@dsh-remote/relay 3.1.0 → 3.1.3

package/README.md

@@ -34,12 +34,12 @@ curl -s http://127.0.0.1:8787/healthz
 
 ### 端点
 
-| 路径                   | 说明                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `GET /healthz`         | 运维契约（**二十三个字段**）：`ok` / `version` / `uptimeSec` / `hosts` / `clients` / `conversations` / `pendingPairs` / `droppedFrames` / `slowConsumers` / `rejectedPairs` / `shutdownForced` / `persistence` / `stateRestored` / `stateSavedAtSec` / `stateWrites` / `stateWriteFailures` / `lastPingAgo` / `shuttingDown` / `protocolSelf` / `protocolMin` / `peerProtocolMin` / `peerProtocolMax` / `peersNoProtocol` |
-| `GET /api/info`        | `{"publicUrl","protocol"}`                                                                                                                                                                                                                                                                                                                                                                                                |
-| `GET /api/pair-status` | **默认 404**。无需认证地回答"配对码 N 是否有效"等于给 6 位码空间装了扫描 oracle；确需调试时 `DRC_PAIR_STATUS=1`，用完关掉                                                                                                                                                                                                                                                                                                 |
-| WebSocket              | 路径不设限，任意路径都能升级                                                                                                                                                                                                                                                                                                                                                                                              |
+| 路径                   | 说明                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `GET /healthz`         | 运维契约（**二十四个字段**）：`ok` / `version` / `uptimeSec` / `hosts` / `clients` / `conversations` / `pendingPairs` / `hostTokens` / `droppedFrames` / `slowConsumers` / `rejectedPairs` / `shutdownForced` / `persistence` / `stateRestored` / `stateSavedAtSec` / `stateWrites` / `stateWriteFailures` / `lastPingAgo` / `shuttingDown` / `protocolSelf` / `protocolMin` / `peerProtocolMin` / `peerProtocolMax` / `peersNoProtocol` |
+| `GET /api/info`        | `{"publicUrl","protocol"}`                                                                                                                                                                                                                                                                                                                                                                                                               |
+| `GET /api/pair-status` | **默认 404**。无需认证地回答"配对码 N 是否有效"等于给 6 位码空间装了扫描 oracle；确需调试时 `DRC_PAIR_STATUS=1`，用完关掉                                                                                                                                                                                                                                                                                                                |
+| WebSocket              | 路径不设限，任意路径都能升级                                                                                                                                                                                                                                                                                                                                                                                                             |
 
