rainskills 0.1.19 → 0.1.21

package/rainbond-platform-installer/scripts/platform-installer.js

@@ -11,7 +11,6 @@ const readline = require("node:readline/promises");
 const { spawn, spawnSync } = require("node:child_process");
 const { createSecureStateStore } = require("./secure-state.js");
 const { writeUserMessage } = require("./user-message.js");
-const { assertIntentCanInstallNewPlatform, validateIntent } = require("./runtime-intents.js");
 const {
   selectPlatformRoute,
   validatePersistedRouteTuple,
@@ -256,6 +255,9 @@ function readOnboardingState(filePath, expectedOperationId, stateStore = secureS
   if (state.deployment_mode !== "self-hosted") {
     throw new Error("状态文件不是私有化部署流程");
   }
+  if (Object.hasOwn(state, "intent")) {
+    throw new Error("平台 onboarding 状态不能包含业务 intent");
+  }
   if (state.control_mode !== undefined) {
     if (!["windows-native", "wsl", "posix"].includes(state.control_mode)) {
       throw new Error("状态文件中的 control_mode 无效");
@@ -269,9 +271,6 @@ function readOnboardingState(filePath, expectedOperationId, stateStore = secureS
       throw new Error("非 WSL 状态不能包含 control_distro");
     }
   }
-  if (state.intent !== undefined && state.intent !== null) {
-    state.intent = validateIntent(state.intent);
-  }
   return state;
 }
 
@@ -2305,7 +2304,6 @@ async function installWindowsRainbond({ adapter, onboarding, options, paths, sta
 
 function resumeInvocationForOnboarding(onboarding, execPath = process.execPath) {
   assertOperationId(onboarding.operation_id);
-  const intent = validateIntent(onboarding.intent);
   const args = [
     path.resolve(__dirname, "..", "..", "bin", "rainskills.js"),
     "runtime",
@@ -2315,32 +2313,12 @@ function resumeInvocationForOnboarding(onboarding, execPath = process.execPath)
     onboarding.console_url,
   ];
   if (onboarding.console_url.startsWith("http://")) args.push("--allow-insecure-http");
-  args.push(
-    "--onboarding-id",
-    onboarding.operation_id,
-    "--intent-json",
-    JSON.stringify(intent)
-  );
   return {
     executable: execPath,
     args,
   };
 }
 
