@swimmingliu/autovpn 2.0.3 → 2.1.0

package/dist/pipeline/speedtest.js

@@ -1,6 +1,7 @@
-import net from 'node:net';
 import tls from 'node:tls';
 import { openMihomoRuntime as defaultOpenMihomoRuntime, probeMihomoProxyDelay as defaultProbeMihomoProxyDelay } from './proxy-runtime.js';
+import { mapWithCompletion } from './concurrency.js';
+import { HTTP_HEAD_LIMIT_BYTES, connectProxySocket, httpStatusLine, parseProxyEndpoint, safeParseHttpStatus, splitHttpResponseHead } from './http-transport.js';
 import { retryTransientNetwork } from './network-retry.js';
 const PROBE_MAX_ATTEMPTS = 2;
 export function aggregateSpeedMeasurements(values) {
@@ -52,31 +53,10 @@ function emitEvent(callback, eventType, payload) {
         callback(eventType, payload);
     }
 }
-async function mapWithConcurrency(items, concurrency, worker, onComplete) {
-    const limit = Math.max(1, Math.trunc(Number(concurrency) || 1));
-    const results = new Array(items.length);
-    let nextIndex = 0;
-    let completed = 0;
-    async function runWorker() {
-        while (nextIndex < items.length) {
-            const index = nextIndex;
-            nextIndex += 1;
-            const result = await worker(items[index], index);
-            results[index] = result;
-            completed += 1;
-            onComplete?.(result, index, completed);
-        }
-    }
-    const workers = await Promise.allSettled(Array.from({ length: Math.min(limit, items.length) }, () => runWorker()));
-    const failed = workers.find((result) => result.status === 'rejected');
-    if (failed) {
-        throw failed.reason;
-    }
-    return results;
-}
 function defaultNow() {
     return performance.now();
 }
+/** Shared-concurrency loop plus the progress hook speedtest emits per finished link. */
 async function fetchWithTimeout(fetchImpl, url, timeoutMs) {
     const controller = new AbortController();
     let internallyTimedOut = false;
@@ -87,6 +67,9 @@ async function fetchWithTimeout(fetchImpl, url, timeoutMs) {
     try {
         const response = await fetchImpl(url, { signal: controller.signal });
         if (internallyTimedOut) {
+            // The headers arrived after we gave up: release the body/socket too.
+            const cancellation = response.body?.cancel?.();
+            void Promise.resolve(cancellation).catch(() => { });
             const error = new Error(`request timed out after ${timeoutMs}ms`);
             error.code = 'AUTOVPN_INTERNAL_TIMEOUT';
             throw error;
@@ -126,6 +109,7 @@ async function readResponseBytes(response, maxBytes, timeoutMs) {
         const reader = response.body.getReader();
         let timedOut = false;
         let reachedCap = false;
+        let failed = false;
         try {
             return await withBodyTimeout(async () => {
                 let total = 0;
@@ -143,11 +127,14 @@ async function readResponseBytes(response, maxBytes, timeoutMs) {
             }, timeoutMs);
         }
         catch (error) {
+            failed = true;
             timedOut = error instanceof Error && error.message.includes('response body timed out');
             throw error;
         }
         finally {
-            if (timedOut || reachedCap) {
+            // Any exit that did not drain the body naturally must release the
+            // keep-alive connection instead of leaving the reader locked.
+            if (failed || timedOut || reachedCap) {
                 await reader.cancel().catch(() => { });
             }
             reader.releaseLock();
@@ -158,104 +145,132 @@ async function readResponseBytes(response, maxBytes, timeoutMs) {
 function requireOkResponse(response, allowedStatuses) {
     const status = Number(response.status ?? 200);
     if (response.ok === false || !allowedStatuses.has(status)) {
+        // Release the keep-alive socket for a body we are about to abandon.
