aws-runtime-bridge 1.9.79 → 1.9.81

package/dist/services/runtime-binding.js

@@ -1,363 +1,6 @@
-import crypto from "node:crypto";
-import fs from "node:fs";
-import path from "node:path";
-import { getRuntimeHomeDir } from "../config.js";
-import { createLogger } from "../utils/logger.js";
-const log = createLogger("runtime-binding");
-const TOKEN_HASH_ALGORITHM = "sha256";
-const pairingCode = generatePairingCode();
-function generatePairingCode() {
-    const value = crypto.randomInt(0, 1_000_000);
-    return String(value)
-        .padStart(6, "0")
-        .replace(/(\d{3})(\d{3})/, "$1-$2");
-}
-function bindingDir() {
-    return path.join(getRuntimeHomeDir(), ".aws-bridge");
-}
-function bindingFile() {
-    return path.join(bindingDir(), "binding.json");
-}
-function tokenStoreFile() {
-    return path.join(bindingDir(), "runtime-tokens.properties");
-}
-function hashToken(token) {
-    return crypto
-        .createHash(TOKEN_HASH_ALGORITHM)
-        .update(token, "utf8")
-        .digest("hex");
-}
-function safeEqual(a, b) {
-    const left = Buffer.from(a, "hex");
-    const right = Buffer.from(b, "hex");
-    if (left.length !== right.length) {
-        return false;
-    }
-    return crypto.timingSafeEqual(left, right);
-}
-function safeTextEqual(a, b) {
-    const left = Buffer.from(a, "utf8");
-    const right = Buffer.from(b, "utf8");
-    if (left.length !== right.length) {
-        return false;
-    }
-    return crypto.timingSafeEqual(left, right);
-}
-function normalizeToken(token) {
-    return String(token || "").trim();
-}
-function repairDuplicatePort(raw) {
-    return raw.replace(/^((?:https?|wss?):\/\/(?:\[[^\]]+\]|[^/:?#]+):\d+):\d+(?=\/|$)/i, "$1");
-}
-function canonicalizeSchedulerHostname(hostname) {
-    const normalized = hostname.toLowerCase();
-    if (normalized === "localhost" || normalized === "::1" || normalized === "[::1]") {
-        return "127.0.0.1";
-    }
-    return normalized;
-}
-export function normalizeSchedulerBaseUrl(value) {
-    const raw = normalizeToken(value);
-    if (!raw) {
-        return undefined;
-    }
-    const repaired = repairDuplicatePort(raw);
-    try {
-        const url = new URL(repaired);
-        if (url.protocol === "ws:") {
-            url.protocol = "http:";
-        }
-        else if (url.protocol === "wss:") {
-            url.protocol = "https:";
-        }
-        else {
-            url.protocol = url.protocol.toLowerCase();
-        }
-        url.hostname = canonicalizeSchedulerHostname(url.hostname);
-        return url.origin;
-    }
-    catch {
-        return repaired.replace(/\/+$/, "");
-    }
-}
-export function getRuntimePairingCode() {
-    return pairingCode;
-}
-export function getRuntimeBindingFilePath() {
-    return bindingFile();
-}
-export function getRuntimeTokenStoreFilePath() {
-    return tokenStoreFile();
-}
-function normalizeServerIp(serverBaseUrl) {
-    const raw = normalizeSchedulerBaseUrl(serverBaseUrl) || String(serverBaseUrl || "").trim();
-    if (!raw) {
-        return "";
-    }
-    try {
-        return new URL(raw).hostname.toLowerCase();
-    }
-    catch {
-        return raw
-            .replace(/^wss?:\/\//i, "")
-            .replace(/^https?:\/\//i, "")
-            .split("/")[0]
-            .split(":")[0]
-            .toLowerCase();
-    }
-}
-function normalizeRuntimeTokenServerUrl(serverBaseUrl) {
-    const normalized = normalizeSchedulerBaseUrl(serverBaseUrl);
-    if (normalized) {
-        return normalized;
-    }
-    const raw = String(serverBaseUrl || "").trim();
-    if (!raw) {
