@walkhi/code-relax 0.1.0-beta.10 → 0.1.0-beta.101

package/dist/src/project-management.mjs

@@ -0,0 +1,59 @@
+import path from 'node:path';
+
+const fail = (message, statusCode = 400) => { throw Object.assign(new Error(message), { statusCode }); };
+const pathKey = value => process.platform === 'win32' ? value.toLowerCase() : value;
+
+function absoluteDirectory(value) {
+  if (typeof value !== 'string' || !value.trim() || !path.isAbsolute(value.trim())) fail('请输入电脑上的绝对文件夹路径。');
+  return path.normalize(value.trim());
+}
+
+async function directory(rpc, value) {
+  const target = absoluteDirectory(value);
+  const stat = await rpc('fs/getMetadata', { path: target });
+  if (!stat.isDirectory) fail(`此路径不是文件夹：${target}`);
+  return target;
+}
+
+function folderName(value) {
+  if (typeof value !== 'string' || !value.trim() || /[<>:"/\\|?*\x00-\x1f]/.test(value) || /[ .]$/.test(value)
+    || /^(?:con|prn|aux|nul|com[1-9¹²³]|lpt[1-9¹²³])(?:\.|$)/i.test(value) || ['.', '..'].includes(value)) {
+    fail('文件夹名称无效，请勿使用路径分隔符或系统保留名称。');
+  }
+  return value;
+}
+
+export async function projectRoots(rpc, roots) {
+  if (!Array.isArray(roots)) fail('项目文件夹列表无效。');
+  const result = [], seen = new Set();
+  for (const root of roots) {
+    const target = await directory(rpc, root?.path);
+    const key = pathKey(target);
+    if (seen.has(key)) fail(`重复的项目文件夹：${target}`);
+    seen.add(key); result.push({ path: target });
+  }
+  return result;
+}
+
+export function projectSummary(project) {
+  return { projectId: project.id, name: project.name, label: project.name, roots: project.roots,
+    path: project.roots[0]?.path || '', cwd: project.roots[0]?.path || '', hostId: 'local' };
+}
+
+export async function browseProjectFolders(rpc, locations, value) {
+  const target = absoluteDirectory(value || locations?.home);
+  const entries = (await rpc('fs/readDirectory', { path: target })).entries
+    .filter(entry => entry.isDirectory).map(entry => ({ name: entry.fileName, path: path.join(target, entry.fileName) }))
+    .sort((a, b) => a.name.localeCompare(b.name, 'zh-CN', { numeric: true }));
+  return { path: target, parent: path.dirname(target) === target ? null : path.dirname(target), entries, ...(locations || {}) };
+}
+
+export async function createProjectFolder(rpc, body) {
+  const parent = await directory(rpc, body.parent);
+  const name = folderName(body.name);
+  const entries = (await rpc('fs/readDirectory', { path: parent })).entries;
+  if (entries.some(entry => pathKey(entry.fileName) === pathKey(name))) fail('同名文件夹已存在，请选择它或使用其他名称。', 409);
+  const target = path.join(parent, name);
+  await rpc('fs/createDirectory', { path: target, recursive: false });
+  return { path: target };
+}