+        const cancellation = response.body?.cancel?.();
+        void Promise.resolve(cancellation).catch(() => { });
         throw new Error(`unexpected status ${status}`);
     }
 }
 async function retryTransientProbe(operation) {
     return retryTransientNetwork(operation, { maxAttempts: PROBE_MAX_ATTEMPTS, delayMs: 0 });
 }
-function socketConnect(host, port, timeoutMs) {
+function waitForHandshake(socket, timeoutMs) {
     return new Promise((resolve, reject) => {
-        const socket = net.createConnection({ host, port });
-        const timer = setTimeout(() => {
-            socket.destroy();
-            reject(new Error(`proxy connection timed out after ${timeoutMs}ms`));
-        }, timeoutMs);
-        socket.once('connect', () => {
-            clearTimeout(timer);
-            resolve(socket);
-        });
-        socket.once('error', (error) => {
+        let settled = false;
+        const cleanup = () => {
             clearTimeout(timer);
+            socket.off('secureConnect', onSecureConnect);
+            socket.off('error', onError);
+        };
+        const fail = (error) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            cleanup();
+            socket.destroy();
             reject(error);
-        });
+        };
+        const timer = setTimeout(() => {
+            const error = new Error(`TLS handshake timed out after ${timeoutMs}ms`);
+            error.code = 'AUTOVPN_INTERNAL_TIMEOUT';
+            fail(error);
+        }, timeoutMs);
+        function onSecureConnect() {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            cleanup();
+            resolve();
+        }
+        function onError(error) {
+            fail(error);
+        }
+        socket.once('secureConnect', onSecureConnect);
+        socket.once('error', onError);
     });
 }
-function splitHttpHeaders(buffer) {
-    const marker = buffer.indexOf('\r\n\r\n');
-    if (marker < 0) {
-        return undefined;
-    }
-    return {
-        head: buffer.subarray(0, marker).subarray(0),
-        body: buffer.subarray(marker + 4).subarray(0)
-    };
-}
-function parseHttpStatus(head) {
-    const firstLine = head.toString('latin1').split('\r\n')[0] ?? '';
-    const match = /^HTTP\/\d(?:\.\d)?\s+(\d+)/i.exec(firstLine);
-    if (!match) {
-        throw new Error(`invalid HTTP response: ${firstLine}`);
-    }
-    return Number(match[1]);
-}
 function readHttpBodyBytes(socket, maxBytes, timeoutMs) {
     return new Promise((resolve, reject) => {
         let buffered = Buffer.alloc(0);
         let headersParsed = false;
         let total = 0;
-        const timer = setTimeout(() => {
-            cleanup();
-            socket.destroy();
-            reject(new Error(`proxy download timed out after ${timeoutMs}ms`));
-        }, timeoutMs);
+        let settled = false;
         const cleanup = () => {
             clearTimeout(timer);
             socket.off('data', onData);
             socket.off('end', onEnd);
             socket.off('error', onError);
         };
-        const finish = (bytes) => {
+        // Single terminal point: stop listening, close the handle, then settle once.
+        const settle = (action) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
             cleanup();
             socket.destroy();
-            resolve(bytes);
-        };
-        const onError = (error) => {
-            cleanup();
-            reject(error);
-        };
-        const onEnd = () => {
-            cleanup();
-            resolve(total);
+            action();
         };
+        const fail = (error) => settle(() => reject(error));
+        const timer = setTimeout(() => fail(new Error(`proxy download timed out after ${timeoutMs}ms`)), timeoutMs);
+        function onError(error) {
+            fail(error);
+        }
+        function onEnd() {
+            if (!headersParsed) {
+                // A captive portal / block page that closes before a parseable head:
+                // fail this link instead of reporting a zero-byte download.