-        return "";
-    }
-    return raw.replace(/\/+$/, "").toLowerCase();
-}
-export function buildRuntimeTokenKey(serverBaseUrl) {
-    const serverUrl = normalizeRuntimeTokenServerUrl(serverBaseUrl);
-    if (!serverUrl) {
-        throw new Error("serverBaseUrl is required to build runtime token key");
-    }
-    return crypto
-        .createHash("md5")
-        .update(serverUrl, "utf8")
-        .digest("hex");
-}
-function loadRuntimeTokenStore() {
-    const result = new Map();
-    try {
-        const content = fs.readFileSync(tokenStoreFile(), "utf8");
-        for (const line of content.split(/\r?\n/)) {
-            const trimmed = line.trim();
-            if (!trimmed || trimmed.startsWith("#")) {
-                continue;
-            }
-            const separatorIndex = trimmed.indexOf("=");
-            if (separatorIndex <= 0) {
-                continue;
-            }
-            const key = trimmed.slice(0, separatorIndex).trim();
-            const token = trimmed.slice(separatorIndex + 1).trim();
-            if (key && token) {
-                result.set(key, token);
-            }
-        }
-    }
-    catch {
-        // Missing token store is valid for an unpaired bridge.
-    }
-    return result;
-}
-function saveRuntimeTokenStore(tokens) {
-    fs.mkdirSync(bindingDir(), { recursive: true });
-    const lines = [...tokens.entries()]
-        .sort(([left], [right]) => left.localeCompare(right))
-        .map(([key, token]) => `${key}=${token}`);
-    fs.writeFileSync(tokenStoreFile(), `${lines.join("\n")}\n`, {
-        encoding: "utf8",
-        mode: 0o600,
-    });
-}
-export function saveScopedRuntimeAccessToken(input) {
-    const accessToken = normalizeToken(input.accessToken);
-    if (accessToken.length < 16) {
-        throw new Error("accessToken must be at least 16 characters");
-    }
-    const key = buildRuntimeTokenKey(input.serverBaseUrl);
-    const tokens = loadRuntimeTokenStore();
-    tokens.set(key, accessToken);
-    saveRuntimeTokenStore(tokens);
-    return key;
-}
-export function getScopedRuntimeAccessToken(serverBaseUrl) {
-    if (!serverBaseUrl) {
-        return undefined;
-    }
-    try {
-        const key = buildRuntimeTokenKey(serverBaseUrl);
-        return loadRuntimeTokenStore().get(key);
-    }
-    catch {
-        return undefined;
-    }
-}
-export function clearScopedRuntimeAccessToken(serverBaseUrl) {
-    if (!serverBaseUrl) {
-        return false;
-    }
-    try {
-        const key = buildRuntimeTokenKey(serverBaseUrl);
-        const tokens = loadRuntimeTokenStore();
-        const removed = tokens.delete(key);
-        if (removed) {
-            saveRuntimeTokenStore(tokens);
-        }
-        return removed;
-    }
-    catch {
-        return false;
-    }
-}
-function validateRuntimeTokenStore(token) {
-    if (!token) {
-        return false;
-    }
-    for (const storedToken of loadRuntimeTokenStore().values()) {
-        if (safeTextEqual(token, storedToken)) {
-            return true;
-        }
-    }
-    return false;
-}
-export function loadRuntimeBinding() {
-    try {
-        const raw = fs.readFileSync(bindingFile(), "utf8");
-        const parsed = JSON.parse(raw);
-        if (parsed?.status === "paired" && parsed.tokenHash) {
-            return {
-                ...parsed,
-                schedulerBaseUrl: normalizeSchedulerBaseUrl(parsed.schedulerBaseUrl) ||
-                    parsed.schedulerBaseUrl,
-            };
-        }
-    }
-    catch {
-        // Missing or invalid binding file means the bridge is unpaired.
