@walkhi/code-relax 0.1.0-beta.1 → 0.1.0-beta.3

package/dist/src/self-relay/connector.mjs

@@ -1,7 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { EventEmitter } from 'node:events';
 import WebSocket from 'ws';
-import { decode, loopbackUrl, relayAddress, send } from './wire.mjs';
+import { decode, loopbackUrl, relayAddress, send } from './wire.mjs';
 import { createP2pProbe, validProbeSignal } from './p2p-probe.mjs';
 import { createWindowsRouteHelper } from './windows-route-helper.mjs';
 
@@ -59,7 +59,8 @@ export function connectBridgeRelay({ relayUrl, hostKey, bridgeUrl, bridgeToken,
         if (message.type === 'attach') {
           events.emit('attached', { session: message.session, clientId: message.clientId });
           dropLocal(message.session);
-          const current = { socket: undefined, ready: false, timer: undefined, p2pProbe: p2pProbe && message.p2pProbe === 1 };
+          const current = { socket: undefined, ready: false, timer: undefined, p2pProbe: p2pProbe && message.p2pProbe === 1,
+            bridgeOutbound: Promise.resolve() };
           locals.set(message.session, current);
           let connection;
           try {
@@ -69,7 +70,13 @@ export function connectBridgeRelay({ relayUrl, hostKey, bridgeUrl, bridgeToken,
             send(remote, { type: 'detach', session: message.session }); dropLocal(message.session); events.emit('detached', { session: message.session });
             events.emit('diagnostic', 'Local Bridge connection not ready'); return;
           }
-          const socket = current.socket = new WebSocket(connection.url, { maxPayload: 64 * 1024 * 1024, perMessageDeflate: false });
+          const socket = current.socket = new WebSocket(connection.url, { maxPayload: 64 * 1024 * 1024, perMessageDeflate: false });
+          current.forwardToBridge = payload => {
+            if (locals.get(message.session) !== current || !current.ready) throw new Error('Local Bridge connection not ready');
+            const request = decode(payload, false);
+            if (!['request', 'subscribe', 'unsubscribe'].includes(request.type)) throw new Error('Unsupported LAN message');
+            send(socket, request);
+          };
           current.timer = setTimeout(() => socket.terminate(), 5000);
           socket.on('open', () => send(socket, { type: 'auth', token: connection.token }));
           socket.on('error', error => events.emit('diagnostic', `Local Bridge: ${error.message}`));
@@ -84,7 +91,15 @@ export function connectBridgeRelay({ relayUrl, hostKey, bridgeUrl, bridgeToken,
               if (!current.ready) {
                 if (response.type !== 'ready') throw new Error('Local Bridge authentication failed');
                 clearTimeout(current.timer); current.ready = true; send(remote, { type: 'ready', session: message.session });
-              } else send(remote, { type: 'data', session: message.session, payload: data.toString() });
+              } else {
+                const payload = data.toString();
+                current.bridgeOutbound = current.bridgeOutbound.then(async () => {
+                  const probe = await current.probe;
+                  if (locals.get(message.session) !== current || !current.ready) return;
+                  if (!probe?.send?.(payload)) send(remote, { type: 'data', session: message.session, payload });
+                });
+                void current.bridgeOutbound.catch(error => { events.emit('diagnostic', error.message); socket.terminate(); });
+              }
             } catch (error) { events.emit('diagnostic', error.message); socket.terminate(); }
           });
         } else if (message.type === 'p2p-probe' && locals.has(message.session)) {
@@ -101,7 +116,9 @@ export function connectBridgeRelay({ relayUrl, hostKey, bridgeUrl, bridgeToken,
               signal: signal => {
                 if (locals.get(message.session) === current && current.probeId === probeId) send(remote, { type: 'p2p-probe', session: message.session,
                   version: 1, probeId, ...signal });
-              }, report: (state, diagnostic) => events.emit('p2p-probe', { state, diagnostic })
+              },
+              onData: payload => current.forwardToBridge(payload),
+              report: (state, diagnostic) => events.emit('p2p-probe', { state, diagnostic })
             })).catch(() => {
               events.emit('diagnostic', p2pWindowsRouteHelper ? 'Windows RTC 路由辅助不可用' : 'WebRTC probe initialization failed');
               return { receive() {}, close() {} };
@@ -121,9 +138,7 @@ export function connectBridgeRelay({ relayUrl, hostKey, bridgeUrl, bridgeToken,
         else if (message.type === 'data' && locals.has(message.session)) {
           const current = locals.get(message.session);
