrl || config.serverUrl || schedulerBaseUrl,
                         });
                         logger.info("[AutoRegister] 已保存调度中心下发的 runtime access token");
+                        // 回写 instanceId 到 config.json，供后续 instanceId 匹配使用
+                        if (response.instanceId) {
+                            writeBackInstanceInfoToConfig(config.serverUrl || schedulerBaseUrl, response.instanceId).catch((error) => {
+                                logger.warn(`[AutoRegister] 回写 instanceId 到 config.json 失败: ${error.message}`);
+                            });
+                        }
                     }
                     catch (error) {
                         const err = error;
@@ -592,6 +783,15 @@ async function autoRegisterSingle(config) {
                 else {
                     logger.warn("[AutoRegister] 注册响应未包含 runtime access token，MCP 将无法访问调度中心，请检查 server 的 bridge 实例 token 颁发逻辑");
                 }
+                // ★ 隧道模式：注册成功且拿到 runtimeAccessToken 后，使用 server 返回的真实 instanceId 启动隧道客户端。
+                //   没有 runtimeAccessToken 时隧道鉴权必然失败，跳过启动以免反复重连刷日志。
+                //   多 target 场景：传入本次注册的 serverUrl，隧道客户端按 server 维度多实例并存。
+                if (isTunnel && response.instanceId && response.runtimeAccessToken) {
+                    const { startTunnelClient } = await import("./tunnel-client.js");
+                    const tunnelServerUrl = config.serverUrl || schedulerBaseUrl;
+                    startTunnelClient(tunnelServerUrl, response.instanceId);
+                    logger.info(`[AutoRegister] 隧道客户端已启动: server=${tunnelServerUrl}, instanceId=${response.instanceId}`);
+                }
                 return true;
             }
             else {
@@ -613,17 +813,26 @@ async function autoRegisterSingle(config) {
             await new Promise((resolve) => setTimeout(resolve, retryInterval));
         }
     }
-    logger.error(`[AutoRegister] ✗ 注册失败，已达最大重试次数`);
-    logger.error(`[AutoRegister] ========================================`);
-    logger.error(`[AutoRegister] 自动注册已启用但注册失败，实例无法正常工作`);
-    logger.error(`[AutoRegister] 请检查以下配置：`);
-    logger.error(`[AutoRegister]   - 用户 Key (userKey): ${config.userKey ? "****" + config.userKey.slice(-4) : "(未设置)"}`);
-    logger.error(`[AutoRegister]   - 租户 ID (tenantId): ${config.tenantId || "(可选，将自动推导)"}`);
-    logger.error(`[AutoRegister]   - 实例名 (instanceName): ${config.instanceName || "(使用主机名)"}`);
-    logger.error(`[AutoRegister]   - 调度中心地址: ${config.serverUrl || schedulerBaseUrl}`);
-    logger.error(`[AutoRegister]   - 最后错误: ${registrationState.error || "未知"}`);
-    logger.error(`[AutoRegister] ========================================`);
-    logger.error(`[AutoRegister] 配置来源：~/.aws-bridge/config.json 或环境变量`);
+    if (options?.backgroundRetry) {
+        // 后台重试轮：单行日志，避免每个间隔刷一大段错误块
+        logger.warn(`[AutoRegister] 后台重试注册仍未成功 (server=${config.serverUrl || schedulerBaseUrl}): ${registrationState.error || "未知"}`);
+    }
+    else {
+        logger.error(`[AutoRegister] ✗ 注册失败，已达最大重试次数`);
+        logger.error(`[AutoRegister] ========================================`);
+        logger.error(`[AutoRegister] 自动注册已启用但注册失败，实例暂时无法正常工作`);
+        logger.error(`[AutoRegister] 请检查以下配置：`);
+        logger.error(`[AutoRegister]   - 用户 Key (userKey): ${config.userKey ? "****" + config.userKey.slice(-4) : "(未设置)"}`);
+        logger.error(`[AutoRegister]   - 租户 ID (tenantId): ${config.tenantId || "(可选，将自动推导)"}`);
+        logger.error(`[AutoRegister]   - 实例名 (instanceName): ${config.instanceName || "(使用主机名)"}`);
+        logger.error(`[AutoRegister]   - 调度中心地址: ${config.serverUrl || schedulerBaseUrl}`);
+        logger.error(`[AutoRegister]   - 最后错误: ${registrationState.error || "未知"}`);
+        logger.error(`[AutoRegister] ========================================`);
+        logger.error(`[AutoRegister] 配置来源：~/.aws-bridge/config.json 或环境变量`);
+        logger.warn(`[AutoRegister] 将在后台持续重试注册（每 ${Math.round(getBackgroundRetryIntervalMs() / 1000)} 秒），直到与调度中心建立连接`);
+    }
+    // 未与 server 建立连接前持续后台重试；成功/配置失效（禁用、缺 userKey）时自动停止
+    scheduleBackgroundRegisterRetry(config);
     return false;
 }
 /**
@@ -716,11 +925,9 @@ export async function requestRuntimeAccessTokenRefreshForServer(serverBaseUrl) {
                     "scheduler did not return runtimeAccessToken",
             };
         }
-        const userId = response.data.userId || config.userKey;
-        const previousToken = getRuntimeAccessToken(userId, targetServerUrl);
+        const previousToken = getRuntimeAccessToken(targetServerUrl);
         const updated = previousToken !== response.data.runtimeAccessToken;
         saveScopedRuntimeAccessToken({
-            userId,
             serverBaseUrl: targetServerUrl,
             accessToken: response.data.runtimeAccessToken,
         });
@@ -749,8 +956,8 @@ export async function unregister() {
             logger.info(`[AutoRegister] ✓ 注销成功: ${registrationState.instanceId}`);
             const targetServerUrl = resolveLifecycleSchedulerBaseUrl(loadPrimaryLifecycleConfig(), registrationState.instanceId);
             const binding = loadRuntimeBinding();
-            if (binding.userId) {
-                clearScopedRuntimeAccessToken(binding.userId, targetServerUrl);
+            if (binding.schedulerBaseUrl) {
+                clearScopedRuntimeAccessToken(targetServerUrl);
             }
             clearRuntimeBinding();
             registrationState.registered = false;

