@walkhi/code-relax 0.1.0-beta.10 → 0.1.0-beta.12

package/dist/src/platform/windows/codex-runtime.mjs

@@ -3,6 +3,8 @@ import os from 'node:os';
 import path from 'node:path';
 import { createRequire } from 'node:module';
 import { execFile } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
 import { promisify } from 'node:util';
 import { readRecord, writeRecord } from '../../service-lifecycle.mjs';
 
@@ -11,7 +13,130 @@ const requiredMethods = ['thread/start', 'thread/resume', 'thread/list', 'thread
   'thread/items/list', 'turn/start', 'turn/steer', 'turn/interrupt', 'model/list', 'project/list',
   'thread/settings/update', 'configRequirements/read', 'thread/queue/list', 'thread/queue/add',
   'thread/queue/delete', 'thread/queue/start', 'thread/read', 'thread/unsubscribe', 'config/read', 'account/rateLimits/read'];
-const fingerprint = file => { const s = fs.statSync(file); return `${s.size}:${s.mtimeMs}`; };
+export const codeModeHostPath = executable => path.join(path.dirname(executable), 'codex-code-mode-host.exe');
+export const runtimeFilesAvailable = executable => fs.existsSync(executable) && fs.existsSync(codeModeHostPath(executable));
+const fingerprint = executable => [executable, codeModeHostPath(executable)]
+  .map(file => { const s = fs.statSync(file); return `${s.size}:${s.mtimeMs}`; }).join('|');
+const powershell = path.join(process.env.SystemRoot || 'C:\\Windows', 'System32/WindowsPowerShell/v1.0/powershell.exe');
+const desktopRuntimeScript = path.join(path.dirname(fileURLToPath(import.meta.url)), 'desktop-runtime.ps1');
+
+async function fileHash(file) {
+  const hash = createHash('sha256');
+  for await (const chunk of fs.createReadStream(file)) hash.update(chunk);
+  return hash.digest('hex');
+}
+
+async function installedDesktopRuntime() {
+  const { stdout } = await exec(powershell, ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass',
+    '-File', desktopRuntimeScript], { windowsHide: true, encoding: 'utf8', timeout: 30000 });
+  return JSON.parse(stdout.trim());
+}
+
+async function matchesInstalledDesktop(executable, installed) {
+  if (!installed || !runtimeFilesAvailable(executable) || !runtimeFilesAvailable(installed.executable)) return false;
+  const files = [[executable, installed.executable], [codeModeHostPath(executable), installed.codeModeHost]];
+  for (const [candidate, bundled] of files) {
+    if (fs.statSync(candidate).size !== fs.statSync(bundled).size || await fileHash(candidate) !== await fileHash(bundled)) return false;
+  }
+  return true;
+}
+
+function runtimeFiles(directory, relative = '') {
+  const files = [];
+  for (const entry of fs.readdirSync(path.join(directory, relative), { withFileTypes: true })) {
+    const name = path.join(relative, entry.name);
+    if (entry.isDirectory()) files.push(...runtimeFiles(directory, name));
+    else if (entry.isFile()) files.push(name);
+    else throw new Error(`Codex 内核目录包含不支持的文件类型：${name}`);
+  }
+  return files.sort();
+}
+
+function runtimeDirectories(files) {
+  const directories = new Set();
+  for (const file of files) {
+    let directory = path.dirname(file);
+    while (directory !== '.') { directories.add(directory); directory = path.dirname(directory); }
+  }
+  return [...directories].sort((a, b) => a.split(path.sep).length - b.split(path.sep).length);
+}
+
+async function retainDesktopRuntime(executable, installed, stateRoot) {
+  if (!/^[\w.-]+$/.test(installed.package)) throw new Error('Codex Desktop 安装包名称无效。');
+  const source = path.dirname(executable);
+  const files = runtimeFiles(source);
+  if (files.includes('runtime.json')) throw new Error('Codex 内核目录与保留清单文件名冲突。');
+  const directories = runtimeDirectories(files);
+  const root = path.join(stateRoot, 'desktop-runtimes');
+  const target = path.join(root, installed.package);
+  const retained = path.join(target, 'codex.exe');
+  if (fs.existsSync(target)) {
+    const manifest = readRecord(path.join(target, 'runtime.json'));
+    if (manifest?.package !== installed.package || JSON.stringify(manifest.files) !== JSON.stringify(files)
+      || JSON.stringify(runtimeFiles(target)) !== JSON.stringify([...files, 'runtime.json'].sort())
+      || !await matchesInstalledDesktop(retained, installed)) {
+      throw new Error(`已保留的 Codex 内核文件不完整：${target}`);
+    }
+    return retained;
+  }
+  fs.mkdirSync(root, { recursive: true });
+  const staging = path.join(root, `.${installed.package}.${randomUUID()}.tmp`);
+  fs.mkdirSync(staging);
+  const created = [];
+  try {
+    for (const directory of directories) fs.mkdirSync(path.join(staging, directory));
+    for (const name of files) {
+      const from = path.join(source, name), to = path.join(staging, name);
+      created.push(to);
+      try { fs.linkSync(from, to); }
+      catch (error) {
+        if (error.code !== 'EXDEV') throw error;
+        fs.copyFileSync(from, to);
+      }
+    }
+    if (!await matchesInstalledDesktop(path.join(staging, 'codex.exe'), installed)) {
+      throw new Error('保留的 Codex 内核与当前安装包不一致。');
+    }
+    const manifestPath = path.join(staging, 'runtime.json');
+    writeRecord(manifestPath, { package: installed.package, files });
+    created.push(manifestPath);
+    fs.renameSync(staging, target);
+    return retained;
+  } catch (error) {
+    for (const file of created) fs.rmSync(file, { force: true });
+    for (const directory of directories.reverse()) {
+      const nested = path.join(staging, directory);
+      if (fs.existsSync(nested)) fs.rmdirSync(nested);
+    }
+    fs.rmdirSync(staging);
+    throw error;
+  }
+}
+
+export function pruneRetainedDesktopRuntimes(stateRoot, keepExecutable) {
+  const root = path.join(stateRoot, 'desktop-runtimes');
+  if (!fs.existsSync(root)) return;
+  const keep = path.resolve(path.dirname(keepExecutable)).toLowerCase();
+  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+    if (!entry.isDirectory() || !/^OpenAI\.Codex_[\w.-]+$/.test(entry.name)) continue;
+    const directory = path.join(root, entry.name);
+    if (path.resolve(directory).toLowerCase() === keep || fs.lstatSync(directory).isSymbolicLink()) continue;
+    const manifest = readRecord(path.join(directory, 'runtime.json'));
+    const files = manifest?.files;
+    if (manifest?.package !== entry.name || !Array.isArray(files) || !files.includes('codex.exe')
+      || !files.includes('codex-code-mode-host.exe') || new Set(files).size !== files.length
+      || !files.every(name => typeof name === 'string' && name !== 'runtime.json'
+        && path.resolve(directory, name).toLowerCase().startsWith(`${path.resolve(directory).toLowerCase()}${path.sep}`))) continue;
+    const expected = [...files, 'runtime.json'].sort();
+    if (JSON.stringify(runtimeFiles(directory)) !== JSON.stringify(expected)) continue;
+    if (!fs.lstatSync(path.join(directory, 'runtime.json')).isFile()
+      || !files.every(name => fs.lstatSync(path.join(directory, name)).isFile())) continue;
+    for (const name of files) fs.unlinkSync(path.join(directory, name));
+    fs.unlinkSync(path.join(directory, 'runtime.json'));
+    for (const name of runtimeDirectories(files).reverse()) fs.rmdirSync(path.join(directory, name));
+    fs.rmdirSync(directory);
+  }
+}
 