           if (!current.ready) { send(remote, { type: 'detach', session: message.session }); dropLocal(message.session); return; }
-          const request = decode(message.payload, false);
-          if (!['request', 'subscribe', 'unsubscribe'].includes(request.type)) throw new Error('Unsupported LAN message');
-          send(current.socket, request);
+          current.forwardToBridge(message.payload);
         }
       } catch (error) { events.emit('diagnostic', error.message); remote.close(1008, 'Invalid relay message'); }
     });

package/dist/src/self-relay/demo.mjs

@@ -6,7 +6,7 @@ import { connectBridgeRelay } from './connector.mjs';
 import { connectRelayClient } from './client.mjs';
 import { secret } from './wire.mjs';
 
-export async function startRelayDemo({ mode = 'lan-shared', pairingTtlMs, dispatch, remoteRelay, hostName = 'TEST-PC', lanCandidates = [] } = {}) {
+export async function startRelayDemo({ mode = 'lan-shared', pairingTtlMs, dispatch, remoteRelay, hostName = 'TEST-PC', lanCandidates = [], relayOptions = {} } = {}) {
   if (!['lan-legacy', 'lan-shared'].includes(mode)) throw new Error('Invalid demo mode');
   const token = secret(), calls = [];
   const bridge = http.createServer((_request, response) => { response.writeHead(404); response.end(); });
@@ -22,7 +22,7 @@ export async function startRelayDemo({ mode = 'lan-shared', pairingTtlMs, dispat
     reply.json(404, { error: '模拟 Bridge 不执行真实任务' });
   } });
   await new Promise(resolve => bridge.listen(0, '127.0.0.1', resolve));
-  const relay = remoteRelay ? { ...remoteRelay, async close() {} } : await startSelfRelay({ pairingTtlMs });
+  const relay = remoteRelay ? { ...remoteRelay, async close() {} } : await startSelfRelay({ pairingTtlMs, ...relayOptions });
   const bridgeUrl = `ws://127.0.0.1:${bridge.address().port}/api/socket`;
   const identity = remoteRelay ? { id: randomUUID(), secret: secret() } : undefined;
   const clientId = randomUUID(), credential = secret();

package/dist/src/self-relay/lifecycle.mjs

@@ -219,7 +219,7 @@ async function worker(stateRoot, instanceId, refresh = false, requiredMode = '')
         if (![1008, 4401, 4406, 4409, 4429].includes(event.code)) scheduleRetry();
       });
       const registration = await current.ready;
-      if (registration.protocolVersion !== 3 || registration.room !== identity.id) {
+      if (registration.protocolVersion !== 7 || registration.room !== identity.id) {
         current.events.removeAllListeners(); current.close(); throw Object.assign(new Error('中继服务器尚未升级设备授权协议，未使用临时配对降级。'), { code: 4401 });
       }
       if (!identity.registered) {

package/dist/src/self-relay/p2p-probe.mjs

@@ -1,83 +1,123 @@
-import { randomUUID } from 'node:crypto';
-import P2pDiagnostics from '../../shared/p2p-diagnostics.cjs';
-
-// Reserve this narrow range so a full-TUN client can identify only the P2P UDP flow.
-const PROBE_UDP_PORT_RANGE = Object.freeze({ begin: 42000, end: 42031 });
-
-// Capability probe only: never accepts or forwards Bridge business messages.
-export async function createP2pProbe({ signal, report = () => {}, iceServers = [] }) {
-  if (!validProbeIceServers(iceServers)) throw new Error('Invalid probe STUN configuration');
-  const { default: rtc } = await import('node-datachannel');
-  const peer = new rtc.PeerConnection('code-relax-probe', {
-    iceServers,
-    maxMessageSize: 4096,
-    portRangeBegin: PROBE_UDP_PORT_RANGE.begin,
-    portRangeEnd: PROBE_UDP_PORT_RANGE.end
-  });
-  const diagnostic = new P2pDiagnostics();
-  let channel, closed = false, answered = false, candidates = [], received = 0, verified = false;
-  const nonce = randomUUID();
-  const timer = setTimeout(() => finish(verified ? 'closed' : 'timeout'), 15000);
-  function finish(state) {
-    if (closed) return;
-    closed = true; clearTimeout(timer); candidates = [];
-    const summary = diagnostic.snapshot(state);
-    channel?.close(); peer.close(); report(state, summary);
-  }
-  peer.onIceStateChange(state => { if (!closed) diagnostic.ice = state; });
-  peer.onGatheringStateChange(state => { if (!closed) diagnostic.gathering = state; });
-  peer.onStateChange(state => { if (!closed && (state === 'failed' || state === 'closed')) { diagnostic.error = 'peer'; finish('failed'); } });
-  peer.onLocalDescription((sdp, type) => { if (!closed) { diagnostic.offer = type === 'offer'; signal({ kind: type, sdp, iceServers }); } });
-  peer.onLocalCandidate((candidate, mid) => { if (!closed) { diagnostic.candidate('local', candidate); signal({ kind: 'candidate', candidate, mid }); } });
-  channel = peer.createDataChannel('code-relax-probe-v1');
-  channel.onOpen(() => { if (!closed) { diagnostic.open = true; channel.sendMessage(JSON.stringify({ type: 'ping', nonce })); } });
