aws-runtime-bridge 1.9.79 → 1.9.80

package/dist/routes/runtime-binding.js

@@ -1,263 +1,2 @@
-import axios from "axios";
-import { Router } from "express";
-import { getConfiguredConnectionKeys } from "../services/auto-register.js";
-import { validateToken } from "../middleware/auth.js";
-import { claimMcpLaunchBinding, getLatestAgentToken, getMcpLaunchQueueSize } from "../services/mcp-launch-binding-queue.js";
-import { clearRuntimeBinding, getRuntimeAccessToken, getRuntimeBindingPublicState, getRuntimePairingCode, hasRuntimeBinding, saveRuntimeBinding, validateRuntimeBindingToken, validateRuntimePairingCode, } from "../services/runtime-binding.js";
-import { createLogger } from "../utils/logger.js";
-const log = createLogger("runtime-binding-route");
-export const runtimeBindingRouter = Router();
-/**
- * 主流程：MCP Node token 必须通过 /runtime/binding/claim-agent 从启动绑定领取。
- * 不再返回 bridge/user/server scoped runtime token，避免 MCP Node 降级使用旧 bridge 级凭据。
- */
-export function resolveRuntimeTokenRequest(input) {
-    void input;
-    return {
-        success: false,
-        error: "MCP runtime token must be claimed from launch binding; bridge-scoped token refresh is disabled",
-    };
-}
-function extractRuntimeToken(req) {
-    const headerToken = req.header("X-Runtime-Token");
-    if (headerToken) {
-        return headerToken.trim();
-    }
-    const authorization = req.header("Authorization") || "";
-    const bearerMatch = authorization.match(/^Bearer\s+(.+)$/i);
-    return bearerMatch?.[1]?.trim() || "";
-}
-runtimeBindingRouter.get("/binding/status", (_req, res) => {
-    const state = getRuntimeBindingPublicState();
-    res.json({
-        ok: true,
-        ...state,
-        pairingRequired: !state.paired,
-    });
-});
-runtimeBindingRouter.post("/binding/pair", (req, res) => {
-    const { accessToken, instanceId, userId, schedulerBaseUrl, pairingCode } = req.body || {};
-    const existingBinding = hasRuntimeBinding();
-    const currentRuntimeToken = extractRuntimeToken(req);
-    if (existingBinding) {
-        const canRotate = validateRuntimeBindingToken(currentRuntimeToken);
-        if (!canRotate) {
-            res.status(401).json({
-                error: "unauthorized",
-                message: "Bridge is already paired. Provide the current runtime token to rotate binding.",
-            });
-            return;
-        }
-    }
-    else if (!validateRuntimePairingCode(pairingCode)) {
-        res.status(401).json({
-            error: "invalid_pairing_code",
-            message: "Invalid pairing code. Read the current pairing code from the bridge console and try again.",
-        });
-        return;
-    }
-    try {
-        saveRuntimeBinding({
-            accessToken: String(accessToken || ""),
-            instanceId: instanceId ? String(instanceId) : undefined,
-            userId: userId ? String(userId) : undefined,
-            schedulerBaseUrl: schedulerBaseUrl ? String(schedulerBaseUrl) : undefined,
-        });
-        log.info(`[runtime-bridge] paired with instanceId=${instanceId || "unknown"}`);
-        res.json({
-            ok: true,
-            ...getRuntimeBindingPublicState(),
-        });
-    }
-    catch (error) {
-        const err = error;
-        res
-            .status(400)
-            .json({ error: err.message || "pair runtime bridge failed" });
-    }
-});
-function isLoopbackRequest(req) {
-    const ip = req.ip || req.socket.remoteAddress || "";
-    return ip === "127.0.0.1" || ip === "::1" || ip === "::ffff:127.0.0.1";
-}
-runtimeBindingRouter.post("/binding/request-token", async (req, res) => {
-    if (!isLoopbackRequest(req)) {
-        res.status(403).json({ ok: false, error: "loopback request required" });
-        return;
-    }
-    const result = resolveRuntimeTokenRequest(req.body || {});
-    if (!result.success || !result.runtimeAccessToken) {
-        res.status(400).json({
-            ok: false,
-            error: result.error || "request runtime token failed",
-        });
-        return;
-    }
-    res.json({
-        ok: true,
-        runtimeAccessToken: result.runtimeAccessToken,
