@walkhi/code-relax 0.1.0-beta.10 → 0.1.0-beta.11

package/dist/src/lan-socket-server.mjs

@@ -1,16 +1,20 @@
 import { EventEmitter } from 'node:events';
 import crypto from 'node:crypto';
-import { WebSocketServer, WebSocket } from 'ws';
+import { WebSocketServer, WebSocket } from 'ws';
+import { createFileUploadSession, FILE_CHUNK_BYTES, MAX_FILE_BYTES, MAX_FILE_COUNT, MAX_TOTAL_BYTES } from './file-upload-session.mjs';
 
 // One authenticated connection carries requests and explicitly owned subscriptions.
 // The dispatcher is shared business routing, not an HTTP loopback proxy.
-export function attachLanSocket(server, { token, dispatch, authorizeDevice = () => false }) {
+export function attachLanSocket(server, { token, dispatch, authorizeDevice = () => false, uploadsRoot }) {
   // Allow four individually valid images to reach the aggregate-size validator,
   // so an oversized composition returns an error instead of dropping the connection.
   const wss = new WebSocketServer({ noServer: true, maxPayload: 48 * 1024 * 1024, perMessageDeflate: false });
-  server.on('upgrade', (request, socket, head) => {
+  const uploadWss = new WebSocketServer({ noServer: true, maxPayload: 512 * 1024, perMessageDeflate: false });
+  const activeUploads = new Set();
+  server.on('upgrade', (request, socket, head) => {
     const origin = request.headers.origin;
-    let allowed = request.url === '/api/socket';
+    const upload = request.url === '/api/file-transfer' && Boolean(uploadsRoot);
+    let allowed = request.url === '/api/socket' || upload;
     // Packaged ArkWeb pages have an opaque ("null") origin; device authentication remains required.
     if (origin && origin !== 'null') {
       try {
@@ -23,8 +27,44 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
       catch { allowed = false; }
     }
     if (!allowed) { socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n'); return; }
-    wss.handleUpgrade(request, socket, head, ws => wss.emit('connection', ws));
-  });
+    const target = upload ? uploadWss : wss;
+    target.handleUpgrade(request, socket, head, ws => target.emit('connection', ws));
+  });
+  uploadWss.on('connection', ws => {
+    let authenticated = false, identity = '', upload;
+    let pending = Promise.resolve();
+    const authTimer = setTimeout(() => ws.close(1008, 'Authentication required'), 5000);
+    const reply = value => { if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify(value)); };
+    ws.on('error', () => {});
+    ws.on('close', () => {
+      clearTimeout(authTimer);
+      void pending.finally(async () => {
+        await upload?.close();
+        if (identity) activeUploads.delete(identity);
+      });
+    });
+    ws.on('message', (bytes, binary) => {
+      pending = pending.then(async () => {
+        if (binary || bytes.length > 512 * 1024) throw new Error('无效的上传分片');
+        const message = JSON.parse(bytes.toString());
+        if (!authenticated) {
+          if (message?.type === 'device-auth' && typeof message.clientId === 'string' &&
+              authorizeDevice(message.clientId, message.credential) === true) identity = `device:${message.clientId}`;
+          else if (token && message?.type === 'auth' && typeof message.token === 'string') {
+            const supplied = Buffer.from(message.token), expected = Buffer.from(token || '');
+            if (supplied.length === expected.length && crypto.timingSafeEqual(supplied, expected)) identity = 'local-token';
+          }
+          if (!identity || activeUploads.has(identity) || activeUploads.size >= 2) throw new Error('上传身份无效或工作站已有上传任务');
+          activeUploads.add(identity); authenticated = true; clearTimeout(authTimer);
+          upload = createFileUploadSession(uploadsRoot);
+          reply({ type: 'ready', maxFileBytes: MAX_FILE_BYTES, maxFileCount: MAX_FILE_COUNT,
+            maxTotalBytes: MAX_TOTAL_BYTES, chunkBytes: FILE_CHUNK_BYTES });
+          return;
+        }
+        reply(await upload.receive(message));
+      }).catch(error => { reply({ type: 'error', error: error.message }); ws.close(1008, 'Upload rejected'); });
+    });
+  });
   wss.on('connection', ws => {
     let authenticated = false, alive = true;
     const active = new Map();
@@ -105,5 +145,8 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
       catch (error) { reply.json(500, { error: error.message }); }
     });
   });
-  return { close() { for (const ws of wss.clients) ws.terminate(); wss.close(); } };
-}
+  return { close() {
+    for (const ws of wss.clients) ws.terminate(); wss.close();
+    for (const ws of uploadWss.clients) ws.terminate(); uploadWss.close();
+  } };
+}

package/dist/src/managed-app-server.mjs

@@ -32,7 +32,6 @@ export class ManagedAppServer extends EventEmitter {
     this.timeout = timeout;
     this.now = now;
     this.recordPath = path.join(stateRoot, 'managed-app-server.json');
-    this.legacyRecordPath = path.join(stateRoot, 'shared-desktop.json');
     this.client = client;
     this.state = { state: 'absent', ready: false, error: null };
     this.restartStatus = null;
@@ -45,7 +44,11 @@ export class ManagedAppServer extends EventEmitter {
     });
   }
 