-  channel.onError(() => { if (!closed) diagnostic.error = 'channel'; finish('failed'); });
-  channel.onClosed(() => finish('closed'));
-  channel.onMessage(value => {
-    try {
-      if (closed) return;
-      if (typeof value !== 'string' || value.length > 4096 || ++received > 4) throw new Error('Invalid probe frame');
-      const message = JSON.parse(value);
-      if (message.type === 'ping' && /^[\w-]{16,128}$/.test(message.nonce)) {
-        diagnostic.ping = true;
-        channel.sendMessage(JSON.stringify({ type: 'pong', nonce: message.nonce }));
-      } else if (message.type === 'pong' && message.nonce === nonce) {
-        diagnostic.pong = true; verified = true; report('verified', diagnostic.snapshot('verified'));
-      } else throw new Error('Invalid probe response');
-    } catch { diagnostic.error = 'frame'; finish('failed'); }
-  });
-  return {
-    receive(message) {
-      if (closed) return;
-      if (message.kind === 'answer' && !answered) {
-        try { peer.setRemoteDescription(message.sdp, 'answer'); }
-        catch { diagnostic.error = 'description'; finish('failed'); return; }
-        answered = true; diagnostic.answer = true;
-        for (const item of candidates) peer.addRemoteCandidate(item.candidate, item.mid);
-        candidates = [];
-      } else if (message.kind === 'candidate') {
-        diagnostic.candidate('remote', message.candidate);
-        if (answered) peer.addRemoteCandidate(message.candidate, message.mid);
-        else if (candidates.length < 64) candidates.push(message);
-        else finish('failed');
-      } else if (message.kind === 'close') finish('closed');
-      else finish('failed');
-    },
-    close() { finish('closed'); }
-  };
-}
-
-export function validProbeSignal(value) {
-  if (!value || value.version !== 1 || !/^[\w-]{16,128}$/.test(value.probeId || '')) return false;
-  if (['start', 'close'].includes(value.kind)) return true;
-  if (['offer', 'answer'].includes(value.kind)) return typeof value.sdp === 'string' && value.sdp.length <= 65536 &&
-    (value.iceServers === undefined || validProbeIceServers(value.iceServers));
-  if (value.kind === 'candidate') return typeof value.candidate === 'string' && value.candidate.length <= 2048 &&
-    typeof value.mid === 'string' && value.mid.length <= 64;
-  return false;
-}
-
-export function validProbeIceServers(value) {
-  return Array.isArray(value) && value.length <= 4 && value.every(item =>
-    typeof item === 'string' && /^stun:[a-zA-Z0-9.-]+:[0-9]{1,5}$/.test(item) && Number(item.split(':').at(-1)) <= 65535);
-}
+import { randomUUID } from 'node:crypto';
+import P2pDiagnostics from '../../shared/p2p-diagnostics.cjs';
+import P2pDataFramer from '../../shared/p2p-data-channel.cjs';
+
+const PROBE_UDP_PORT_RANGE = Object.freeze({ begin: 42000, end: 42031 });
+const HIGH_WATER = 1024 * 1024;
+const LOW_WATER = 512 * 1024;
+const MAX_QUEUED = 16 * 1024 * 1024;
+
+export async function createP2pProbe({ signal, report = () => {}, onData = () => {}, iceServers = [] }) {
+  if (!validProbeIceServers(iceServers)) throw new Error('Invalid probe STUN configuration');
+  const { default: rtc } = await import('node-datachannel');
+  const peer = new rtc.PeerConnection('code-relax-probe', {
+    iceServers,
+    maxMessageSize: 65536,
+    portRangeBegin: PROBE_UDP_PORT_RANGE.begin,
+    portRangeEnd: PROBE_UDP_PORT_RANGE.end
+  });
+  const diagnostic = new P2pDiagnostics();
+  const framer = new P2pDataFramer();
+  const dataPrefix = randomUUID().replaceAll('-', '');
+  let channel, closed = false, answered = false, candidates = [], verified = false, remoteDirect = false;
+  let pingReceived = false, pongReceived = false, dataSerial = 0, queuedBytes = 0;
+  const outbound = [];
+  const nonce = randomUUID();
+  const timer = setTimeout(() => finish(verified ? 'closed' : 'timeout'), 15000);
+  function finish(state) {
+    if (closed) return;
+    closed = true; clearTimeout(timer); candidates = []; queuedBytes = 0; outbound.length = 0; framer.reset();
+    const summary = diagnostic.snapshot(state);
+    channel?.close(); peer.close(); report(state, summary);
+  }
+  function verify() {
+    if (verified || !pingReceived || !pongReceived) return;
+    verified = true; clearTimeout(timer);
+    report(remoteDirect ? 'direct' : 'verified', diagnostic.snapshot('verified'));
+    pump();
+  }
+  function pump() {
+    if (!verified || !remoteDirect || closed || !channel?.isOpen()) return;
+    try {
+      while (outbound.length && channel.bufferedAmount() < HIGH_WATER) {
+        const item = outbound[0], frame = framer.frame(item);
+        if (!channel.sendMessage(frame)) return;
+        if (framer.commit(item)) { outbound.shift(); queuedBytes -= item.bytes; }
+      }
+    } catch { diagnostic.error = 'channel'; finish('failed'); }
+  }