 落盘五字段（`persistence` / `stateRestored` / `stateSavedAtSec` / `stateWrites` /
 `stateWriteFailures`）是"还在落盘"的唯一读数——换机器先看 `stateWriteFailures`，不是 0 就是没在写。

package/dist/bundle/main.js

@@ -2279,7 +2279,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes2, createHash } = __require("crypto");
+    var { randomBytes: randomBytes3, createHash } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -2830,7 +2830,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes2(16).toString("base64");
+      const key = randomBytes3(16).toString("base64");
       const request = isSecure ? https.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -23394,7 +23394,7 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.4/node_modules/@dsh-remote/protocol/dist/src/wire/limits.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.0.7/node_modules/@dsh-remote/protocol/dist/src/wire/limits.js
 var MAX_RELAY_MESSAGE_BYTES = 1024 * 1024;
 var MAX_CIPHERTEXT_BYTES = MAX_RELAY_MESSAGE_BYTES - 8 * 1024;
 var MAX_IMAGE_ATTACHMENTS = 4;
@@ -23403,7 +23403,7 @@ var MAX_ATTACHMENT_BYTES = 512 * 1024;
 var MAX_ATTACHMENT_TOTAL_BYTES = 512 * 1024;
 var IDEMPOTENCY_WINDOW_MS = 5 * 60 * 1e3;
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.4/node_modules/@dsh-remote/protocol/dist/src/wire/frames.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.0.7/node_modules/@dsh-remote/protocol/dist/src/wire/frames.js
 var PROTOCOL_VERSION = 1;
 var MIN_SUPPORTED_PROTOCOL = 1;
 var PAIRING_TOKEN_RE = /^\d{6}$/;
@@ -23725,7 +23725,19 @@ var BackpressureGate = class {
 var LOG_LEVELS = { debug: 10, info: 20, warn: 30, error: 40, silent: 99 };
 var levelWeight = (level) => LOG_LEVELS[level];
 var DECIMAL_INTEGER_RE = /^[0-9]+$/;
-function integer2(raw, fallback, name, problems) {
+function claimMinIntervalMs(env, problems) {
+  const value = integer2(env.DRC_CLAIM_MIN_INTERVAL_MS, 4e3, "DRC_CLAIM_MIN_INTERVAL_MS", problems, {
+    allowZero: true
+  });
+  if (value === 0) {
+    problems.push({
+      level: "warn",
+      message: "DRC_CLAIM_MIN_INTERVAL_MS=0\uFF1A\u8BA4\u9886\u63A5\u53E3\u7684\u9650\u9891**\u5DF2\u5173\u95ED**\uFF08\u540C IP \u53EF\u4EE5\u65E0\u9650\u8FDE\u6253\uFF09\u3002\u53EA\u5728\u6D4B\u8BD5\u6216\u5B8C\u5168\u5185\u7F51\u81EA\u7528\u65F6\u8FD9\u4E48\u8BBE\uFF1B\u516C\u7F51\u4E0A\u7684\u8FD9\u53F0\u4E2D\u7EE7\u8BF7\u7559 4000\u3002"
+    });
+  }
+  return value;
+}
+function integer2(raw, fallback, name, problems, options = {}) {
   if (raw === void 0) return fallback;
   if (raw === "") {
     problems.push({
@@ -23739,8 +23751,9 @@ function integer2(raw, fallback, name, problems) {
     return fallback;
   }
   const n = Number(raw.trim());
-  if (!Number.isSafeInteger(n) || n <= 0) {
-    problems.push({ level: "error", message: `${name} \u5FC5\u987B\u662F\u6B63\u6574\u6570\uFF0C\u6536\u5230 ${JSON.stringify(raw)}` });
+  if (!Number.isSafeInteger(n) || n < 0 || n === 0 && options.allowZero !== true) {
+    const shape = options.allowZero === true ? "\u975E\u8D1F\u6574\u6570" : "\u6B63\u6574\u6570";
+    problems.push({ level: "error", message: `${name} \u5FC5\u987B\u662F${shape}\uFF0C\u6536\u5230 ${JSON.stringify(raw)}` });
     return fallback;
   }
   return n;
@@ -23804,6 +23817,8 @@ function loadConfig(env, version2) {
     pairGlobalBudgetPerSec: integer2(env.DRC_PAIR_GLOBAL_PER_SEC, 20, "DRC_PAIR_GLOBAL_PER_SEC", problems),