-  snapshot() { return { ...this.state, ...(this.restartStatus ? { restart: { ...this.restartStatus } } : {}) }; }
+  snapshot() {
+    return { ...this.state,
+      version: this.state.ready && this.client.ready ? this.client.serverVersion || null : null,
+      ...(this.restartStatus ? { restart: { ...this.restartStatus } } : {}) };
+  }
 
   async start() {
     this.stopped = false;
@@ -68,10 +71,9 @@ export class ManagedAppServer extends EventEmitter {
     try {
       fs.mkdirSync(this.stateRoot, { recursive: true });
       let record = null, actual = null;
-      for (const candidate of [readRecord(this.recordPath), readRecord(this.legacyRecordPath)].filter(Boolean)) {
-        const process = candidate.pid ? await this.host.process(candidate.pid) : null;
-        if (sameManagedProcess(candidate, process)) { record = candidate; actual = process; break; }
-      }
+      const candidate = readRecord(this.recordPath);
+      const process = candidate?.pid ? await this.host.process(candidate.pid) : null;
+      if (sameManagedProcess(candidate, process)) { record = candidate; actual = process; }
       const runtime = actual
         ? readRecord(path.join(this.stateRoot, 'codex-runtime.json')) || { executable: actual.executable }
         : await resolveCodexRuntime(this.stateRoot, { environment: this.environment });
@@ -145,7 +147,7 @@ export class ManagedAppServer extends EventEmitter {
     const previous = this.state;
     this.publish({ ...previous, state: 'restarting', ready: false, error: null });
     try {
-      const record = readRecord(this.recordPath) || readRecord(this.legacyRecordPath);
+      const record = readRecord(this.recordPath);
       const actual = record?.pid ? await this.host.process(record.pid) : null;
       if (actual && !sameManagedProcess(record, actual)) {
         throw new Error('Codex 内核进程身份已经变化，未结束任何进程。');

package/dist/src/onboarding.mjs

@@ -8,10 +8,10 @@ export const connectionModesText = [
 export function phonePairingSteps(transportMode, paired = false) {
   const mode = transportMode === 'lan-shared' ? '局域网 · Codex 内核已就绪' : '局域网（Codex 内核未就绪）';
   return paired ? [
-    `已有移动设备授权。手机可继续使用私有中继；${mode} 会显示验证成功的当前网络和历史记录。`,
+    `已有移动设备授权。移动端可继续使用私有中继；${mode} 会显示验证成功的当前网络和历史记录。`,
     '添加另一台设备时执行 relax pair；每台设备只需扫码配对一次。',
   ] : [
-    '手机先安装 Code Relax。当前为鸿蒙 HarmonyOS 7 私测版，调试 HAP 需通过 DevEco/调试设备安装，尚无商店下载入口。',
+    '请先在移动端安装 Code Relax。当前为鸿蒙 HarmonyOS 7 私测版，调试 HAP 需通过 DevEco/调试设备安装，尚无商店下载入口。',
     '使用 App 扫描配对二维码；每台移动设备只需配对一次。',
     `配对后可直接使用私有中继；${mode} 会接收并验证当前网络候选，也可手动输入 IP。`,
   ];
@@ -25,5 +25,5 @@ export const desktopSetupSteps = [
 ];
 
 export function pairingDisplayText(nextSteps, notice) {
-  return ['Bridge 已就绪，请在手机上完成连接。', connectionModesText, ...nextSteps.map((step, index) => `${index + 1}. ${step}`), notice].join('\n\n');
+  return ['Bridge 已就绪，请在移动端完成连接。', connectionModesText, ...nextSteps.map((step, index) => `${index + 1}. ${step}`), notice].join('\n\n');
 }

package/dist/src/platform/windows/desktop-host.mjs

@@ -37,10 +37,9 @@ export const desktopHost = {
 };
 export const resolveStateRoot = stateRoot => runScript('resolve-state-root.ps1', ['-StateRoot', stateRoot]);
 
-export async function desktopShortcuts({ serviceRoot, nodeExecutable }, remove = false, destination) {
+export async function removeDesktopShortcut({ serviceRoot, nodeExecutable }, destination) {
   const entry = path.join(serviceRoot, 'dist/bin/codex-remote.mjs');
   const args = ['-NodePath', nodeExecutable, '-Entry', entry];
-  if (remove) args.push('-Remove');
   if (destination) args.push('-Destination', destination);
   return JSON.parse(await runScript('desktop-shortcuts.ps1', args));
 }