package/dist/src/project-remove.mjs

@@ -0,0 +1,55 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { readRecord, writeRecord } from './service-lifecycle.mjs';
+import { withDesktopProjectRegistration } from './platform/desktop-project-registration.mjs';
+
+const pending = new Map();
+const uuid = /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i;
+
+export async function removeWorkstationProject(server, stateRoot, codexDataRoot, projectId, body, dependencies = {}) {
+  if (!projectId || !uuid.test(body.idempotencyKey || '')) throw Object.assign(new Error('项目移除标识无效。'), { statusCode: 400 });
+  const record = path.join(stateRoot, 'project-remove-operations', `${body.idempotencyKey}.json`);
+  const running = pending.get(record);
+  if (running) {
+    if (running.projectId !== projectId) throw Object.assign(new Error('同一请求不能移除其他项目。'), { statusCode: 409 });
+    return running.promise;
+  }
+  const promise = perform().finally(() => pending.delete(record));
+  pending.set(record, { projectId, promise });
+  return promise;
+
+  async function perform() {
+    await fs.mkdir(path.dirname(record), { recursive: true });
+    const operation = readRecord(record) || { projectId };
+    if (operation.projectId !== projectId) throw Object.assign(new Error('移除标识已用于其他项目。'), { statusCode: 409 });
+    if (operation.result) return operation.result;
+    const save = () => writeRecord(record, operation);
+    const registration = dependencies.registration || withDesktopProjectRegistration;
+    return registration({ stateRoot, codexDataRoot, operationId: body.idempotencyKey, operation: 'remove',
+      confirmed: body.confirmDesktopRestart === true, serverUrl: server.url }, async desktop => {
+      if (!operation.project) {
+        operation.project = (await server.request('project/read', { projectId })).project;
+        if (operation.project.id !== projectId) throw new Error('项目身份不一致，未执行移除。');
+        save();
+      }
+      const removeNative = async () => {
+        if (operation.nativeDeleted) return;
+        if (operation.deleteAttempted) {
+          // An explicit retry first resolves an earlier unknown response.
+          try { await server.request('project/read', { projectId }); }
+          catch (error) {
+            if (error.message !== `project not found: ${projectId}`) throw error;
+            operation.nativeDeleted = true; save(); return;
+          }
+        }
+        operation.deleteAttempted = true; save();
+        await server.request('project/delete', { projectId });
+        operation.nativeDeleted = true; save();
+      };
+      const desktopRemoval = await desktop.remove(operation.project, operation, save, removeNative);
+      operation.result = { projectId, desktopRemoval };
+      save();
+      return operation.result;
+    });
+  }
+}

package/dist/src/project-update.mjs

@@ -0,0 +1,59 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { readRecord, writeRecord } from './service-lifecycle.mjs';
+import { projectRoots, projectSummary } from './project-management.mjs';
+import { withDesktopProjectRegistration } from './platform/desktop-project-registration.mjs';
+
+const pending = new Map();
+const fail = message => { throw Object.assign(new Error(message), { statusCode: 409 }); };
+const rootKey = roots => JSON.stringify(roots.map(root => process.platform === 'win32' ? path.normalize(root.path).toLowerCase() : path.normalize(root.path)));
+const same = (a, b) => a.name === b.name && rootKey(a.roots) === rootKey(b.roots);
+
+export async function updateWorkstationProject(server, stateRoot, codexDataRoot, projectId, body, dependencies = {}) {
+  const name = typeof body.name === 'string' ? body.name.trim() : '';
+  if (!name || !Array.isArray(body.roots) || body.roots.some(root => typeof root?.path !== 'string' || !path.isAbsolute(root.path.trim()))
+    || !/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(body.idempotencyKey || '')) fail('项目名称、文件夹或操作标识无效。');
+  const target = { name, roots: body.roots.map(root => ({ path: path.normalize(root.path.trim()) })) };
+  const signature = createHash('sha256').update(JSON.stringify({ projectId, ...target })).digest('hex');
+  const record = path.join(stateRoot, 'project-update-operations', `${body.idempotencyKey}.json`);
+  const active = pending.get(record);
+  if (active) { if (active.signature !== signature) fail('同一请求不能修改其他项目内容。'); return active.promise; }
+  const promise = perform().finally(() => pending.delete(record));
+  pending.set(record, { signature, promise }); return promise;
+
+  async function perform() {
+    await fs.mkdir(path.dirname(record), { recursive: true });
+    const operation = readRecord(record) || { signature };
+    if (operation.signature !== signature) fail('项目编辑标识已用于其他内容。');
+    if (operation.result) return operation.result;
+    const save = () => writeRecord(record, operation);
+    const rpc = (method, params) => server.request(method, params);
+    try {
+      return await (dependencies.registration || withDesktopProjectRegistration)({ stateRoot, codexDataRoot,
+        operationId: body.idempotencyKey, operation: 'update', confirmed: body.confirmDesktopRestart === true, serverUrl: server.url }, async desktop => {
+        const current = (await rpc('project/read', { projectId })).project;
+        if (current.id !== projectId) fail('项目身份不一致。');
+        if (current.roots.length && rootKey(current.roots.slice(0, 1)) !== rootKey(target.roots.slice(0, 1))) {
+          fail('编辑项目不能修改或移除主目录。');
+        }
+        operation.previousProject ||= current;
+        if (!same(current, operation.previousProject) && !same(current, target)) fail('项目已被其他操作修改，请刷新后重新编辑。');
+        let project = current;
+        if (!same(current, target)) {
+          const rootsChanged = rootKey(current.roots) !== rootKey(target.roots);
+          const roots = rootsChanged ? await projectRoots(rpc, target.roots) : current.roots;
+          operation.updateAttempted = true; save();
+          project = (await rpc('project/update', { projectId, name, roots })).project;
+        }
+        save();
+        const desktopRegistration = await desktop.register(project, operation, save);
+        operation.result = { project: projectSummary(project), desktopRegistration }; save(); return operation.result;
+      });
+    } catch (error) {
+      error.details = { ...error.details, projectUpdatePending: operation.updateAttempted === true };
+      if (operation.updateAttempted) error.message += ' 请继续完成本次同步，会先核对已有修改。';
+      throw error;
+    }
+  }
+}