     pairStatusBudgetPerSec: integer2(env.DRC_PAIR_STATUS_PER_SEC, 5, "DRC_PAIR_STATUS_PER_SEC", problems),
     maxPendingPairs: integer2(env.DRC_MAX_PENDING_PAIRS, 1e3, "DRC_MAX_PENDING_PAIRS", problems),
+    maxHostTokens: integer2(env.DRC_MAX_HOST_TOKENS, 500, "DRC_MAX_HOST_TOKENS", problems),
+    claimMinIntervalMs: claimMinIntervalMs(env, problems),
     conversationIdleTtlMs: integer2(env.DRC_CONV_IDLE_TTL_MS, 7 * 24 * 3600 * 1e3, "DRC_CONV_IDLE_TTL_MS", problems),
     // P2-⑤（2026-10-04 用户拍板 30 分钟）：远小于 7 天的空闲 TTL。
     // 删的代价是手机再扫一次码；不删的代价是 conversations 计数虚高、排障对不上。
@@ -23855,7 +23870,7 @@ function loadConfig(env, version2) {
 
 // src/server.ts
 import { createServer } from "node:http";
-import { randomUUID as randomUUID2, timingSafeEqual } from "node:crypto";
+import { randomBytes as randomBytes2, randomUUID as randomUUID2, timingSafeEqual } from "node:crypto";
 
 // node_modules/.pnpm/ws@8.22.0/node_modules/ws/wrapper.mjs
 var import_stream = __toESM(require_stream(), 1);
@@ -23867,7 +23882,7 @@ var import_subprotocol = __toESM(require_subprotocol(), 1);
 var import_websocket = __toESM(require_websocket(), 1);
 var import_websocket_server = __toESM(require_websocket_server(), 1);
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.4/node_modules/@dsh-remote/protocol/dist/src/identity/ids.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.0.7/node_modules/@dsh-remote/protocol/dist/src/identity/ids.js
 import { randomBytes, randomUUID } from "node:crypto";
 var CONVERSATION_ID_PREFIX = "c_";
 function newConversationId() {
@@ -23877,10 +23892,10 @@ function newHostId() {
   return randomBytes(4).toString("hex");
 }
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.4/node_modules/@dsh-remote/protocol/dist/src/platform/sleep.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.0.7/node_modules/@dsh-remote/protocol/dist/src/platform/sleep.js
 var SLEEP_BACKENDS = ["caffeinate", "systemd-inhibit", "unsupported"];
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.4/node_modules/@dsh-remote/protocol/dist/src/wire/payloads.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.0.7/node_modules/@dsh-remote/protocol/dist/src/wire/payloads.js
 var SESSION_STATES = [
   "idle",
   "running",
@@ -24291,7 +24306,7 @@ var PAYLOAD_TYPES = {
   evSessionHistory: "ev.session_history"
 };
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.4/node_modules/@dsh-remote/protocol/dist/src/wire/registry.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.0.7/node_modules/@dsh-remote/protocol/dist/src/wire/registry.js
 var ENDPOINT_FRAME_NAMES = [
   "hello",
   "pair-begin",
@@ -24383,7 +24398,7 @@ var CAPABILITY_IDS = [
 ];
 var CAPABILITY_SET = new Set(CAPABILITY_IDS);
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.4/node_modules/@dsh-remote/protocol/dist/src/wire/negotiate.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.0.7/node_modules/@dsh-remote/protocol/dist/src/wire/negotiate.js
 function negotiateProtocol(peerProtocol, own2 = PROTOCOL_VERSION, min = MIN_SUPPORTED_PROTOCOL) {
   if (peerProtocol === void 0 || peerProtocol === null) {
     return verdictFor(1, own2, min, true);
@@ -24423,13 +24438,13 @@ function verdictFor(peer, own2, min, missing) {
   return { ok: true, version: peer, missing };
 }
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.4/node_modules/@dsh-remote/protocol/dist/src/wire/errors.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.0.7/node_modules/@dsh-remote/protocol/dist/src/wire/errors.js
 var WAIT_HINTABLE = /* @__PURE__ */ new Set(["rate_limited", "pair_table_full"]);
 function wantsRetryAfter(code) {