package/dist/src/platform/windows/desktop-shortcuts.ps1

@@ -1,9 +1,10 @@
-param([string]$NodePath, [string]$Entry, [switch]$Remove, [string]$Destination)
+param([string]$NodePath, [string]$Entry, [string]$Destination)
 $ErrorActionPreference = 'Stop'
 [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
 $shell = New-Object -ComObject WScript.Shell
 if (-not $Destination) { $Destination = $shell.SpecialFolders.Item('Desktop') }
-$launcher = Join-Path $PSScriptRoot 'desktop-shortcut-run.ps1'
+# Only identify and remove the retired shortcut; never create a new launcher.
+$launcher = Join-Path $PSScriptRoot 'desktop-shortcut-run.ps1'
 $items = @(@{Name='Code Relax - Codex 内核'; Command='shared-start'})
 $results = @()
 foreach ($item in $items) {
@@ -11,18 +12,10 @@ foreach ($item in $items) {
     $arguments = '-NoProfile -NoExit -ExecutionPolicy Bypass -File "' + $launcher + '" -NodePath "' + $NodePath + '" -Entry "' + $Entry + '" -Action ' + $item.Command
     if (Test-Path -LiteralPath $target) {
         $existing = $shell.CreateShortcut($target)
-        if ($existing.Arguments -ne $arguments) { throw ('快捷方式不是本安装创建的，未覆盖或删除：' + $target) }
-    }
-    if ($Remove) {
-        if (Test-Path -LiteralPath $target) { Remove-Item -LiteralPath $target }
-    } else {
-        $link = $shell.CreateShortcut($target)
-        $link.TargetPath = Join-Path $env:SystemRoot 'System32/WindowsPowerShell/v1.0/powershell.exe'
-        $link.Arguments = $arguments
-        $link.WorkingDirectory = Split-Path $Entry -Parent
-        $link.Description = $item.Name
-        $link.Save()
+        $powershell = Join-Path $env:SystemRoot 'System32/WindowsPowerShell/v1.0/powershell.exe'
+        if ($existing.Arguments -ne $arguments -or $existing.TargetPath -ne $powershell) { continue }
     }
+    if (Test-Path -LiteralPath $target) { Remove-Item -LiteralPath $target }
     $results += $target
 }
 ConvertTo-Json -InputObject $results -Compress

package/dist/src/platform/windows/service-host.mjs

@@ -20,21 +20,12 @@ async function detect(script) {
 export const sharedServiceUrl = () => detect('get-shared-service-url.ps1');
 export const lanAddress = async () => (await lanNetworks())[0]?.address || '';
 export { lanNetworks };
-export function migrateState(stateRoot) {
-  fs.mkdirSync(stateRoot, { recursive: true });
-  for (const name of ['bridge-config.json', 'bridge-session.json']) {
-    const target = path.join(stateRoot, name);
-    const old = path.join(bridgeRoot, '../.codex/bridge', name);
-    if (!fs.existsSync(target) && fs.existsSync(old)) fs.copyFileSync(old, target, fs.constants.COPYFILE_EXCL);
-  }
-}
 export async function bridgeEnvironment() {
   const environment = { ...process.env };
   const installation = readRecord(path.join(runtimePaths(environment).serviceRoot, 'installation.json'));
   const executable = installation?.nodeExecutable;
   if (!executable || !fs.existsSync(executable)) throw new Error('安装时选用的 Node 不存在，请重新安装 Code Relax。');
   environment.CODEX_MCP_NODE_PATH = executable;
-  environment.CODEX_REMOTE_LEGACY_UPLOADS_ROOTS = JSON.stringify(installation.legacyUploadsRoots || []);
   delete environment.CODEX_APP_TOOLS_PIPE_PATH;
   return { executable, environment };
 }

package/dist/src/self-relay/admin-page.mjs

@@ -47,7 +47,7 @@ const gb=value=>value==null?'—':number(Number(value)/1073741824,2)+' GB';
 el('trafficUsage').textContent=trafficFresh?'已用 '+gb(cloud.trafficUsedBytes)+' / '+gb(cloud.trafficTotalBytes):'流量暂不可用';
 el('trafficNote').textContent=trafficFresh?'更新时间 '+new Date(cloud.trafficSampledAt).toLocaleTimeString('zh-CN',{hour:'2-digit',minute:'2-digit'}):'暂不可用';
 renderTrafficTimeline(cloud,trafficFresh);
-el('metrics').replaceChildren(metric(number(state.activeRelaySessions)+' / '+number(state.maxRelaySessions),'受限转发',null,state.maxRelaySessions?toneAbove(state.activeRelaySessions/state.maxRelaySessions,.75,.9):''),metric(number(state.activeExemptRelaySessions),'白名单转发'),metric(number(state.websocketConnections),'WebSocket 连接'),metric(number(state.onlineComputers),'在线工作站'),metric(number(state.activePhones),'活动手机'))}
+el('metrics').replaceChildren(metric(number(state.activeRelaySessions)+' / '+number(state.maxRelaySessions),'受限转发',null,state.maxRelaySessions?toneAbove(state.activeRelaySessions/state.maxRelaySessions,.75,.9):''),metric(number(state.activeExemptRelaySessions),'白名单转发'),metric(number(state.websocketConnections),'WebSocket 连接'),metric(number(state.onlineComputers),'在线工作站'),metric(number(state.activePhones),'活动移动端'))}
 let editorItem=null,editorMode='new',writing=false;
 function openEditor(item=null,duplicate=false){editorItem=duplicate?null:item;editorMode=duplicate?'new':item?.status==='draft'?'draft':item?'view':'new';el('editorHeading').textContent=duplicate?'复制为新公告':editorMode==='draft'?'编辑草稿':editorMode==='view'?'查看公告':'新建公告';el('title').value=item?.title||'';el('message').value=item?.message||'';el('title').disabled=editorMode==='view';el('message').disabled=editorMode==='view';el('editorActions').hidden=editorMode==='view';el('editorNote').textContent=editorMode==='view'?'已发布内容只读；可复制为新公告再修改。':'发布后会立即替换当前公告并通知在线设备。';el('editorError').hidden=true;el('announcementEditor').showModal();if(editorMode!=='view')el('title').focus()}
 function action(label,className,handler,disabled=false){const button=node('button',className,label);button.type='button';button.disabled=disabled;button.addEventListener('click',handler);return button}