package/dist/src/relay-config-import.mjs

@@ -0,0 +1,45 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { credentialStore } from './platform/credential-store.mjs';
+import { readRecord } from './service-lifecycle.mjs';
+
+const exec = promisify(execFile);
+
+// One-time installation transfer. Execute the previously installed reader at
+// its original location before replacing it; the new runtime never uses a vault.
+export async function importRelayConfig(serviceRoot, stateRoot, nodeExecutable = process.execPath) {
+  const configuredId = readRecord(path.join(stateRoot, 'self-relay-config.json'))?.deviceId;
+  const validate = record => {
+    if (record?.version !== 2 || !record.devices || typeof record.devices !== 'object' || Array.isArray(record.devices)
+        || Object.entries(record.devices).some(([id, item]) => !/^[\w-]{16,128}$/.test(id) || item?.id !== id
+          || !/^[A-Za-z0-9_-]{43}$/.test(item.secret || '') || typeof item.registered !== 'boolean')
+        || (configuredId && configuredId !== 'new' && !record.devices[configuredId])) {
+      throw new Error('工作站身份配置不完整或与当前工作站不一致，未停止旧服务。');
+    }
+  };
+  const current = credentialStore('load', undefined, stateRoot).record;
+  if (current) { validate(current); return { status: 'already-configured' }; }
+  const legacy = path.join(serviceRoot, 'dist/src/platform', process.platform === 'win32' ? 'windows'
+    : process.platform === 'darwin' ? 'macos' : 'linux', 'credential-store.mjs');
+  if (!fs.existsSync(legacy)) {
+    if (configuredId && configuredId !== 'new') throw new Error('缺少当前工作站身份配置，未停止旧服务；请先完成原配对转存。');
+    return { status: 'not-needed' };
+  }
+  let record;
+  try {
+    const script = 'import { pathToFileURL } from "node:url"; const {credentialStore} = await import(pathToFileURL(process.argv[1])); '
+      + 'process.stdout.write(JSON.stringify((await credentialStore("load")).record));';
+    const { stdout } = await exec(nodeExecutable, ['--input-type=module', '-e', script, legacy],
+      { windowsHide: true, timeout: 65000, maxBuffer: 1024 * 1024 });
+    record = JSON.parse(stdout.replace(/^\uFEFF/, ''));
+    if (record === null && !configuredId) return { status: 'not-found' };
+    validate(record);
+  } catch {
+    // Never log execFile's error: it can contain stdout with the old identity.
+    throw new Error('原设备配对配置转存失败，未停止旧服务。无人值守更新已中止，未更换工作站身份；请先完成原配对转存。');
+  }
+  credentialStore('save', record, stateRoot);
+  return { status: 'imported' };
+}