-function intentResumeInvocationForOnboarding(onboarding, execPath = process.execPath) {
-  assertOperationId(onboarding.operation_id);
-  return {
-    executable: execPath,
-    args: [
-      path.resolve(__dirname, "..", "..", "bin", "rainskills.js"),
-      "intent",
-      "resume",
-      "--onboarding-id",
-      onboarding.operation_id,
-    ],
-  };
-}
-
 function startWindowsRuntimeLease({
   controlMode = "windows-native",
   systemRoot = process.env.SystemRoot || "C:\\Windows",
@@ -2433,10 +2411,7 @@ async function runResume(onboardingId, {
   consoleReadiness = waitForWindowsConsole,
   onboardingUpdater = updateOnboarding,
   invocationBuilder = resumeInvocationForOnboarding,
-  intentInvocationBuilder = intentResumeInvocationForOnboarding,
-  credentialReader = null,
   environment = process.env,
-  credentialHome = environment.USERPROFILE || environment.HOME || os.homedir(),
   attachedRunner = spawnAttached,
   write = (value) => process.stdout.write(value),
   abortState = null,
@@ -2536,63 +2511,6 @@ async function runResume(onboardingId, {
       write(`\nRainbond 已部署，授权尚未完成。稍后继续：\n  npx rainskills@${packageManifest.version} resume --onboarding-id ${onboardingId}\n`);
       throw new Error(`RainSkills 授权流程退出码为 ${result.code}`);
     }
-    let latestCredential;
-    try {
-      assertHostOperationActive(abortState);
-      if (credentialReader) {
-        latestCredential = await credentialReader({
-          expectedOrigin: onboarding.console_url,
-          home: credentialHome,
-          platform: onboarding.control_mode === "windows-native" ? "win32" : process.platform,
-        });
-      } else {
-        const credentialPlatform = onboarding.control_mode === "windows-native" ? "win32" : process.platform;
-        const { createEnvironmentRegistry } = require("./environment-registry.js");
-        const { createEnvironmentCredentialStore } = require("./environment-credentials.js");
-        const { createRuntimeOperationStore } = require("./runtime-operations.js");
-        const registry = createEnvironmentRegistry({
-          platform: credentialPlatform,
-          home: credentialHome,
-        });
-        const operations = createRuntimeOperationStore({
-          platform: credentialPlatform,
-          home: credentialHome,
-          registry,
-        });
-        const operation = operations.read(onboardingId);
-        if (!operation?.environment_id) throw new Error("运行环境操作尚未绑定环境");
-        latestCredential = createEnvironmentCredentialStore({
-          platform: credentialPlatform,
-          home: credentialHome,
-        }).read({
-          environmentId: operation.environment_id,
-          expectedOrigin: onboarding.console_url,
-        });
-      }
-      assertHostOperationActive(abortState);
-    } catch {
-      write(`\n运行环境已连接，但无法安全读取最新凭据。稍后继续：\n  npx rainskills@${packageManifest.version} resume --onboarding-id ${onboardingId}\n`);
-      throw new Error("无法安全读取与当前 Rainbond origin 匹配的最新运行凭据");
-    }
-    const intentEnvironment = {
-      ...resumeEnvironment,
-      RAINBOND_JWT: latestCredential.token,
-      RAINBOND_URL: latestCredential.origin,
-    };
-    const intentInvocation = intentInvocationBuilder(onboarding);
-    assertHostOperationActive(abortState);
-    const intentResult = await attachedRunner(
-      intentInvocation.executable,
-      intentInvocation.args,
-      { env: intentEnvironment },
-      null
-    );
-    assertHostOperationActive(abortState);
-    if (intentResult.signal || intentResult.code !== 0) {
-      write(`\n运行环境已连接，原始操作尚未恢复。稍后继续：\n  npx rainskills@${packageManifest.version} resume --onboarding-id ${onboardingId}\n`);
-      if (intentResult.signal) throw new Error(`原始 intent 恢复流程被信号 ${intentResult.signal} 中断`);
-      throw new Error(`原始 intent 恢复流程退出码为 ${intentResult.code}`);
-    }
     if (windowsContext) {
       const adapter = windowsAdapterFactory(onboarding);
       write("\n最后会弹出一次 Windows 管理员确认，用于清理自动恢复任务。\n");
@@ -2795,9 +2713,6 @@ async function runInstallOperation(options, {
   if (!["awaiting-platform", "platform-ready", "authorizing"].includes(onboarding.stage)) {
     throw new Error(`当前 onboarding 阶段不能安装平台：${onboarding.stage}`);
   }
-  if (onboarding.stage === "awaiting-platform" && onboarding.intent) {
-    onboarding = { ...onboarding, intent: assertIntentCanInstallNewPlatform(onboarding.intent) };
-  }
   if (onboarding.stage === "platform-ready" || onboarding.stage === "authorizing") {
     if (!options.noResume) await runResume(options.onboardingId);
     return;
@@ -3377,7 +3292,6 @@ module.exports = {
   evaluatePreflight,
   extractConsoleUrl,
   inspectRemoteSystem,
-  intentResumeInvocationForOnboarding,
   normalizeConsoleHost,
   normalizeRainbondImage,
   normalizeRemoteTarget,

package/rainbond-platform-installer/scripts/runtime-state.js

@@ -1,14 +1,12 @@
 "use strict";
 