package/dist/src/self-relay/connector.mjs

@@ -15,19 +15,65 @@ export function connectBridgeRelay({ relayUrl, hostKey, bridgeUrl, bridgeToken,
     serverNoContextTakeover: true, clientNoContextTakeover: true,
     threshold: 1024, zlibDeflateOptions: { level: 3 },
   } });
-  const locals = new Map();
-  let heartbeat, operation, lastClose;
+  const locals = new Map();
+  const fileLocals = new Map();
+  let fileRemote, fileRetryTimer, heartbeat, operation, lastClose, closing = false;
   const alive = () => { clearTimeout(heartbeat); heartbeat = setTimeout(() => remote.terminate(), 75000); };
   remote.on('open', alive); remote.on('ping', alive); remote.on('message', alive);
   function dropLocal(session) {
     const current = locals.get(session);
     if (!current) return;
     locals.delete(session); clearTimeout(current.timer); current.socket?.terminate();
-    current.probe?.then(probe => probe.close());
-  }
-  function dropLocals() {
-    for (const session of [...locals.keys()]) dropLocal(session);
+    current.probe?.then(probe => probe.close());
+    current.diagnosticProbe?.then(probe => probe.close());
   }
+  function dropLocals() {
+    for (const session of [...locals.keys()]) dropLocal(session);
+    for (const socket of fileLocals.values()) socket.terminate();
+    fileLocals.clear(); clearTimeout(fileRetryTimer); fileRemote?.terminate(); fileRemote = undefined;
+  }
+  function startFileReceiver() {
+    if (!identity || closing || remote.readyState !== WebSocket.OPEN) return;
+    const receiver = fileRemote = new WebSocket(relayUrl, { maxPayload: 512 * 1024, perMessageDeflate: false });
+    receiver.on('open', () => send(receiver, { type: 'file-host', deviceId: identity.id, deviceSecret: identity.secret }));
+    receiver.on('error', error => events.emit('diagnostic', `File receiver: ${error.message}`));
+    receiver.on('close', () => {
+      for (const socket of fileLocals.values()) socket.terminate();
+      fileLocals.clear();
+      if (fileRemote === receiver) {
+        fileRemote = undefined;
+        if (!closing && remote.readyState === WebSocket.OPEN) fileRetryTimer = setTimeout(startFileReceiver, 3000);
+      }
+    });
+    receiver.on('message', (bytes, binary) => {
+      try {
+        const message = decode(bytes, binary);
+        if (message.type === 'file-host-ready') return;
+        if (message.type === 'file-open') {
+          const connection = bridgeConnection?.() || { url: bridgeUrl, token: bridgeToken };
+          const url = new URL(connection.url); url.pathname = '/api/file-transfer';
+          loopbackUrl(url.href, '/api/file-transfer');
+          const socket = new WebSocket(url.href, { maxPayload: 512 * 1024, perMessageDeflate: false });
+          fileLocals.set(message.session, socket);
+          socket.on('open', () => send(socket, { type: 'auth', token: connection.token }));
+          socket.on('error', error => events.emit('diagnostic', `Local file receiver: ${error.message}`));
+          socket.on('close', () => {
+            if (fileLocals.get(message.session) !== socket) return;
+            fileLocals.delete(message.session);
+            send(receiver, { type: 'file-close', session: message.session });
+          });
+          socket.on('message', (data, isBinary) => {
+            if (isBinary || fileLocals.get(message.session) !== socket) return socket.terminate();
+            send(receiver, { type: 'file-frame', session: message.session, payload: data.toString() });
+          });
+        } else if (message.type === 'file-frame') {
+          const socket = fileLocals.get(message.session);
+          if (socket?.readyState === WebSocket.OPEN) socket.send(message.payload);
+        } else if (message.type === 'file-close') fileLocals.get(message.session)?.terminate();
+        else throw new Error('Invalid file receiver frame');
+      } catch (error) { events.emit('diagnostic', error.message); receiver.close(1008, 'Invalid file frame'); }
+    });
+  }
   const ready = new Promise((resolve, reject) => {
     let registered = false;
     const timer = setTimeout(() => { reject(new Error('Relay registration timeout')); remote.terminate(); }, 5000);
@@ -44,7 +90,7 @@ export function connectBridgeRelay({ relayUrl, hostKey, bridgeUrl, bridgeToken,
     remote.on('message', (bytes, binary) => {
       try {
         const message = decode(bytes, binary);
-        if (message.type === 'registered' && !registered) { registered = true; clearTimeout(timer); resolve(message); return; }
+        if (message.type === 'registered' && !registered) { registered = true; clearTimeout(timer); startFileReceiver(); resolve(message); return; }
         if (!registered) throw new Error('Relay not registered');
         if (message.type === 'pair-code' || message.type === 'revoked' || message.type === 'status') {
           if (operation && message.commandId === operation.id && message.type === operation.responseType) {
@@ -102,10 +148,36 @@ export function connectBridgeRelay({ relayUrl, hostKey, bridgeUrl, bridgeToken,
               }
             } catch (error) { events.emit('diagnostic', error.message); socket.terminate(); }
           });
-        } else if (message.type === 'p2p-probe' && locals.has(message.session)) {
-          const current = locals.get(message.session);
-          if (!current.ready || !current.p2pProbe || !validProbeSignal(message)) throw new Error('Invalid probe signal');
-          if (message.kind === 'start' && current.probeId !== message.probeId) {
+        } else if (message.type === 'p2p-probe' && locals.has(message.session)) {
+          const current = locals.get(message.session);
+          if (!current.ready || !current.p2pProbe || !validProbeSignal(message)) throw new Error('Invalid probe signal');
+          if (message.purpose === 'diagnostic') {
+            if (message.kind === 'start' && current.diagnosticProbeId !== message.probeId) {
+              void current.diagnosticProbe?.then(probe => probe.close());
+              current.diagnosticProbeId = message.probeId;
+              const probeId = message.probeId;
+              current.diagnosticProbe = createP2pProbe({ iceServers,
+                signal: signal => {
+                  if (locals.get(message.session) === current && current.diagnosticProbeId === probeId) {
+                    send(remote, { type: 'p2p-probe', purpose: 'diagnostic', session: message.session,
+                      version: 1, probeId, ...signal });
+                  }
+                },
+                report: (state, diagnostic) => events.emit('p2p-probe', { state, diagnostic })
+              }).catch(() => {
+                if (locals.get(message.session) === current && current.diagnosticProbeId === probeId) {
+                  send(remote, { type: 'p2p-probe', purpose: 'diagnostic', session: message.session,
+                    version: 1, probeId, kind: 'close' });
+                }
+                return { receive() {}, close() {} };
+              });
+            } else if (current.diagnosticProbe && current.diagnosticProbeId === message.probeId) {
+              void current.diagnosticProbe.then(probe => probe.receive(message));
+            }
+            return;
+          }
+          if (message.purpose) throw new Error('Invalid probe purpose');
+          if (message.kind === 'start' && current.probeId !== message.probeId) {
             void current.probe?.then(probe => probe.close());
             current.probeId = message.probeId;
             current.routeSignals = Promise.resolve();
@@ -157,6 +229,6 @@ export function connectBridgeRelay({ relayUrl, hostKey, bridgeUrl, bridgeToken,
     updateLanCandidates(candidates) {
       if (!send(remote, { type: 'lan-candidates', candidates })) throw new Error('中继未连接');
     },
-    close() { clearTimeout(heartbeat); dropLocals(); remote.terminate(); }
+    close() { closing = true; clearTimeout(heartbeat); dropLocals(); remote.terminate(); }
   };
 }