   return typeof code === "string" && WAIT_HINTABLE.has(code);
 }
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.4/node_modules/@dsh-remote/protocol/dist/src/wire/outbound.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.0.7/node_modules/@dsh-remote/protocol/dist/src/wire/outbound.js
 function helloOkForClient(clientId, protocol) {
   return { t: "hello-ok", role: "client", clientId, ...protocol === void 0 ? {} : { protocol } };
 }
@@ -24507,7 +24522,7 @@ function encBatchToRelay(sessionId, items) {
   return { t: "enc-batch", sessionId, items: items.map((item) => ({ ...item })) };
 }
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.4/node_modules/@dsh-remote/protocol/dist/src/wire/classify.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.0.7/node_modules/@dsh-remote/protocol/dist/src/wire/classify.js
 function frameTypeOf(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value))
     return void 0;
@@ -24602,6 +24617,30 @@ import {
 import { dirname } from "node:path";
 var STATE_FILE_VERSION = 1;
 var CONVERSATION_ID_RE = new RegExp(`^${CONVERSATION_ID_PREFIX}[0-9a-f]{12}$`);
+var HOST_TOKEN_RE = /^[0-9a-f]{48}$/;
+var MAX_HOST_ID_LEN = 200;
+function sanitizeHostTokens(raw) {
+  if (!Array.isArray(raw)) return { hostTokens: [], dropped: 0 };
+  const hostTokens = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of raw) {
+    if (typeof item !== "object" || item === null) {
+      continue;
+    }
+    const entry = item;
+    if (typeof entry.hostId !== "string" || entry.hostId.length > MAX_HOST_ID_LEN || entry.hostId !== "" && entry.hostId.trim() !== entry.hostId || !isNonEmptyString(entry.token) || !HOST_TOKEN_RE.test(entry.token) || !isTimestamp(entry.issuedAt) || !isTimestamp(entry.lastUsedAt) || seen.has(entry.hostId)) {
+      continue;
+    }
+    seen.add(entry.hostId);
+    hostTokens.push({
+      hostId: entry.hostId,
+      token: entry.token,
+      issuedAt: entry.issuedAt,
+      lastUsedAt: entry.lastUsedAt
+    });
+  }
+  return { hostTokens, dropped: raw.length - hostTokens.length };
+}
 function isNonEmptyString(value) {
   return typeof value === "string" && value.length > 0;
 }
@@ -24664,8 +24703,27 @@ function readStateFile(path, log) {
   }
   const { conversations, dropped } = sanitize(file2.conversations);
   if (dropped > 0) log.warn("state file entries dropped", { path, dropped, kept: conversations.length });
-  log.info("state file loaded", { path, conversations: conversations.length, dropped });
-  return { version: STATE_FILE_VERSION, savedAt: isTimestamp(file2.savedAt) ? file2.savedAt : 0, conversations };
+  const hostTokenResult = sanitizeHostTokens(file2.hostTokens);
+  if (hostTokenResult.dropped > 0) {
+    log.warn("state file host tokens dropped", {
+      path,
+      dropped: hostTokenResult.dropped,
+      kept: hostTokenResult.hostTokens.length
+    });
+  }
+  log.info("state file loaded", {
+    path,
+    conversations: conversations.length,
+    dropped,
+    hostTokens: hostTokenResult.hostTokens.length
+  });
+  const restored = {
+    version: STATE_FILE_VERSION,
+    savedAt: isTimestamp(file2.savedAt) ? file2.savedAt : 0,
+    conversations
+  };
+  if (hostTokenResult.hostTokens.length > 0) restored.hostTokens = hostTokenResult.hostTokens;
+  return restored;
 }
 function snapshotState(state, now) {
   const conversations = [];
@@ -24680,7 +24738,13 @@ function snapshotState(state, now) {
     if (conv.emptySince !== void 0) conversation.emptySince = conv.emptySince;
     conversations.push(conversation);
   }