package/dist/services/event-delta-pusher.js

@@ -12,7 +12,7 @@ const pushStates = new Map();
 function runtimeAuthHeaders(authOptions, callbackBaseUrl) {
     const resolvedBaseUrl = callbackBaseUrl ?? resolveSchedulerBaseUrlFrom(authOptions?.schedulerBaseUrl).url;
     const token = authOptions?.runtimeAccessToken ||
-        getRuntimeAccessToken(undefined, resolvedBaseUrl) ||
+        getRuntimeAccessToken(resolvedBaseUrl) ||
         getRuntimeAccessToken();
     return token ? { "X-Runtime-Token": token } : undefined;
 }

package/dist/services/lifecycle-state.js

@@ -66,7 +66,7 @@ async function sendLifecycleNotification(operation) {
     const schedulerBaseUrl = normalizeSchedulerBaseUrl(operation.schedulerBaseUrl) ||
         normalizeSchedulerBaseUrl(loadRuntimeBinding().schedulerBaseUrl) ||
         resolveSchedulerBaseUrlFrom(undefined).url;
-    const token = getRuntimeAccessToken(operation.requestedByUserId, schedulerBaseUrl);
+    const token = getRuntimeAccessToken(schedulerBaseUrl);
     if (!token) {
         throw new Error("runtime access token is missing");
     }

package/dist/services/mcp-launch-binding-queue.js

@@ -126,7 +126,7 @@ export function claimMcpLaunchBinding(request) {
     const runtimeState = loadRuntimeBinding();
     const userId = binding.userId || runtimeState.userId;
     const schedulerBaseUrl = binding.schedulerBaseUrl || runtimeState.schedulerBaseUrl;
-    const runtimeAccessToken = binding.runtimeAccessToken || getRuntimeAccessToken(userId, schedulerBaseUrl);
+    const runtimeAccessToken = binding.runtimeAccessToken || getRuntimeAccessToken(schedulerBaseUrl);
     return {
         ...binding,
         runtimeAccessToken,

package/dist/services/orphan-monitor.d.ts

@@ -54,6 +54,11 @@ export declare class OrphanMonitor {
      * 清理已死亡的会话记录
      */
     private cleanupDeadSessions;
+    /**
+     * 向 server 查询 agent 是否仍然存在。
+     * 返回 true=存在, false=已删除, null=无法确认（网络错误/认证失败等）。
+     */
+    private checkAgentExistsOnServer;
     /**
      * 上报事件到调度中心
      */