package/dist/src/self-relay/lifecycle.mjs

@@ -58,7 +58,7 @@ async function registrationKey(config) {
   if (!validSecret(hostKey)) throw new Error('中继注册凭据格式无效。');
   return hostKey;
 }
-export async function selfRelay(command, stateRoot, requiredMode = '') {
+export async function selfRelay(command, stateRoot) {
   const previous = readRecord(recordPath(stateRoot));
   let current;
   if (previous) {
@@ -77,22 +77,18 @@ export async function selfRelay(command, stateRoot, requiredMode = '') {
     return { stopped: true, displayText: '私有中继连接器已停止；Bridge 和 Codex 保持运行。' };
   }
   if (current) {
-    if (requiredMode) {
-      const bridge = await serviceHealth(readRecord(path.join(stateRoot, 'bridge-session.json')));
-      if (bridge?.transportMode !== requiredMode) throw new Error('Codex 内核未就绪；请先执行 shared-start。');
-    }
     if (command === 'relay-revoke') return controlRequest(previous, 'POST', 'revoke');
     if (command === 'relay-pair' || (current.relayConnected && !current.paired && !current.qrPath)) return controlRequest(previous, 'POST', 'pair');
     if (command === 'relay-start' && current.relayConnected) return controlRequest(previous, 'POST', 'refresh-lan');
     return current;
   }
-  if (command === 'relay-revoke') throw new Error('请先启动连接器，再撤销手机授权。');
+  if (command === 'relay-revoke') throw new Error('请先启动连接器，再撤销移动端授权。');
   fs.mkdirSync(stateRoot, { recursive: true });
   const instanceId = randomUUID();
   const log = path.join(stateRoot, 'self-relay.log');
   const readyPath = path.join(stateRoot, `relay-ready-${instanceId}.json`);
   const pid = await startBackground(process.execPath, [script, '--worker', stateRoot, instanceId,
-    command === 'relay-pair' ? 'pair' : '', requiredMode], process.env, [log, log]);
+    command === 'relay-pair' ? 'pair' : ''], process.env, [log, log]);
   try {
     const deadline = Date.now() + 25000;
     while (true) {
@@ -110,16 +106,13 @@ export async function selfRelay(command, stateRoot, requiredMode = '') {
   finally { fs.rmSync(readyPath, { force: true }); }
 }
 