-  return { version: STATE_FILE_VERSION, savedAt: now, conversations };
+  const hostTokens = [];
+  for (const [hostId, entry] of state.hostTokens) {
+    hostTokens.push({ hostId, token: entry.token, issuedAt: entry.issuedAt, lastUsedAt: entry.lastUsedAt });
+  }
+  const snapshot = { version: STATE_FILE_VERSION, savedAt: now, conversations };
+  if (hostTokens.length > 0) snapshot.hostTokens = hostTokens;
+  return snapshot;
 }
 function restoreState(path, state, log, now) {
   const file2 = readStateFile(path, log);
@@ -24702,7 +24766,18 @@ function restoreState(path, state, log, now) {
   if (clamped > 0) {
     log.warn("state file timestamps in the future, clamped to now", { path, clamped });
   }
-  log.info("state restored", { path, conversations: state.conversations.size });
+  for (const entry of file2.hostTokens ?? []) {
+    state.hostTokens.set(entry.hostId, {
+      token: entry.token,
+      issuedAt: entry.issuedAt,
+      lastUsedAt: entry.lastUsedAt
+    });
+  }
+  log.info("state restored", {
+    path,
+    conversations: state.conversations.size,
+    hostTokens: state.hostTokens.size
+  });
   return state.conversations.size;
 }
 function syncPath(target, log, strict = true) {
@@ -24751,11 +24826,14 @@ function writeStateFile(path, snapshot, log) {
 
 // src/state.ts
 var WS_OPEN = 1;
+var UNBOUND_HOST_TOKEN_KEY = "";
 var RelayState = class {
   hosts = /* @__PURE__ */ new Map();
   clients = /* @__PURE__ */ new Map();
   pendingPairs = /* @__PURE__ */ new Map();
   conversations = /* @__PURE__ */ new Map();
+  /** 按 hostId 一机一枚（外加 `UNBOUND_HOST_TOKEN_KEY` 那个未绑定槽位）。 */
+  hostTokens = /* @__PURE__ */ new Map();
   /** 测试可注入固定时钟；默认用真实时间。 */
   clock;
   maxPendingPairsValue;
@@ -25120,12 +25198,56 @@ var RelayState = class {
     return dropped;
   }
   /** 测试与诊断：把内部计数摊平成 `/healthz` 需要的形状。 */
+  // ── host token（按 hostId 一机一枚，2026-10-11 起）────────────────────
+  /**
+   * 签发/覆盖 `hostId` 的令牌。**只动这一条**，别人那枚不受影响。
+   *
+   * `lastUsedAt` 归零：这一枚刚签出来还没被用来鉴权过。它只影响诊断与裁剪顺序
+   * （见 `pruneHostTokens`），不参与鉴权判定——鉴权只看 `token` 本身。
+   */
+  issueHostToken(hostId, token, now) {
+    const entry = { token, issuedAt: now, lastUsedAt: 0 };
+    this.hostTokens.set(hostId, entry);
+    return entry;
+  }
+  /** 记下"这枚令牌刚被用来**成功**鉴权"。没这一条时裁剪顺序就退化成"签得早的先丢"。 */
+  markHostTokenUsed(hostId, now) {
+    const entry = this.hostTokens.get(hostId);
+    if (entry) entry.lastUsedAt = now;
+  }
+  /**
+   * 令牌表有界：超出 `max` 时，按 `lastUsedAt || issuedAt` **从旧到新**丢。
+   *
+   * 为什么不是"按签发时刻丢最老"：一台一直在用的机器（签得早、但一直在用）会被
+   * 优先丢掉，而它**不会自愈**——下次它连上来只会拿到 `bad_token`，而它盘上有令牌
+   * 就不会重新认领。所以分两档：**没用过的先丢**，同一档里再按最近活动从旧到新。
+   *
+   * 返回丢掉几条（调用方去记一条 warn）。
+   */
+  pruneHostTokens(max) {
+    if (!Number.isFinite(max) || max <= 0) return 0;
+    if (this.hostTokens.size <= max) return 0;
+    const order = [...this.hostTokens.entries()].sort((a, b) => {
+      const usedA = a[1].lastUsedAt > 0 ? 1 : 0;
+      const usedB = b[1].lastUsedAt > 0 ? 1 : 0;
+      if (usedA !== usedB) return usedA - usedB;
+      return (a[1].lastUsedAt || a[1].issuedAt) - (b[1].lastUsedAt || b[1].issuedAt);
+    });
+    let dropped = 0;
+    for (const [key] of order) {
+      if (this.hostTokens.size <= max) break;
+      this.hostTokens.delete(key);
+      dropped += 1;
+    }
+    return dropped;
+  }
   counts() {
     return {
       hosts: this.hosts.size,
       clients: this.clients.size,
       conversations: this.conversations.size,
-      pendingPairs: this.pendingPairs.size
+      pendingPairs: this.pendingPairs.size,
+      hostTokens: this.hostTokens.size
     };
   }