-        updated: result.updated,
-    });
-});
-runtimeBindingRouter.post("/binding/claim-agent", (req, res) => {
-    if (!isLoopbackRequest(req)) {
-        res.status(403).json({ ok: false, error: "loopback request required" });
-        return;
-    }
-    const { agentId, workspacePath, serverUrl } = req.body || {};
-    if (!workspacePath || !String(workspacePath).trim()) {
-        res.status(400).json({ ok: false, error: "workspacePath is required" });
-        return;
-    }
-    if (!serverUrl || !String(serverUrl).trim()) {
-        res.status(400).json({ ok: false, error: "serverUrl is required" });
-        return;
-    }
-    const claimed = claimMcpLaunchBinding({ agentId, workspacePath, serverUrl });
-    if (!claimed) {
-        res.status(404).json({
-            ok: false,
-            error: "launch binding not found for workspacePath and serverUrl",
-            queueSize: getMcpLaunchQueueSize(workspacePath),
-        });
-        return;
-    }
-    // ★ 通知调度中心：McpNode 已领取启动绑定（fire-and-forget，不阻塞响应）
-    notifySchedulerBindingClaimed(claimed.agentId, claimed.schedulerBaseUrl).catch(() => {
-        // 通知失败不影响 MCP node 的 claim 响应
-    });
-    res.json({
-        ok: true,
-        agentId: claimed.agentId,
-        workspacePath: claimed.workspacePath,
-        runtimeAccessToken: claimed.runtimeAccessToken,
-        userId: claimed.userId,
-        schedulerBaseUrl: claimed.schedulerBaseUrl,
-        serverUrl: claimed.serverUrl,
-        mcpHttpUrl: claimed.mcpHttpUrl,
-        bindingId: claimed.id,
-        remainingQueueSize: getMcpLaunchQueueSize(workspacePath),
-    });
-});
-/**
- * MCP node 在 401 后向 bridge 查询最新 session token 的端点。
- * 仅接受本地回环请求，仅返回缓存中最新的 token。
- */
-runtimeBindingRouter.post("/binding/refresh-token", (req, res) => {
-    if (!isLoopbackRequest(req)) {
-        res.status(403).json({ ok: false, error: "loopback request required" });
-        return;
-    }
-    const { agentId, currentToken, forceRefresh } = req.body || {};
-    const normalizedAgentId = String(agentId || "").trim();
-    if (!normalizedAgentId) {
-        res.status(400).json({ ok: false, error: "agentId is required" });
-        return;
-    }
-    const latest = getLatestAgentToken(normalizedAgentId);
-    if (!latest) {
-        res.status(404).json({ ok: false, error: "no cached token for agent" });
-        return;
-    }
-    // forceRefresh=true 时跳过 token 一致性检查，直接返回缓存的最新 token。
-    // 用于 WebSocket 1008（policy rejection）场景：即使 bridge 缓存的 token 与当前相同，
-    // 也允许返回，由客户端侧的 hammer 保护控制重复请求。
-    // 非 forceRefresh（HTTP 401 反应式刷新）保持原有 409 语义。
-    const normalizedCurrent = String(currentToken || "").trim();
-    if (!forceRefresh && normalizedCurrent && latest.runtimeAccessToken === normalizedCurrent) {
-        res.status(409).json({
-            ok: false,
-            error: "token_unchanged",
-            message: "Bridge cached token is the same as current; token may be revoked server-side",
-        });
-        return;
-    }
-    res.json({
-        ok: true,
-        runtimeAccessToken: latest.runtimeAccessToken,
-    });
-});
-runtimeBindingRouter.post("/binding/issue", validateToken, (req, res) => {
-    const { accessToken, instanceId, userId, schedulerBaseUrl } = req.body || {};
-    const nextToken = String(accessToken || "").trim();
-    if (!nextToken) {
-        res.status(400).json({ error: "accessToken is required" });
-        return;
-    }
-    try {
-        const previousToken = getRuntimeAccessToken();
-        const updated = previousToken !== nextToken;
-        if (updated) {
-            saveRuntimeBinding({
-                accessToken: nextToken,
-                instanceId: instanceId ? String(instanceId) : undefined,
-                userId: userId ? String(userId) : undefined,
-                schedulerBaseUrl: schedulerBaseUrl
-                    ? String(schedulerBaseUrl)
-                    : undefined,
-            });
-            log.info(`[runtime-bridge] runtime token redispatched and updated: instanceId=${instanceId || "unknown"}`);
-        }
-        else {