-async function worker(stateRoot, instanceId, refresh = false, requiredMode = '') {
+async function worker(stateRoot, instanceId, refresh = false) {
   const config = await loadConfig(stateRoot);
   const session = () => readRecord(path.join(stateRoot, 'bridge-session.json'));
   let health = await serviceHealth(session());
   if (health?.status !== 'ok') throw new Error('Bridge 尚未运行，请先执行 relax start --json。');
-  if (requiredMode && health.transportMode !== requiredMode) throw new Error('Codex 内核未就绪，请先执行 relax shared-start --json。');
-  const legacyPath = path.join(stateRoot, 'self-relay-device.json');
-  const legacy = readRecord(legacyPath);
-  const stored = await credentialStore('load');
-  let identities = stored.record || legacy || { version: 1, servers: {} };
+  const stored = await credentialStore('load');
+  const identities = stored.record || { version: 1, servers: {} };
   const validate = value => {
     if (value?.version !== 1 || !value.servers || typeof value.servers !== 'object' || Array.isArray(value.servers)) throw new Error('本机设备身份损坏，未自动覆盖');
     for (const [url, item] of Object.entries(value.servers)) {
@@ -128,15 +121,6 @@ async function worker(stateRoot, instanceId, refresh = false, requiredMode = '')
     }
   };
   validate(identities);
-  if (legacy) {
-    validate(legacy);
-    if (stored.record && JSON.stringify(stored.record) !== JSON.stringify(legacy)) throw new Error('新旧设备身份冲突，未覆盖任何凭据');
-    if (!stored.record) {
-      const verified = await credentialStore('save', identities);
-      if (JSON.stringify(verified.record) !== JSON.stringify(identities)) throw new Error('凭据迁移校验失败');
-    }
-    fs.rmSync(legacyPath);
-  }
   let identity = identities.servers[config.url];
   if (!identity) {
     identity = { id: randomUUID(), secret: randomBytes(32).toString('base64url'), registered: false };
@@ -163,7 +147,7 @@ async function worker(stateRoot, instanceId, refresh = false, requiredMode = '')
   const status = () => {
     const available = online && !paired && qrPath && Date.now() < expiresAt;
     const next = !online ? (lastError || '电脑连接器正在恢复中继连接，已保存授权。')
-      : paired ? '设备已授权，手机可直接重连；网络断开不需要重新扫码。'
+      : paired ? '设备已授权，移动端可直接重连；网络断开不需要重新扫码。'
         : available ? '用要添加的移动设备在有效期内扫描统一配对二维码。连接器在后台运行。'
           : '尚未完成设备授权；调用 relax pair --json 生成配对二维码。';
     return { running: !closing, relayConnected: online, mode: 'self-relay', transportMode: health.transportMode,
@@ -278,7 +262,7 @@ async function worker(stateRoot, instanceId, refresh = false, requiredMode = '')
 }
 
 if (process.argv[1] && path.resolve(process.argv[1]) === script && process.argv[2] === '--worker') {
-  worker(process.argv[3], process.argv[4], process.argv[5] === 'pair', process.argv[6]).catch(error => {
+  worker(process.argv[3], process.argv[4], process.argv[5] === 'pair').catch(error => {
     writeRecord(path.join(process.argv[3], `relay-ready-${process.argv[4]}.json`), { instanceId: process.argv[4], pid: process.pid, error: error.message });
     console.error(error.message); process.exitCode = 1;
   });

package/dist/src/self-relay/p2p-probe.mjs

@@ -110,7 +110,7 @@ export function validProbeSignal(value) {
   if (!value || value.version !== 1 || !/^[\w-]{16,128}$/.test(value.probeId || '')) return false;
   if (['start', 'close'].includes(value.kind)) return true;
   if (['offer', 'answer'].includes(value.kind)) return typeof value.sdp === 'string' && value.sdp.length <= 65536 &&
-    (value.direct === undefined || value.direct === 1) &&
+    (value.direct === undefined || value.direct === 0 || value.direct === 1) &&
     (value.iceServers === undefined || validProbeIceServers(value.iceServers));
   if (value.kind === 'candidate') return typeof value.candidate === 'string' && value.candidate.length <= 2048 &&
     typeof value.mid === 'string' && value.mid.length <= 64;

