@cjhyy/code-shell-server 0.9.52 → 0.10.1

package/dist/account/native-lock.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Native credential stores are shared by all TUI/serve processes for this OS
+ * user. Lock the whole read/refresh/save/logout lifecycle, including prompts.
+ * No age-based recovery: a suspended process may still own a rotating token.
+ */
+export declare function acquireNativeAccountLock(origin: string, directory?: string): Promise<() => Promise<void>>;

package/dist/account/native-lock.js

@@ -0,0 +1,26 @@
+import { createHash } from "node:crypto";
+import { mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { acquireWorkspaceWriteLock } from "@cjhyy/code-shell-core/internal";
+import { accountRegistrationUrl } from "@cjhyy/code-shell-web/account";
+/**
+ * Native credential stores are shared by all TUI/serve processes for this OS
+ * user. Lock the whole read/refresh/save/logout lifecycle, including prompts.
+ * No age-based recovery: a suspended process may still own a rotating token.
+ */
+export async function acquireNativeAccountLock(origin, directory = join(homedir(), ".code-shell", "accounts", "locks")) {
+    accountRegistrationUrl(origin);
+    const key = createHash("sha256").update(origin).digest("hex");
+    const parent = join(directory, key);
+    mkdirSync(parent, { recursive: true, mode: 0o700 });
+    try {
+        return await acquireWorkspaceWriteLock(parent, "session");
+    }
+    catch (cause) {
+        if (cause.code !== "ELOCKED")
+            throw cause;
+        throw Object.assign(new Error("Another native account command owns this account service. Finish that command and retry. " +
+            `If it crashed, first stop all account commands for this origin, then remove the empty .lock directory inside ${parent}.`, { cause }), { code: "ELOCKED" });
+    }
+}

package/dist/account/native-store.d.ts

@@ -0,0 +1,32 @@
+import { type SavedCloudAccount } from "./store.js";
+export type NativeAccountStoreRunner = (command: string, args: string[], input?: string) => {
+    status: number | null;
+    stdout: string;
+    error?: unknown;
+};
+/** Explicit temporary account authority; lifetime is the owning CLI session. */
+export declare class MemoryAccountStore {
+    private saved?;
+    preflight(): void;
+    load(): SavedCloudAccount | undefined;
+    save(value: SavedCloudAccount): void;
+    forget(): void;
+}
+/** OS credential storage only. Secrets travel through pipes, never command arguments. */
+export declare class NativeAccountStore {
+    private readonly origin;
+    private readonly account;
+    private readonly platform;
+    private readonly run;
+    private readonly windows?;
+    constructor(origin: string, options?: {
+        platform?: NodeJS.Platform;
+        run?: NativeAccountStoreRunner;
+        dataDir?: string;
+    });
+    private command;
+    preflight(): void;
+    load(): SavedCloudAccount | undefined;
+    save(saved: SavedCloudAccount): void;
+    forget(): void;
+}