+                fail(buffered.byteLength > 0
+                    ? new Error(`invalid HTTP response: ${httpStatusLine(buffered)}`)
+                    : new Error('proxy response ended before HTTP headers were received'));
+                return;
+            }
+            settle(() => resolve(total));
+        }
         const countBody = (chunk) => {
             total += Math.min(chunk.byteLength, Math.max(maxBytes - total, 0));
             if (total >= maxBytes) {
-                finish(maxBytes);
+                settle(() => resolve(maxBytes));
             }
         };
-        const onData = (chunk) => {
-            if (!headersParsed) {
-                buffered = Buffer.concat([buffered, chunk]);
-                const split = splitHttpHeaders(buffered);
-                if (!split) {
-                    return;
-                }
-                const status = parseHttpStatus(split.head);
-                if (status < 200 || status >= 300) {
-                    cleanup();
-                    socket.destroy();
-                    reject(new Error(`unexpected status ${status}`));
+        function onData(chunk) {
+            if (settled) {
+                return;
+            }
+            try {
+                if (!headersParsed) {
+                    buffered = Buffer.concat([buffered, chunk]);
+                    const split = splitHttpResponseHead(buffered);
+                    if (!split) {
+                        if (buffered.byteLength > HTTP_HEAD_LIMIT_BYTES) {
+                            fail(new Error(`invalid HTTP response: ${httpStatusLine(buffered)}`));
+                        }
+                        return;
+                    }
+                    const status = safeParseHttpStatus(split.head);
+                    if (status === null) {
+                        fail(new Error(`invalid HTTP response: ${httpStatusLine(split.head)}`));
+                        return;
+                    }
+                    if (status < 200 || status >= 300) {
+                        fail(new Error(`unexpected status ${status}`));
+                        return;
+                    }
+                    headersParsed = true;
+                    buffered = Buffer.alloc(0);
+                    if (split.body.byteLength > 0) {
+                        countBody(split.body);
+                    }
                     return;
                 }
-                headersParsed = true;
-                if (split.body.byteLength > 0) {
-                    countBody(split.body);
-                }
-                return;
+                countBody(chunk);
             }
-            countBody(chunk);
-        };
+            catch (error) {
+                fail(error instanceof Error ? error : new Error(String(error)));
+            }
+        }
         socket.on('data', onData);
         socket.once('end', onEnd);
         socket.once('error', onError);
@@ -264,92 +279,116 @@ function readHttpBodyBytes(socket, maxBytes, timeoutMs) {
 function readConnectResponse(socket, timeoutMs) {
     return new Promise((resolve, reject) => {
         let buffered = Buffer.alloc(0);
-        const timer = setTimeout(() => {
-            cleanup();
-            socket.destroy();
-            reject(new Error(`proxy CONNECT timed out after ${timeoutMs}ms`));
-        }, timeoutMs);
+        let settled = false;
         const cleanup = () => {
             clearTimeout(timer);
             socket.off('data', onData);
+            socket.off('end', onEnd);
             socket.off('error', onError);
         };
-        const onError = (error) => {
+        const fail = (error) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
             cleanup();
+            socket.destroy();
             reject(error);
         };
-        const onData = (chunk) => {
+        const timer = setTimeout(() => fail(new Error(`proxy CONNECT timed out after ${timeoutMs}ms`)), timeoutMs);
+        function onError(error) {
+            fail(error);
+        }
+        function onEnd() {
+            fail(new Error('proxy CONNECT response ended before HTTP headers were received'));