-    }
-    return { status: "unpaired" };
-}
-export function getRuntimeBindingPublicState() {
-    const state = loadRuntimeBinding();
-    const { tokenHash: _tokenHash, accessToken: _accessToken, ...publicState } = state;
-    return {
-        ...publicState,
-        paired: state.status === "paired",
-    };
-}
-export function hasRuntimeBinding() {
-    const state = loadRuntimeBinding();
-    return state.status === "paired" && Boolean(state.tokenHash);
-}
-export function validateRuntimeBindingToken(token) {
-    const candidate = normalizeToken(token);
-    if (!candidate) {
-        return false;
-    }
-    const state = loadRuntimeBinding();
-    if (state.status === "paired" && state.tokenHash) {
-        if (safeEqual(hashToken(candidate), state.tokenHash)) {
-            return true;
-        }
-    }
-    return validateRuntimeTokenStore(candidate);
-}
-export function getRuntimeAccessToken(serverBaseUrl) {
-    const scopedToken = getScopedRuntimeAccessToken(serverBaseUrl);
-    if (scopedToken) {
-        return scopedToken;
-    }
-    const state = loadRuntimeBinding();
-    if (state.status !== "paired") {
-        return undefined;
-    }
-    if (serverBaseUrl) {
-        const requestedSchedulerBaseUrl = normalizeSchedulerBaseUrl(serverBaseUrl);
-        const boundSchedulerBaseUrl = normalizeSchedulerBaseUrl(state.schedulerBaseUrl);
-        if (requestedSchedulerBaseUrl &&
-            boundSchedulerBaseUrl &&
-            requestedSchedulerBaseUrl === boundSchedulerBaseUrl) {
-            return normalizeToken(state.accessToken) || undefined;
-        }
-        return undefined;
-    }
-    return normalizeToken(state.accessToken) || undefined;
-}
-export function validateRuntimePairingCode(code) {
-    return String(code || "").trim() === pairingCode;
-}
-export function saveRuntimeBinding(input) {
-    const accessToken = normalizeToken(input.accessToken);
-    if (accessToken.length < 16) {
-        throw new Error("accessToken must be at least 16 characters");
-    }
-    const previous = loadRuntimeBinding();
-    const schedulerBaseUrl = normalizeSchedulerBaseUrl(input.schedulerBaseUrl) ||
-        normalizeSchedulerBaseUrl(previous.schedulerBaseUrl);
-    const now = new Date().toISOString();
-    const next = {
-        status: "paired",
-        instanceId: input.instanceId
-            ? String(input.instanceId)
-            : previous.instanceId,
-        userId: input.userId ? String(input.userId) : previous.userId,
-        schedulerBaseUrl,
-        accessToken,
-        tokenHash: hashToken(accessToken),
-        createdAt: previous.createdAt || now,
-        updatedAt: now,
-    };
-    fs.mkdirSync(bindingDir(), { recursive: true });
-    fs.writeFileSync(bindingFile(), `${JSON.stringify(next, null, 2)}\n`, {
-        encoding: "utf8",
-        mode: 0o600,
-    });
-    if (next.schedulerBaseUrl) {
-        const key = saveScopedRuntimeAccessToken({
-            serverBaseUrl: next.schedulerBaseUrl,
-            accessToken,
-        });
-        log.info(`[runtime-bridge] scoped runtime token saved: key=${key}`);
-    }
-    log.info(`[runtime-bridge] runtime binding saved: ${bindingFile()}`);
-    return next;
-}
-export function clearRuntimeBinding() {
-    const current = loadRuntimeBinding();
-    const revokedState = {
-        ...current,
-        status: "unpaired",
-        accessToken: undefined,
-        tokenHash: undefined,
-        revokedAt: new Date().toISOString(),
-        updatedAt: new Date().toISOString(),
-    };
-    fs.mkdirSync(bindingDir(), { recursive: true });