+  function sendData(payload) {
+    if (!verified || !remoteDirect || closed || !channel?.isOpen()) return false;
+    let item;
+    try { item = framer.create(payload, `${dataPrefix}-${++dataSerial}`); }
+    catch { return false; }
+    if (queuedBytes + item.bytes > MAX_QUEUED) return false;
+    outbound.push(item); queuedBytes += item.bytes; pump(); return true;
+  }
+  peer.onIceStateChange(state => { if (!closed) diagnostic.ice = state; });
+  peer.onGatheringStateChange(state => { if (!closed) diagnostic.gathering = state; });
+  peer.onStateChange(state => { if (!closed && (state === 'failed' || state === 'closed')) { diagnostic.error = 'peer'; finish('failed'); } });
+  peer.onLocalDescription((sdp, type) => { if (!closed) { diagnostic.offer = type === 'offer'; signal({ kind: type, sdp, iceServers, direct: 1 }); } });
+  peer.onLocalCandidate((candidate, mid) => { if (!closed) { diagnostic.candidate('local', candidate); signal({ kind: 'candidate', candidate, mid }); } });
+  channel = peer.createDataChannel('code-relax-probe-v1');
+  channel.setBufferedAmountLowThreshold(LOW_WATER);
+  channel.onBufferedAmountLow(pump);
+  channel.onOpen(() => { if (!closed) { diagnostic.open = true; channel.sendMessage(JSON.stringify({ type: 'ping', nonce })); } });
+  channel.onError(() => { if (!closed) diagnostic.error = 'channel'; finish('failed'); });
+  channel.onClosed(() => finish('closed'));
+  channel.onMessage(value => {
+    try {
+      if (closed || typeof value !== 'string' || value.length > 65536) throw new Error('Invalid P2P frame');
+      const message = JSON.parse(value);
+      const data = framer.accept(message);
+      if (data.handled) {
+        if (!verified || !remoteDirect) throw new Error('P2P transport not verified');
+        if (data.complete) onData(data.payload);
+        return;
+      }
+      if (message.type === 'ping' && /^[\w-]{16,128}$/.test(message.nonce)) {
+        diagnostic.ping = true; pingReceived = true;
+        channel.sendMessage(JSON.stringify({ type: 'pong', nonce: message.nonce }));
+      } else if (message.type === 'pong' && message.nonce === nonce) {
+        diagnostic.pong = true; pongReceived = true;
+      } else throw new Error('Invalid P2P response');
+      verify();
+    } catch { diagnostic.error = 'frame'; finish('failed'); }
+  });
+  return {
+    receive(message) {
+      if (closed) return;
+      if (message.kind === 'answer' && !answered) {
+        try { peer.setRemoteDescription(message.sdp, 'answer'); }
+        catch { diagnostic.error = 'description'; finish('failed'); return; }
+        answered = true; remoteDirect = message.direct === 1; diagnostic.answer = true;
+        for (const item of candidates) peer.addRemoteCandidate(item.candidate, item.mid);
+        candidates = [];
+      } else if (message.kind === 'candidate') {
+        diagnostic.candidate('remote', message.candidate);
+        if (answered) peer.addRemoteCandidate(message.candidate, message.mid);
+        else if (candidates.length < 64) candidates.push(message);
+        else finish('failed');
+      } else if (message.kind === 'close') finish('closed');
+      else finish('failed');
+    },
+    send: sendData,
+    close() { finish('closed'); }
+  };
+}
+
+export function validProbeSignal(value) {
+  if (!value || value.version !== 1 || !/^[\w-]{16,128}$/.test(value.probeId || '')) return false;
+  if (['start', 'close'].includes(value.kind)) return true;
+  if (['offer', 'answer'].includes(value.kind)) return typeof value.sdp === 'string' && value.sdp.length <= 65536 &&
+    (value.direct === undefined || value.direct === 1) &&
+    (value.iceServers === undefined || validProbeIceServers(value.iceServers));
+  if (value.kind === 'candidate') return typeof value.candidate === 'string' && value.candidate.length <= 2048 &&
+    typeof value.mid === 'string' && value.mid.length <= 64;
+  return false;
+}
+
+export function validProbeIceServers(value) {
+  return Array.isArray(value) && value.length <= 4 && value.every(item =>
+    typeof item === 'string' && /^stun:[a-zA-Z0-9.-]+:[0-9]{1,5}$/.test(item) && Number(item.split(':').at(-1)) <= 65535);
+}

package/dist/src/self-relay/server.mjs

@@ -1,17 +1,19 @@
 import http from 'node:http';
 import { deviceStore, validId } from './device-store.mjs';
-import { randomUUID } from 'node:crypto';
+import { randomUUID } from 'node:crypto';
 import { WebSocketServer } from 'ws';
 import { secret, digest, matches, validSecret, send, decode } from './wire.mjs';
 import { readDebugAllowlist, debugAllowed } from './debug-allowlist.mjs';
 import { validProbeSignal } from './p2p-probe.mjs';
-
+import { relayAdminState } from './admin-state.mjs';
+
 // Always loopback; a TLS reverse proxy supplies the private-trial Internet endpoint.