+        }
+        function onData(chunk) {
+            if (settled) {
+                return;
+            }
             buffered = Buffer.concat([buffered, chunk]);
-            const split = splitHttpHeaders(buffered);
+            const split = splitHttpResponseHead(buffered);
             if (!split) {
+                if (buffered.byteLength > HTTP_HEAD_LIMIT_BYTES) {
+                    fail(new Error(`invalid HTTP response: ${httpStatusLine(buffered)}`));
+                }
+                return;
+            }
+            const status = safeParseHttpStatus(split.head);
+            if (status === null) {
+                fail(new Error(`invalid HTTP response: ${httpStatusLine(split.head)}`));
                 return;
             }
-            const status = parseHttpStatus(split.head);
-            cleanup();
             if (status < 200 || status >= 300) {
-                socket.destroy();
-                reject(new Error(`proxy CONNECT failed with status ${status}`));
+                fail(new Error(`proxy CONNECT failed with status ${status}`));
                 return;
             }
+            settled = true;
+            cleanup();
             resolve();
-        };
+        }
         socket.on('data', onData);
+        socket.once('end', onEnd);
         socket.once('error', onError);
     });
 }
 export async function downloadUrlViaHttpProxy(url, proxyUrl, maxBytes, timeoutSeconds) {
     const target = new URL(url);
-    const proxy = new URL(proxyUrl);
     const timeoutMs = Math.max(1, timeoutSeconds) * 1000;
-    const proxyPort = Number(proxy.port || 80);
-    const socket = await socketConnect(proxy.hostname, proxyPort, timeoutMs);
+    if (target.protocol !== 'http:' && target.protocol !== 'https:') {
+        throw new Error(`unsupported speedtest URL protocol: ${target.protocol}`);
+    }
+    const endpoint = parseProxyEndpoint(proxyUrl);
+    const socket = await connectProxySocket(endpoint, timeoutMs);
     const requestPath = `${target.pathname || '/'}${target.search}`;
     const targetPort = Number(target.port || (target.protocol === 'https:' ? 443 : 80));
-    if (target.protocol === 'http:') {
+    const proxyAuthorization = endpoint.authorization ? [`Proxy-Authorization: ${endpoint.authorization}`] : [];
+    let secureSocket;
+    try {
+        if (target.protocol === 'http:') {
+            socket.write([
+                `GET ${target.toString()} HTTP/1.1`,
+                `Host: ${target.host}`,
+                ...proxyAuthorization,
+                'Connection: close',
+                '',
+                ''
+            ].join('\r\n'));
+            return await readHttpBodyBytes(socket, Math.max(1, maxBytes), timeoutMs);
+        }
         socket.write([
-            `GET ${target.toString()} HTTP/1.1`,
+            `CONNECT ${target.hostname}:${targetPort} HTTP/1.1`,
+            `Host: ${target.hostname}:${targetPort}`,
+            ...proxyAuthorization,
+            'Connection: keep-alive',
+            '',
+            ''
+        ].join('\r\n'));
+        await readConnectResponse(socket, timeoutMs);
+        secureSocket = tls.connect({
+            socket,
+            servername: target.hostname,
+            rejectUnauthorized: false
+        });
+        // Destroying a TLSSocket after the request-scoped listeners are removed
+        // must not surface as an uncaught 'error'.
+        secureSocket.on('error', () => { });
+        await waitForHandshake(secureSocket, timeoutMs);
+        secureSocket.write([
+            `GET ${requestPath} HTTP/1.1`,
             `Host: ${target.host}`,
             'Connection: close',
             '',
             ''
         ].join('\r\n'));
-        return await readHttpBodyBytes(socket, Math.max(1, maxBytes), timeoutMs);
+        return await readHttpBodyBytes(secureSocket, Math.max(1, maxBytes), timeoutMs);
     }
-    if (target.protocol !== 'https:') {
+    finally {
+        // Every terminal branch (success, non-2xx, parse failure, timeout, handshake
+        // failure) releases both handles. destroy() is idempotent.