 // Resolve native binaries, never execute a shell shim from a background task.
 export function discoverCodex(environment = process.env) {
@@ -92,11 +217,18 @@ export async function resolveCodexRuntime(stateRoot, { refresh = false, environm
   environment = { ...environment,
     CODEX_HOME: environment.CODEX_HOME || saved?.codexHome || path.join(os.homedir(), '.codex'),
     CODE_RELAX_CODEX_PATH: environment.CODE_RELAX_CODEX_PATH || (saved?.source === 'explicit' ? saved.executable : '') };
-  if (!refresh && saved?.executable && fs.existsSync(saved.executable)
+  if (!refresh && saved?.executable && runtimeFilesAvailable(saved.executable)
     && saved.fingerprint === fingerprint(saved.executable)) return saved;
   const candidates = [], rejected = [];
+  let installed = null;
+  try { installed = await installedDesktopRuntime(); }
+  catch (error) { rejected.push(`无法读取当前 Codex Desktop 安装包：${error.message}`); }
   for (const candidate of discoverCodex(environment)) {
     try {
+      if (!runtimeFilesAvailable(candidate.executable)) throw new Error('缺少同目录的 codex-code-mode-host.exe');
+      if (candidate.source === 'desktop' && !await matchesInstalledDesktop(candidate.executable, installed)) {
+        throw new Error('不是当前 Codex Desktop 安装包配套的 CLI');
+      }
       const { stdout } = await exec(candidate.executable, ['--version'], { windowsHide: true, timeout: 10000 });
       const version = /^codex-cli (\d+\.\d+\.\d+(?:-[\w.]+)?)/m.exec(stdout)?.[1];
       if (!version) throw new Error('无法识别版本');
@@ -106,8 +238,10 @@ export async function resolveCodexRuntime(stateRoot, { refresh = false, environm
   candidates.sort((a, b) => Number(b.source === 'desktop') - Number(a.source === 'desktop') || compareVersions(b.version, a.version));
   for (const candidate of candidates) {
     try {
-      await verifyProtocol(candidate.executable, stateRoot);
-      const result = { ...candidate, fingerprint: fingerprint(candidate.executable),
+      const executable = candidate.source === 'desktop'
+        ? await retainDesktopRuntime(candidate.executable, installed, stateRoot) : candidate.executable;
+      await verifyProtocol(executable, stateRoot);
+      const result = { ...candidate, executable, fingerprint: fingerprint(executable),
         codexHome: path.resolve(environment.CODEX_HOME || path.join(os.homedir(), '.codex')) };
       writeRecord(recordFile, result);
       return result;