package/dist/account/native-store.js

@@ -0,0 +1,162 @@
+import { spawnSync } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { join, win32 } from "node:path";
+import { homedir } from "node:os";
+import { CloudAccountStore, validCloudAccountGrant } from "./store.js";
+import { isRelayOrigin } from "../remote-relay/protocol.js";
+const execute = (command, args, input) => {
+    const result = spawnSync(command, args, {
+        input,
+        encoding: "utf8",
+        timeout: 15_000,
+        maxBuffer: 65_536,
+        windowsHide: true,
+        stdio: ["pipe", "pipe", "pipe"],
+    });
+    return { status: result.status, stdout: result.stdout ?? "", error: result.error };
+};
+const unavailable = () => new Error("系统安全存储不可用。可使用 --memory 保持当前进程内的账号会话；不会保存明文凭据。");
+const validate = (saved, origin) => isRelayOrigin(origin) &&
+    validCloudAccountGrant(saved) &&
+    saved.kind !== "device" &&
+    saved.origin === origin &&
+    (saved.audience === undefined || saved.audience === origin);
+/** Explicit temporary account authority; lifetime is the owning CLI session. */
+export class MemoryAccountStore {
+    saved;
+    preflight() { }
+    load() {
+        return this.saved ? structuredClone(this.saved) : undefined;
+    }
+    save(value) {
+        if (!validate(value, value.origin))
+            throw new Error("无效的账号授权。");
+        this.saved = structuredClone(value);
+    }
+    forget() {
+        this.saved = undefined;
+    }
+}
+/** OS credential storage only. Secrets travel through pipes, never command arguments. */
+export class NativeAccountStore {
+    origin;
+    account;
+    platform;
+    run;
+    windows;
+    constructor(origin, options = {}) {
+        this.origin = origin;
+        if (!isRelayOrigin(origin))
+            throw new Error("请输入完整的 HTTPS 账号服务地址。");
+        this.account = createHash("sha256").update(origin).digest("hex");
+        this.platform = options.platform ?? process.platform;
+        this.run = options.run ?? execute;
+        if (this.platform === "win32") {
+            const crypt = (operation, input) => {
+                const script = `Add-Type -AssemblyName System.Security; $data=[Convert]::FromBase64String([Console]::In.ReadToEnd()); $result=[Security.Cryptography.ProtectedData]::${operation}($data,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser); [Console]::Out.Write([Convert]::ToBase64String($result))`;
+                const result = this.run(win32.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe"), ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], input);
+                if (result.error || result.status !== 0 || !/^[A-Za-z0-9+/]+={0,2}$/.test(result.stdout))
+                    throw unavailable();
+                return Buffer.from(result.stdout, "base64");
+            };
+            this.windows = new CloudAccountStore(join(options.dataDir ?? join(homedir(), ".code-shell", "accounts"), `${this.account}.enc`), {
+                available: () => true,
+                encrypt: (text) => crypt("Protect", Buffer.from(text).toString("base64")),
+                decrypt: (bytes) => crypt("Unprotect", bytes.toString("base64")).toString("utf8"),
+            });
+        }
+    }
+    command(operation, account, value) {
+        let result;
+        if (this.platform === "darwin") {
+            // security's interactive command parser receives only fixed identifiers + base64.
+            // The process argument list contains no password, grant, or token.
+            result =
+                operation === "write"
+                    ? this.run("/usr/bin/security", ["-i"], `add-generic-password -U -s codeshell-native-account -a ${account} -w ${value}\n`)
+                    : this.run("/usr/bin/security", [
+                        operation === "read" ? "find-generic-password" : "delete-generic-password",
+                        "-s",
+                        "codeshell-native-account",
+                        "-a",
+                        account,
+                        ...(operation === "read" ? ["-w"] : []),
+                    ]);
+        }
+        else if (this.platform === "linux") {
+            result = this.run("/usr/bin/secret-tool", operation === "write"
+                ? [
+                    "store",
+                    "--label=CodeShell Account",
+                    "service",
+                    "codeshell-native-account",
+                    "account",
+                    account,
+                ]
+                : [
+                    operation === "read" ? "lookup" : "clear",
+                    "service",
+                    "codeshell-native-account",
+                    "account",
+                    account,
+                ], value);
+        }
+        else
+            throw unavailable();
+        const missing = this.platform === "darwin" ? 44 : 1;
+        if (!result.error && result.status === missing && operation !== "write")
+            return;
+        if (result.error || result.status !== 0)
+            throw unavailable();
+        return result.stdout.trim();
+    }
+    preflight() {
+        if (this.windows)
+            return this.windows.preflight();
+        const account = `probe-${randomUUID()}`;
+        const value = Buffer.from(randomUUID()).toString("base64");
+        try {
+            this.command("write", account, value);
+            if (this.command("read", account) !== value)
+                throw unavailable();
+        }
+        finally {
+            this.command("delete", account);
+        }
+    }
+    load() {
+        const bytes = this.windows ? undefined : this.command("read", this.account);
+        if (!this.windows && bytes === undefined)
+            return;
+        try {
+            if (bytes && bytes.length > 32_768)
+                throw unavailable();
+            const saved = this.windows
+                ? this.windows.load()
+                : JSON.parse(Buffer.from(bytes, "base64").toString("utf8"));
+            if (saved === undefined && this.windows)
+                return;
+            if (!validate(saved, this.origin))
+                throw unavailable();
+            return saved;
+        }
+        catch {
+            throw new Error("账号安全存储读取失败，请退出后重新登录。");
+        }
+    }
+    save(saved) {
+        if (!validate(saved, this.origin))
+            throw new Error("无效的账号授权。");
+        if (this.windows)
+            return this.windows.save(saved);
+        const encoded = Buffer.from(JSON.stringify(saved)).toString("base64");
+        this.command("write", this.account, encoded);
+        if (this.command("read", this.account) !== encoded)
+            throw unavailable();
+    }
+    forget() {
+        if (this.windows)
+            return this.windows.forget();
+        this.command("delete", this.account);
+    }
+}