package/dist/services/orphan-monitor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orphan-monitor.d.ts","sourceRoot":"","sources":["../../src/services/orphan-monitor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA0BH;;GAEG;AACH,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,gBAAgB,GAChB,sBAAsB,GACtB,kBAAkB,GAClB,qBAAqB,GACrB,cAAc,CAAC;AAEnB;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,cAAc,CAA2C;IACjE,OAAO,CAAC,OAAO,CAAkB;IAEjC;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB5B;;OAEG;IACH,IAAI,IAAI,IAAI;IASZ;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA0E3B;;OAEG;YACW,oBAAoB;IAoClC;;OAEG;YACW,iBAAiB;IAwC/B;;OAEG;YACW,eAAe;IA0B7B;;OAEG;YACW,mBAAmB;IAsBjC;;OAEG;YACW,iBAAiB;IA8C/B;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,IAAI;IAIrD;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,IAAI;IAOtD;;OAEG;IACH,OAAO,CAAC,IAAI;IAUZ;;OAEG;IACH,SAAS,IAAI;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE;CAO3E;AAKD;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAKhD;AAED;;GAEG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAGxD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAGxC"}
+{"version":3,"file":"orphan-monitor.d.ts","sourceRoot":"","sources":["../../src/services/orphan-monitor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA0BH;;GAEG;AACH,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,gBAAgB,GAChB,sBAAsB,GACtB,kBAAkB,GAClB,qBAAqB,GACrB,cAAc,CAAC;AAEnB;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,cAAc,CAA2C;IACjE,OAAO,CAAC,OAAO,CAAkB;IAEjC;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB5B;;OAEG;IACH,IAAI,IAAI,IAAI;IASZ;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA0E3B;;OAEG;YACW,oBAAoB;IA8ClC;;OAEG;YACW,iBAAiB;IAwC/B;;OAEG;YACW,eAAe;IA0B7B;;OAEG;YACW,mBAAmB;IAsBjC;;;OAGG;YACW,wBAAwB;IAmCtC;;OAEG;YACW,iBAAiB;IA8C/B;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,IAAI;IAIrD;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,IAAI;IAOtD;;OAEG;IACH,OAAO,CAAC,IAAI;IAUZ;;OAEG;IACH,SAAS,IAAI;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE;CAO3E;AAKD;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAKhD;AAED;;GAEG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAGxD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAGxC"}

package/dist/services/orphan-monitor.js

@@ -127,7 +127,16 @@ export class OrphanMonitor {
         };
         this.emit(event);
         logger.warn(`检测到孤儿进程: agentId=${agentId}, pid=${pid}`);
-        // 根据模式处理。auto 模式也必须经过显式清理开关，避免重启恢复时误杀保留会话。
+        // ★ 优先向 server 确认 agent 是否已被删除。如果已删除，直接自动终止残留进程，
+        // 绕过 ORPHAN_AUTO_CLEAN_MODE 和双重开关保护——因为 agent 已明确不存在，
+        // 残留进程不可能再被恢复，继续运行只会浪费资源。
+        const agentExists = await this.checkAgentExistsOnServer(agentId);
+        if (agentExists === false) {
+            logger.info(`agent ${agentId} 已从服务端删除，自动终止残留进程 pid=${pid}`);
+            await this.autoCleanOrphan(agentId, pid);
+            return;
+        }
+        // agent 仍存在或无法确认时，按原有模式处理
         switch (ORPHAN_AUTO_CLEAN_MODE) {
             case 'auto':
                 if (shouldAutoCleanOrphanProcesses()) {
@@ -229,6 +238,41 @@ export class OrphanMonitor {
             await savePersistedSessions(aliveSessions);
         }
     }
+    /**
+     * 向 server 查询 agent 是否仍然存在。
+     * 返回 true=存在, false=已删除, null=无法确认（网络错误/认证失败等）。
+     */
+    async checkAgentExistsOnServer(agentId) {
+        if (this.stopped) {
+            return null;
+        }
+        try {
+            const runtimeAccessToken = getRuntimeAccessToken(schedulerBaseUrl) || getRuntimeAccessToken();
+            if (!runtimeAccessToken) {
+                logger.debug('缺少 runtimeAccessToken，无法查询 agent 存在性');
+                return null;
+            }
+            const response = await fetch(`${schedulerBaseUrl}/api/runtime/callback/agent-exists`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'X-Runtime-Token': runtimeAccessToken,
+                },
+                body: JSON.stringify({ agentId }),
+                signal: AbortSignal.timeout(5000),
+            });
+            if (!response.ok) {
+                logger.debug(`查询 agent 存在性失败: ${response.status}`);
+                return null;
+            }
+            const data = await response.json();
+            return data.exists === true;
+        }
+        catch (error) {
+            logger.debug('查询 agent 存在性异常:', error);
+            return null;
+        }
+    }
     /**
      * 上报事件到调度中心
      */
@@ -239,16 +283,16 @@ export class OrphanMonitor {
             return;
         }
         try {
-            const runtimeAccessToken = getRuntimeAccessToken(undefined, schedulerBaseUrl) || getRuntimeAccessToken();
+            const runtimeAccessToken = getRuntimeAccessToken(schedulerBaseUrl) || getRuntimeAccessToken();
             if (!runtimeAccessToken) {
                 logger.debug(`缺少 runtimeAccessToken，跳过上报: ${eventType}`);
                 return;
             }
-            const response = await fetch(`${schedulerBaseUrl}/api/runtime/orphan-event`, {
+            const response = await fetch(`${schedulerBaseUrl}/api/runtime/callback/orphan-event`, {
                 method: 'POST',
                 headers: {
                     'Content-Type': 'application/json',
-                    'Authorization': `Bearer ${runtimeAccessToken}`,
+                    'X-Runtime-Token': runtimeAccessToken,
                 },
                 body: JSON.stringify({
                     agentId,