package/dist/src/platform/windows/desktop-host.mjs

@@ -37,10 +37,9 @@ export const desktopHost = {
 };
 export const resolveStateRoot = stateRoot => runScript('resolve-state-root.ps1', ['-StateRoot', stateRoot]);
 
-export async function desktopShortcuts({ serviceRoot, nodeExecutable }, remove = false, destination) {
+export async function removeDesktopShortcut({ serviceRoot, nodeExecutable }, destination) {
   const entry = path.join(serviceRoot, 'dist/bin/codex-remote.mjs');
   const args = ['-NodePath', nodeExecutable, '-Entry', entry];
-  if (remove) args.push('-Remove');
   if (destination) args.push('-Destination', destination);
   return JSON.parse(await runScript('desktop-shortcuts.ps1', args));
 }

package/dist/src/platform/windows/desktop-runtime.ps1

@@ -0,0 +1,10 @@
+$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+$package = Get-AppxPackage OpenAI.Codex | Select-Object -First 1
+if (-not $package) { 'null'; exit }
+$resources = Join-Path $package.InstallLocation 'app\resources'
+@{
+    package = $package.PackageFullName
+    executable = Join-Path $resources 'codex.exe'
+    codeModeHost = Join-Path $resources 'codex-code-mode-host.exe'
+} | ConvertTo-Json -Compress

package/dist/src/platform/windows/desktop-shortcuts.ps1

@@ -1,9 +1,10 @@
-param([string]$NodePath, [string]$Entry, [switch]$Remove, [string]$Destination)
+param([string]$NodePath, [string]$Entry, [string]$Destination)
 $ErrorActionPreference = 'Stop'
 [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
 $shell = New-Object -ComObject WScript.Shell
 if (-not $Destination) { $Destination = $shell.SpecialFolders.Item('Desktop') }
-$launcher = Join-Path $PSScriptRoot 'desktop-shortcut-run.ps1'
+# Only identify and remove the retired shortcut; never create a new launcher.
+$launcher = Join-Path $PSScriptRoot 'desktop-shortcut-run.ps1'
 $items = @(@{Name='Code Relax - Codex 内核'; Command='shared-start'})
 $results = @()
 foreach ($item in $items) {
@@ -11,18 +12,10 @@ foreach ($item in $items) {
     $arguments = '-NoProfile -NoExit -ExecutionPolicy Bypass -File "' + $launcher + '" -NodePath "' + $NodePath + '" -Entry "' + $Entry + '" -Action ' + $item.Command
     if (Test-Path -LiteralPath $target) {
         $existing = $shell.CreateShortcut($target)
-        if ($existing.Arguments -ne $arguments) { throw ('快捷方式不是本安装创建的，未覆盖或删除：' + $target) }
-    }
-    if ($Remove) {
-        if (Test-Path -LiteralPath $target) { Remove-Item -LiteralPath $target }
-    } else {
-        $link = $shell.CreateShortcut($target)
-        $link.TargetPath = Join-Path $env:SystemRoot 'System32/WindowsPowerShell/v1.0/powershell.exe'
-        $link.Arguments = $arguments
-        $link.WorkingDirectory = Split-Path $Entry -Parent
-        $link.Description = $item.Name
-        $link.Save()
+        $powershell = Join-Path $env:SystemRoot 'System32/WindowsPowerShell/v1.0/powershell.exe'
+        if ($existing.Arguments -ne $arguments -or $existing.TargetPath -ne $powershell) { continue }
     }
+    if (Test-Path -LiteralPath $target) { Remove-Item -LiteralPath $target }
     $results += $target
 }
 ConvertTo-Json -InputObject $results -Compress

package/dist/src/platform/windows/resident-start.js

@@ -0,0 +1,8 @@
+// Windows Script Host has no console. Keep the login task alive until the
+// short-lived CLI has handed the resident service to the background broker.
+if (WScript.Arguments.length !== 2) WScript.Quit(2);
+var shell = new ActiveXObject('WScript.Shell');
+var node = WScript.Arguments.Item(0);
+var entry = WScript.Arguments.Item(1);
+var command = '"' + node + '" "' + entry + '" start --json';
+WScript.Quit(shell.Run(command, 0, true));

package/dist/src/platform/windows/resident-startup.ps1

@@ -5,7 +5,9 @@ $ErrorActionPreference = 'Stop'
 $taskName = 'Code Relax Bridge'
 $taskSource = '@walkhi/code-relax'
 $taskPath = '\' + $taskName
-$arguments = '"' + $Entry + '" start --json'
+$launcher = Join-Path $PSScriptRoot 'resident-start.js'
+$wscript = Join-Path $env:WINDIR 'System32\wscript.exe'
+$arguments = '//B //Nologo "' + $launcher + '" "' + $NodePath + '" "' + $Entry + '"'
 $currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
 
