@walkhi/code-relax 0.1.0-beta.22 → 0.1.0-beta.23

package/dist/src/self-relay/admin-page.mjs

@@ -21,8 +21,8 @@ button{background:#e0f0e5;color:#235d3a;border-color:#a9cbb4}button:hover{backgr
 #metrics{grid-template-columns:repeat(5,minmax(0,1fr))}.relay-heading{margin-bottom:14px}.resource-head{display:flex;align-items:center;justify-content:space-between;gap:10px}.resource-head .hint{white-space:nowrap}.resource-card .throughput{border-top:1px solid #dce5df;padding-top:10px;margin-top:12px}.resource-card .throughput .metric{display:flex;flex-direction:row-reverse;align-items:center;justify-content:space-between;gap:8px;padding:8px 10px}.resource-card .throughput .metric strong{font-size:16px;margin:0;white-space:nowrap}
 @media(max-width:800px){#metrics{grid-template-columns:repeat(2,minmax(0,1fr))}}
 @media(max-width:600px){.resource-card .throughput .metric strong{font-size:14px}}
-</style><style>main:not(.authenticated)>:not(#adminLogin){display:none!important}#adminLogin{max-width:430px;margin:10vh auto}#adminLogin[hidden]{display:none}.usage-toolbar{display:flex;align-items:center;justify-content:space-between;gap:12px;flex-wrap:wrap;margin-bottom:16px}.usage-views,.usage-pages{display:flex;align-items:center;gap:8px}.usage-views button[aria-pressed=true]{background:#286e43;color:#fff}.usage-rows{display:grid;gap:8px}.usage-row{display:grid;grid-template-columns:minmax(0,1fr) minmax(0,2fr) 150px;gap:12px;align-items:center;padding:12px 14px;border:1px solid var(--admin-row-border);border-radius:var(--admin-control-radius);background:var(--admin-row)}.usage-row span{overflow-wrap:anywhere}.usage-row strong{font-variant-numeric:tabular-nums}.usage-row small{text-align:right}.usage-pages{margin-top:16px}@media(max-width:700px){.usage-row{grid-template-columns:minmax(0,1fr)}.usage-row small{text-align:left}}</style></head><body><main>
-<section id="adminLogin" class="card"><h1>管理员登录</h1><p class="subtle">使用已授予管理权限的 Code Relax 邮箱账号</p><div class="field"><label for="loginEmail">邮箱</label><input id="loginEmail" type="email" autocomplete="email"></div><div class="field"><label for="loginCode">邮件验证码</label><input id="loginCode" inputmode="numeric" maxlength="6" autocomplete="one-time-code"></div><div class="actions"><button id="sendLoginCode" type="button">发送验证码</button><button id="verifyLogin" type="button">登录后台</button></div><p id="loginError" class="status error" role="alert"></p></section>
+</style><style>main:not(.authenticated)>:not(#adminLogin){display:none!important}#adminLogin{max-width:430px;margin:10vh auto}#adminLogin[hidden]{display:none}.usage-toolbar{display:flex;align-items:center;justify-content:space-between;gap:12px;flex-wrap:wrap;margin-bottom:16px}.usage-views,.usage-pages{display:flex;align-items:center;gap:8px}.usage-views button[aria-pressed=true]{background:#286e43;color:#fff}.usage-rows{display:grid;gap:8px}.usage-row{display:grid;gap:8px;padding:12px 14px;border:1px solid var(--admin-row-border);border-radius:var(--admin-control-radius);background:var(--admin-row)}.usage-row-head{display:flex;align-items:baseline;justify-content:space-between;gap:12px;min-width:0}.usage-row-head span{min-width:0;overflow-wrap:anywhere}.usage-row-head small{flex-shrink:0;white-space:nowrap}.usage-row strong{font-variant-numeric:tabular-nums}.usage-row small{text-align:right}.usage-pages{margin-top:16px}</style></head><body><main>
+<section id="adminLogin" class="card" hidden><h1>管理员登录</h1><p class="subtle">使用已授予管理权限的 Code Relax 邮箱账号</p><div class="field"><label for="loginEmail">邮箱</label><input id="loginEmail" type="email" autocomplete="email"></div><div class="field"><label for="loginCode">邮件验证码</label><input id="loginCode" inputmode="numeric" maxlength="6" autocomplete="one-time-code"></div><div class="actions"><button id="sendLoginCode" type="button">发送验证码</button><button id="verifyLogin" type="button">登录后台</button></div><p id="loginError" class="status error" role="alert"></p></section>
 <header class="page-head"><h1>中继管理</h1><nav class="nav" aria-label="管理页面"><button type="button" data-page="overview" aria-current="page">运行概览</button><button type="button" data-page="announcements">系统公告</button><button type="button" data-page="settings">容量设置</button><button type="button" data-page="usage">使用统计</button><button id="adminLogout" type="button" class="secondary">退出后台</button></nav></header>
 <section id="overview" class="page stack"><section class="card" aria-label="中继连接与转发"><div class="relay-heading"><h2>中继连接与转发</h2><span id="healthText" class="state">读取中</span></div><div id="metrics" class="metrics"></div></section><div class="grid"><section class="card resource-card" aria-label="服务器资源"><div class="card-head resource-head"><h2>服务器资源</h2><span id="sampleTime" class="hint">等待采样</span></div><div id="serverMetrics" class="metrics"></div><div class="throughput" id="throughput"></div></section><section class="card quota-card"><div class="card-head"><h2>流量包</h2><span id="trafficNote" class="hint">等待更新</span></div><p id="trafficUsage" class="traffic-usage">—</p><div id="trafficTimeline" class="quota-timeline" hidden><div class="quota-heading"><strong id="trafficRemaining">流量剩余 —</strong><span id="trafficPace" class="quota-pace">—×</span><span id="timeRemaining">时间剩余 —</span></div><div id="quotaTrack" class="quota-track" role="img"><span id="quotaFill" class="quota-fill"></span><span id="quotaNow" class="quota-now"></span></div><div class="quota-period"><span id="trafficEnd">到期 —</span><span id="trafficStart">本期开始 —</span></div></div></section></div></section>