+        secureSocket?.destroy();
         socket.destroy();
-        throw new Error(`unsupported speedtest URL protocol: ${target.protocol}`);
     }
-    socket.write([
-        `CONNECT ${target.hostname}:${targetPort} HTTP/1.1`,
-        `Host: ${target.hostname}:${targetPort}`,
-        'Connection: keep-alive',
-        '',
-        ''
-    ].join('\r\n'));
-    await readConnectResponse(socket, timeoutMs);
-    const secureSocket = tls.connect({
-        socket,
-        servername: target.hostname,
-        rejectUnauthorized: false
-    });
-    await new Promise((resolve, reject) => {
-        const timer = setTimeout(() => {
-            secureSocket.destroy();
-            const error = new Error(`TLS handshake timed out after ${timeoutMs}ms`);
-            error.code = 'AUTOVPN_INTERNAL_TIMEOUT';
-            reject(error);
-        }, timeoutMs);
-        secureSocket.once('secureConnect', () => { clearTimeout(timer); resolve(); });
-        secureSocket.once('error', (error) => { clearTimeout(timer); reject(error); });
-    });
-    secureSocket.write([
-        `GET ${requestPath} HTTP/1.1`,
-        `Host: ${target.host}`,
-        'Connection: close',
-        '',
-        ''
-    ].join('\r\n'));
-    return await readHttpBodyBytes(secureSocket, Math.max(1, maxBytes), timeoutMs);
 }
 async function probeLinksDirect(links, config, options, onComplete) {
     const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
@@ -358,13 +397,17 @@ async function probeLinksDirect(links, config, options, onComplete) {
     }
     const now = options.now ?? defaultNow;
     const timeoutMs = Math.max(1, Number(config.timeout_seconds)) * 1000;
-    return mapWithConcurrency(links, config.concurrency, async (link) => {
+    return mapWithCompletion(links, config.concurrency, async (link) => {
         try {
             return await retryTransientProbe(async () => {
                 const started = now();
                 const response = await fetchWithTimeout(fetchImpl, config.probe_url, timeoutMs);
                 const elapsed = Math.max(now() - started, 1);
                 requireOkResponse(response, new Set([200, 204]));
+                // A reachability probe never reads the body; cancel it so the
+                // keep-alive connection goes back to the pool instead of leaking.
+                const cancellation = response.body?.cancel?.();
+                void Promise.resolve(cancellation).catch(() => { });
                 return { link, reachable: true, latency_ms: Math.max(Math.round(elapsed), 1), error: '' };
             });
         }
@@ -376,7 +419,7 @@ async function probeLinksDirect(links, config, options, onComplete) {
 async function probeLinksMihomo(links, config, runtimePath, options, onComplete) {
     const openRuntime = options.openMihomoRuntime ?? defaultOpenMihomoRuntime;
     const probeDelay = options.probeMihomoProxyDelay ?? defaultProbeMihomoProxyDelay;
-    return mapWithConcurrency(links, config.concurrency, async (link) => {
+    return mapWithCompletion(links, config.concurrency, async (link) => {
         try {
             return await retryTransientProbe(async () => {
                 let runtime;
@@ -542,7 +585,7 @@ async function speedtestInNode(input, options) {
         latency_ms: probe.latency_ms,
         error: probe.error ?? ''
     }));
-    const testedResults = await mapWithConcurrency(candidateLinks, config.concurrency, async (link) => (testLink(link, config, { runtime_path: runtimePath })), (result, _index, completed) => {
+    const testedResults = await mapWithCompletion(candidateLinks, config.concurrency, async (link) => (testLink(link, config, { runtime_path: runtimePath })), (result, _index, completed) => {
         if (result.reachable && result.latency_ms <= 0) {
             result.latency_ms = probeByLink.get(result.link)?.latency_ms ?? 0;
         }

package/dist/pool/account-store.js

@@ -302,7 +302,8 @@ export class AccountStore {
             deleted: 0,
             expiring_soon: 0,
             by_brand: [],
-            db_path: this.dbPath
+            db_path: this.dbPath,
+            expiry_unknown: 0
         };
         const soon = isoDay(new Date(this.now().getTime() + 7 * 86_400_000));
         const today = isoDay(this.now());
@@ -311,12 +312,27 @@ export class AccountStore {
             stats[row.status] += 1;
             if (row.deleted_at !== null)
                 stats.deleted += 1;
+            // Only live rows count: a retired row's unknown date is history, not a
+            // gap the operator can still close by refreshing the pool.