 $scheduler = New-Object -ComObject 'Schedule.Service'
@@ -30,7 +32,8 @@ if ($Action -ne 'status' -and $legacyExists) {
 }
 
 if ($Action -eq 'enable') {
-    if (-not (Test-Path -LiteralPath $NodePath) -or -not (Test-Path -LiteralPath $Entry)) { throw 'Installed runtime is missing.' }
+    if (-not (Test-Path -LiteralPath $NodePath) -or -not (Test-Path -LiteralPath $Entry) -or
+        -not (Test-Path -LiteralPath $launcher) -or -not (Test-Path -LiteralPath $wscript)) { throw 'Installed runtime is missing.' }
     $definition = $scheduler.NewTask(0)
     $definition.RegistrationInfo.Description = 'Start the Code Relax Bridge when this user signs in.'
     $definition.RegistrationInfo.Source = $taskSource
@@ -48,7 +51,7 @@ if ($Action -eq 'enable') {
     $trigger.UserId = $currentUser
     $trigger.Enabled = $true
     $exec = $definition.Actions.Create(0) # TASK_ACTION_EXEC
-    $exec.Path = $NodePath
+    $exec.Path = $wscript
     $exec.Arguments = $arguments
     $exec.WorkingDirectory = $env:USERPROFILE
     [void]$root.RegisterTaskDefinition($taskName, $definition, 6, $null, $null, 3, $null) # TASK_CREATE_OR_UPDATE

package/dist/src/platform/windows/service-host.mjs

@@ -20,21 +20,12 @@ async function detect(script) {
 export const sharedServiceUrl = () => detect('get-shared-service-url.ps1');
 export const lanAddress = async () => (await lanNetworks())[0]?.address || '';
 export { lanNetworks };
-export function migrateState(stateRoot) {
-  fs.mkdirSync(stateRoot, { recursive: true });
-  for (const name of ['bridge-config.json', 'bridge-session.json']) {
-    const target = path.join(stateRoot, name);
-    const old = path.join(bridgeRoot, '../.codex/bridge', name);
-    if (!fs.existsSync(target) && fs.existsSync(old)) fs.copyFileSync(old, target, fs.constants.COPYFILE_EXCL);
-  }
-}
 export async function bridgeEnvironment() {
   const environment = { ...process.env };
   const installation = readRecord(path.join(runtimePaths(environment).serviceRoot, 'installation.json'));
   const executable = installation?.nodeExecutable;
   if (!executable || !fs.existsSync(executable)) throw new Error('安装时选用的 Node 不存在，请重新安装 Code Relax。');
   environment.CODEX_MCP_NODE_PATH = executable;
-  environment.CODEX_REMOTE_LEGACY_UPLOADS_ROOTS = JSON.stringify(installation.legacyUploadsRoots || []);
   delete environment.CODEX_APP_TOOLS_PIPE_PATH;
   return { executable, environment };
 }

package/dist/src/self-relay/admin-page.mjs

@@ -47,7 +47,7 @@ const gb=value=>value==null?'—':number(Number(value)/1073741824,2)+' GB';
 el('trafficUsage').textContent=trafficFresh?'已用 '+gb(cloud.trafficUsedBytes)+' / '+gb(cloud.trafficTotalBytes):'流量暂不可用';
 el('trafficNote').textContent=trafficFresh?'更新时间 '+new Date(cloud.trafficSampledAt).toLocaleTimeString('zh-CN',{hour:'2-digit',minute:'2-digit'}):'暂不可用';
 renderTrafficTimeline(cloud,trafficFresh);
-el('metrics').replaceChildren(metric(number(state.activeRelaySessions)+' / '+number(state.maxRelaySessions),'受限转发',null,state.maxRelaySessions?toneAbove(state.activeRelaySessions/state.maxRelaySessions,.75,.9):''),metric(number(state.activeExemptRelaySessions),'白名单转发'),metric(number(state.websocketConnections),'WebSocket 连接'),metric(number(state.onlineComputers),'在线工作站'),metric(number(state.activePhones),'活动手机'))}
+el('metrics').replaceChildren(metric(number(state.activeRelaySessions)+' / '+number(state.maxRelaySessions),'受限转发',null,state.maxRelaySessions?toneAbove(state.activeRelaySessions/state.maxRelaySessions,.75,.9):''),metric(number(state.activeExemptRelaySessions),'白名单转发'),metric(number(state.websocketConnections),'WebSocket 连接'),metric(number(state.onlineComputers),'在线工作站'),metric(number(state.activePhones),'活动移动端'))}
 let editorItem=null,editorMode='new',writing=false;
 function openEditor(item=null,duplicate=false){editorItem=duplicate?null:item;editorMode=duplicate?'new':item?.status==='draft'?'draft':item?'view':'new';el('editorHeading').textContent=duplicate?'复制为新公告':editorMode==='draft'?'编辑草稿':editorMode==='view'?'查看公告':'新建公告';el('title').value=item?.title||'';el('message').value=item?.message||'';el('title').disabled=editorMode==='view';el('message').disabled=editorMode==='view';el('editorActions').hidden=editorMode==='view';el('editorNote').textContent=editorMode==='view'?'已发布内容只读；可复制为新公告再修改。':'发布后会立即替换当前公告并通知在线设备。';el('editorError').hidden=true;el('announcementEditor').showModal();if(editorMode!=='view')el('title').focus()}
 function action(label,className,handler,disabled=false){const button=node('button',className,label);button.type='button';button.disabled=disabled;button.addEventListener('click',handler);return button}