-            log.info(`[runtime-bridge] runtime token redispatched but unchanged: instanceId=${instanceId || "unknown"}`);
-        }
-        res.json({
-            ok: true,
-            updated,
-            ...getRuntimeBindingPublicState(),
-        });
-    }
-    catch (error) {
-        const err = error;
-        res
-            .status(400)
-            .json({ error: err.message || "issue runtime token failed" });
-    }
-});
-runtimeBindingRouter.post("/binding/unpair", validateToken, (_req, res) => {
-    clearRuntimeBinding();
-    res.json({
-        ok: true,
-        ...getRuntimeBindingPublicState(),
-    });
-});
-export function logRuntimeBindingStartupState() {
-    const state = getRuntimeBindingPublicState();
-    if (state.paired) {
-        log.info(`[runtime-bridge] runtime binding loaded: instanceId=${state.instanceId || "unknown"}`);
-        return;
-    }
-    log.info("[runtime-bridge] bridge is unpaired; sensitive APIs will reject requests until paired");
-    log.info(`[runtime-bridge] pairing code: ${getRuntimePairingCode()}`);
-}
-/**
- * Fire-and-forget: 通知调度中心 McpNode 已领取启动绑定。
- * 主流程：claimMcpLaunchBinding 成功后异步调用此函数，不阻塞 MCP node 的 claim 响应。
- */
-async function notifySchedulerBindingClaimed(agentId, schedulerBaseUrl) {
-    if (!schedulerBaseUrl) {
-        log.debug(`[runtime-binding] notifySchedulerBindingClaimed skipped: no schedulerBaseUrl for agentId=${agentId}`);
-        return;
-    }
-    const connectionKeys = getConfiguredConnectionKeys();
-    const runtimeToken = connectionKeys[0];
-    if (!runtimeToken) {
-        log.warn(`[runtime-binding] notifySchedulerBindingClaimed skipped: no connection key for agentId=${agentId}`);
-        return;
-    }
-    const url = `${schedulerBaseUrl.replace(/\/+$/, "")}/api/runtime/bridge/binding-claimed`;
-    try {
-        await axios.post(url, { agentId }, {
-            headers: {
-                "X-Runtime-Token": runtimeToken,
-                "Content-Type": "application/json",
-            },
-            timeout: 5000,
-        });
-        log.debug(`[runtime-binding] Notified scheduler: agentId=${agentId}, url=${url}`);
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        log.warn(`[runtime-binding] Failed to notify scheduler binding claimed: agentId=${agentId}, error=${message}`);
-    }
-}
+import b from"axios";import{Router as T}from"express";import{getConfiguredConnectionKeys as I}from"../services/auto-register.js";import{validateToken as f}from"../middleware/auth.js";import{claimMcpLaunchBinding as j,getLatestAgentToken as R,getMcpLaunchQueueSize as k}from"../services/mcp-launch-binding-queue.js";import{clearRuntimeBinding as y,getRuntimeAccessToken as B,getRuntimeBindingPublicState as g,getRuntimePairingCode as S,hasRuntimeBinding as v,saveRuntimeBinding as p,validateRuntimeBindingToken as w,validateRuntimePairingCode as A}from"../services/runtime-binding.js";import{createLogger as U}from"../utils/logger.js";const a=U("runtime-binding-route"),d=T();function $(n){return{success:!1,error:"MCP runtime token must be claimed from launch binding; bridge-scoped token refresh is disabled"}}function q(n){const e=n.header("X-Runtime-Token");return e?e.trim():(n.header("Authorization")||"").match(/^Bearer\s+(.+)$/i)?.[1]?.trim()||""}d.get("/binding/status",(n,e)=>{const i=g();e.json({ok:!0,...i,pairingRequired:!i.paired})}),d.post("/binding/pair",(n,e)=>{const{accessToken:i,instanceId:t,userId:o,schedulerBaseUrl:r,pairingCode:s}=n.body||{},u=v(),c=q(n);if(u){if(!w(c)){e.status(401).json({error:"unauthorized",message:"Bridge is already paired. Provide the current runtime token to rotate binding."});return}}else if(!A(s)){e.status(401).json({error:"invalid_pairing_code",message:"Invalid pairing code. Read the current pairing code from the bridge console and try again."