package/dist/account/profile.d.ts

@@ -0,0 +1,4 @@
+import type { CloudAccountIdentity, CloudAccountProfileRequest } from "./types.js";
+export declare function accountProfileRequest(raw: unknown): CloudAccountProfileRequest;
+/** Project only public identity fields, never server authority or unknown data. */
+export declare function accountProfile(raw: unknown, accountId: string): CloudAccountIdentity;

package/dist/account/profile.js

@@ -0,0 +1,46 @@
+import { isRelayOrigin } from "../remote-relay/protocol.js";
+import { normalizeCloudDisplayName, normalizeCloudUsername, } from "@cjhyy/code-shell-web/account-profile";
+const uuid = /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/;
+export function accountProfileRequest(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        throw new Error("云账号资料请求无效。");
+    const input = raw;
+    if (!isRelayOrigin(input.origin) ||
+        input.origin.length > 2048 ||
+        typeof input.accountId !== "string" ||
+        !uuid.test(input.accountId))
+        throw new Error("云账号资料请求无效。");
+    const identity = { origin: input.origin, accountId: input.accountId };
+    if (input.action === "read" && Object.keys(input).length === 3)
+        return { ...identity, action: "read" };
+    if (input.action !== "update" ||
+        Object.keys(input).some((key) => !["origin", "accountId", "action", "displayName", "username"].includes(key)) ||
+        (input.displayName === undefined && input.username === undefined))
+        throw new Error("云账号资料请求无效。");
+    const displayName = normalizeCloudDisplayName(input.displayName);
+    const username = normalizeCloudUsername(input.username);
+    if (input.displayName !== undefined && displayName === undefined)
+        throw new Error("昵称需为 1–64 个字符，不能包含控制字符。");
+    if (input.username !== undefined && username === undefined)
+        throw new Error("用户名需为 3–64 位字母、数字、点、下划线或连字符，并以字母或数字开头。");
+    return {
+        ...identity,
+        action: "update",
+        ...(displayName === undefined ? {} : { displayName }),
+        ...(username === undefined ? {} : { username }),
+    };
+}
+/** Project only public identity fields, never server authority or unknown data. */
+export function accountProfile(raw, accountId) {
+    const account = raw?.account;
+    if (!account || typeof account !== "object" || Array.isArray(account))
+        throw new Error("云服务返回了无效的账号资料。");
+    const value = account;
+    if (value.id !== accountId ||
+        normalizeCloudUsername(value.username) !== value.username ||
+        typeof value.username !== "string" ||
+        typeof value.displayName !== "string" ||
+        normalizeCloudDisplayName(value.displayName) !== value.displayName)
+        throw new Error("云服务返回了无效的账号资料。");
+    return { id: accountId, username: value.username, displayName: value.displayName };
+}

package/dist/account/store.d.ts

@@ -0,0 +1,34 @@
+import type { CloudAccountIdentity } from "./types.js";
+export interface RelaySecretCipher {
+    available(): boolean;
+    encrypt(value: string): Buffer;
+    decrypt(value: Buffer): string;
+}
+/** Main-process-only grants. Never return this type from an IPC handler. */
+export interface CloudAccountGrant {
+    accessToken: string;
+    refreshToken: string;
+    accessTokenExpiresAt: number;
+    refreshTokenExpiresAt: number;
+    sessionId: string;
+    account: CloudAccountIdentity;
+    kind?: "account" | "device";
+    audience?: string;
+    hostId?: string;
+}
+export interface SavedCloudAccount extends CloudAccountGrant {
+    origin: string;
+}
+export declare function validCloudAccountGrant(value: unknown): value is CloudAccountGrant;
+/** Independent from agent credentials; no plaintext fallback or generic enumeration. */
+export declare class CloudAccountStore {
+    private readonly path;
+    private readonly cipher;
+    constructor(path: string, cipher: RelaySecretCipher);
+    private assertAvailable;
+    private temporary;
+    preflight(): void;
+    load(): SavedCloudAccount | undefined;
+    save(saved: SavedCloudAccount): void;
+    forget(): void;
+}