package/dist/services/runtime-binding.d.ts

@@ -18,21 +18,20 @@ export declare function normalizeSchedulerBaseUrl(value: unknown): string | unde
 export declare function getRuntimePairingCode(): string;
 export declare function getRuntimeBindingFilePath(): string;
 export declare function getRuntimeTokenStoreFilePath(): string;
-export declare function buildRuntimeTokenKey(userId: unknown, serverBaseUrl: unknown): string;
+export declare function buildRuntimeTokenKey(serverBaseUrl: unknown): string;
 export declare function saveScopedRuntimeAccessToken(input: {
-    userId: string;
     serverBaseUrl: string;
     accessToken: string;
 }): string;
-export declare function getScopedRuntimeAccessToken(userId: unknown, serverBaseUrl: unknown): string | undefined;
-export declare function clearScopedRuntimeAccessToken(userId: unknown, serverBaseUrl: unknown): boolean;
+export declare function getScopedRuntimeAccessToken(serverBaseUrl: unknown): string | undefined;
+export declare function clearScopedRuntimeAccessToken(serverBaseUrl: unknown): boolean;
 export declare function loadRuntimeBinding(): RuntimeBindingState;
 export declare function getRuntimeBindingPublicState(): Omit<RuntimeBindingState, "tokenHash" | "accessToken"> & {
     paired: boolean;
 };
 export declare function hasRuntimeBinding(): boolean;
 export declare function validateRuntimeBindingToken(token: unknown): boolean;
-export declare function getRuntimeAccessToken(userId?: unknown, serverBaseUrl?: unknown): string | undefined;
+export declare function getRuntimeAccessToken(serverBaseUrl?: unknown): string | undefined;
 export declare function validateRuntimePairingCode(code: unknown): boolean;
 export declare function saveRuntimeBinding(input: {
     accessToken: string;

package/dist/services/runtime-binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-binding.d.ts","sourceRoot":"","sources":["../../src/services/runtime-binding.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAmEF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAqB5E;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAiCD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,OAAO,GACrB,MAAM,CAYR;AAsCD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,MAAM,CAWT;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,OAAO,GACrB,MAAM,GAAG,SAAS,CAUpB;AAED,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,OAAO,GACrB,OAAO,CAeT;AAcD,wBAAgB,kBAAkB,IAAI,mBAAmB,CAgBxD;AAED,wBAAgB,4BAA4B,IAAI,IAAI,CAClD,mBAAmB,EACnB,WAAW,GAAG,aAAa,CAC5B,GAAG;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAWtB;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAG3C;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAcnE;AAED,wBAAgB,qBAAqB,CACnC,MAAM,CAAC,EAAE,OAAO,EAChB,aAAa,CAAC,EAAE,OAAO,GACtB,MAAM,GAAG,SAAS,CAyBpB;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAEjE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,mBAAmB,CAwCtB;AAED,wBAAgB,mBAAmB,IAAI,IAAI,CAkB1C;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CA0B3C"}
+{"version":3,"file":"runtime-binding.d.ts","sourceRoot":"","sources":["../../src/services/runtime-binding.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAmEF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAqB5E;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAiCD,wBAAgB,oBAAoB,CAClC,aAAa,EAAE,OAAO,GACrB,MAAM,CAWR;AAsCD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,MAAM,CAWT;AAED,wBAAgB,2BAA2B,CACzC,aAAa,EAAE,OAAO,GACrB,MAAM,GAAG,SAAS,CAUpB;AAED,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,OAAO,GACrB,OAAO,CAeT;AAcD,wBAAgB,kBAAkB,IAAI,mBAAmB,CAgBxD;AAED,wBAAgB,4BAA4B,IAAI,IAAI,CAClD,mBAAmB,EACnB,WAAW,GAAG,aAAa,CAC5B,GAAG;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAWtB;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAG3C;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAcnE;AAED,wBAAgB,qBAAqB,CACnC,aAAa,CAAC,EAAE,OAAO,GACtB,MAAM,GAAG,SAAS,CAyBpB;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAEjE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,mBAAmB,CAuCtB;AAED,wBAAgB,mBAAmB,IAAI,IAAI,CAkB1C;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CA0B3C"}