package/dist/src/self-relay/admin-state.mjs

@@ -2,19 +2,20 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 
-export function relayAdminState(file, initialMaxRelaySessions) {
-  let value = { version: 3, maxRelaySessions: initialMaxRelaySessions, announcement: null, announcements: [] };
+export function relayAdminState(file, initialMaxRelaySessions, { initial, persist } = {}) {
+  let value = initial ? validate(initial) : { version: 3, maxRelaySessions: initialMaxRelaySessions, announcement: null, announcements: [] };
   if (file && fs.existsSync(file)) value = validate(JSON.parse(fs.readFileSync(file, 'utf8')));
 
-  function save(next) {
-    value = validate(next);
-    if (!file) return value;
+  async function save(next) {
+    const validated = validate(next);
+    if (persist) await persist(validated);
+    if (!file) { value = validated; return value; }
     fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
     const temporary = `${file}.${randomUUID()}.tmp`;
     let descriptor;
     try {
       descriptor = fs.openSync(temporary, 'wx', 0o600);
-      fs.writeFileSync(descriptor, JSON.stringify(value));
+      fs.writeFileSync(descriptor, JSON.stringify(validated));
       fs.fsyncSync(descriptor); fs.closeSync(descriptor); descriptor = undefined;
       fs.renameSync(temporary, file);
       if (process.platform !== 'win32') {
@@ -25,6 +26,7 @@ export function relayAdminState(file, initialMaxRelaySessions) {
       if (descriptor !== undefined) fs.closeSync(descriptor);
       fs.rmSync(temporary, { force: true });
     }
+    value = validated;
     return value;
   }
 