 export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlMs = 120000,
   maxConnections = 32, maxClientsPerHost = 16, maxPayload = 8 * 1024 * 1024, stateFile,
-  publicRelayUrl = '', appDownloadUrl = '', debugAllowlistFile, log = () => {} } = {}) {
+  maxRelaySessions = 8, adminStateFile, publicRelayUrl = '', appDownloadUrl = '', debugAllowlistFile, log = () => {} } = {}) {
   if (!validSecret(hostKey)) throw new Error('Invalid host credential');
   if (!Number.isSafeInteger(maxClientsPerHost) || maxClientsPerHost < 1 || maxClientsPerHost > 64) throw new Error('Invalid mobile device limit');
+  if (!Number.isSafeInteger(maxRelaySessions) || maxRelaySessions < 1 || maxRelaySessions > 256) throw new Error('Invalid relay session limit');
   if (publicRelayUrl) relayPublicAddress(publicRelayUrl);
   // Harmony's native WebSocket supplies the endpoint Origin automatically.
   // libwebsockets can use http even for WSS; trust only the configured endpoint.
@@ -20,6 +22,8 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
   const hostHash = digest(hostKey), rooms = new Map();
   const store = deviceStore(stateFile);
   const debugAllowlist = readDebugAllowlist(debugAllowlistFile);
+  const adminState = relayAdminState(adminStateFile, maxRelaySessions);
+  let activeRelaySessions = 0;
   for (const record of store.entries()) rooms.set(record.id, { ...record, durable: true, connections: new Map(), observers: new Map() });
   function commit(room, changes) {
     const next = { ...room, ...changes, updatedAt: new Date().toISOString() };
@@ -46,6 +50,13 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
   }
   const server = http.createServer((request, response) => {
     const target = new URL(request.url || '/', `http://${request.headers.host || 'localhost'}`);
+    if (target.pathname === '/admin' || target.pathname.startsWith('/admin/')) {
+      void handleAdmin(request, response, target); return;
+    }
+    if (request.method === 'GET' && target.pathname === '/announcement') {
+      const body = JSON.stringify({ announcement: adminState.read().announcement });
+      response.writeHead(200, pairingHeaders('application/json; charset=utf-8', body)); response.end(body); return;
+    }
     if (request.method !== 'GET' || !['/pair', '/pair/resolve'].includes(target.pathname)) {
       response.writeHead(404, { 'Cache-Control': 'no-store' }); response.end(); return;
     }
@@ -57,7 +68,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
       response.writeHead(410, pairingHeaders(json ? 'application/json; charset=utf-8' : 'text/html; charset=utf-8', body)); response.end(body); return;
     }
     if (target.pathname === '/pair/resolve' || /application\/json/i.test(request.headers.accept || '')) {
-      const body = JSON.stringify({ version: 3, relayUrl: relayUrl(request), room: room.id, expires: room.expires });
+      const body = JSON.stringify({ version: 6, relayUrl: relayUrl(request), room: room.id, expires: room.expires });
       response.writeHead(200, pairingHeaders('application/json; charset=utf-8', body)); response.end(body); return;
     }
     const secure = request.socket.encrypted || request.headers['x-forwarded-proto'] === 'https';
@@ -65,6 +76,63 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
     const body = pairingPage({ deepLink: `codex-remote://pair?url=${encodeURIComponent(current.href)}`, expires: room.expires, appDownloadUrl });
     response.writeHead(200, pairingHeaders('text/html; charset=utf-8', body)); response.end(body);
   });
+  function adminReply(response, status, body, type = 'application/json; charset=utf-8') {
+    const value = typeof body === 'string' ? body : JSON.stringify(body);
+    response.writeHead(status, { 'Content-Type': type, 'Content-Length': Buffer.byteLength(value), 'Cache-Control': 'no-store',
+      'X-Content-Type-Options': 'nosniff', 'Content-Security-Policy': "default-src 'self'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'" });
+    response.end(value);
+  }
+  async function handleAdmin(request, response, target) {
+    if (request.method === 'GET' && target.pathname === '/admin') {
+      adminReply(response, 200, adminPage(), 'text/html; charset=utf-8'); return;
+    }
+    if (request.method === 'GET' && target.pathname === '/admin/api/status') {
+      const state = adminState.read();
+      adminReply(response, 200, { maxRelaySessions: state.maxRelaySessions, activeRelaySessions,
+        activeExemptRelaySessions: [...rooms.values()].reduce((sum, room) => sum + [...room.connections.values()].filter(connection => connection.relayExempt).length, 0),