package/dist/account/store.js

@@ -0,0 +1,118 @@
+import { constants, closeSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
+import { dirname } from "node:path";
+import { randomUUID } from "node:crypto";
+import { isRelayHostId, isRelayOrigin, isRelayToken } from "../remote-relay/protocol.js";
+import { normalizeCloudDisplayName } from "@cjhyy/code-shell-web/account-profile";
+export function validCloudAccountGrant(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const grant = value;
+    return (isRelayToken(grant.accessToken) &&
+        isRelayToken(grant.refreshToken) &&
+        isRelayHostId(grant.sessionId) &&
+        Number.isSafeInteger(grant.accessTokenExpiresAt) &&
+        grant.accessTokenExpiresAt > 0 &&
+        Number.isSafeInteger(grant.refreshTokenExpiresAt) &&
+        grant.refreshTokenExpiresAt >= grant.accessTokenExpiresAt &&
+        !!grant.account &&
+        isRelayHostId(grant.account.id) &&
+        typeof grant.account.username === "string" &&
+        grant.account.username.length > 0 &&
+        grant.account.username.length <= 128 &&
+        (grant.account.displayName === undefined ||
+            (typeof grant.account.displayName === "string" &&
+                normalizeCloudDisplayName(grant.account.displayName) === grant.account.displayName)) &&
+        (grant.kind === undefined || grant.kind === "account" || grant.kind === "device") &&
+        (grant.audience === undefined || isRelayOrigin(grant.audience)) &&
+        (grant.hostId === undefined || isRelayHostId(grant.hostId)));
+}
+function validSaved(value) {
+    return (validCloudAccountGrant(value) &&
+        value.kind !== "device" &&
+        isRelayOrigin(value.origin) &&
+        (value.audience === undefined || value.audience === value.origin));
+}
+/** Independent from agent credentials; no plaintext fallback or generic enumeration. */
+export class CloudAccountStore {
+    path;
+    cipher;
+    constructor(path, cipher) {
+        this.path = path;
+        this.cipher = cipher;
+    }
+    assertAvailable() {
+        if (!this.cipher.available())
+            throw new Error("系统安全存储不可用；本地使用不受影响。");
+    }
+    temporary(bytes) {
+        mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+        const temporary = `${this.path}.${randomUUID()}.tmp`;
+        const fd = openSync(temporary, "wx", 0o600);
+        try {
+            writeFileSync(fd, bytes);
+            fsyncSync(fd);
+            return temporary;
+        }
+        catch (error) {
+            unlinkSync(temporary);
+            throw error;
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    preflight() {
+        this.assertAvailable();
+        const probe = randomUUID();
+        const bytes = this.cipher.encrypt(probe);
+        if (this.cipher.decrypt(bytes) !== probe)
+            throw new Error("系统安全存储校验失败。");
+        unlinkSync(this.temporary(bytes));
+    }
+    load() {
+        let metadata;
+        try {
+            metadata = lstatSync(this.path);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return;
+            throw error;
+        }
+        this.assertAvailable();
+        if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > 16_384)
+            throw new Error("云账号登记损坏，请退出后重新登录。");
+        const fd = openSync(this.path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        try {
+            const saved = JSON.parse(this.cipher.decrypt(readFileSync(fd)));
+            if (!validSaved(saved))
+                throw new Error("云账号登记损坏，请退出后重新登录。");
+            return saved;
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    save(saved) {
+        this.assertAvailable();
+        if (!validSaved(saved))
+            throw new Error("无效的云账号授权。");
+        const temporary = this.temporary(this.cipher.encrypt(JSON.stringify(saved)));
+        try {
+            renameSync(temporary, this.path);
+        }
+        catch (error) {
+            unlinkSync(temporary);
+            throw error;
+        }
+    }
+    forget() {
+        try {
+            unlinkSync(this.path);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+}