package/dist/src/self-relay/connector.mjs

@@ -15,19 +15,65 @@ export function connectBridgeRelay({ relayUrl, hostKey, bridgeUrl, bridgeToken,
     serverNoContextTakeover: true, clientNoContextTakeover: true,
     threshold: 1024, zlibDeflateOptions: { level: 3 },
   } });
-  const locals = new Map();
-  let heartbeat, operation, lastClose;
+  const locals = new Map();
+  const fileLocals = new Map();
+  let fileRemote, fileRetryTimer, heartbeat, operation, lastClose, closing = false;
   const alive = () => { clearTimeout(heartbeat); heartbeat = setTimeout(() => remote.terminate(), 75000); };
   remote.on('open', alive); remote.on('ping', alive); remote.on('message', alive);
   function dropLocal(session) {
     const current = locals.get(session);
     if (!current) return;
     locals.delete(session); clearTimeout(current.timer); current.socket?.terminate();
-    current.probe?.then(probe => probe.close());
-  }
-  function dropLocals() {
-    for (const session of [...locals.keys()]) dropLocal(session);
+    current.probe?.then(probe => probe.close());
+    current.diagnosticProbe?.then(probe => probe.close());
   }
+  function dropLocals() {
+    for (const session of [...locals.keys()]) dropLocal(session);
+    for (const socket of fileLocals.values()) socket.terminate();
+    fileLocals.clear(); clearTimeout(fileRetryTimer); fileRemote?.terminate(); fileRemote = undefined;
+  }
+  function startFileReceiver() {
+    if (!identity || closing || remote.readyState !== WebSocket.OPEN) return;
+    const receiver = fileRemote = new WebSocket(relayUrl, { maxPayload: 512 * 1024, perMessageDeflate: false });
+    receiver.on('open', () => send(receiver, { type: 'file-host', deviceId: identity.id, deviceSecret: identity.secret }));
+    receiver.on('error', error => events.emit('diagnostic', `File receiver: ${error.message}`));
+    receiver.on('close', () => {
+      for (const socket of fileLocals.values()) socket.terminate();
+      fileLocals.clear();
+      if (fileRemote === receiver) {
+        fileRemote = undefined;
+        if (!closing && remote.readyState === WebSocket.OPEN) fileRetryTimer = setTimeout(startFileReceiver, 3000);
+      }
+    });
+    receiver.on('message', (bytes, binary) => {
+      try {
+        const message = decode(bytes, binary);
+        if (message.type === 'file-host-ready') return;
+        if (message.type === 'file-open') {
+          const connection = bridgeConnection?.() || { url: bridgeUrl, token: bridgeToken };
+          const url = new URL(connection.url); url.pathname = '/api/file-transfer';
+          loopbackUrl(url.href, '/api/file-transfer');
+          const socket = new WebSocket(url.href, { maxPayload: 512 * 1024, perMessageDeflate: false });
+          fileLocals.set(message.session, socket);
+          socket.on('open', () => send(socket, { type: 'auth', token: connection.token }));
+          socket.on('error', error => events.emit('diagnostic', `Local file receiver: ${error.message}`));
+          socket.on('close', () => {
+            if (fileLocals.get(message.session) !== socket) return;
+            fileLocals.delete(message.session);
+            send(receiver, { type: 'file-close', session: message.session });
+          });
+          socket.on('message', (data, isBinary) => {
+            if (isBinary || fileLocals.get(message.session) !== socket) return socket.terminate();
+            send(receiver, { type: 'file-frame', session: message.session, payload: data.toString() });
+          });
+        } else if (message.type === 'file-frame') {
+          const socket = fileLocals.get(message.session);
+          if (socket?.readyState === WebSocket.OPEN) socket.send(message.payload);
+        } else if (message.type === 'file-close') fileLocals.get(message.session)?.terminate();
+        else throw new Error('Invalid file receiver frame');
+      } catch (error) { events.emit('diagnostic', error.message); receiver.close(1008, 'Invalid file frame'); }
+    });
+  }
   const ready = new Promise((resolve, reject) => {
     let registered = false;
     const timer = setTimeout(() => { reject(new Error('Relay registration timeout')); remote.terminate(); }, 5000);
@@ -44,7 +90,7 @@ export function connectBridgeRelay({ relayUrl, hostKey, bridgeUrl, bridgeToken,
     remote.on('message', (bytes, binary) => {
       try {
         const message = decode(bytes, binary);
-        if (message.type === 'registered' && !registered) { registered = true; clearTimeout(timer); resolve(message); return; }
+        if (message.type === 'registered' && !registered) { registered = true; clearTimeout(timer); startFileReceiver(); resolve(message); return; }
         if (!registered) throw new Error('Relay not registered');
         if (message.type === 'pair-code' || message.type === 'revoked' || message.type === 'status') {
           if (operation && message.commandId === operation.id && message.type === operation.responseType) {
@@ -102,10 +148,36 @@ export function connectBridgeRelay({ relayUrl, hostKey, bridgeUrl, bridgeToken,
               }
             } catch (error) { events.emit('diagnostic', error.message); socket.terminate(); }
           });
-        } else if (message.type === 'p2p-probe' && locals.has(message.session)) {
-          const current = locals.get(message.session);
-          if (!current.ready || !current.p2pProbe || !validProbeSignal(message)) throw new Error('Invalid probe signal');
-          if (message.kind === 'start' && current.probeId !== message.probeId) {
+        } else if (message.type === 'p2p-probe' && locals.has(message.session)) {
+          const current = locals.get(message.session);
+          if (!current.ready || !current.p2pProbe || !validProbeSignal(message)) throw new Error('Invalid probe signal');
+          if (message.purpose === 'diagnostic') {
+            if (message.kind === 'start' && current.diagnosticProbeId !== message.probeId) {
+              void current.diagnosticProbe?.then(probe => probe.close());
+              current.diagnosticProbeId = message.probeId;
+              const probeId = message.probeId;
+              current.diagnosticProbe = createP2pProbe({ iceServers,
+                signal: signal => {
+                  if (locals.get(message.session) === current && current.diagnosticProbeId === probeId) {
+                    send(remote, { type: 'p2p-probe', purpose: 'diagnostic', session: message.session,
+                      version: 1, probeId, ...signal });
+                  }
+                },
+                report: (state, diagnostic) => events.emit('p2p-probe', { state, diagnostic })
+              }).catch(() => {
+                if (locals.get(message.session) === current && current.diagnosticProbeId === probeId) {
+                  send(remote, { type: 'p2p-probe', purpose: 'diagnostic', session: message.session,
+                    version: 1, probeId, kind: 'close' });
+                }
+                return { receive() {}, close() {} };
+              });
+            } else if (current.diagnosticProbe && current.diagnosticProbeId === message.probeId) {
+              void current.diagnosticProbe.then(probe => probe.receive(message));
+            }
+            return;
+          }
+          if (message.purpose) throw new Error('Invalid probe purpose');
+          if (message.kind === 'start' && current.probeId !== message.probeId) {
             void current.probe?.then(probe => probe.close());
             current.probeId = message.probeId;
             current.routeSignals = Promise.resolve();
@@ -157,6 +229,6 @@ export function connectBridgeRelay({ relayUrl, hostKey, bridgeUrl, bridgeToken,
     updateLanCandidates(candidates) {
       if (!send(remote, { type: 'lan-candidates', candidates })) throw new Error('中继未连接');
     },
-    close() { clearTimeout(heartbeat); dropLocals(); remote.terminate(); }
+    close() { closing = true; clearTimeout(heartbeat); dropLocals(); remote.terminate(); }
   };
 }