+        websocketConnections: wss.clients.size, onlineComputers: [...rooms.values()].filter(room => room.host).length,
+        activePhones: [...rooms.values()].reduce((sum, room) => sum + room.connections.size, 0), announcement: state.announcement }); return;
+    }
+    if (!['PUT', 'DELETE'].includes(request.method || '') || request.headers['content-type'] !== 'application/json' ||
+        request.headers['x-code-relax-admin'] !== '1') { adminReply(response, 405, { error: 'Unsupported admin request' }); return; }
+    try {
+      const body = request.method === 'DELETE' ? {} : JSON.parse(await readBody(request, 4096));
+      if (target.pathname === '/admin/api/settings' && request.method === 'PUT') {
+        const state = adminState.setMaxRelaySessions(body.maxRelaySessions);
+        log({ event: 'admin-relay-limit-updated', maxRelaySessions: state.maxRelaySessions });
+      } else if (target.pathname === '/admin/api/announcement' && request.method === 'PUT') {
+        const state = adminState.publish(body.title, body.message); broadcastAnnouncement(state.announcement);
+        log({ event: 'admin-announcement-published', announcementId: state.announcement.id });
+      } else if (target.pathname === '/admin/api/announcement' && request.method === 'DELETE') {
+        const state = adminState.withdraw(); broadcastAnnouncement(state.announcement);
+        log({ event: 'admin-announcement-withdrawn' });
+      } else { adminReply(response, 404, { error: 'Admin route not found' }); return; }
+      adminReply(response, 200, { ok: true });
+    } catch (error) { adminReply(response, 400, { error: error.message }); }
+  }
+  function broadcastAnnouncement(announcement) {
+    for (const room of rooms.values()) {
+      for (const observer of room.observers.values()) send(observer.ws, { type: 'announcement', announcement });
+      for (const connection of room.connections.values()) send(connection.ws, { type: 'announcement', announcement });
+    }
+  }
+  function releaseRelay(connection) {
+    if (!connection?.relayAdmitted) return;
+    connection.relayAdmitted = false; activeRelaySessions = Math.max(0, activeRelaySessions - 1);
+  }
+  function admitRelay(connection, room) {
+    if (connection.relayAdmitted || connection.relayExempt) return true;
+    if (connection.capacityExempt) {
+      connection.relayExempt = true;
+      log({ event: 'relay-capacity-exempt', device: room.id }); return true;
+    }
+    const limit = adminState.read().maxRelaySessions;
+    if (activeRelaySessions >= limit) {
+      log({ event: 'relay-capacity-rejected', device: room.id, activeRelaySessions, maxRelaySessions: limit }); return false;
+    }
+    connection.relayAdmitted = true; activeRelaySessions++;
+    log({ event: 'relay-capacity-admitted', device: room.id, activeRelaySessions, maxRelaySessions: limit }); return true;
+  }
   const wss = new WebSocketServer({ noServer: true, maxPayload, perMessageDeflate: {
     serverNoContextTakeover: true, clientNoContextTakeover: true,
     threshold: 1024, concurrencyLimit: 4, zlibDeflateOptions: { level: 3 },
@@ -81,12 +149,24 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
     }
     wss.handleUpgrade(request, socket, head, ws => wss.emit('connection', ws));
   });
-  wss.on('connection', ws => {
+  wss.on('connection', ws => {
     let role, room, session, clientId, alive = true;
     const authTimer = setTimeout(() => ws.close(1008, 'Authentication timeout'), 5000);
     ws.on('pong', () => { alive = true; });
     const heartbeat = setInterval(() => { if (!alive) ws.terminate(); else { alive = false; ws.ping(); } }, 30000);
-    const fail = (code = 4401, reason = 'Device authorization rejected') => ws.close(code, reason);
+    const fail = (code = 4401, reason = 'Device authorization rejected') => ws.close(code, reason);
+    const queueClientMessage = (connection, message, pause = 0) => {
+      const bytes = Buffer.byteLength(JSON.stringify(message));
+      connection.queuedBytes = (connection.queuedBytes || 0) + bytes;
+      if (connection.queuedBytes > 40 * 1024 * 1024) {
+        connection.ws.close(1013, 'Receiver too slow'); return;
+      }
+      connection.outbound = (connection.outbound || Promise.resolve()).then(async () => {
+        if (pause > 0) await new Promise(resolve => setTimeout(resolve, pause));
+        connection.queuedBytes -= bytes;
+        send(connection.ws, message);
+      }).catch(() => connection.ws.close(1011, 'Relay delivery failed'));
+    };
     ws.on('error', () => {}); // close owns routing cleanup.