package/dist/services/runtime-binding.js

@@ -117,15 +117,14 @@ function normalizeRuntimeTokenServerUrl(serverBaseUrl) {
     }
     return raw.replace(/\/+$/, "").toLowerCase();
 }
-export function buildRuntimeTokenKey(userId, serverBaseUrl) {
-    const normalizedUserId = String(userId || "").trim();
+export function buildRuntimeTokenKey(serverBaseUrl) {
     const serverUrl = normalizeRuntimeTokenServerUrl(serverBaseUrl);
-    if (!normalizedUserId || !serverUrl) {
-        throw new Error("userId and serverBaseUrl are required to build runtime token key");
+    if (!serverUrl) {
+        throw new Error("serverBaseUrl is required to build runtime token key");
     }
     return crypto
         .createHash("md5")
-        .update(`${normalizedUserId}:${serverUrl}`, "utf8")
+        .update(serverUrl, "utf8")
         .digest("hex");
 }
 function loadRuntimeTokenStore() {
@@ -168,30 +167,30 @@ export function saveScopedRuntimeAccessToken(input) {
     if (accessToken.length < 16) {
         throw new Error("accessToken must be at least 16 characters");
     }
-    const key = buildRuntimeTokenKey(input.userId, input.serverBaseUrl);
+    const key = buildRuntimeTokenKey(input.serverBaseUrl);
     const tokens = loadRuntimeTokenStore();
     tokens.set(key, accessToken);
     saveRuntimeTokenStore(tokens);
     return key;
 }
-export function getScopedRuntimeAccessToken(userId, serverBaseUrl) {
-    if (!userId || !serverBaseUrl) {
+export function getScopedRuntimeAccessToken(serverBaseUrl) {
+    if (!serverBaseUrl) {
         return undefined;
     }
     try {
-        const key = buildRuntimeTokenKey(userId, serverBaseUrl);
+        const key = buildRuntimeTokenKey(serverBaseUrl);
         return loadRuntimeTokenStore().get(key);
     }
     catch {
         return undefined;
     }
 }
-export function clearScopedRuntimeAccessToken(userId, serverBaseUrl) {
-    if (!userId || !serverBaseUrl) {
+export function clearScopedRuntimeAccessToken(serverBaseUrl) {
+    if (!serverBaseUrl) {
         return false;
     }
     try {
-        const key = buildRuntimeTokenKey(userId, serverBaseUrl);
+        const key = buildRuntimeTokenKey(serverBaseUrl);
         const tokens = loadRuntimeTokenStore();
         const removed = tokens.delete(key);
         if (removed) {
@@ -256,8 +255,8 @@ export function validateRuntimeBindingToken(token) {
     }
     return validateRuntimeTokenStore(candidate);
 }
-export function getRuntimeAccessToken(userId, serverBaseUrl) {
-    const scopedToken = getScopedRuntimeAccessToken(userId, serverBaseUrl);
+export function getRuntimeAccessToken(serverBaseUrl) {
+    const scopedToken = getScopedRuntimeAccessToken(serverBaseUrl);
     if (scopedToken) {
         return scopedToken;
     }
@@ -306,9 +305,8 @@ export function saveRuntimeBinding(input) {
         encoding: "utf8",
         mode: 0o600,
     });
-    if (next.userId && next.schedulerBaseUrl) {
+    if (next.schedulerBaseUrl) {
         const key = saveScopedRuntimeAccessToken({
-            userId: next.userId,
             serverBaseUrl: next.schedulerBaseUrl,
             accessToken,
         });

package/dist/services/runtime-lifecycle-policy.d.ts

@@ -4,6 +4,7 @@ export interface GracefulShutdownPlan {
     terminateResidualProcesses: boolean;
     unregisterInstance: boolean;
     clearPersistedSessions: boolean;
+    stopTunnelClient: boolean;
 }
 /**
  * Build shutdown side-effect policy from the requested restart mode.