   /** 全量清空（优雅停机或测试重置）。 */
@@ -25134,6 +25256,7 @@ var RelayState = class {
     this.clients.clear();
     this.pendingPairs.clear();
     this.conversations.clear();
+    this.hostTokens.clear();
   }
 };
 
@@ -25147,6 +25270,9 @@ function tokenMatches(expected, got) {
   if (a.length !== b.length) return false;
   return timingSafeEqual(a, b);
 }
+var CLAIM_TRACK_MAX = 1e4;
+var MAX_HOST_ID_LEN2 = 200;
+var HOST_ID_RE = /^[A-Za-z0-9._:-]+$/;
 function createRelay(config2) {
   const log = new Log(config2.logLevel);
   const state = new RelayState({ maxPendingPairs: config2.maxPendingPairs });
@@ -25155,10 +25281,39 @@ function createRelay(config2) {
   const pairStatusBudget = new Budget(config2.pairStatusBudgetPerSec);
   const peers = /* @__PURE__ */ new WeakMap();
   let shuttingDown = false;
+  const lastClaimAt = /* @__PURE__ */ new Map();
   let sweepTimer;
   let pingTimer;
   let lastPingAt = 0;
   let lastCountersAt = 0;
+  function newHostToken() {
+    return randomBytes2(24).toString("hex");
+  }
+  function rememberClaim(ip, now) {
+    lastClaimAt.set(ip, now);
+    if (lastClaimAt.size <= CLAIM_TRACK_MAX) return;
+    const drop = lastClaimAt.size - CLAIM_TRACK_MAX;
+    let i = 0;
+    for (const key of lastClaimAt.keys()) {
+      lastClaimAt.delete(key);
+      if (++i >= drop) break;
+    }
+  }
+  function hostTokenAccepted(hostId, got) {
+    if (!got) return false;
+    const now = Date.now();
+    const perHost = state.hostTokens.get(hostId);
+    if (perHost && tokenMatches(perHost.token, got)) {
+      state.markHostTokenUsed(hostId, now);
+      return true;
+    }
+    const unbound = state.hostTokens.get(UNBOUND_HOST_TOKEN_KEY);
+    if (unbound && tokenMatches(unbound.token, got)) {
+      state.markHostTokenUsed(UNBOUND_HOST_TOKEN_KEY, now);
+      return true;
+    }
+    return config2.hostToken !== "" && tokenMatches(config2.hostToken, got);
+  }
   const persistence = { enabled: config2.stateFile !== "", restored: 0, savedAt: 0, writes: 0, failures: 0 };
   if (persistence.enabled) {
     persistence.restored = restoreState(config2.stateFile, state, log, startedAt);
@@ -25284,19 +25439,19 @@ function createRelay(config2) {
     }
     peer.protocol = frame.protocol;
     if (frame.role === "host") {
-      if (!config2.hostToken) {
+      const hostId = frame.hostId?.trim() || newHostId();
+      if (!config2.hostToken && state.hostTokens.size === 0) {
         sendError(peer, "internal", "relay has no host token configured");
         peer.ws.close(1011);
         return;
       }
-      if (!frame.token || !tokenMatches(config2.hostToken, frame.token)) {
+      if (!hostTokenAccepted(hostId, frame.token)) {
         peer.authAttempts += 1;
         log.warn("host auth failed", { attempts: peer.authAttempts });
         sendError(peer, "bad_token");
         if (peer.authAttempts >= config2.maxHostAuthAttempts) peer.ws.close(4001, "too_many_auth_attempts");
         return;
       }
-      const hostId = frame.hostId?.trim() || newHostId();
       releaseIdentityFor(peer, { role: "host", id: hostId });
       const { replaced } = state.attachHost(hostId, peer.ws, frame.label ?? "");
       peer.role = "host";
@@ -25756,6 +25911,76 @@ function createRelay(config2) {
       peersNoProtocol: peersWithoutProtocol
     };
   }
+  function readBody(req, limit) {
+    return new Promise((resolve, reject) => {
+      const chunks = [];
+      let size = 0;
+      req.on("data", (chunk) => {
+        size += chunk.length;
+        if (size > limit) {
+          reject(new Error("body_too_large"));