 <section id="announcements" class="page" hidden><section class="card"><div class="announcement-toolbar"><div><h2>公告管理</h2><p id="announcementCount" class="hint">正在读取</p></div><button id="newAnnouncement" type="button">新建公告</button></div><div class="announcement-controls"><input id="announcementSearch" type="search" aria-label="搜索公告" placeholder="搜索标题或正文"><select id="announcementFilter" aria-label="筛选状态"><option value="all">全部状态</option><option value="active">发布中</option><option value="draft">草稿</option><option value="withdrawn">已撤下</option></select></div><div id="announcementList" class="announcement-list" style="margin-top:14px"></div></section></section>
@@ -31,7 +31,7 @@ button{background:#e0f0e5;color:#235d3a;border-color:#a9cbb4}button:hover{backgr
 <section id="usage" class="page" hidden><section class="card"><div class="usage-toolbar"><div><h2>今日使用统计</h2><p id="usageCount" class="hint">正在读取</p></div><div class="usage-views"><button id="usageUsers" type="button" class="secondary" aria-pressed="true">用户</button><button id="usageComputers" type="button" class="secondary" aria-pressed="false">工作站</button><button id="usageRefresh" type="button" class="secondary">刷新</button></div></div><div id="usageRows" class="usage-rows"></div><div class="usage-pages"><button id="usagePrev" type="button" class="secondary">上一页</button><span id="usagePageText" class="hint"></span><button id="usageNext" type="button" class="secondary">下一页</button></div><p id="usageError" class="status error" role="alert"></p></section></section><p id="result" class="status" role="status" aria-live="polite"></p>
 </main><script>
 const el=id=>document.getElementById(id);let snapshot=null;
-const request=async(path,options={})=>{const token=sessionStorage.getItem('codeRelaxAdminToken');const headers={...options.headers,...(token?{Authorization:'Bearer '+token}:{})};const response=await fetch(path,{...options,headers});const body=await response.json();if(!response.ok){const message=body.error||('HTTP '+response.status);if(path.startsWith('/admin/api/')&&(response.status===401||response.status===403)){sessionStorage.removeItem('codeRelaxAdminToken');showLogin(message)}throw new Error(message)}return body};
+const request=async(path,options={})=>{const token=localStorage.getItem('codeRelaxAdminToken');const headers={...options.headers,...(token?{Authorization:'Bearer '+token}:{})};const response=await fetch(path,{...options,headers});const body=await response.json();if(!response.ok){const message=body.error||('HTTP '+response.status);if(path.startsWith('/admin/api/')&&(response.status===401||response.status===403)){localStorage.removeItem('codeRelaxAdminToken');showLogin(message)}throw new Error(message)}return body};
 function setResult(message,error=false){el('result').textContent=message;el('result').classList.toggle('error',error)}
 function node(tag,className,value){const item=document.createElement(tag);if(className)item.className=className;if(value!==undefined)item.textContent=value;return item}
 function metric(value,label,extra,tone){const item=node('div','metric'+(tone?' '+tone:''));item.append(node('strong','',value),node('span','',label));if(extra)item.append(node('small','',extra));return item}
@@ -66,8 +66,8 @@ async function load(){try{render(await request('/admin/api/status'));setResult('
 async function write(method,path,body,message){if(writing)return false;writing=true;try{await request(path,{method,headers:{'Content-Type':'application/json','X-Code-Relax-Admin':'1'},body:JSON.stringify(body)});await load();setResult(message);return true}catch(error){setResult(error.message,true);if(el('announcementEditor').open){el('editorError').textContent=error.message;el('editorError').hidden=false}return false}finally{writing=false}}
 let usageView='user',usagePage=1,usageTotal=0;
 function usageDuration(value){const seconds=Math.floor(Number(value)||0),hours=Math.floor(seconds/3600),minutes=Math.floor(seconds%3600/60),rest=seconds%60;return hours?hours+' 小时 '+minutes+' 分钟':minutes?minutes+' 分钟 '+rest+' 秒':rest+' 秒'}
-function usageTime(value){return value?new Date(value.replace(' ','T')+'Z').toLocaleString('zh-CN'):'—'}
-async function loadUsage(){const view=usageView,page=usagePage;el('usageError').textContent='';el('usageCount').textContent='正在读取';try{const result=await request('/admin/api/usage?view='+view+'&page='+page);if(view!==usageView||page!==usagePage||el('usage').hidden)return;usageTotal=result.total;el('usageCount').textContent='今日有记录：'+usageTotal+(view==='user'?' 个用户':' 台工作站')+' · 北京时间';el('usagePageText').textContent='第 '+page+' / '+Math.max(1,Math.ceil(usageTotal/30))+' 页';el('usagePrev').disabled=page<=1;el('usageNext').disabled=page*30>=usageTotal;const rows=el('usageRows');rows.replaceChildren();if(!result.rows.length){rows.append(node('div','empty-note','今日暂无计时记录'));return}for(const item of result.rows){const row=node('div','usage-row');const counts=' · 消息 '+Number(item.message_count||0)+' · 轮次 '+Number(item.turn_count||0);row.append(node('span','',view==='user'?item.email:item.id),node('strong','',view==='user'?'任务 '+usageDuration(item.today_task_seconds)+counts:'任务 '+usageDuration(item.today_task_seconds)+' · 免费账号 '+usageDuration(item.today_free_task_seconds)+counts),node('small','hint','最后使用 '+usageTime(item.last_used_at)));rows.append(row)}}catch(error){if(view===usageView&&page===usagePage){usageTotal=0;el('usageCount').textContent='统计暂不可用';el('usageRows').replaceChildren();el('usagePageText').textContent='';el('usagePrev').disabled=true;el('usageNext').disabled=true;el('usageError').textContent=error.message}}}