package/dist/src/remote-control.mjs

@@ -0,0 +1,51 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { fileURLToPath } from 'node:url';
+const exec = promisify(execFile);
+const camera = fileURLToPath(new URL('../native/desktop-helper/CodeRelaxCamera.exe', import.meta.url));
+
+// User-triggered, bounded still images. No model, persistent image or video session.
+export class RemoteControl {
+  constructor(desktop) { this.desktop = desktop; this.cameraBusy = false; }
+  async request(body, context) {
+    context?.signal?.throwIfAborted();
+    context?.requestSignal?.throwIfAborted();
+    if (process.platform !== 'win32') throw new Error('当前仅支持 Windows 工作站');
+    if (!body || typeof body !== 'object') throw new Error('无效的控制参数');
+    if (!['frame', 'camera'].includes(body.action) && !/^[a-f0-9]{32}$/.test(body.sessionId || '')) throw new Error('请先刷新桌面');
+    if (body.action === 'frame') {
+      const binary = body.transfer === 'binary';
+      const frame = await this.desktop.frame({ preview: true, encodedOnly: !binary }, context);
+      if (frame.state !== 'pending') throw new Error(frame.message || '桌面辅助服务未就绪，请在电脑安装桌面辅助服务');
+      if (binary) return { sessionId: frame.sessionId, width: frame.width, height: frame.height,
+        desktopWidth: frame.desktopWidth, imagePath: frame.imagePath, size: frame.size, revision: frame.frameId,
+        cursor: frame.cursor, kind: frame.kind, expiresInMs: frame.expiresInMs };
+      const image = this.desktop.imageData(frame.frameId);
+      if (image.length > 1400000) throw new Error('截图过大，请降低桌面分辨率');
+      return { sessionId: frame.sessionId, width: frame.width, height: frame.height,
+        desktopWidth: frame.desktopWidth, image, cursor: frame.cursor, kind: frame.kind, expiresInMs: frame.expiresInMs };
+    }
+    if (body.action === 'release') { this.desktop.release(undefined, body.sessionId); return { released: true }; }
+    if (body.action === 'cursor') return this.desktop.cursor(body, context);
+    if (body.action === 'move') return this.desktop.move(body, context);
+    if (body.action === 'position') return this.desktop.position(body, context);
+    if (body.action === 'click') return this.desktop.click(body, context);
+    if (body.action === 'pointer') return this.desktop.pointer(body, context);
+    if (body.action === 'input') return this.desktop.keyboard(body, context);
+    if (body.action === 'camera') {
+      if (this.cameraBusy) throw new Error('正在拍照，请稍候');
+      this.cameraBusy = true;
+      try {
+        const { stdout } = await exec(camera, [], { windowsHide: true, timeout: 8000, maxBuffer: 2 * 1024 * 1024, encoding: 'utf8' });
+        const result = JSON.parse(stdout);
+        if (!/^data:image\/jpeg;base64,[A-Za-z0-9+/=]+$/.test(result.image) || result.image.length > 1400000)
+          throw new Error('摄像头图片格式无效');
+        return result;
+      } catch (error) {
+        throw new Error(error.code === 'ENOENT' ? '缺少摄像头组件，请更新工作站后台' :
+          error.killed ? '摄像头拍照超时，已结束拍照进程' : '摄像头拍照失败，请检查摄像头占用和 Windows 相机权限。' + (error.stderr?.trim() || error.message));
+      } finally { this.cameraBusy = false; }
+    }
+    throw new Error('无效的远程操作');
+  }
+}