package/dist/src/self-relay/email-accounts.mjs

@@ -0,0 +1,125 @@
+import fs from 'node:fs';
+import { createHash, createHmac, randomBytes, randomInt, randomUUID, timingSafeEqual } from 'node:crypto';
+import { tencentAccountProvider } from '../../relay-admin/tencent-account-provider.mjs';
+
+const sqlTime = value => value.replace('T', ' ').replace(/Z$/, '');
+const isoTime = value => value.replace(' ', 'T') + 'Z';
+const error = (status, message) => Object.assign(new Error(message), { status });
+const tokenHash = token => createHash('sha256').update(token).digest('hex');
+const normalizeEmail = value => {
+  if (typeof value !== 'string') throw error(400, 'Invalid email address');
+  const email = value.trim().toLowerCase();
+  if (email.length > 254 || !/^[a-z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-z0-9-]+(?:\.[a-z0-9-]+)+$/.test(email)) {
+    throw error(400, 'Invalid email address');
+  }
+  return email;
+};
+
+export function openEmailAccounts(pool, configFile, providerOverride) {
+  const config = JSON.parse(fs.readFileSync(configFile, 'utf8'));
+  if (![config.secretId, config.secretKey, config.captchaAppSecretKey, config.fromEmailAddress, config.sesRegion]
+    .every(value => typeof value === 'string' && value.length > 0) ||
+    !Number.isSafeInteger(config.captchaAppId) || config.captchaAppId < 1 ||
+    !Number.isSafeInteger(config.emailTemplateId) || config.emailTemplateId < 1 ||
+    typeof config.codePepper !== 'string' || config.codePepper.length < 32) {
+    throw new Error('Incomplete relay account configuration');
+  }
+  const provider = providerOverride || tencentAccountProvider(config);
+  const codeHash = (email, code) => createHmac('sha256', config.codePepper).update(`${email}\0${code}`).digest('hex');
+  const scopeHash = value => createHmac('sha256', config.codePepper).update(value).digest('hex');
+
+  async function requestCode({ email: rawEmail, ticket, randstr }, ip) {
+    const email = normalizeEmail(rawEmail);
+    if (typeof ticket !== 'string' || !ticket || ticket.length > 2048 ||
+        typeof randstr !== 'string' || !randstr || randstr.length > 128) throw error(400, 'Invalid human verification');
+    if (!ip || ip.length > 64) throw error(400, 'Invalid client address');
+    // A cheap pre-check precedes the billable human verification.
+    const [recent] = await pool.execute('SELECT sent_at FROM email_login_challenges WHERE email = ? AND sent_at > UTC_TIMESTAMP(3) - INTERVAL 60 SECOND', [email]);
+    if (recent.length) throw error(429, 'Please wait before requesting another code');
+    const [ipLimit] = await pool.execute(`SELECT request_count FROM email_send_limits
+      WHERE scope_hash=? AND window_start>=UTC_TIMESTAMP() - INTERVAL 1 HOUR ORDER BY window_start DESC LIMIT 1`, [scopeHash(`ip:${ip}`)]);
+    if (ipLimit[0]?.request_count >= 20) throw error(429, 'Too many email requests');
+    if (!await provider.verifyHuman(ticket, randstr, ip)) throw error(403, 'Human verification failed');
+    const code = String(randomInt(0, 1000000)).padStart(6, '0');
+    const hash = codeHash(email, code);
+    const windowStart = sqlTime(new Date(Math.floor(Date.now() / 3600000) * 3600000).toISOString()).slice(0, 19);
+    const db = await pool.getConnection();
+    try {
+      await db.beginTransaction();
+      for (const [scope, limit] of [[`email:${email}`, 5], [`ip:${ip}`, 20]]) {
+        const key = scopeHash(scope);
+        await db.execute('INSERT INTO email_send_limits (scope_hash,window_start,request_count) VALUES (?,?,1) ON DUPLICATE KEY UPDATE request_count=request_count+1', [key, windowStart]);
+        const [rows] = await db.execute('SELECT request_count FROM email_send_limits WHERE scope_hash=? AND window_start=? FOR UPDATE', [key, windowStart]);
+        if (rows[0].request_count > limit) throw error(429, 'Too many email requests');
+      }
+      const [existing] = await db.execute('SELECT sent_at FROM email_login_challenges WHERE email=? FOR UPDATE', [email]);
+      if (existing.length && Date.now() - new Date(`${existing[0].sent_at.replace(' ', 'T')}Z`).getTime() < 60000) {
+        throw error(429, 'Please wait before requesting another code');