+function usageTime(value){return value?new Date(value.replace(' ','T')+'Z').toLocaleTimeString('zh-CN',{timeZone:'Asia/Shanghai',hour:'2-digit',minute:'2-digit',second:'2-digit',hour12:false}):'—'}
+async function loadUsage(){const view=usageView,page=usagePage;el('usageError').textContent='';el('usageCount').textContent='正在读取';try{const result=await request('/admin/api/usage?view='+view+'&page='+page);if(view!==usageView||page!==usagePage||el('usage').hidden)return;usageTotal=result.total;el('usageCount').textContent='今日有记录：'+usageTotal+(view==='user'?' 个用户':' 台工作站')+' · 北京时间';el('usagePageText').textContent='第 '+page+' / '+Math.max(1,Math.ceil(usageTotal/30))+' 页';el('usagePrev').disabled=page<=1;el('usageNext').disabled=page*30>=usageTotal;const rows=el('usageRows');rows.replaceChildren();if(!result.rows.length){rows.append(node('div','empty-note','今日暂无计时记录'));return}for(const item of result.rows){const row=node('div','usage-row');const counts=' · 消息 '+Number(item.message_count||0)+' · 轮次 '+Number(item.turn_count||0);const heading=node('div','usage-row-head');const title=node('span','',view==='user'?item.email:'工作站 …'+item.id.slice(-8));title.title=view==='user'?item.email:item.id;heading.append(title,node('small','hint','最后使用 '+usageTime(item.last_used_at)));row.append(heading,node('strong','',view==='user'?'任务 '+usageDuration(item.today_task_seconds)+counts:'任务 '+usageDuration(item.today_task_seconds)+' · 免费账号 '+usageDuration(item.today_free_task_seconds)+counts));rows.append(row)}}catch(error){if(view===usageView&&page===usagePage){usageTotal=0;el('usageCount').textContent='统计暂不可用';el('usageRows').replaceChildren();el('usagePageText').textContent='';el('usagePrev').disabled=true;el('usageNext').disabled=true;el('usageError').textContent=error.message}}}
 function setUsageView(view){if(usageView===view)return;usageView=view;usagePage=1;el('usageUsers').setAttribute('aria-pressed',String(view==='user'));el('usageComputers').setAttribute('aria-pressed',String(view==='computer'));void loadUsage()}
 el('usageUsers').onclick=()=>setUsageView('user');el('usageComputers').onclick=()=>setUsageView('computer');el('usageRefresh').onclick=()=>loadUsage();el('usagePrev').onclick=()=>{if(usagePage>1){usagePage--;void loadUsage()}};el('usageNext').onclick=()=>{if(usagePage*30<usageTotal){usagePage++;void loadUsage()}};
 function showPage(page){for(const button of document.querySelectorAll('[data-page]'))button.setAttribute('aria-current',button.dataset.page===page?'page':'false');for(const section of document.querySelectorAll('.page'))section.hidden=section.id!==page;history.replaceState(null,'','#'+page);if(page==='usage')void loadUsage();else void load()}
@@ -77,10 +77,10 @@ el('newAnnouncement').addEventListener('click',()=>openEditor());el('closeEditor
 async function saveAnnouncement(publish){const title=el('title').value.trim(),message=el('message').value.trim();if(!title||!message){el('editorError').textContent='请填写标题和正文';el('editorError').hidden=false;return}if(publish&&snapshot?.announcement&&snapshot.announcement.id!==editorItem?.id&&!confirm('发布后将替换当前公告，确定发布？'))return;const path=editorMode==='draft'?'/admin/api/announcements/'+encodeURIComponent(editorItem.id):'/admin/api/announcements';const target=publish&&editorMode==='draft'?path+'/publish':path;const body={title,message};if(publish&&editorMode==='new')body.publish=true;const ok=await write('PUT',target,body,publish?'公告已发布':'草稿已保存');if(ok)el('announcementEditor').close()}
 el('saveDraft').addEventListener('click',()=>saveAnnouncement(false));el('publish').addEventListener('click',()=>saveAnnouncement(true));
 function showLogin(error=''){document.querySelector('main').classList.remove('authenticated');el('adminLogin').hidden=false;el('loginError').textContent=error}
-async function authorize(){try{await request('/admin/api/session');document.querySelector('main').classList.add('authenticated');el('adminLogin').hidden=true;showPage(['overview','announcements','settings','usage'].includes(location.hash.slice(1))?location.hash.slice(1):'overview')}catch(error){sessionStorage.removeItem('codeRelaxAdminToken');showLogin(error.message)}}
+async function authorize(){try{await request('/admin/api/session');document.querySelector('main').classList.add('authenticated');el('adminLogin').hidden=true;showPage(['overview','announcements','settings','usage'].includes(location.hash.slice(1))?location.hash.slice(1):'overview')}catch(error){showLogin(localStorage.getItem('codeRelaxAdminToken')?'登录验证暂时失败，请刷新页面重试：'+error.message:error.message)}}