package/dist/src/runtime-discovery.mjs

@@ -1,43 +1,67 @@
-import fs from 'node:fs';
-import { discoverCodex, resolveCodexRuntime } from './platform/windows/codex-runtime.mjs';
-
-// Advisory discovery is independent of execution health. Failure here must never
-// disable an already running app-server or cause an automatic process restart.
-export class RuntimeDiscovery {
-  constructor({ stateRoot, host, url, interval = 60000 }) {
-    Object.assign(this, { stateRoot, host, url, interval });
-    this.state = {};
-  }
-  start() { this.stopped = false; void this.tick(); }
-  stop() { this.stopped = true; clearTimeout(this.timer); }
-  async sample() {
-    const errors = [];
-    try {
-      const candidates = discoverCodex();
-      const signature = JSON.stringify(candidates.map(candidate => {
-        const stat = fs.statSync(candidate.executable);
-        return [candidate.executable, stat.size, stat.mtimeMs];
-      }));
-      if (signature !== this.signature) {
-        await resolveCodexRuntime(this.stateRoot, { refresh: true });
-        this.signature = signature;
+import { discoverCodex, resolveCodexRuntime, runtimeFingerprint, runtimeInstallationFingerprint } from './platform/codex-runtime.mjs';
+
+// Advisory discovery is independent of execution health. Failure here must never
+// disable an already running app-server or cause an automatic process restart.
+export class RuntimeDiscovery {
+  constructor({ stateRoot, host, url, interval = 60000, diagnose = () => {} }) {
+    Object.assign(this, { stateRoot, host, url, interval, diagnose });
+    this.state = {};
+  }
+  start() { this.stopped = false; void this.tick(); }
+  stop() { this.stopped = true; clearTimeout(this.timer); }
+  async sample() {
+    const errors = [];
+    try {
+      const candidates = discoverCodex();
+      const installation = await runtimeInstallationFingerprint();
+      const fingerprints = candidates.map(candidate => {
+        try { return [candidate.executable, runtimeFingerprint(candidate.executable)]; }
+        catch (error) { return [candidate.executable, error.message]; }
+      });
+      const signature = JSON.stringify([installation, fingerprints]);
+      if (signature !== this.diagnosticCandidateSignature) {
+        this.diagnosticCandidateSignature = signature;
+        this.diagnose('runtime-candidates', { installation, candidates: candidates.map((candidate, index) => ({
+          executable: candidate.executable, source: candidate.source, fingerprint: fingerprints[index][1] })) });
       }
-    } catch (error) { errors.push(error.message); }
-    try {
-      const desktop = await this.host.inspect();
-      const attached = desktop.running && await this.host.sharedServiceUrl() === this.url;
-      this.state = { desktop: { state: !desktop.running ? 'stopped' : attached ? 'managed' : 'ordinary',
-        installed: Boolean(desktop.desktop), attachedToManagedServer: Boolean(attached) },
-        desktopRestartRecommended: Boolean(desktop.running && !attached), checkedAt: new Date().toISOString() };
-    } catch (error) {
-      errors.push(error.message);
-      this.state = { checkedAt: new Date().toISOString() };
-    }
-    if (errors.length) this.state.discoveryError = errors.join('\n');
-    return this.state;
-  }
-  async tick() {
-    await this.sample();
-    if (!this.stopped) { this.timer = setTimeout(() => this.tick(), this.interval); this.timer.unref?.(); }
+      if (signature !== this.signature) {
+        const selected = await resolveCodexRuntime(this.stateRoot, { refresh: true });
+        this.signature = signature;
+        this.diagnose('runtime-selected', { version: selected.version, source: selected.source,
+          executable: selected.executable, runningKernelPreserved: true });
+      }
+    } catch (error) { errors.push(error.message); }
+    try {
+      if (this.host.desktopIntegration === false) {
+        this.state = { desktop: { state: 'unsupported', integrationSupported: false }, checkedAt: new Date().toISOString() };
+        if (errors.length) this.state.discoveryError = errors.join('\n');
+        this.diagnoseState();
+        return this.state;
+      }
+      const desktop = await this.host.inspect();
+      const attached = desktop.running && await this.host.sharedServiceUrl() === (typeof this.url === 'function' ? this.url() : this.url);
+      this.state = { desktop: { state: !desktop.running ? 'stopped' : attached ? 'managed' : 'ordinary',
+        installed: Boolean(desktop.desktop), version: desktop.version || '', hasWindow: desktop.hasWindow, attachedToManagedServer: Boolean(attached) },
+        desktopRestartRecommended: Boolean(desktop.running && !attached), checkedAt: new Date().toISOString() };
+    } catch (error) {
+      errors.push(error.message);
+      this.state = { checkedAt: new Date().toISOString() };
+    }
+    if (errors.length) this.state.discoveryError = errors.join('\n');
+    this.diagnoseState();
+    return this.state;
+  }
+  diagnoseState() {
+    const details = { desktop: this.state.desktop || null,
+      desktopRestartRecommended: this.state.desktopRestartRecommended === true,
+      discoveryError: this.state.discoveryError || null, runningKernelPreserved: true };
+    const signature = JSON.stringify(details);
+    if (signature === this.diagnosticStateSignature) return;
+    this.diagnosticStateSignature = signature;
+    this.diagnose('runtime-discovery', details);
   }
-}
+  async tick() {
+    await this.sample();
+    if (!this.stopped) { this.timer = setTimeout(() => this.tick(), this.interval); this.timer.unref?.(); }
+  }
+}