+      }
+      await db.execute(`INSERT INTO email_login_challenges (email,code_hash,expires_at,attempts,sent_at)
+        VALUES (?, ?, UTC_TIMESTAMP(3) + INTERVAL 10 MINUTE, 0, UTC_TIMESTAMP(3))
+        ON DUPLICATE KEY UPDATE code_hash=VALUES(code_hash),expires_at=VALUES(expires_at),attempts=0,sent_at=VALUES(sent_at)`, [email, hash]);
+      await db.commit();
+    } catch (failure) { await db.rollback(); throw failure; }
+    finally { db.release(); }
+    try { await provider.sendLoginCode(email, code); }
+    catch (failure) {
+      await pool.execute('DELETE FROM email_login_challenges WHERE email=? AND code_hash=?', [email, hash]);
+      throw error(503, 'Email delivery unavailable');
+    }
+    return { sent: true, expiresInSeconds: 600 };
+  }
+
+  async function verifyCode({ email: rawEmail, code }) {
+    const email = normalizeEmail(rawEmail);
+    if (typeof code !== 'string' || !/^\d{6}$/.test(code)) throw error(400, 'Invalid code');
+    const db = await pool.getConnection();
+    try {
+      await db.beginTransaction();
+      const [challenges] = await db.execute('SELECT code_hash,attempts,expires_at FROM email_login_challenges WHERE email=? FOR UPDATE', [email]);
+      const challenge = challenges[0];
+      if (!challenge || new Date(`${challenge.expires_at.replace(' ', 'T')}Z`).getTime() <= Date.now()) throw error(401, 'Code expired or incorrect');
+      const supplied = Buffer.from(codeHash(email, code), 'hex');
+      if (!timingSafeEqual(supplied, Buffer.from(challenge.code_hash, 'hex'))) {
+        if (challenge.attempts >= 4) await db.execute('DELETE FROM email_login_challenges WHERE email=?', [email]);
+        else await db.execute('UPDATE email_login_challenges SET attempts=attempts+1 WHERE email=?', [email]);
+        await db.commit();
+        throw error(401, 'Code expired or incorrect');
+      }
+      await db.execute('DELETE FROM email_login_challenges WHERE email=?', [email]);
+      const [identities] = await db.execute(`SELECT u.id,u.status FROM user_login_identities i
+        JOIN users u ON u.id=i.user_id WHERE i.kind='email' AND i.normalized_value=?`, [email]);
+      let userId = identities[0]?.id;
+      if (identities[0]?.status === 'disabled') throw error(403, 'Account unavailable');
+      if (!userId) {
+        userId = randomUUID();
+        await db.execute('INSERT INTO users (id,status,created_at,updated_at) VALUES (?,\'active\',UTC_TIMESTAMP(3),UTC_TIMESTAMP(3))', [userId]);
+        await db.execute(`INSERT INTO user_login_identities (user_id,kind,normalized_value,verified_at,created_at)
+          VALUES (?,'email',?,UTC_TIMESTAMP(3),UTC_TIMESTAMP(3))`, [userId, email]);
+      }
+      const token = randomBytes(32).toString('base64url');
+      await db.execute(`INSERT INTO user_sessions (token_hash,user_id,created_at,expires_at)
+        VALUES (?,?,UTC_TIMESTAMP(3),UTC_TIMESTAMP(3) + INTERVAL 30 DAY)`, [tokenHash(token), userId]);
+      await db.commit();
+      return { token, user: { id: userId, email }, expiresInSeconds: 30 * 86400 };
+    } catch (failure) { await db.rollback(); throw failure; }
+    finally { db.release(); }
+  }
+
+  async function current(token) {
+    if (typeof token !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(token)) throw error(401, 'Unauthorized');
+    const [rows] = await pool.execute(`SELECT u.id,i.normalized_value AS email,s.expires_at FROM user_sessions s
+      JOIN users u ON u.id=s.user_id JOIN user_login_identities i ON i.user_id=u.id AND i.kind='email'
+      WHERE s.token_hash=? AND s.revoked_at IS NULL AND s.expires_at>UTC_TIMESTAMP(3) AND u.status='active'`, [tokenHash(token)]);
+    if (!rows.length) throw error(401, 'Unauthorized');
+    return { id: rows[0].id, email: rows[0].email, expiresAt: isoTime(rows[0].expires_at) };
+  }
+
+  async function logout(token) {
+    await current(token);
+    await pool.execute('UPDATE user_sessions SET revoked_at=UTC_TIMESTAMP(3) WHERE token_hash=? AND revoked_at IS NULL', [tokenHash(token)]);
+    return { ok: true };
+  }
+
+  return { captchaAppId: config.captchaAppId, requestCode, verifyCode, current, logout };
+}