 el('sendLoginCode').onclick=async()=>{const email=el('loginEmail').value.trim().toLowerCase();if(!email){showLogin('请输入邮箱');return}el('loginError').textContent='';try{const config=await request('/account/config');if(!window.TencentCaptcha){await new Promise((resolve,reject)=>{const script=document.createElement('script');script.src='https://turing.captcha.qcloud.com/TJCaptcha.js';script.onload=resolve;script.onerror=reject;document.head.append(script)})}new TencentCaptcha(String(config.captchaAppId),async result=>{if(result.ret!==0)return;try{await request('/account/email/request',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({email,ticket:result.ticket,randstr:result.randstr})});el('loginError').textContent='验证码已发送'}catch(error){el('loginError').textContent=error.message}}).show()}catch(error){el('loginError').textContent='人机验证不可用：'+error.message}};
-el('verifyLogin').onclick=async()=>{const email=el('loginEmail').value.trim().toLowerCase(),code=el('loginCode').value.trim();if(!/^\\d{6}$/.test(code)){el('loginError').textContent='请输入 6 位验证码';return}try{const result=await request('/account/email/verify',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({email,code})});sessionStorage.setItem('codeRelaxAdminToken',result.token);await authorize()}catch(error){el('loginError').textContent=error.message}};
-el('adminLogout').onclick=()=>{sessionStorage.removeItem('codeRelaxAdminToken');showLogin()};
-if(sessionStorage.getItem('codeRelaxAdminToken'))void authorize();else showLogin();setInterval(()=>{if(!document.hidden&&!el('overview').hidden&&document.querySelector('main').classList.contains('authenticated'))load()},5000);
+el('verifyLogin').onclick=async()=>{const email=el('loginEmail').value.trim().toLowerCase(),code=el('loginCode').value.trim();if(!/^[0-9]{6}$/.test(code)){el('loginError').textContent='请输入 6 位验证码';return}try{const result=await request('/account/email/verify',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({email,code})});localStorage.setItem('codeRelaxAdminToken',result.token);await authorize()}catch(error){el('loginError').textContent=error.message}};
+el('adminLogout').onclick=()=>{localStorage.removeItem('codeRelaxAdminToken');showLogin()};
+if(localStorage.getItem('codeRelaxAdminToken'))void authorize();else showLogin();setInterval(()=>{if(!document.hidden&&!el('overview').hidden&&document.querySelector('main').classList.contains('authenticated'))load()},5000);
 </script></body></html>`;
 }

package/dist/src/self-relay/connector.mjs

@@ -251,7 +251,7 @@ export function connectBridgeRelay({ relayUrl, hostKey, bridgeUrl, bridgeToken,
           current.forwardToBridge = payload => {
             if (locals.get(message.session) !== current || !current.ready) throw new Error('Local desktop service connection not ready');
             const request = decode(payload, false);
-            if (!['request', 'subscribe', 'unsubscribe'].includes(request.type)) throw new Error('Unsupported LAN message');
+            if (!['request', 'subscribe', 'unsubscribe', 'response-ack', 'cancel'].includes(request.type)) throw new Error('Unsupported LAN message');
             if (request.type === 'request' && request.method === 'POST' && Number.isSafeInteger(request.id)) {
               const path = (request.path || '').split('?')[0];
               const existing = /^\/api\/threads\/([^/?]+)\/(?:messages|queue)$/.exec(path);

package/dist/src/self-relay/lifecycle.mjs

@@ -1,22 +1,19 @@
-import fs from 'node:fs';
 import path from 'node:path';
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-import { randomBytes, randomUUID } from 'node:crypto';
-import { hostname } from 'node:os';
-import QRCode from 'qrcode';
-import { credentialStore } from '../platform/windows/credential-store.mjs';
-import { readRecord, writeRecord } from '../service-lifecycle.mjs';
-import { serviceHealth } from '../service-health.mjs';
+import serviceEndpoints from '../../shared/service-endpoints.cjs';
+import { randomBytes, randomUUID } from 'node:crypto';
+import { hostname } from 'node:os';
+import QRCode from 'qrcode';
+import { credentialStore } from '../platform/windows/credential-store.mjs';
+import { readRecord, writeRecord } from '../service-lifecycle.mjs';
+import { serviceHealth } from '../service-health.mjs';
 import { controlRequest } from '../service-control.mjs';
-import { connectBridgeRelay } from './connector.mjs';
-import { validProbeIceServers } from './p2p-probe.mjs';
-import { relayAddress, validSecret } from './wire.mjs';
-import { saveLanAuthorizations } from './lan-authorizations.mjs';
+import { connectBridgeRelay } from './connector.mjs';
+import { validProbeIceServers } from './p2p-probe.mjs';
+import { relayAddress, validSecret } from './wire.mjs';
+import { saveLanAuthorizations } from './lan-authorizations.mjs';
 import { lanNetworks } from '../platform/windows/network-info.mjs';
 
-const exec = promisify(execFile);
-const officialConfig = { url: 'wss://api.uulife.site/relay' };
+const officialConfig = { url: serviceEndpoints.relayUrl };
 
 async function loadConfig(stateRoot) {
   const configPath = path.join(stateRoot, 'self-relay-config.json');
@@ -26,33 +23,16 @@ async function loadConfig(stateRoot) {