-const crypto = require("node:crypto");
 const fs = require("node:fs");
 const os = require("node:os");
 const path = require("node:path");
 const { isDeepStrictEqual } = require("node:util");
 
 const { createSecureStateStore } = require("./secure-state.js");
-const { persistWindowsEnvironment, validateMcp } = require("./windows-client-config.js");
-const { INTENT_DEFINITIONS, validateIntent } = require("./runtime-intents.js");
+const { validateMcp } = require("./windows-client-config.js");
 
 const RUNTIME_SCHEMA = "rainskills.runtime-connection.v1";
 const STATUS_SCHEMA = "rainskills.runtime-status.v1";
@@ -16,13 +14,10 @@ const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3
 const STATES = new Set(["not_started", "connecting", "connected"]);
 const TARGET_CLIENTS = new Set(["codex", "claude", "pi", "all"]);
 const ENVIRONMENT_KINDS = new Set(["saas", "private"]);
-const FAILURE_CATEGORIES = new Set(["credential-expired", "permission-denied"]);
-const MAX_RETRY_COUNT = 1000;
 const RUNTIME_STATE_LOCK_ID = "cf1c1a85-63e7-45f8-9dd5-20ea1d511c48";
 const STATE_FIELDS = new Set([
   "schema", "version", "state", "target_client", "environment_kind", "console_origin",
-  "validated_probe_at", "intent", "operation_id", "created_at", "updated_at", "failed_step",
-  "retry_count", "retry_budget", "last_failure_category",
+  "validated_probe_at", "operation_id", "created_at", "updated_at",
 ]);
 
 function normalizeConsoleOrigin(value) {
@@ -84,61 +79,6 @@ async function fetchPinnedMcpEndpoint(endpoint, fetchImpl, options) {
   return response;
 }
 