package/dist/src/self-relay/account-cleanup.mjs

@@ -0,0 +1,30 @@
+// Process one account per transaction; foreign keys keep incomplete deletion atomic.
+export async function purgeCancelledAccounts(pool, scopeHash) {
+  let purged = 0;
+  for (;;) {
+    const db = await pool.getConnection();
+    try {
+      await db.beginTransaction();
+      const [rows] = await db.query(`SELECT id FROM users WHERE status='cancelled'
+        AND cancelled_at <= UTC_TIMESTAMP(3) - INTERVAL 1 DAY
+        ORDER BY cancelled_at LIMIT 1 FOR UPDATE`);
+      if (!rows.length) { await db.commit(); return purged; }
+      const id = rows[0].id;
+      const [identities] = await db.execute("SELECT normalized_value FROM user_login_identities WHERE user_id=? AND kind='email'", [id]);
+      for (const { normalized_value: email } of identities) {
+        await db.execute('DELETE FROM email_login_challenges WHERE email=?', [email]);
+        await db.execute('DELETE FROM email_send_limits WHERE scope_hash=?', [scopeHash(`email:${email}`)]);
+        await db.execute('DELETE FROM relay_admin_emails WHERE email=?', [email]);
+      }
+      for (const table of ['user_sessions', 'relay_usage_actions', 'relay_usage_sessions',
+        'relay_usage_user_days', 'relay_usage_budgets', 'relay_usage_entitlements',
+        'relay_usage_totals', 'user_login_identities']) {
+        await db.execute(`DELETE FROM ${table} WHERE user_id=?`, [id]);
+      }
+      await db.execute('UPDATE computers SET owner_user_id=NULL WHERE owner_user_id=?', [id]);
+      await db.execute('DELETE FROM users WHERE id=?', [id]);
+      await db.commit(); purged++;
+    } catch (error) { await db.rollback(); throw error; }
+    finally { db.release(); }
+  }
+}

package/dist/src/self-relay/account-connections.mjs

@@ -0,0 +1,63 @@
+import { digest } from './wire.mjs';
+
+// Register before the asynchronous database check so logout also invalidates
+// handshakes whose successful authentication response has not arrived yet.
+export function accountConnections() {
+  const sessions = new Map();
+  return {
+    track(token, onInvalid, refresh) {
+      const key = digest(token);
+      const entries = sessions.get(key) || new Set();
+      sessions.set(key, entries);
+      let active = true, expires = Infinity, timer;
+      function dispose() {
+        active = false;
+        clearTimeout(timer);
+        entries.delete(entry);
+        if (!entries.size && sessions.get(key) === entries) sessions.delete(key);
+      }
+      function invalidate() {
+        if (!active) return;
+        dispose();
+        onInvalid();
+      }
+      function valid() {
+        if (active && Date.now() >= expires) invalidate();
+        return active;
+      }
+      function schedule(delay = 86400000) {
+        clearTimeout(timer);
+        if (!valid()) return;
+        timer = setTimeout(async () => {
+          if (!valid()) return;
+          if (!refresh) { schedule(); return; }
+          try {
+            const user = await refresh();
+            // A logout/disconnect during the database request must win.
+            if (active) entry.activate(user.expiresAt);
+          } catch (error) {
+            if (error.status === 401 || error.status === 403) invalidate();
+            else if (active) schedule(60000);
+          }
+        }, Math.min(expires - Date.now(), delay));
+        timer.unref();
+      }
+      const entry = {
+        activate(expiresAt) {
+          if (!active) return false;
+          expires = Date.parse(expiresAt);
+          if (!Number.isFinite(expires)) { invalidate(); return false; }
+          schedule();
+          return active;
+        },
+        valid, dispose, invalidate,
+      };
+      entries.add(entry);
+      return entry;
+    },
+    revoke(token) {
+      const entries = sessions.get(digest(token));
+      if (entries) for (const entry of [...entries]) entry.invalidate();
+    },
+  };
+}