+            const expiryUnknown = row.deleted_at === null && row.expires_at === '';
+            if (expiryUnknown)
+                stats.expiry_unknown += 1;
             if (row.status === 'active' && row.expires_at && row.expires_at >= today && row.expires_at <= soon) {
                 stats.expiring_soon += 1;
             }
-            const bucket = brands.get(row.brand) ?? { brand: row.brand, total: 0, active: 0, disabled: 0, expired: 0, invalid: 0 };
+            const bucket = brands.get(row.brand) ?? {
+                brand: row.brand,
+                total: 0,
+                active: 0,
+                disabled: 0,
+                expired: 0,
+                invalid: 0,
+                expiry_unknown: 0
+            };
             bucket.total += 1;
             bucket[row.status] += 1;
+            if (expiryUnknown)
+                bucket.expiry_unknown += 1;
             brands.set(row.brand, bucket);
         }
         stats.by_brand = [...brands.values()].sort((left, right) => left.brand.localeCompare(right.brand));
@@ -393,8 +409,21 @@ export class AccountStore {
         this.db.prepare('UPDATE accounts SET fail_count = fail_count + 1, updated_at = ? WHERE id = ?').run(stamp, id);
         this.setStatus(id, 'invalid', reason, 'invalidated');
     }
+    /**
+     * Retire a row because its membership is gone.
+     *
+     * Same semantics as `expireDue`: status='expired', a soft delete, and a
+     * 'expired' event, so a row retired by the date sweep and one retired by the
+     * pipeline's login (a vendor that rejects a lapsed credential without
+     * stating a date) are indistinguishable in the UI. `setExpiryById` revives
+     * exactly this shape once a fresh date is learned.
+     */
     markExpired(id, reason = 'membership expired') {
-        this.setStatus(id, 'expired', reason, 'expired');
+        // `setExpiryById` revives a lapse only when the reason is the canonical one,
+        // so a caller passing an empty string must not create a row no renewal can
+        // bring back.
+        const detail = String(reason ?? '').trim() || 'membership expired';
+        this.setStatus(id, 'expired', detail, 'expired');
     }
     disable(brand, account, reason = 'disabled by operator') {
         const id = this.findId(brand, account);
@@ -449,9 +478,16 @@ export class AccountStore {
      * a stored `2026/1/5` would sort above every ISO date and never retire the
      * row. Returns null when the value is not a date, so the caller can refuse
      * instead of writing something the sweep will skip forever.
+     *
+     * Renewing a row this function itself retired brings it back: a fresh date on
+     * or after today clears the 'membership expired' retirement, exactly as an
+     * import revives a row. Only that exact shape is revived — `invalid` rows and
+     * operator-disabled rows keep their retirement, because a new membership date
+     * says nothing about a rejected password or an explicit disable.
      */
     setExpiryById(id, expiresAt) {
-        if (!this.hasId(id))
+        const row = this.db.prepare('SELECT status, status_reason FROM accounts WHERE id = ?').get(Math.trunc(id));
+        if (!row)
             return false;
         const normalized = normalizeExpiry(expiresAt);
         if (normalized === null)
@@ -459,6 +495,12 @@ export class AccountStore {
         const stamp = isoNow(this.now());
         this.db.prepare('UPDATE accounts SET expires_at = ?, updated_at = ? WHERE id = ?').run(normalized, stamp, id);
         this.event(id, 'expiry_set', normalized || '(cleared)');
+        if (normalized && normalized >= isoDay(this.now()) && row.status === 'expired' && row.status_reason === 'membership expired') {
+            this.db
+                .prepare(`UPDATE accounts SET status = 'active', status_reason = '', deleted_at = NULL, updated_at = ? WHERE id = ?`)
+                .run(stamp, Math.trunc(id));
+            this.event(id, 'revived', normalized);
+        }
         this.expireDue();
         return true;
     }

package/dist/server/http.js

@@ -206,6 +206,17 @@ export async function createAutoVpnServer(options) {