-function shellSingleQuote(value) {
-  return `'${String(value).replaceAll("'", `'"'"'`)}'`;
-}
-
-function persistPosixCredential({ home, stateStore, token, baseUrl }) {
-  const directory = stateStore.ensurePrivateDirectory(path.join(home, ".rainbond"));
-  const target = stateStore.assertInsideHome(path.join(directory, "mcp.env"), "凭据文件");
-  try {
-    fs.lstatSync(target);
-    stateStore.assertProtectedRegularFile(target);
-  } catch (error) {
-    if (error.code !== "ENOENT") throw error;
-  }
-  const temporary = path.join(
-    directory,
-    `.mcp.env.${process.pid}.${crypto.randomBytes(8).toString("hex")}`
-  );
-  const content = [
-    `export RAINBOND_JWT=${shellSingleQuote(token)}`,
-    `export RAINBOND_URL=${shellSingleQuote(baseUrl)}`,
-    "",
-  ].join("\n");
-  let fd;
-  try {
-    fd = fs.openSync(temporary, "wx", 0o600);
-    fs.writeFileSync(fd, content, "utf8");
-    fs.fsyncSync(fd);
-    fs.closeSync(fd);
-    fd = undefined;
-    stateStore.protectRegularFile(temporary);
-    try {
-      fs.lstatSync(target);
-      stateStore.assertProtectedRegularFile(target);
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-    }
-    fs.renameSync(temporary, target);
-    stateStore.protectRegularFile(target);
-    const directoryFd = fs.openSync(directory, "r");
-    try {
-      fs.fsyncSync(directoryFd);
-    } finally {
-      fs.closeSync(directoryFd);
-    }
-  } catch (error) {
-    if (fd !== undefined) fs.closeSync(fd);
-    try {
-      fs.unlinkSync(temporary);
-    } catch (cleanupError) {
-      if (cleanupError.code !== "ENOENT") throw cleanupError;
-    }
-    throw error;
-  }
-}
-
 async function probeConfiguredMcp(state, { env, fetchImpl }) {
   const originalToken = env.RAINBOND_JWT;
   const endpoint = `${state.console_origin}/console/mcp/rainskills/api/query`;
@@ -197,22 +137,21 @@ function createRuntimeStateManager({
   platform = process.platform,
   home = os.homedir(),
   stateStore = createDefaultStore(platform, home),
-  operationId,
   liveProbe,
   fetchImpl = globalThis.fetch,
   env = process.env,
   credentialWriter,
   now = () => new Date().toISOString(),
 } = {}) {
-  if (operationId !== undefined && !UUID_PATTERN.test(operationId || "")) {
-    throw new Error("runtime state operation_id 无效");
-  }
-  const statePath = operationId
-    ? path.join(home, ".rainbond", "rainskills", "runtime-connections-v1", `${operationId}.json`)
-    : path.join(home, ".rainbond", "rainskills", "runtime-connection-v1.json");
-  const writeCredential = credentialWriter || (platform === "win32"
-    ? ({ token, baseUrl }) => persistWindowsEnvironment({ token, baseUrl })
-    : ({ token, baseUrl }) => persistPosixCredential({ home, stateStore, token, baseUrl }));
+  const statePath = path.join(home, ".rainbond", "rainskills", "runtime-connection-v1.json");
+  const writeCredential = credentialWriter || (({ token, baseUrl, kind }) => require(
+    "./single-runtime.js"
+  ).createSingleRuntimeStore({ platform, home, stateStore }).write({
+    consoleOrigin: baseUrl,
+    kind,
+    token,
+    allowInsecureHttp: baseUrl.startsWith("http://"),
+  }));
   const probe = liveProbe || ((state) => probeConfiguredMcp(state, {
     env,
     fetchImpl,
@@ -230,30 +169,15 @@ function createRuntimeStateManager({
     if (!ENVIRONMENT_KINDS.has(state.environment_kind)) throw new Error("environment_kind 无效");
     const consoleOrigin = normalizeConsoleOrigin(state.console_origin);
     if (!UUID_PATTERN.test(state.operation_id || "")) throw new Error("operation_id 无效");
-    const intent = state.intent === undefined || state.intent === null ? null : validateIntent(state.intent);
     if (!isIsoTimestamp(state.created_at) || !isIsoTimestamp(state.updated_at)) {
       throw new Error("runtime state timestamp 无效");
     }
     if (state.validated_probe_at !== null && !isIsoTimestamp(state.validated_probe_at)) {
       throw new Error("runtime state validated probe timestamp 无效");
     }
-    const fixedSteps = intent ? INTENT_DEFINITIONS[intent.type].steps : [];
-    if (state.failed_step !== null && !fixedSteps.includes(state.failed_step)) {
-      throw new Error("runtime state failed step 不是 intent 的固定步骤");
-    }
-    if (!Number.isInteger(state.retry_count) || state.retry_count < 0 || state.retry_count > MAX_RETRY_COUNT) {
-      throw new Error("runtime state retry count 无效");
-    }
-    if (!Number.isInteger(state.retry_budget) || state.retry_budget < 0 || state.retry_budget > 1) {
-      throw new Error("runtime state retry budget 无效");
-    }
-    if (state.last_failure_category !== null && !FAILURE_CATEGORIES.has(state.last_failure_category)) {
-      throw new Error("runtime state failure category 无效");
-    }
     return {
       ...state,
       console_origin: consoleOrigin,
-      intent,
     };
   }
 
@@ -271,7 +195,6 @@ function createRuntimeStateManager({
       target_client: input.target_client,
       environment_kind: input.environment_kind,
       console_origin: normalizeConsoleOrigin(input.console_origin),
-      intent: input.intent === undefined ? null : validateIntent(input.intent),
       operation_id: input.operation_id,
     };
   }
@@ -321,7 +244,7 @@ function createRuntimeStateManager({
       }
       if (renewedCredential) {
         try {
-          await writeCredential(renewedCredential);
+          await writeCredential({ ...renewedCredential, kind: state.environment_kind });
         } catch {
           const failed = credentialFailureState
             ? writeStateUnlocked(credentialFailureState(current))
@@ -340,26 +263,18 @@ function createRuntimeStateManager({
       && left.operation_id === right.operation_id
       && left.target_client === right.target_client
       && left.environment_kind === right.environment_kind
-      && left.console_origin === right.console_origin
-      && JSON.stringify(left.intent) === JSON.stringify(right.intent);
+      && left.console_origin === right.console_origin;
   }
 