package/dist/account/types.d.ts

@@ -0,0 +1,138 @@
+import type { AccountFeatureMap } from "@cjhyy/code-shell-web/account";
+/** Public account state. Tokens and OAuth receipts never cross the preload bridge. */
+export declare const DEFAULT_CLOUD_ACCOUNT_ORIGIN = "https://115.159.45.55";
+export interface CloudAccountIdentity {
+    id: string;
+    username: string;
+    /** Optional for grants saved before profile support. */
+    displayName?: string;
+}
+export interface CloudAccountStatus {
+    state: "signed-out" | "signed-in" | "signing-in" | "storage-error";
+    origin?: string;
+    account?: CloudAccountIdentity;
+    /** Data connection progress; independent from the account session and never persisted here. */
+    githubConnection?: {
+        state: "pending" | "connected" | "failed" | "skipped";
+    };
+}
+/** Local credentials are erased even when the service cannot acknowledge revocation. */
+export interface CloudAccountLogoutResult {
+    state: "signed-out";
+    revocation: "confirmed" | "unconfirmed";
+}
+export interface CloudAccountLogin {
+    origin: string;
+    username: string;
+    password: string;
+    deviceName?: string;
+}
+export interface CloudAccountBrowserLogin {
+    origin: string;
+    deviceName?: string;
+}
+export type CloudAccountManagementSection = "profile" | "security" | "sessions" | "connections";
+export interface CloudAccountCapabilities {
+    features: AccountFeatureMap;
+    registrationAllowed: boolean;
+    githubEnabled: boolean;
+    browserLoginEnabled?: boolean;
+    githubLinkEnabled?: boolean;
+    linkManagementEnabled?: boolean;
+    profileEnabled?: boolean;
+    relay?: {
+        enabled: false;
+    } | {
+        enabled: true;
+        directoryOrigin: string;
+        protocolVersion: 1;
+        accountHandoffVersion: 1;
+    };
+}
+export type CloudAccountProfileRequest = {
+    origin: string;
+    accountId: string;
+} & ({
+    action: "read";
+} | {
+    action: "update";
+    displayName?: string;
+    username?: string;
+});
+/** Account-owned metadata only. Provider credentials and global clients are never exposed. */
+export interface CloudAccountLinkView {
+    linkOrigin: string;
+    connections: Array<{
+        id: string;
+        provider: string;
+        account: {
+            id: string;
+            login?: string;
+            label?: string;
+        };
+        revoked: boolean;
+    }>;
+    grants: Array<{
+        id: string;
+        connectionId: string;
+        client: {
+            id: string;
+            name: string;
+        };
+        scopes: string[];
+        resources: string[];
+        revoked: boolean;
+    }>;
+}
+export type CloudAccountLinksRequest = {
+    origin: string;
+    accountId: string;
+} & ({
+    action: "list";
+} | {
+    action: "revoke";
+    kind: "connections" | "grants";
+    id: string;
+});
+export type CloudAccountLinksResult = {
+    action: "list";
+    view: CloudAccountLinkView;
+} | {
+    action: "revoke";
+    revoked: true;
+    kind: "connections" | "grants";
+    id: string;
+};
+export type CloudAccountGitHubRequest = {
+    mode: "login";
+    input: CloudAccountGitHubLogin;
+} | {
+    mode: "link";
+};
+export interface CloudAccountGitHubLogin {
+    origin: string;
+    deviceName?: string;
+    connectGitHub?: boolean;
+}
+export interface CloudAccountApi {
+    openRegistration(origin: string): Promise<void>;
+    openManagement(section: CloudAccountManagementSection): Promise<void>;
+    signInWithBrowser(input: CloudAccountBrowserLogin): Promise<CloudAccountStatus>;
+    status(): Promise<CloudAccountStatus>;
+    resume?(): Promise<CloudAccountStatus>;
+    capabilities(origin: string): Promise<CloudAccountCapabilities>;
+    login(input: CloudAccountLogin): Promise<CloudAccountStatus>;
+    register(input: CloudAccountLogin): Promise<CloudAccountStatus>;
+    signInWithGitHub(input: CloudAccountGitHubLogin): Promise<CloudAccountStatus>;
+    linkGitHub(): Promise<CloudAccountStatus>;
+    manageLinks(input: CloudAccountLinksRequest): Promise<CloudAccountLinksResult>;
+    profile(input: CloudAccountProfileRequest): Promise<CloudAccountStatus>;
+    cancelSignIn(): Promise<void>;
+    logout(): Promise<CloudAccountLogoutResult>;
+    onStatus(callback: (status: CloudAccountStatus) => void): () => void;
+}
+/** Bounded public projection; no grants, service secrets, or server-only fields. */
+export interface CloudAccountOverview {
+    account: CloudAccountIdentity;
+    features: AccountFeatureMap;
+}

package/dist/account/types.js

@@ -0,0 +1,2 @@
+/** Public account state. Tokens and OAuth receipts never cross the preload bridge. */
+export const DEFAULT_CLOUD_ACCOUNT_ORIGIN = "https://115.159.45.55";