+          req.destroy();
+          return;
+        }
+        chunks.push(chunk);
+      });
+      req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+      req.on("error", reject);
+    });
+  }
+  const CLAIM_BODY_MAX_BYTES = 1024;
+  async function handleClaimToken(req, res) {
+    if (req.method !== "POST") {
+      res.statusCode = 405;
+      res.end(JSON.stringify({ error: "use POST" }));
+      return;
+    }
+    if (shuttingDown) {
+      res.statusCode = 503;
+      res.end(JSON.stringify({ error: "shutting_down" }));
+      return;
+    }
+    const now = Date.now();
+    const ip = req.socket.remoteAddress ?? "unknown";
+    const last = lastClaimAt.get(ip) ?? 0;
+    if (now - last < config2.claimMinIntervalMs) {
+      res.statusCode = 429;
+      res.end(JSON.stringify({ error: "too_soon", retryAfterMs: config2.claimMinIntervalMs - (now - last) }));
+      return;
+    }
+    rememberClaim(ip, now);
+    let body = {};
+    const raw = await readBody(req, CLAIM_BODY_MAX_BYTES);
+    if (raw.trim() !== "") {
+      try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+          body = parsed;
+        }
+      } catch {
+      }
+    }
+    const rawHostId = typeof body.hostId === "string" ? body.hostId.trim() : "";
+    if (rawHostId !== "" && (rawHostId.length > MAX_HOST_ID_LEN2 || !HOST_ID_RE.test(rawHostId))) {
+      res.statusCode = 400;
+      res.end(
+        JSON.stringify({ error: "bad_host_id", hint: `hostId \u6700\u591A ${MAX_HOST_ID_LEN2} \u5B57\u7B26\uFF0C\u53EA\u5141\u8BB8\u5B57\u6BCD\u6570\u5B57\u4E0E ._:-` })
+      );
+      return;
+    }
+    const slot = rawHostId === "" ? UNBOUND_HOST_TOKEN_KEY : rawHostId;
+    const token = newHostToken();
+    state.issueHostToken(slot, token, now);
+    const pruned = state.pruneHostTokens(config2.maxHostTokens);
+    if (pruned > 0) log.warn("host tokens pruned", { dropped: pruned, kept: state.hostTokens.size });
+    markStateChanged();
+    log.info(rawHostId === "" ? "host token claimed (unbound)" : "host token claimed", {
+      ip,
+      hostId: rawHostId,
+      hostTokens: state.hostTokens.size
+    });
+    res.end(JSON.stringify({ token, hostId: rawHostId, rotatedAt: new Date(now).toISOString() }));
+  }
   function httpHandler(req, res) {
     try {
       const url2 = new URL(req.url ?? "/", "http://relay.invalid");
@@ -25765,6 +25990,16 @@ function createRelay(config2) {
         res.end(JSON.stringify(health()));
         return;
       }
+      if (url2.pathname === "/api/claim-token") {
+        void handleClaimToken(req, res).catch((e) => {
+          log.warn("claim handler failed", { error: String(e) });
+          if (!res.headersSent) {
+            res.statusCode = 500;
+            res.end(JSON.stringify({ error: "internal" }));
+          }
+        });
+        return;
+      }
       if (url2.pathname === "/api/info") {
         res.end(JSON.stringify({ publicUrl: config2.publicUrl, protocol: PROTOCOL_VERSION }));
         return;
@@ -25951,7 +26186,7 @@ function registerSignalHandlers(shutdown) {
 
 // src/main.ts
 function readVersion() {
-  if ("3.1.0") return "3.1.0";
+  if ("3.1.3") return "3.1.3";
   try {
     const pkg = JSON.parse(readFileSync2(new URL("../../package.json", import.meta.url), "utf8"));
     if (typeof pkg.version === "string") return pkg.version;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dsh-remote/relay",
-  "version": "3.1.0",
+  "version": "3.1.3",
   "description": "DSH Remote Control 的零知识 WebSocket 中继：只做路由，不碰载荷明文。可自托管的单文件产物。",
   "type": "module",
   "license": "MIT",