   if (config.p2pIceServers !== undefined && !validProbeIceServers(config.p2pIceServers)) throw new Error('p2pIceServers 只接受最多 4 个 stun:主机:端口地址');
   if (config.p2pWindowsRouteHelper !== undefined && typeof config.p2pWindowsRouteHelper !== 'boolean') throw new Error('p2pWindowsRouteHelper 必须是布尔值');
   if (config.p2pWindowsRouteHelper && !/^[A-Za-z0-9_-]{32,128}$/.test(config.p2pWindowsRouteHelperToken || '')) throw new Error('p2pWindowsRouteHelperToken 无效');
-  const url = process.env.RELAY_URL || config.url;
-  if (!url) throw new Error('请先配置 self-relay-config.json 的 url 和 hostKeyFile（或 sshHost、sshKeyPath），详见自建中继文档。');
-  relayAddress(url);
-  const resolved = relayAddress(url);
-  const pairingUrl = config.pairingUrl || `${resolved.startsWith('wss:') ? 'https:' : 'http:'}//${new URL(resolved).host}/pair`;
-  const pairing = new URL(pairingUrl);
-  if (!['https:', 'http:'].includes(pairing.protocol) || pairing.pathname !== '/pair' || pairing.search || pairing.hash || pairing.username || pairing.password ||
-      (pairing.protocol === 'http:' && pairing.hostname !== '127.0.0.1')) throw new Error('self-relay-config.json 的 pairingUrl 必须是 HTTPS /pair 地址。');
+  const url = process.env.RELAY_URL || serviceEndpoints.resolveRelayUrl(config.url);
+  if (!url) throw new Error('请先配置 self-relay-config.json 的 url，详见自建中继文档。');
+  relayAddress(url);
+  const resolved = relayAddress(url);
+  const pairingUrl = config.pairingUrl || (resolved === serviceEndpoints.relayUrl ? serviceEndpoints.pairingUrl : `${resolved.startsWith('wss:') ? 'https:' : 'http:'}//${new URL(resolved).host}/pair`);
+  const pairing = new URL(pairingUrl);
+  if (!['https:', 'http:'].includes(pairing.protocol) || pairing.pathname !== '/pair' || pairing.search || pairing.hash || pairing.username || pairing.password ||
+      (pairing.protocol === 'http:' && pairing.hostname !== '127.0.0.1')) throw new Error('self-relay-config.json 的 pairingUrl 必须是 HTTPS /pair 地址。');
   return { ...config, url: resolved, pairingUrl: pairing.href };
 }
-async function registrationKey(config) {
-  if (config.url === officialConfig.url) return undefined;
-  const hostKeyFile = process.env.RELAY_HOST_KEY_FILE || config.hostKeyFile;
-  let hostKey;
-  if (hostKeyFile) hostKey = fs.readFileSync(hostKeyFile, 'utf8').trim();
-  else {
-    if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(config.sshHost || '') ||
-      !/^\/[a-zA-Z0-9/_.-]+$/.test(config.sshKeyPath || '')) throw new Error('中继注册凭据配置不完整或无效。');
-    try {
-      const result = await exec('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10', config.sshHost,
-        `sudo -n cat ${config.sshKeyPath}`], { encoding: 'utf8', timeout: 15000, windowsHide: true });
-      hostKey = result.stdout.trim();
-    } catch { throw new Error('无法通过已配置 SSH 读取中继注册凭据。'); }
-  }
-  if (!validSecret(hostKey)) throw new Error('中继注册凭据格式无效。');
-  return hostKey;
-}
 export async function selfRelay(command, stateRoot) {
   const session = readRecord(path.join(stateRoot, 'bridge-session.json'));
   if (!session) {
@@ -64,142 +44,162 @@ export async function selfRelay(command, stateRoot) {
 }
 
 async function createRelayRuntime(stateRoot) {
-  const config = await loadConfig(stateRoot);
-  const session = () => readRecord(path.join(stateRoot, 'bridge-session.json'));
-  let health = await serviceHealth(session());
+  const config = await loadConfig(stateRoot);
+  const configPath = path.join(stateRoot, 'self-relay-config.json');
+  const session = () => readRecord(path.join(stateRoot, 'bridge-session.json'));
+  let health = await serviceHealth(session());
   if (health?.status !== 'ok') throw new Error('桌面服务尚未运行，请先执行 relax start --json。');
   const stored = await credentialStore('load');
-  const identities = stored.record || { version: 1, servers: {} };
-  const validate = value => {
-    if (value?.version !== 1 || !value.servers || typeof value.servers !== 'object' || Array.isArray(value.servers)) throw new Error('本机设备身份损坏，未自动覆盖');
-    for (const [url, item] of Object.entries(value.servers)) {
-      relayAddress(url);
-      if (!validSecret(item.secret) || !/^[\w-]{16,128}$/.test(item.id)) throw new Error('本机设备身份损坏，未自动覆盖');
-    }
-  };
-  validate(identities);
-  let identity = identities.servers[config.url];
+  let identities = stored.record || { version: 2, devices: {} };
+  const validIdentity = (id, item) => /^[\w-]{16,128}$/.test(id) && item?.id === id &&
+    validSecret(item.secret) && typeof item.registered === 'boolean';
+  if (identities.version === 1 && identities.servers && typeof identities.servers === 'object' && !Array.isArray(identities.servers)) {
+    const devices = {};
+    for (const [url, item] of Object.entries(identities.servers)) {
+      relayAddress(url);
+      if (!validIdentity(item?.id, item) || devices[item.id]) throw new Error('本机设备身份损坏，未自动覆盖');
+      devices[item.id] = item;
+    }
+    const previous = identities.servers[config.url];
+    identities = { version: 2, devices };
+    await credentialStore('save', identities);
+    if (!config.deviceId && previous) config.deviceId = previous.id;
+  }
+  if (identities.version !== 2 || !identities.devices || typeof identities.devices !== 'object' || Array.isArray(identities.devices) ||