     ws.on('close', (code, reason) => {
       log({ event: 'closed', role: role || 'unauthenticated', device: room?.id, code, reason: reason.toString() });
@@ -97,6 +177,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
         if (!room.durable) rooms.delete(room.id);
         for (const connection of room.connections.values()) connection.ws.close(4410, 'Computer offline; authorization retained');
       } else if (role === 'client' && room?.connections.get(clientId)?.ws === ws) {
+        releaseRelay(room.connections.get(clientId));
         room.connections.delete(clientId);
         if (room.host) send(room.host, { type: 'detach', session });
       } else if (role === 'observer' && room?.observers.get(clientId)?.ws === ws) {
@@ -143,7 +224,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
               send(observer.ws, { type: 'lan-candidates', candidates: room.lanCandidates });
             }
             const invite = room.clients.length ? {} : invitation(room);
-            send(ws, { type: 'registered', protocolVersion: 3, room: room.id, paired: room.clients.length > 0,
+            send(ws, { type: 'registered', protocolVersion: 7, room: room.id, paired: room.clients.length > 0,
               clientCount: room.clients.length, clients: room.clients, revision: room.revision, ...invite }); return;
           }
           room = rooms.get(message.room);
@@ -177,6 +258,8 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
             room.observers.set(clientId, { ws });
             send(ws, { type: 'observing', online: Boolean(room.host) });
             send(ws, { type: 'debug-permissions', enabled: debugAllowed(debugAllowlist, room.id, room.clients.find(client => client.id === clientId)) });
+            const announcement = adminState.read().announcement;
+            if (announcement) send(ws, { type: 'announcement', announcement });
             if (room.hostName) send(ws, { type: 'computer-info', hostName: room.hostName });
             if (room.lanCandidates?.length) send(ws, { type: 'lan-candidates', candidates: room.lanCandidates });
             if (room.officialComputer) send(ws, { type: 'official-computer', computer: room.officialComputer });
@@ -186,14 +269,19 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
           const oldConnection = room.connections.get(clientId);
           role = 'client'; clearTimeout(authTimer); session = randomUUID();
           if (oldConnection?.ws && oldConnection.ws !== ws) {
+            releaseRelay(oldConnection);
             send(room.host, { type: 'detach', session: oldConnection.session });
             oldConnection.ws.close(4409, 'Phone connection replaced by same identity');
           }
           room.connections.set(clientId, { ws, session, p2pProbe: room.p2pProbe && message.p2pProbe === 1,
-            repeat: room.p2pProbeRepeat, signals: 0, probeStarted: 0 });
-          send(ws, { type: 'paired', protocolVersion: 3, room: room.id, clientId, revision: room.revision, ...(credential ? { credential } : {}) });
+            repeat: room.p2pProbeRepeat, signals: 0, probeStarted: 0, outbound: Promise.resolve(), queuedBytes: 0,
+            relayAdmitted: false, relayExempt: false,
+            capacityExempt: debugAllowed(debugAllowlist, room.id, room.clients.find(client => client.id === clientId)) });
+          send(ws, { type: 'paired', protocolVersion: 7, room: room.id, clientId, revision: room.revision, ...(credential ? { credential } : {}) });
           send(ws, { type: 'computer-info', hostName: room.hostName });
           if (room.lanCandidates?.length) send(ws, { type: 'lan-candidates', candidates: room.lanCandidates });
+          const announcement = adminState.read().announcement;
+          if (announcement) send(ws, { type: 'announcement', announcement });
           send(room.host, { type: 'attach', session, clientId, p2pProbe: room.connections.get(clientId).p2pProbe ? 1 : 0 }); return;
         }
         if (role === 'host') {
@@ -214,6 +302,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
             commit(room, { clients: [], revision: room.revision + 1 });
             room.pairingHash = undefined;
             for (const connection of room.connections.values()) {
+              releaseRelay(connection);
               send(ws, { type: 'detach', session: connection.session });
               connection.ws.close(4401, 'Device authorization revoked');
             }
@@ -225,8 +314,8 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
           }
           const connection = [...room.connections.values()].find(item => item.session === message.session);
           if (!connection) return; // Late frames from an ended session.