package/dist/src/self-relay/admin-auth.mjs

@@ -0,0 +1,59 @@
+import fs from 'node:fs';
+import { randomBytes, scrypt, timingSafeEqual } from 'node:crypto';
+import { promisify } from 'node:util';
+
+const derive = promisify(scrypt);
+const COOKIE = '__Host-code-relax-admin';
+const SESSION_MS = 12 * 60 * 60 * 1000;
+const cookie = (value, seconds) => `${COOKIE}=${value}; Path=/; Secure; HttpOnly; SameSite=Strict; Max-Age=${seconds}`;
+
+export async function passwordRecord(password) {
+  if (typeof password !== 'string' || password.length < 10 || Buffer.byteLength(password) > 256) {
+    throw new Error('Admin password must have at least 10 characters and at most 256 bytes');
+  }
+  const salt = randomBytes(16).toString('hex');
+  return { salt, hash: (await derive(password, salt, 64)).toString('hex') };
+}
+
+export function createAdminAuth(passwordFile) {
+  const { salt, hash } = JSON.parse(fs.readFileSync(passwordFile, 'utf8'));
+  if (!/^[a-f0-9]{32}$/.test(salt) || !/^[a-f0-9]{128}$/.test(hash)) throw new Error('Invalid admin password record');
+  const expected = Buffer.from(hash, 'hex');
+  const sessions = new Map();
+  let windowStart = 0, attempts = 0, verifying = false;
+  const token = request => (request.headers.cookie || '').split(';').map(value => value.trim())
+    .find(value => value.startsWith(`${COOKIE}=`))?.slice(COOKIE.length + 1);
+  function purge() {
+    for (const [id, expires] of sessions) if (expires <= Date.now()) sessions.delete(id);
+  }
+  return {
+    authenticated(request) { purge(); return sessions.has(token(request)); },
+    async login(password, request, response) {
+      const now = Date.now();
+      if (now - windowStart >= 60000) { windowStart = now; attempts = 0; }
+      // This is a single-owner console: bound both guessing and concurrent scrypt memory.
+      if (attempts >= 10 || verifying) {
+        response.setHeader('Retry-After', '60');
+        return { status: 429, error: '尝试过于频繁，请一分钟后重试' };
+      }
+      attempts++;
+      if (typeof password !== 'string' || Buffer.byteLength(password) > 256) return { status: 400, error: '请输入有效密码' };
+      verifying = true;
+      try {
+        const actual = await derive(password, salt, 64);
+        if (!timingSafeEqual(actual, expected)) return { status: 401, error: '密码不正确' };
+        purge();
+        sessions.delete(token(request));
+        if (sessions.size >= 32) sessions.delete(sessions.keys().next().value);
+        const id = randomBytes(32).toString('base64url');
+        sessions.set(id, Date.now() + SESSION_MS);
+        response.setHeader('Set-Cookie', cookie(id, SESSION_MS / 1000));
+        return { status: 200 };
+      } finally { verifying = false; }
+    },
+    logout(request, response) {
+      sessions.delete(token(request));
+      response.setHeader('Set-Cookie', cookie('', 0));
+    },
+  };
+}

package/dist/src/self-relay/admin-login-page.mjs

@@ -0,0 +1,7 @@
+import { adminUiTokens, adminFooterStyles, adminAuthStyles } from './admin-style.mjs';
+
+export function adminLoginPage() {
+  return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>登录 · Code Relax 管理</title><style>${adminUiTokens}${adminFooterStyles}${adminAuthStyles}</style></head>
+<body class="admin-login"><main><form id="login" class="login-card"><h1>Code Relax 管理</h1><p>输入管理密码，进入后台。</p><label for="password">管理密码</label><input id="password" name="password" type="password" autocomplete="current-password" required maxlength="256" autofocus><button id="submit" type="submit">登录</button><p id="result" role="alert" aria-live="polite"></p></form></main><footer class="admin-footer">京ICP备2026027643号-2</footer>
+<script>const form=document.getElementById('login'),button=document.getElementById('submit'),result=document.getElementById('result');form.addEventListener('submit',async event=>{event.preventDefault();if(button.disabled)return;button.disabled=true;result.textContent='正在登录…';try{const response=await fetch('/admin/login',{method:'POST',headers:{'Content-Type':'application/json','X-Code-Relax-Admin':'1'},body:JSON.stringify({password:form.password.value})});const body=await response.json();if(!response.ok)throw new Error(body.error||'登录失败');form.reset();location.replace('/')}catch(error){result.textContent=error.message}finally{button.disabled=false}});</script></body></html>`;
+}