+      Object.entries(identities.devices).some(([id, item]) => !validIdentity(id, item))) throw new Error('本机设备身份损坏，未自动覆盖');
+  if (!config.deviceId) {
+    const known = Object.values(identities.devices);
+    if (known.length > 1) throw new Error('存在多个工作站身份，请在 self-relay-config.json 中指定 deviceId。');
+    config.deviceId = known[0]?.id || randomUUID();
+  }
+  const createIdentity = config.deviceId === 'new';
+  if (createIdentity) config.deviceId = randomUUID();
+  if (!/^[\w-]{16,128}$/.test(config.deviceId)) throw new Error('self-relay-config.json 的 deviceId 无效。');
+  let identity = identities.devices[config.deviceId];
   if (!identity) {
-    identity = { id: randomUUID(), secret: randomBytes(32).toString('base64url'), registered: false };
-    identities.servers[config.url] = identity; await credentialStore('save', identities);
+    if (!createIdentity && Object.keys(identities.devices).length) throw new Error('找不到配置指定的工作站身份，未自动创建新身份。');
+    identity = { id: config.deviceId, secret: randomBytes(32).toString('base64url'), registered: false };
+    identities.devices[identity.id] = identity;
+    await credentialStore('save', identities);
   }
-  const hostKey = identity.registered ? undefined : await registrationKey(config);
+  const persistedConfig = readRecord(configPath) || {};
+  if (persistedConfig.deviceId !== identity.id) writeRecord(configPath, { ...persistedConfig, deviceId: identity.id });
   let bridgeError = '';
-  async function refreshHealth() {
+  async function refreshHealth() {
     try { health = await serviceHealth(session()) || { transportMode: health.transportMode, status: 'offline' }; bridgeError = ''; }
     catch (error) { bridgeError = error.message; health = { transportMode: health.transportMode, status: 'offline' }; }
-  }
+  }
   let connector, qrPath, expiresAt = 0, paired = false, clientCount = 0, attachedCount = 0;
-  let closing = false, online = false, connecting = false, retryTimer, attempts = 0, lastError = '';
-  const audit = (event, details = {}) => console.log(JSON.stringify({ time: new Date().toISOString(), event, ...details }));
-  async function currentLanCandidates() {
-    try {
-      const bridge = session(), port = bridge?.port || 45831;
-      return (await lanNetworks()).map(network => ({ ...network, address: `http://${network.address}:${port}` }));
-    } catch (error) {
-      audit('lan-candidates-unavailable', { message: error.message }); return [];
-    }
-  }
-  const status = () => {
-    const available = online && !paired && qrPath && Date.now() < expiresAt;
-    const next = !online ? (lastError || '电脑连接器正在恢复中继连接，已保存授权。')
-      : paired ? '设备已授权，移动端可直接重连；网络断开不需要重新扫码。'
-        : available ? '用要添加的移动设备在有效期内扫描统一配对二维码。连接器在后台运行。'
+  let closing = false, online = false, connecting = false, retryTimer, attempts = 0, lastError = '';
+  const audit = (event, details = {}) => console.log(JSON.stringify({ time: new Date().toISOString(), event, ...details }));
+  async function currentLanCandidates() {
+    try {
+      const bridge = session(), port = bridge?.port || 45831;
+      return (await lanNetworks()).map(network => ({ ...network, address: `http://${network.address}:${port}` }));
+    } catch (error) {
+      audit('lan-candidates-unavailable', { message: error.message }); return [];
+    }
+  }
+  const status = () => {
+    const available = online && !paired && qrPath && Date.now() < expiresAt;
+    const next = !online ? (lastError || '电脑连接器正在恢复中继连接，已保存授权。')
+      : paired ? '设备已授权，移动端可直接重连；网络断开不需要重新扫码。'
+        : available ? '用要添加的移动设备在有效期内扫描统一配对二维码。连接器在后台运行。'
           : '尚未完成设备授权；调用 relax pair --json 生成配对二维码。';
-    return { running: !closing, relayConnected: online, mode: 'self-relay', transportMode: health.transportMode,
-      relayUrl: config.url, deviceId: identity.id, paired, clientCount, authorization: online ? (paired ? 'authorized' : 'unpaired') : 'unverified', phoneConnected: attachedCount > 0,
+    return { running: !closing, relayConnected: online, mode: 'self-relay', transportMode: health.transportMode,
+      relayUrl: config.url, deviceId: identity.id, paired, clientCount, authorization: online ? (paired ? 'authorized' : 'unpaired') : 'unverified', phoneConnected: attachedCount > 0,
       bridgeReady: health.status === 'ok' && health.execution?.ready === true && health.sharedAppServerConnected === true, bridgeError,
-      expiresAt: expiresAt ? new Date(expiresAt).toISOString() : null,
-      ...(available ? { qrPath } : {}), mobileAccess: 'unverified', lastError,
+      expiresAt: expiresAt ? new Date(expiresAt).toISOString() : null,
+      ...(available ? { qrPath } : {}), mobileAccess: 'unverified', lastError,
       displayText: `Code Relax 中继 · ${health.transportMode === 'lan-shared' ? 'Codex 内核已就绪' : 'Codex 内核未就绪'}\n${next}` };
-  };
-  async function shutdown() {
-    if (closing) return;
-    closing = true; clearTimeout(retryTimer);
-    connector?.events.removeAllListeners(); connector?.close();
-  }
-  async function saveInvitation(message) {
-    if (!message.code) return;
-    expiresAt = message.expires;
-    const link = new URL(config.pairingUrl);
-    link.searchParams.set('invite', message.code);
-    // Keep previously displayed files intact even when their invitation expires.