-          if (message.type === 'data' && typeof message.payload === 'string') send(connection.ws, { type: 'data', payload: message.payload });
-          else if (message.type === 'ready') send(connection.ws, { type: 'ready', p2pProbe: connection.p2pProbe ? 1 : 0,
+          if (message.type === 'data' && typeof message.payload === 'string') queueClientMessage(connection, { type: 'data', payload: message.payload });
+          else if (message.type === 'ready') queueClientMessage(connection, { type: 'ready', p2pProbe: connection.p2pProbe ? 1 : 0,
             p2pProbeRepeat: connection.p2pProbe && connection.repeat });
           else if (message.type === 'p2p-probe' && connection.p2pProbe && validProbeSignal(message)) {
             if (connection.probeId !== message.probeId) return;
@@ -251,7 +340,13 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
           if (connection.probeId !== message.probeId) return;
           if (++connection.signals > 150) return fail(1008, 'Probe signal limit');
           send(room.host, { ...message, session });
+        } else if (room.connections.get(clientId)?.ws === ws && message.type === 'p2p-route' && message.direct === 1) {
+          releaseRelay(room.connections.get(clientId));
         } else if (room.connections.get(clientId)?.ws === ws && message.type === 'data' && typeof message.payload === 'string') {
+          const connection = room.connections.get(clientId);
+          if (!controlPayload(message.payload) && !admitRelay(connection, room)) {
+            ws.close(4428, 'Server busy'); return;
+          }
           send(room.host, { type: 'data', session, payload: message.payload });
         } else fail();
       } catch (error) { log({ event: 'request-error', role, message: 'Relay operation failed' }); ws.close(1011, 'Relay operation failed'); }
@@ -338,3 +433,34 @@ function plainLabel(value) {
 function plainText(value, limit, empty) {
   return typeof value === 'string' && (empty || value.trim().length > 0) && value.trim().length <= limit && !/[\u0000-\u001f\u007f]/.test(value);
 }
+
+function controlPayload(value) {
+  try {
+    const message = JSON.parse(value);
+    if (message.type === 'unsubscribe') return true;
+    return ['request', 'subscribe'].includes(message.type) && typeof message.path === 'string' &&
+      (message.path === '/api/health' || message.path.startsWith('/api/shared-recovery'));
+  } catch { return false; }
+}
+
+function readBody(request, limit) {
+  return new Promise((resolve, reject) => {
+    let value = '';
+    request.setEncoding('utf8');
+    request.on('data', chunk => {
+      value += chunk;
+      if (Buffer.byteLength(value) > limit) { reject(new Error('Admin request too large')); request.destroy(); }
+    });
+    request.on('end', () => resolve(value)); request.on('error', reject);
+  });
+}
+
+function adminPage() {
+  return `<!doctype html><html lang="zh-CN"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Code Relax 管理</title><style>
+body{margin:0;background:#0d1210;color:#eef4f0;font:15px system-ui,sans-serif}main{max-width:760px;margin:40px auto;padding:0 20px}section{background:#151d19;border:1px solid #2a3931;border-radius:14px;padding:18px;margin:16px 0}h1{font-size:24px}h2{font-size:17px}label{display:block;margin:12px 0 6px;color:#aab7af}input,textarea{box-sizing:border-box;width:100%;padding:11px;border:1px solid #43564b;border-radius:9px;background:#0d1210;color:#eef4f0}textarea{min-height:120px;resize:vertical}button{margin:12px 8px 0 0;padding:10px 16px;border:0;border-radius:9px;background:#2c7653;color:white}button.secondary{background:#39443e}pre{white-space:pre-wrap;color:#b9c8bf}.row{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:10px}.metric{padding:12px;background:#0d1210;border-radius:9px}.metric b{display:block;font-size:22px}</style><main><h1>Code Relax 管理</h1><section><h2>运行状态</h2><div id="metrics" class="row"></div><button onclick="load()">刷新</button></section><section><h2>服务器转发容量</h2><label>最大并发 WSS 转发会话</label><input id="limit" type="number" min="1" max="256"><button onclick="saveLimit()">保存</button></section><section><h2>系统公告</h2><label>标题</label><input id="title" maxlength="80"><label>正文</label><textarea id="message" maxlength="2000"></textarea><button onclick="publish()">发布</button><button class="secondary" onclick="withdraw()">撤下</button><pre id="current"></pre></section><pre id="result"></pre><script>
+const request=async(path,options={})=>{const response=await fetch(path,options);const body=await response.json();if(!response.ok)throw new Error(body.error||('HTTP '+response.status));return body};
+async function load(){try{const s=await request('/admin/api/status');limit.value=s.maxRelaySessions;metrics.innerHTML='<div class="metric"><b>'+s.activeRelaySessions+'</b>受限转发 / '+s.maxRelaySessions+'</div><div class="metric"><b>'+s.activeExemptRelaySessions+'</b>白名单转发</div><div class="metric"><b>'+s.websocketConnections+'</b>WebSocket</div><div class="metric"><b>'+s.onlineComputers+'</b>在线工作站</div><div class="metric"><b>'+s.activePhones+'</b>活动手机</div>';current.textContent=s.announcement?s.announcement.title+'\\n'+s.announcement.message+'\\n'+s.announcement.publishedAt:'当前无公告';}catch(e){result.textContent=e.message}}
+const write=(method,path,body)=>request(path,{method,headers:{'Content-Type':'application/json','X-Code-Relax-Admin':'1'},body:JSON.stringify(body)}).then(()=>{result.textContent='已保存';return load()}).catch(e=>result.textContent=e.message);
+function saveLimit(){return write('PUT','/admin/api/settings',{maxRelaySessions:Number(limit.value)})}function publish(){return write('PUT','/admin/api/announcement',{title:title.value,message:message.value})}function withdraw(){return write('DELETE','/admin/api/announcement',{})}load();
+</script></main></html>`;
+}