                 writeJson(response, result.ok === false ? 400 : 200, result);
                 return;
             }
+            if (request.method === 'POST' && url.pathname === '/api/accounts/expiry') {
+                const body = await readJsonBody(request);
+                const result = await options.runtime.setAccountExpiry?.({
+                    id: Number(body.id ?? 0),
+                    brand: String(body.brand ?? ''),
+                    account: String(body.account ?? ''),
+                    expires_at: body.expires_at === undefined ? undefined : String(body.expires_at)
+                }) ?? { ok: false, error: 'accounts_unavailable' };
+                writeJson(response, result.ok === false ? 400 : 200, result);
+                return;
+            }
             if (request.method === 'POST' && url.pathname === '/api/qr') {
                 const body = await readJsonBody(request);
                 const text = String(body.text ?? '');

package/dist/server/runtime.js

@@ -8,7 +8,7 @@ import { followLog as defaultFollowLog } from '../jobs/logs.js';
 import { latestJobId, loadJob } from '../jobs/read.js';
 import { AccountStore } from '../pool/account-store.js';
 import { normalizeBrand } from '../pool/brands.js';
-import { parseAccountFile } from '../pool/csv.js';
+import { parseAccountFile, normalizeExpiry } from '../pool/csv.js';
 import { readRunProgress } from '../pipeline/run-store.js';
 import { resolveArtifactsRoot, resolveProfilePath } from '../runtime/paths.js';
 const DEPLOY_SECRET_KEYS = new Set([
@@ -475,6 +475,32 @@ export function createServerRuntime(options) {
                 store.close();
             }
         },
+        async setAccountExpiry(input = {}) {
+            const id = Number(input.id);
+            const brand = normalizeBrand(input.brand);
+            const account = String(input.account ?? '').trim();
+            const byId = Number.isInteger(id) && id > 0;
+            if (!byId && (!brand || !account))
+                return { ok: false, error: 'id_or_brand_and_account_required' };
+            // An absent `expires_at` is a bad request, not "clear the date": the old
+            // CLI wrote '' on a missing flag and erased known expiries. Clearing is
+            // spelled as an explicit empty string.
+            if (input.expires_at === undefined)
+                return { ok: false, error: 'expires_at_required' };
+            const expiresAt = String(input.expires_at);
+            const store = new AccountStore({ env: options.env, now: options.now });
+            try {
+                const ok = byId ? store.setExpiryById(id, expiresAt) : store.setExpiry(brand, account, expiresAt);
+                if (ok === null)
+                    return { ok: false, error: 'invalid_date', ...(byId ? { id } : { brand }) };
+                if (!ok)
+                    return { ok: false, error: 'account_not_found' };
+                return { ok: true, ...(byId ? { id } : { brand }), expires_at: normalizeExpiry(expiresAt) };
+            }
+            finally {
+                store.close();
+            }
+        },
         async startRun(runOptions = {}) {
             if (runState === 'running' || runState === 'stopping') {
                 return { ok: false, error: 'run_already_active' };

package/dist/server/web-adapter.js

@@ -172,6 +172,18 @@ export function renderWebAdapterScript(options = {}) {
       method: 'POST',
       body: JSON.stringify(payload || {})
     }),
+    // The H5 build reaches the same expiry editor the Electron preload
+    // exposes; without this the browser UI hides the affordance entirely.
+    // Accepts both shapes the renderer may use: (id, date) like the preload
+    // bridge, or ({id, expires_at}).
+    setAccountExpiry: async (idOrPayload, date) => request('/api/accounts/expiry', {
+      method: 'POST',
+      body: JSON.stringify(
+        idOrPayload && typeof idOrPayload === 'object'
+          ? idOrPayload
+          : { id: idOrPayload, expires_at: date }
+      )
+    }),
     accountsTemplate: async () => ({ ok: true, content: ${JSON.stringify(accountsTemplate())} }),
     runPipeline: async (options = {}) => request('/api/runs', {
       method: 'POST',