-    qrPath = path.join(stateRoot, `self-relay-qr-${randomUUID()}.png`);
-    await QRCode.toFile(qrPath, link.href, { width: 640, margin: 3 });
-  }
-  function scheduleRetry() {
-    if (closing || retryTimer) return;
-    const delay = Math.min(1000 * 2 ** Math.min(attempts++, 5), 30000) * (0.8 + Math.random() * 0.2);
-    retryTimer = setTimeout(() => { retryTimer = undefined; void connect(); }, delay);
-  }
-  async function connect() {
-    if (closing || connecting) return;
-    connecting = true;
-    let retryAfterAttempt = false;
-    try {
-      const bridge = session();
-      await refreshHealth();
-      const lanCandidates = await currentLanCandidates();
-      connector?.events.removeAllListeners(); connector?.close();
-      const current = connector = connectBridgeRelay({ relayUrl: config.url, hostKey: identity.registered ? undefined : hostKey, identity,
+  };
+  async function shutdown() {
+    if (closing) return;
+    closing = true; clearTimeout(retryTimer);
+    connector?.events.removeAllListeners(); connector?.close();
+  }
+  async function saveInvitation(message) {
+    if (!message.code) return;
+    expiresAt = message.expires;
+    const link = new URL(config.pairingUrl);
+    link.searchParams.set('invite', message.code);
+    // Keep previously displayed files intact even when their invitation expires.
+    qrPath = path.join(stateRoot, `self-relay-qr-${randomUUID()}.png`);
+    await QRCode.toFile(qrPath, link.href, { width: 640, margin: 3 });
+  }
+  function scheduleRetry() {
+    if (closing || retryTimer) return;
+    const delay = Math.min(1000 * 2 ** Math.min(attempts++, 5), 30000) * (0.8 + Math.random() * 0.2);
+    retryTimer = setTimeout(() => { retryTimer = undefined; void connect(); }, delay);
+  }
+  async function connect() {
+    if (closing || connecting) return;
+    connecting = true;
+    let retryAfterAttempt = false;
+    try {
+      const bridge = session();
+      await refreshHealth();
+      const lanCandidates = await currentLanCandidates();
+      connector?.events.removeAllListeners(); connector?.close();
+      const current = connector = connectBridgeRelay({ relayUrl: config.url, identity,
         usageCacheFile: path.join(stateRoot, 'relay-usage-tasks.json'),
-        bridgeUrl: `ws://127.0.0.1:${bridge?.port || 45831}/api/socket`, bridgeToken: bridge?.accessUrl ? new URL(bridge.accessUrl).searchParams.get('token') : 'unavailable',
-        bridgeConnection: () => { const latest = session(); return { url: `ws://127.0.0.1:${latest.port}/api/socket`, token: new URL(latest.accessUrl).searchParams.get('token') }; },
+        bridgeUrl: `ws://127.0.0.1:${bridge?.port || 45831}/api/socket`, bridgeToken: bridge?.accessUrl ? new URL(bridge.accessUrl).searchParams.get('token') : 'unavailable',
+        bridgeConnection: () => { const latest = session(); return { url: `ws://127.0.0.1:${latest.port}/api/socket`, token: new URL(latest.accessUrl).searchParams.get('token') }; },
         hostName: hostname(), lanCandidates, p2pProbe: config.p2pProbe === true, iceServers: config.p2pIceServers || [],
         p2pWindowsRouteHelper: config.p2pWindowsRouteHelper === true, p2pWindowsRouteHelperToken: config.p2pWindowsRouteHelperToken || '' });
-      current.events.on('p2p-probe', result => audit('p2p-probe', result));
-      current.events.on('diagnostic', message => audit('transport-error', { message }));
-      current.events.on('attached', () => { paired = true; attachedCount++; audit('phone-attached', { attachedCount }); });
-      current.events.on('detached', () => { attachedCount = Math.max(0, attachedCount - 1); audit('phone-detached', { attachedCount }); });
-      current.events.on('authorization-changed', update => {
-        saveLanAuthorizations(stateRoot, identity.id, update.clients, update.revision);
-        paired = update.clients.length > 0; clientCount = update.clients.length;
-        audit('mobile-authorizations-updated', { clientCount, revision: update.revision });
-      });
-      current.events.once('disconnected', event => {
-        if (connector !== current || closing) return;
-        online = false; attachedCount = 0; lastError = `电脑与中继连接断开（${event.code}）：${event.reason}`; audit('relay-disconnected', event);
-        if (![1008, 4401, 4406, 4409, 4429].includes(event.code)) scheduleRetry();
-      });
-      const registration = await current.ready;
+      current.events.on('p2p-probe', result => audit('p2p-probe', result));
+      current.events.on('diagnostic', message => audit('transport-error', { message }));
+      current.events.on('attached', () => { paired = true; attachedCount++; audit('phone-attached', { attachedCount }); });
+      current.events.on('detached', () => { attachedCount = Math.max(0, attachedCount - 1); audit('phone-detached', { attachedCount }); });
+      current.events.on('authorization-changed', update => {
+        saveLanAuthorizations(stateRoot, identity.id, update.clients, update.revision);
+        paired = update.clients.length > 0; clientCount = update.clients.length;