package/dist/src/self-relay/server.mjs

@@ -25,7 +25,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
   const debugAllowlist = readDebugAllowlist(debugAllowlistFile);
   const adminState = relayAdminState(adminStateFile, maxRelaySessions);
   let activeRelaySessions = 0;
-  for (const record of store.entries()) rooms.set(record.id, { ...record, durable: true, connections: new Map(), observers: new Map() });
+  for (const record of store.entries()) rooms.set(record.id, { ...record, durable: true, connections: new Map(), observers: new Map(), uploadClients: new Map() });
   function commit(room, changes) {
     const next = { ...room, ...changes, updatedAt: new Date().toISOString() };
     if (room.durable) {
@@ -195,6 +195,8 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
       clearTimeout(authTimer); clearInterval(heartbeat);
       if (role === 'host' && room?.host === ws) {
         room.host = undefined; room.hostName = undefined; room.lanCandidates = [];
+        room.uploadHost?.close(4410, 'Computer offline');
+        for (const client of room.uploadClients?.values() || []) client.ws.close(4410, 'Computer offline');
         for (const observer of room.observers.values()) send(observer.ws, { type: 'observing', online: false });
         if (!room.durable) rooms.delete(room.id);
         for (const connection of room.connections.values()) connection.ws.close(4410, 'Computer offline; authorization retained');
@@ -204,12 +206,41 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
         if (room.host) send(room.host, { type: 'detach', session });
       } else if (role === 'observer' && room?.observers.get(clientId)?.ws === ws) {
         room.observers.delete(clientId);
-      }
+      } else if (role === 'file-host' && room?.uploadHost === ws) {
+        room.uploadHost = undefined;
+        for (const client of room.uploadClients?.values() || []) client.ws.close(4410, 'File receiver offline');
+      } else if (role === 'file-client' && room?.uploadClients?.get(clientId)?.ws === ws) {
+        room.uploadClients.delete(clientId);
+        if (room.uploadHost) send(room.uploadHost, { type: 'file-close', session });
+      }
     });
     ws.on('message', (bytes, binary) => {
       try {
-        const message = decode(bytes, binary);
-        if (!role) {
+        const message = decode(bytes, binary);
+        if (!role) {
+          if (message.type === 'file-host') {
+            room = rooms.get(message.deviceId);
+            if (!room?.host || room.status !== 'active' || !matches(message.deviceSecret, room.hostHash)) return fail();
+            role = 'file-host'; clearTimeout(authTimer);
+            room.uploadClients ||= new Map();
+            room.uploadHost?.close(4409, 'File receiver replaced');
+            room.uploadHost = ws;
+            send(ws, { type: 'file-host-ready' }); return;
+          }
+          if (message.type === 'file-client') {
+            room = rooms.get(message.room);
+            const client = room?.clients.find(item => item.id === message.clientId);
+            if (!room?.host || !room.uploadHost || room.status !== 'active' || !client ||
+                !matches(message.credential, client.hash)) return fail();
+            room.uploadClients ||= new Map();
+            if (room.uploadClients.has(message.clientId) ||
+                [...rooms.values()].reduce((sum, item) => sum + (item.uploadClients?.size || 0), 0) >= 2) {
+              return fail(4429, 'Too many file uploads');
+            }
+            role = 'file-client'; clientId = message.clientId; session = randomUUID(); clearTimeout(authTimer);
+            room.uploadClients.set(clientId, { ws, session });
+            send(room.uploadHost, { type: 'file-open', session }); return;
+          }
           if (message.type === 'host') {
             const durable = message.deviceId !== undefined;
             if (durable && (!validId(message.deviceId) || !validSecret(message.deviceSecret))) return fail();
@@ -229,13 +260,14 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
               if (rooms.size >= 256) return fail(4429, 'Device limit reached');
               const now = new Date().toISOString();
               room = { id: durable ? message.deviceId : randomUUID(), durable,
-                revision: 0, status: 'active', clients: [], connections: new Map(), observers: new Map(), createdAt: now, updatedAt: now,
+                revision: 0, status: 'active', clients: [], connections: new Map(), observers: new Map(), uploadClients: new Map(), createdAt: now, updatedAt: now,
                 ...(durable ? { hostHash: digest(message.deviceSecret) } : {}) };
               commit(room, {}); rooms.set(room.id, room);
             }
             const oldHost = room.host;
             room.observers ||= new Map();
             room.host = ws; room.hostName = hostName; room.lanCandidates = lanCandidates;
+            if (oldHost && oldHost !== ws) room.uploadHost?.close(4409, 'Computer connection replaced');
             room.p2pProbe = message.p2pProbe === 1; room.p2pProbeRepeat = message.p2pProbeRepeat === true;
             role = 'host'; clearTimeout(authTimer);
             if (oldHost && oldHost !== ws) {
@@ -331,6 +363,8 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
               connection.ws.close(4401, 'Device authorization revoked');