   function startConnecting(input) {
     return withRuntimeStateLock(() => {
       const prior = read();
       const fields = connectionFields(input);
-      if (prior.operation_id === fields.operation_id && prior.last_failure_category !== null) {
-        if (prior.last_failure_category === "permission-denied") {
-          throw new Error("permission denied 不允许重新授权");
-        }
-        throw new Error("凭据失效恢复必须使用受保护的 runtime reconnect 重试门禁");
-      }
       if (prior.state === "connecting") {
         const identical = prior.operation_id === fields.operation_id
           && prior.target_client === fields.target_client
           && prior.environment_kind === fields.environment_kind
-          && prior.console_origin === fields.console_origin
-          && isDeepStrictEqual(prior.intent, fields.intent);
+          && prior.console_origin === fields.console_origin;
         if (identical) return prior;
         throw new Error("另一个 runtime connecting operation 正在进行中");
       }
@@ -372,29 +287,10 @@ function createRuntimeStateManager({
         validated_probe_at: null,
         created_at: prior.created_at || timestamp,
         updated_at: timestamp,
-        failed_step: null,
-        retry_count: 0,
-        retry_budget: 0,
-        last_failure_category: null,
       });
     });
   }
 
-  function persistConnectingCredential({ operationId, token }) {
-    if (!UUID_PATTERN.test(operationId || "")) throw new Error("operation_id 无效");
-    if (typeof token !== "string" || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(token)) {
-      throw new Error("runtime credential 无效");
-    }
-    return withRuntimeStateLock(() => {
-      const current = read();
-      if (current.state !== "connecting" || current.operation_id !== operationId) {
-        throw new Error("runtime credential 与 connecting operation 不匹配");
-      }
-      writeCredential({ token, baseUrl: current.console_origin });
-      return { persisted: true };
-    });
-  }
-
   async function markConnected(input) {
     const prior = read();
     const fields = connectionFields(input);
@@ -406,7 +302,6 @@ function createRuntimeStateManager({
       || prior.target_client !== fields.target_client
       || prior.environment_kind !== fields.environment_kind
       || prior.console_origin !== fields.console_origin
-      || JSON.stringify(prior.intent) !== JSON.stringify(fields.intent)
     ) {
       throw new Error("connected 写入必须匹配当前 connecting operation");
     }
@@ -429,10 +324,6 @@ function createRuntimeStateManager({
       validated_probe_at: timestamp,
       created_at: prior.created_at || timestamp,
       updated_at: timestamp,
-      failed_step: prior.failed_step || null,
-      retry_count: prior.retry_count || 0,
-      retry_budget: prior.retry_budget || 0,
-      last_failure_category: prior.last_failure_category || null,
     }, {
       renewedCredential: probeResult.renewedCredential,
     });
@@ -503,143 +394,16 @@ function createRuntimeStateManager({
     };
   }
 