+        audit('mobile-authorizations-updated', { clientCount, revision: update.revision });
+      });
+      current.events.once('disconnected', event => {
+        if (connector !== current || closing) return;
+        online = false; attachedCount = 0; lastError = `电脑与中继连接断开（${event.code}）：${event.reason}`; audit('relay-disconnected', event);
+        if (![1008, 4401, 4406, 4409, 4429].includes(event.code)) scheduleRetry();
+      });
+      const registration = await current.ready;
       if (registration.protocolVersion !== 7 || registration.room !== identity.id) {
-        current.events.removeAllListeners(); current.close(); throw Object.assign(new Error('中继服务器尚未升级设备授权协议，未使用临时配对降级。'), { code: 4401 });
-      }
-      if (!identity.registered) {
-        const registeredIdentity = { ...identity, registered: true };
-        identities.servers[config.url] = registeredIdentity;
-        await credentialStore('save', identities); identity = registeredIdentity;
-      }
-      current.assertConnected();
-      online = true; attempts = 0; paired = registration.paired; clientCount = registration.clientCount || 0; lastError = '';
-      saveLanAuthorizations(stateRoot, identity.id, registration.clients || [], registration.revision);
-      await saveInvitation(registration); audit('relay-connected', { paired });
-    } catch (error) {
-      online = false; lastError = error.message; audit('connect-failed', { message: error.message });
-      if (![1008, 4401, 4406, 4409, 4429].includes(error.code)) retryAfterAttempt = true;
-      else { clearTimeout(retryTimer); retryTimer = undefined; }
-    } finally { connecting = false; if (retryAfterAttempt) scheduleRetry(); }
-  }
-  async function pair() {
-    if (!online || closing) throw new Error('中继尚未连接，设备授权保持不变。');
-    await saveInvitation(await connector.command('pair-code'));
-    // Each invitation adds or refreshes one mobile identity without revoking other devices.
-    return { ...status(), qrPath, expiresAt: new Date(expiresAt).toISOString(),
-      displayText: '用要添加的移动设备扫描此码。每台设备只需配对一次；已有设备授权保持不变。' };
-  }
-  async function revoke() {
-    if (!online || closing) throw new Error('中继尚未连接，未撤销授权。');
-    await connector.command('revoke'); paired = false; clientCount = 0; attachedCount = 0; qrPath = undefined; expiresAt = 0;
+        current.events.removeAllListeners(); current.close(); throw Object.assign(new Error('中继服务器尚未升级设备授权协议，未使用临时配对降级。'), { code: 4401 });
+      }
+      if (!identity.registered) {
+        const registeredIdentity = { ...identity, registered: true };
+        identities.devices[identity.id] = registeredIdentity;
+        await credentialStore('save', identities); identity = registeredIdentity;
+      }
+      current.assertConnected();
+      online = true; attempts = 0; paired = registration.paired; clientCount = registration.clientCount || 0; lastError = '';
+      saveLanAuthorizations(stateRoot, identity.id, registration.clients || [], registration.revision);
+      await saveInvitation(registration); audit('relay-connected', { paired });
+    } catch (error) {
+      online = false; lastError = error.message; audit('connect-failed', { message: error.message });
+      if (![1008, 4401, 4406, 4409, 4429].includes(error.code)) retryAfterAttempt = true;
+      else { clearTimeout(retryTimer); retryTimer = undefined; }
+    } finally { connecting = false; if (retryAfterAttempt) scheduleRetry(); }
+  }
+  async function pair() {
+    if (!online || closing) throw new Error('中继尚未连接，设备授权保持不变。');
+    await saveInvitation(await connector.command('pair-code'));
+    // Each invitation adds or refreshes one mobile identity without revoking other devices.
+    return { ...status(), qrPath, expiresAt: new Date(expiresAt).toISOString(),
+      displayText: '用要添加的移动设备扫描此码。每台设备只需配对一次；已有设备授权保持不变。' };
+  }
+  async function revoke() {
+    if (!online || closing) throw new Error('中继尚未连接，未撤销授权。');
+    await connector.command('revoke'); paired = false; clientCount = 0; attachedCount = 0; qrPath = undefined; expiresAt = 0;
     return { ...status(), displayText: '全部移动设备授权已撤销；重新添加请调用 relax pair --json。' };
-  }
-  async function refreshLan() {
-    if (!online || closing) throw new Error('中继尚未连接，未更新局域网候选。');
-    await refreshHealth();
-    const candidates = await currentLanCandidates();
-    connector.updateLanCandidates(candidates);
-    audit('lan-candidates-updated', { count: candidates.length });
-    return { ...status(), lanCandidateCount: candidates.length };
-  }
+  }
+  async function refreshLan() {
+    if (!online || closing) throw new Error('中继尚未连接，未更新局域网候选。');
+    await refreshHealth();
+    const candidates = await currentLanCandidates();
+    connector.updateLanCandidates(candidates);
+    audit('lan-candidates-updated', { count: candidates.length });
+    return { ...status(), lanCandidateCount: candidates.length };
+  }
   const inspect = async () => {
     if (online) {
       const remote = await connector.command('status'); paired = remote.paired;