-    fs.writeFileSync(bindingFile(), `${JSON.stringify(revokedState, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
-    log.info("[runtime-bridge] runtime binding cleared");
-}
-/**
- * 将旧路径 ~/.agentswork/runtime-bridge/ 下的配置文件迁移到新路径 ~/.aws-bridge/。
- * 仅在旧路径存在且新路径不存在时执行，避免覆盖已有配置。
- */
-export function migrateOldBindingDir() {
-    const homedir = getRuntimeHomeDir();
-    const oldDir = path.join(homedir, ".agentswork", "runtime-bridge");
-    const newDir = bindingDir();
-    if (oldDir === newDir)
-        return;
-    if (!fs.existsSync(oldDir))
-        return;
-    const files = ["binding.json", "runtime-tokens.properties"];
-    let migratedCount = 0;
-    for (const file of files) {
-        const oldFile = path.join(oldDir, file);
-        const newFile = path.join(newDir, file);
-        if (fs.existsSync(oldFile) && !fs.existsSync(newFile)) {
-            fs.mkdirSync(newDir, { recursive: true });
-            fs.copyFileSync(oldFile, newFile);
-            try {
-                fs.chmodSync(newFile, 0o600);
-            }
-            catch { /* ignore */ }
-            migratedCount++;
-            log.info(`[runtime-bridge] 已迁移 ${oldFile} → ${newFile}`);
-        }
-    }
-    if (migratedCount > 0) {
-        log.info(`[runtime-bridge] 已迁移 ${migratedCount} 个配置文件从 ${oldDir} 到 ${newDir}`);
-    }
-}
+import m from"node:crypto";import o from"node:fs";import a from"node:path";import{getRuntimeHomeDir as y}from"../config.js";import{createLogger as B}from"../utils/logger.js";const p=B("runtime-binding"),b="sha256",T=v();function v(){const e=m.randomInt(0,1e6);return String(e).padStart(6,"0").replace(/(\d{3})(\d{3})/,"$1-$2")}function d(){return a.join(y(),".aws-bridge")}function g(){return a.join(d(),"binding.json")}function S(){return a.join(d(),"runtime-tokens.properties")}function x(e){return m.createHash(b).update(e,"utf8").digest("hex")}function $(e,t){const n=Buffer.from(e,"hex"),r=Buffer.from(t,"hex");return n.length!==r.length?!1:m.timingSafeEqual(n,r)}function H(e,t){const n=Buffer.from(e,"utf8"),r=Buffer.from(t,"utf8");return n.length!==r.length?!1:m.timingSafeEqual(n,r)}function f(e){return String(e||"").trim()}function I(e){return e.replace(/^((?:https?|wss?):\/\/(?:\[[^\]]+\]|[^/:?#]+):\d+):\d+(?=\/|$)/i,"$1")}function U(e){const t=e.toLowerCase();return t==="localhost"||t==="::1"||t==="[::1]"?"127.0.0.1":t}function u(e){const t=f(e);if(!t)return;const n=I(t);try{const r=new URL(n);return r.protocol==="ws:"?r.protocol="http:":r.protocol==="wss:"?r.protocol="https:":r.protocol=r.protocol.toLowerCase(),r.hostname=U(r.hostname),r.origin}catch{return n.replace(/\/+$/,"")}}function P(){return T}function q(){return g()}function _(){return S()}function N(e){const t=u(e)||String(e||"").trim();if(!t)return"";try{return new URL(t).hostname.toLowerCase()}catch{return t.replace(/^wss?:\/\//i,"").replace(/^https?:\/\//i,"").split("/")[0].split(":")[0].toLowerCase()}}function F(e){const t=u(e);if(t)return t;const n=String(e||"").trim();return n?n.replace(/\/+$/,"").toLowerCase():""}function w(e){const t=F(e);if(!t)throw new Error("serverBaseUrl is required to build runtime token key");return m.createHash("md5").update(t,"utf8").digest("hex")}function k(){const e=new Map;try{const t=o.readFileSync(S(),"utf8");for(const n of t.split(/\r?\n/)){const r=n.trim();if(!r||r.startsWith("#"))continue;const i=r.indexOf("=");if(i<=0)continue;const s=r.slice(0,i).trim(),c=r.slice(i+1).trim();s&&c&&e.set(s,c)}}catch{}return e}function R(e){o.mkdirSync(d(),{recursive:!0});const t=[...e.entries()].sort(([n],[r])=>n.localeCompare(r)).map(([n,r])=>`${n}=${r}`);o.writeFileSync(S(),`${t.join(`