-  function assertMatchingOperation(current, operationId) {
-    if (!UUID_PATTERN.test(operationId || "")) throw new Error("operation_id 无效");
-    if (current.state === "not_started" || current.operation_id !== operationId) {
-      throw new Error("runtime operation_id 与参数不匹配");
-    }
-    if (!current.intent) throw new Error("runtime state 缺少 validated intent");
-  }
-
-  function recordFailure({ operationId, step, reason } = {}) {
-    if (!FAILURE_CATEGORIES.has(reason)) throw new Error("runtime failure reason 无效");
-    return withRuntimeStateLock(() => {
-      const current = read();
-      assertMatchingOperation(current, operationId);
-      const fixedSteps = INTENT_DEFINITIONS[current.intent.type].steps;
-      if (!fixedSteps.includes(step)) throw new Error("runtime failure step 不是 intent 的固定步骤");
-
-      if (
-        reason === "credential-expired"
-        && current.state === "connecting"
-        && current.last_failure_category === reason
-        && current.failed_step === step
-        && current.retry_count === 0
-        && current.retry_budget === 1
-      ) {
-        return current;
-      }
-      if (current.state !== "connected") {
-        throw new Error("只有 connected runtime 才能记录业务操作失败");
-      }
-
-      const credentialExpired = reason === "credential-expired";
-      const retryBudget = credentialExpired && current.retry_count === 0 ? 1 : 0;
-      return writeStateUnlocked({
-        ...current,
-        state: credentialExpired ? "connecting" : "connected",
-        validated_probe_at: credentialExpired ? null : current.validated_probe_at,
-        failed_step: step,
-        retry_budget: retryBudget,
-        last_failure_category: reason,
-        updated_at: now(),
-      });
-    });
-  }
-
-  function reconnectInput(operationId) {
-    return withRuntimeStateLock(() => {
-      const current = read();
-      assertMatchingOperation(current, operationId);
-      if (current.last_failure_category === "permission-denied") {
-        throw new Error("permission denied 不允许重新授权或重试");
-      }
-      if (
-        current.state !== "connecting"
-        || current.last_failure_category !== "credential-expired"
-        || current.retry_budget !== 1
-        || current.retry_count !== 0
-      ) {
-        throw new Error("runtime credential retry budget 已用尽或尚未记录凭据失效");
-      }
-      return connectionFields(current);
-    });
-  }
-
-  async function withReconnectLease(operationId, action) {
-    if (!UUID_PATTERN.test(operationId || "")) throw new Error("operation_id 无效");
-    if (typeof action !== "function") throw new Error("runtime reconnect action 无效");
-    let lease;
-    try {
-      lease = stateStore.acquireOperationLock({ operationId });
-    } catch {
-      throw new Error("该 runtime reconnect 正在运行；请稍后重试");
-    }
-    try {
-      const connection = reconnectInput(operationId);
-      return await action(connection);
-    } finally {
-      lease.release();
-    }
-  }
-
-  function assertContinuationEligible(operationId) {
-    return withRuntimeStateLock(() => {
-      const current = read();
-      assertMatchingOperation(current, operationId);
-      if (current.state !== "connected") throw new Error("runtime 尚未 connected，不能恢复 intent");
-      if (current.last_failure_category === "permission-denied") {
-        throw new Error("permission denied：当前操作没有权限，不能自动重试");
-      }
-      if (
-        current.last_failure_category === "credential-expired"
-        && (current.retry_budget !== 1 || current.retry_count !== 0)
-      ) {
-        throw new Error("runtime credential retry budget 已用尽");
-      }
-      return current;
-    });
-  }
-
-  function prepareContinuation(operationId) {
-    return withRuntimeStateLock(() => {
-      const current = read();
-      assertMatchingOperation(current, operationId);
-      if (current.state !== "connected") throw new Error("runtime 尚未 connected，不能恢复 intent");
-      if (current.last_failure_category === "permission-denied") {
-        throw new Error("permission denied：当前操作没有权限，不能自动重试");
-      }
-      if (current.last_failure_category !== "credential-expired") return current;
-      if (current.retry_budget !== 1 || current.retry_count !== 0) {
-        throw new Error("runtime credential retry budget 已用尽");
-      }
-      return writeStateUnlocked({
-        ...current,
-        retry_count: current.retry_count + 1,
-        retry_budget: 0,
-        updated_at: now(),
-      });
-    });
-  }
-
   return {
     markConnected,
     path: statePath,
-    persistConnectingCredential,
-    assertContinuationEligible,
-    prepareContinuation,
     read,
-    reconnectInput,
-    recordFailure,
     startConnecting,
     status,
-    withReconnectLease,
   };
 }
 
 module.exports = {
-  FAILURE_CATEGORIES,
-  MAX_RETRY_COUNT,
   RUNTIME_STATE_LOCK_ID,
   RUNTIME_SCHEMA,
   STATUS_SCHEMA,
@@ -648,6 +412,5 @@ module.exports = {
   normalizeConsoleOrigin,
   normalizeProbeResult,
   fetchPinnedMcpEndpoint,
-  persistPosixCredential,
   probeConfiguredMcp,
 };