             }
             room.connections.clear();
+            for (const client of room.uploadClients?.values() || []) client.ws.close(4401, 'Device authorization revoked');
+            room.uploadClients?.clear();
             for (const observer of room.observers.values()) observer.ws.close(4401, 'Device authorization revoked');
             room.observers.clear();
             send(ws, { type: 'authorization-changed', clients: [], revision: room.revision });
@@ -342,12 +376,26 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
           else if (message.type === 'ready') queueClientMessage(connection, { type: 'ready', p2pProbe: connection.p2pProbe ? 1 : 0,
             p2pProbeRepeat: connection.p2pProbe && connection.repeat });
           else if (message.type === 'p2p-probe' && connection.p2pProbe && validProbeSignal(message)) {
-            if (connection.probeId !== message.probeId) return;
-            if (++connection.signals > 150) return fail(1008, 'Probe signal limit');
+            const diagnostic = message.purpose === 'diagnostic';
+            if (message.purpose && !diagnostic) return fail(1008, 'Invalid probe purpose');
+            if ((diagnostic ? connection.diagnosticProbeId : connection.probeId) !== message.probeId) return;
+            if (++connection[diagnostic ? 'diagnosticSignals' : 'signals'] > 150) return fail(1008, 'Probe signal limit');
             send(connection.ws, { ...message, session: undefined });
           }
           else if (message.type === 'detach') connection.ws.close(1011, 'Local Bridge unavailable');
           else fail();
+        } else if (role === 'file-host' && room.uploadHost === ws) {
+          const client = [...room.uploadClients.values()].find(item => item.session === message.session);
+          if (!client) return;
+          if (message.type === 'file-frame' && typeof message.payload === 'string' && message.payload.length <= 512 * 1024) {
+            if (client.ws.bufferedAmount > 1024 * 1024) return client.ws.close(1013, 'File receiver too slow');
+            send(client.ws, { type: 'file-frame', payload: message.payload });
+          } else if (message.type === 'file-close') client.ws.close(1011, 'File receiver unavailable');
+          else fail(1008, 'Invalid file frame');
+        } else if (role === 'file-client' && room.uploadClients?.get(clientId)?.ws === ws) {
+          if (message.type !== 'file-frame' || typeof message.payload !== 'string' || message.payload.length > 512 * 1024) return fail(1008, 'Invalid file frame');
+          if (room.uploadHost?.bufferedAmount > 1024 * 1024) return fail(1013, 'File receiver too slow');
+          send(room.uploadHost, { type: 'file-frame', session, payload: message.payload });
         } else if (role === 'observer' && room.observers.get(clientId)?.ws === ws && message.type === 'official-computer') {
           const computer = normalizeOfficialComputer(message);
           commit(room, { officialComputer: computer });
@@ -355,15 +403,22 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
         } else if (role === 'client' && room.connections.get(clientId)?.ws === ws && message.type === 'p2p-probe') {
           const connection = room.connections.get(clientId);
           if (!connection.p2pProbe || !validProbeSignal(message)) return fail(1008, 'Invalid probe signal');
+          const diagnostic = message.purpose === 'diagnostic';
+          if (message.purpose && !diagnostic) return fail(1008, 'Invalid probe purpose');
+          const idField = diagnostic ? 'diagnosticProbeId' : 'probeId';
+          const signalsField = diagnostic ? 'diagnosticSignals' : 'signals';
+          const startedField = diagnostic ? 'diagnosticProbeStarted' : 'probeStarted';
           if (message.kind === 'start') {
-            if (connection.probeId && (!connection.repeat || Date.now() - connection.probeStarted < 2000)) {
-              send(ws, { type: 'p2p-probe', version: 1, probeId: message.probeId, kind: 'close' }); return;
+            if (connection[idField] && (!connection.repeat || Date.now() - connection[startedField] < 2000)) {
+              send(ws, { type: 'p2p-probe', version: 1, probeId: message.probeId,
+                ...(diagnostic ? { purpose: 'diagnostic' } : {}), kind: 'close' }); return;
             }
-            connection.probeId = message.probeId; connection.signals = 0; connection.probeStarted = Date.now();
+            connection[idField] = message.probeId; connection[signalsField] = 0; connection[startedField] = Date.now();
           }
-          if (connection.probeId !== message.probeId) return;
-          if (++connection.signals > 150) return fail(1008, 'Probe signal limit');
+          if (connection[idField] !== message.probeId) return;
+          if (++connection[signalsField] > 150) return fail(1008, 'Probe signal limit');
           send(room.host, { ...message, session });
+          if (diagnostic && message.kind === 'close') connection.diagnosticProbeId = undefined;
         } else if (room.connections.get(clientId)?.ws === ws && message.type === 'p2p-route' && message.direct === 1) {
           releaseRelay(room.connections.get(clientId));
         } else if (room.connections.get(clientId)?.ws === ws && message.type === 'data' && typeof message.payload === 'string') {