+`)}
+`,{encoding:"utf8",mode:384})}function A(e){const t=f(e.accessToken);if(t.length<16)throw new Error("accessToken must be at least 16 characters");const n=w(e.serverBaseUrl),r=k();return r.set(n,t),R(r),n}function C(e){if(e)try{const t=w(e);return k().get(t)}catch{return}}function J(e){if(!e)return!1;try{const t=w(e),n=k(),r=n.delete(t);return r&&R(n),r}catch{return!1}}function O(e){if(!e)return!1;for(const t of k().values())if(H(e,t))return!0;return!1}function l(){try{const e=o.readFileSync(g(),"utf8"),t=JSON.parse(e);if(t?.status==="paired"&&t.tokenHash)return{...t,schedulerBaseUrl:u(t.schedulerBaseUrl)||t.schedulerBaseUrl}}catch{}return{status:"unpaired"}}function K(){const e=l(),{tokenHash:t,accessToken:n,...r}=e;return{...r,paired:e.status==="paired"}}function M(){const e=l();return e.status==="paired"&&!!e.tokenHash}function G(e){const t=f(e);if(!t)return!1;const n=l();return n.status==="paired"&&n.tokenHash&&$(x(t),n.tokenHash)?!0:O(t)}function W(e){const t=C(e);if(t)return t;const n=l();if(n.status==="paired"){if(e){const r=u(e),i=u(n.schedulerBaseUrl);return r&&i&&r===i&&f(n.accessToken)||void 0}return f(n.accessToken)||void 0}}function Q(e){return String(e||"").trim()===T}function V(e){const t=f(e.accessToken);if(t.length<16)throw new Error("accessToken must be at least 16 characters");const n=l(),r=u(e.schedulerBaseUrl)||u(n.schedulerBaseUrl),i=new Date().toISOString(),s={status:"paired",instanceId:e.instanceId?String(e.instanceId):n.instanceId,userId:e.userId?String(e.userId):n.userId,schedulerBaseUrl:r,accessToken:t,tokenHash:x(t),createdAt:n.createdAt||i,updatedAt:i};if(o.mkdirSync(d(),{recursive:!0}),o.writeFileSync(g(),`${JSON.stringify(s,null,2)}
+`,{encoding:"utf8",mode:384}),s.schedulerBaseUrl){const c=A({serverBaseUrl:s.schedulerBaseUrl,accessToken:t});p.info(`[runtime-bridge] scoped runtime token saved: key=${c}`)}return p.info(`[runtime-bridge] runtime binding saved: ${g()}`),s}function X(){const t={...l(),status:"unpaired",accessToken:void 0,tokenHash:void 0,revokedAt:new Date().toISOString(),updatedAt:new Date().toISOString()};o.mkdirSync(d(),{recursive:!0}),o.writeFileSync(g(),`${JSON.stringify(t,null,2)}
+`,{encoding:"utf8",mode:384}),p.info("[runtime-bridge] runtime binding cleared")}function Y(){const e=y(),t=a.join(e,".agentswork","runtime-bridge"),n=d();if(t===n||!o.existsSync(t))return;const r=["binding.json","runtime-tokens.properties"];let i=0;for(const s of r){const c=a.join(t,s),h=a.join(n,s);if(o.existsSync(c)&&!o.existsSync(h)){o.mkdirSync(n,{recursive:!0}),o.copyFileSync(c,h);try{o.chmodSync(h,384)}catch{}i++,p.info(`[runtime-bridge] \u5DF2\u8FC1\u79FB ${c} \u2192 ${h}`)}}i>0&&p.info(`[runtime-bridge] \u5DF2\u8FC1\u79FB ${i} \u4E2A\u914D\u7F6E\u6587\u4EF6\u4ECE ${t} \u5230 ${n}`)}export{w as buildRuntimeTokenKey,X as clearRuntimeBinding,J as clearScopedRuntimeAccessToken,W as getRuntimeAccessToken,q as getRuntimeBindingFilePath,K as getRuntimeBindingPublicState,P as getRuntimePairingCode,_ as getRuntimeTokenStoreFilePath,C as getScopedRuntimeAccessToken,M as hasRuntimeBinding,l as loadRuntimeBinding,Y as migrateOldBindingDir,u as normalizeSchedulerBaseUrl,V as saveRuntimeBinding,A as saveScopedRuntimeAccessToken,G as validateRuntimeBindingToken,Q as validateRuntimePairingCode};
+

package/dist/services/runtime-lifecycle-policy.d.ts

@@ -24,4 +24,3 @@ export declare function shouldCleanupPersistedSessionsOnStartup(preserveSessions
  * monitoring behavior, so restart recovery cannot be undone by auto-clean mode.