package/rainbond-platform-installer/scripts/single-runtime.js

@@ -0,0 +1,114 @@
+"use strict";
+
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+
+const { normalizeConsoleOrigin } = require("./console-origin.js");
+const { createSecureStateStore } = require("./secure-state.js");
+const { looksLikeJwt } = require("./windows-auth.js");
+
+const SINGLE_RUNTIME_SCHEMA = "rainskills.single-runtime.v1";
+const KINDS = new Set(["saas", "private"]);
+const FIELDS = new Set([
+  "schema", "version", "console_origin", "kind", "token",
+  "allow_insecure_http", "created_at", "updated_at",
+]);
+const MAX_BYTES = 16384;
+
+function isIsoTimestamp(value) {
+  return typeof value === "string"
+    && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/.test(value)
+    && !Number.isNaN(Date.parse(value));
+}
+
+function validateSingleRuntime(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    throw new Error("单运行环境记录无效");
+  }
+  for (const field of Object.keys(input)) {
+    if (!FIELDS.has(field)) throw new Error(`单运行环境记录包含未知字段：${field}`);
+  }
+  if (
+    Object.keys(input).length !== FIELDS.size
+    || input.schema !== SINGLE_RUNTIME_SCHEMA
+    || input.version !== 1
+    || !KINDS.has(input.kind)
+    || typeof input.allow_insecure_http !== "boolean"
+    || !looksLikeJwt(input.token)
+    || !isIsoTimestamp(input.created_at)
+    || !isIsoTimestamp(input.updated_at)
+  ) {
+    throw new Error("单运行环境记录 schema 无效");
+  }
+  const origin = normalizeConsoleOrigin(input.console_origin);
+  if (origin.startsWith("http://") && !input.allow_insecure_http) {
+    throw new Error("明文 HTTP 运行环境必须显式允许不安全传输");
+  }
+  return {
+    schema: SINGLE_RUNTIME_SCHEMA,
+    version: 1,
+    console_origin: origin,
+    kind: input.kind,
+    token: input.token,
+    allow_insecure_http: input.allow_insecure_http,
+    created_at: input.created_at,
+    updated_at: input.updated_at,
+  };
+}
+
+function createSingleRuntimeStore({
+  platform = process.platform,
+  home = os.homedir(),
+  stateStore = createSecureStateStore({ platform, home }),
+  now = () => new Date().toISOString(),
+} = {}) {
+  const runtimePath = path.join(home, ".rainbond", "rainskills", "single-runtime-v1.json");
+
+  function read() {
+    if (!fs.existsSync(runtimePath)) return null;
+    stateStore.assertProtectedRegularFile(runtimePath);
+    if (fs.lstatSync(runtimePath).size > MAX_BYTES) {
+      throw new Error("单运行环境记录文件过大");
+    }
+    return validateSingleRuntime(stateStore.readProtectedJson(runtimePath));
+  }
+
+  function write({
+    consoleOrigin,
+    kind,
+    token,
+    allowInsecureHttp = false,
+  } = {}) {
+    if (fs.existsSync(runtimePath)) stateStore.assertProtectedRegularFile(runtimePath);
+    const current = read();
+    const timestamp = now();
+    const value = validateSingleRuntime({
+      schema: SINGLE_RUNTIME_SCHEMA,
+      version: 1,
+      console_origin: consoleOrigin,
+      kind,
+      token,
+      allow_insecure_http: allowInsecureHttp,
+      created_at: current?.created_at || timestamp,
+      updated_at: timestamp,
+    });
+    stateStore.atomicWriteJson(runtimePath, value);
+    return value;
+  }
+
+  function remove() {
+    if (!fs.existsSync(runtimePath)) return false;
+    stateStore.assertProtectedRegularFile(runtimePath);
+    fs.unlinkSync(runtimePath);
+    return true;
+  }
+
+  return { path: runtimePath, read, remove, write };
+}
+
+module.exports = {
+  SINGLE_RUNTIME_SCHEMA,
+  createSingleRuntimeStore,
+  validateSingleRuntime,
+};