});return}try{p({accessToken:String(i||""),instanceId:t?String(t):void 0,userId:o?String(o):void 0,schedulerBaseUrl:r?String(r):void 0}),a.info(`[runtime-bridge] paired with instanceId=${t||"unknown"}`),e.json({ok:!0,...g()})}catch(l){const h=l;e.status(400).json({error:h.message||"pair runtime bridge failed"})}});function m(n){const e=n.ip||n.socket.remoteAddress||"";return e==="127.0.0.1"||e==="::1"||e==="::ffff:127.0.0.1"}d.post("/binding/request-token",async(n,e)=>{if(!m(n)){e.status(403).json({ok:!1,error:"loopback request required"});return}const i=$(n.body||{});if(!i.success||!i.runtimeAccessToken){e.status(400).json({ok:!1,error:i.error||"request runtime token failed"});return}e.json({ok:!0,runtimeAccessToken:i.runtimeAccessToken,updated:i.updated})}),d.post("/binding/claim-agent",(n,e)=>{if(!m(n)){e.status(403).json({ok:!1,error:"loopback request required"});return}const{agentId:i,workspacePath:t,serverUrl:o}=n.body||{};if(!t||!String(t).trim()){e.status(400).json({ok:!1,error:"workspacePath is required"});return}if(!o||!String(o).trim()){e.status(400).json({ok:!1,error:"serverUrl is required"});return}const r=j({agentId:i,workspacePath:t,serverUrl:o});if(!r){e.status(404).json({ok:!1,error:"launch binding not found for workspacePath and serverUrl",queueSize:k(t)});return}C(r.agentId,r.schedulerBaseUrl).catch(()=>{}),e.json({ok:!0,agentId:r.agentId,workspacePath:r.workspacePath,runtimeAccessToken:r.runtimeAccessToken,userId:r.userId,schedulerBaseUrl:r.schedulerBaseUrl,serverUrl:r.serverUrl,mcpHttpUrl:r.mcpHttpUrl,bindingId:r.id,remainingQueueSize:k(t)})}),d.post("/binding/refresh-token",(n,e)=>{if(!m(n)){e.status(403).json({ok:!1,error:"loopback request required"});return}const{agentId:i,currentToken:t,forceRefresh:o}=n.body||{},r=String(i||"").trim();if(!r){e.status(400).json({ok:!1,error:"agentId is required"});return}const s=R(r);if(!s){e.status(404).json({ok:!1,error:"no cached token for agent"});return}const u=String(t||"").trim();if(!o&&u&&s.runtimeAccessToken===u){e.status(409).json({ok:!1,error:"token_unchanged",message:"Bridge cached token is the same as current; token may be revoked server-side"});return}e.json({ok:!0,runtimeAccessToken:s.runtimeAccessToken})}),d.post("/binding/issue",f,(n,e)=>{const{accessToken:i,instanceId:t,userId:o,schedulerBaseUrl:r}=n.body||{},s=String(i||"").trim();if(!s){e.status(400).json({error:"accessToken is required"});return}try{const c=B()!==s;c?(p({accessToken:s,instanceId:t?String(t):void 0,userId:o?String(o):void 0,schedulerBaseUrl:r?String(r):void 0}),a.info(`[runtime-bridge] runtime token redispatched and updated: instanceId=${t||"unknown"}`)):a.info(`[runtime-bridge] runtime token redispatched but unchanged: instanceId=${t||"unknown"}`),e.json({ok:!0,updated:c,...g()})}catch(u){const c=u;e.status(400).json({error:c.message||"issue runtime token failed"})}}),d.post("/binding/unpair",f,(n,e)=>{y(),e.json({ok:!0,...g()})});function H(){const n=g();if(n.paired){a.info(`[runtime-bridge] runtime binding loaded: instanceId=${n.instanceId||"unknown"}`);return}a.info("[runtime-bridge] bridge is unpaired; sensitive APIs will reject requests until paired"),a.info(`[runtime-bridge] pairing code: ${S()}`)}async function C(n,e){if(!e){a.debug(`[runtime-binding] notifySchedulerBindingClaimed skipped: no schedulerBaseUrl for agentId=${n}`);return}const t=I()[0];if(!t){a.warn(`[runtime-binding] notifySchedulerBindingClaimed skipped: no connection key for agentId=${n}`);return}const o=`${e.replace(/\/+$/,"")}/api/runtime/bridge/binding-claimed`;try{await b.post(o,{agentId:n},{headers:{"X-Runtime-Token":t,"Content-Type":"application/json"},timeout:5e3}),a.debug(`[runtime-binding] Notified scheduler: agentId=${n}, url=${o}`)}catch(r){const s=r instanceof Error?r.message:String(r);a.warn(`[runtime-binding] Failed to notify scheduler binding claimed: agentId=${n}, error=${s}`)}}export{H as logRuntimeBindingStartupState,$ as resolveRuntimeTokenRequest,d as runtimeBindingRouter};
+

package/dist/routes/sessions.d.ts

@@ -9,4 +9,3 @@ export declare const sessionsRouter: import("express-serve-static-core").Router;
  * 主流程：优先使用 adapter 细粒度状态，其次使用 terminal 路由内存里的最近 runtimeStatus，最后兼容旧会话回退 running。
  */
 export declare function resolveActiveSdkSessionSnapshotStatus(adapterStatus?: string, currentRuntimeStatus?: string, currentRuntimeActionType?: string): string;
-//# sourceMappingURL=sessions.d.ts.map