package/dist/desktop-web/http-api.d.ts

@@ -28,6 +28,8 @@ export interface DesktopWebApiOptions {
     /** Release owner-scoped resources contributed by handleExtra (for example Link probes). */
     onSessionRevoked?: (sessionId: string) => void;
     onClose?: () => void | Promise<void>;
+    /** The account computer list, while this computer is registered to an account. */
+    accountComputers?: () => string | undefined;
     /** Authenticated same-origin composition point, for example the shared Link API. */
     handleExtra?: (request: IncomingMessage, response: ServerResponse, context: DesktopWebRequestContext) => boolean | Promise<boolean>;
     now?: () => number;
@@ -45,6 +47,8 @@ export interface DesktopWebHttpApi {
         baseUrl: string;
         /** Recheck the entrance authorization captured after its access gate succeeded. */
         isAccessAuthorized?: () => boolean;
+        /** Account handoffs may authenticate only their own short-lived device. */
+        accessDeviceId?: string;
     }) => Promise<boolean>;
     /** Reopen after RemoteHostManager.stop(), without reviving previous cookies. */
     start: () => void;

package/dist/desktop-web/http-api.js

@@ -318,7 +318,9 @@ export function createDesktopWebApi(options) {
                     if (context.isAccessAuthorized?.() === false)
                         throw new HubConfigurationError(401, "访问口令已更新，请重新连接桌面。");
                     const device = options.devices.authenticate(input.deviceId, input.secretHash);
-                    if (!device)
+                    if (!device ||
+                        (context.accessDeviceId && context.accessDeviceId !== device.id) ||
+                        (options.devices.isEphemeralDevice(device.id) && context.accessDeviceId !== device.id))
                         throw new HubConfigurationError(401, "设备未配对或已被撤销，请在桌面重新配对。");
                     const existing = principal(token);
                     if (token && existing?.session.deviceId === device.id) {
@@ -347,14 +349,20 @@ export function createDesktopWebApi(options) {
                     json(response, 200, status(session, device));
                     return true;
                 }
-                const current = principal(token);
+                const candidate = principal(token);
+                const current = (context.accessDeviceId && candidate?.device.id !== context.accessDeviceId) ||
+                    (candidate &&
+                        options.devices.isEphemeralDevice(candidate.device.id) &&
+                        context.accessDeviceId !== candidate.device.id)
+                    ? undefined
+                    : candidate;
                 if (request.method === "GET" &&
                     ["/api/v1/auth/status", "/api/v1/auth"].includes(url.pathname)) {
                     json(response, 200, status(current?.session, current?.device));
                     return true;
                 }
                 if (request.method === "POST" && url.pathname === "/api/v1/auth/logout") {
-                    if (token)
+                    if (token && current)
                         dropSession(token);
                     setCookie(response, "", secure);
                     json(response, 200, { ok: true });
@@ -370,7 +378,7 @@ export function createDesktopWebApi(options) {
                         context.isAccessAuthorized?.() === false ||
                         principal(token)?.session !== current.session)
                         throw new HubConfigurationError(401, "设备连接已失效，请重新连接桌面。");
-                    json(response, 200, describeEnvironment(id, "desktop"));
+                    json(response, 200, describeEnvironment(id, "desktop", options.accountComputers?.()));
                     return true;
                 }
                 const input = workspaceInput(request, url);

package/dist/environment-identity.d.ts

@@ -1,4 +1,4 @@
 import type { EnvironmentDescriptor } from "@cjhyy/code-shell-web";
 /** Publish once, atomically. Never silently replace a corrupt identity or adopt a symlink. */
 export declare function environmentIdentity(dataDir: string): Promise<string>;
-export declare function describeEnvironment(id: string, kind: EnvironmentDescriptor["kind"]): EnvironmentDescriptor;
+export declare function describeEnvironment(id: string, kind: EnvironmentDescriptor["kind"], accountComputers?: string): EnvironmentDescriptor;

package/dist/environment-identity.js

@@ -56,12 +56,13 @@ export async function environmentIdentity(dataDir) {
         await file.close();
     }
 }
-export function describeEnvironment(id, kind) {
+export function describeEnvironment(id, kind, accountComputers) {
     return {
         version: 1,
         id,
         name: kind === "desktop" ? "我的电脑" : kind === "project-host" ? "云端项目" : "Hub 工作台",
         kind,
         entryPath: kind === "desktop" ? "/mobile" : "/",
+        ...(accountComputers ? { accountComputers } : {}),
     };
 }

package/dist/headless-worker-env.d.ts

@@ -0,0 +1,2 @@
+/** Preserve the caller's environment while disabling Desktop-only host access. */
+export declare function headlessWorkerEnv(base: NodeJS.ProcessEnv, extra?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;