  */
 export declare function shouldAutoCleanOrphanProcesses(env?: NodeJS.ProcessEnv): boolean;
-//# sourceMappingURL=runtime-lifecycle-policy.d.ts.map

package/dist/services/runtime-lifecycle-policy.js

@@ -1,35 +1,2 @@
-/**
- * Build shutdown side-effect policy from the requested restart mode.
- * Main flow: explicit bridge shutdown cleans resources; scheduler restart keeps
- * SDK/PTY processes and persisted metadata so the scheduler can restore state.
- */
-export function buildGracefulShutdownPlan(preserveSessions) {
-    const shouldCleanRuntimeState = !preserveSessions;
-    return {
-        terminateSdkSessions: shouldCleanRuntimeState,
-        closePtySessions: shouldCleanRuntimeState,
-        terminateResidualProcesses: shouldCleanRuntimeState,
-        unregisterInstance: shouldCleanRuntimeState,
-        clearPersistedSessions: shouldCleanRuntimeState,
-        stopTunnelClient: shouldCleanRuntimeState,
-    };
-}
-/**
- * Decide whether startup may destructively clean persisted runtime sessions.
- * Main flow: default bridge restart is non-destructive; operators can opt into
- * legacy cleanup with AWS_BRIDGE_CLEAN_ORPHANS_ON_STARTUP=true.
- */
-export function shouldCleanupPersistedSessionsOnStartup(preserveSessions, env = process.env) {
-    if (preserveSessions) {
-        return false;
-    }
-    return env.AWS_BRIDGE_CLEAN_ORPHANS_ON_STARTUP === "true";
-}
-/**
- * Decide whether background orphan monitoring may terminate persisted sessions.
- * Main flow: process termination is an explicit cleanup action, not a default
- * monitoring behavior, so restart recovery cannot be undone by auto-clean mode.
- */
-export function shouldAutoCleanOrphanProcesses(env = process.env) {
-    return env.AWS_BRIDGE_CLEAN_ORPHANS_ON_STARTUP === "true";
-}
+function n(s){const e=!s;return{terminateSdkSessions:e,closePtySessions:e,terminateResidualProcesses:e,unregisterInstance:e,clearPersistedSessions:e,stopTunnelClient:e}}function t(s,e=process.env){return s?!1:e.AWS_BRIDGE_CLEAN_ORPHANS_ON_STARTUP==="true"}function r(s=process.env){return s.AWS_BRIDGE_CLEAN_ORPHANS_ON_STARTUP==="true"}export{n as buildGracefulShutdownPlan,r as shouldAutoCleanOrphanProcesses,t as shouldCleanupPersistedSessionsOnStartup};
+

package/dist/services/session-output.d.ts

@@ -144,4 +144,3 @@ export declare function scheduleOutputFlush(sessionId: string): void;
  * @param sessionId - 会话 ID
  */
 export declare function flushSessionOutput(sessionId: string): Promise<void>;
-//# sourceMappingURL=session-output.d.ts.map