@walkhi/code-relax 0.1.0-beta.23 → 0.1.0-beta.25

package/dist/src/self-relay/server.mjs

@@ -1,22 +1,22 @@
+import { privacyPage } from './privacy-page.mjs';
 import http from 'node:http';
 import fs from 'node:fs';
 import { isIP } from 'node:net';
-import { deviceStore, validId } from './device-store.mjs';
+import { deviceStore, validId } from './device-store.mjs';
 import { randomUUID, timingSafeEqual } from 'node:crypto';
-import { WebSocketServer } from 'ws';
+import { WebSocketServer } from 'ws';
 import { secret, digest, matches, validSecret, send, decode } from './wire.mjs';
 import { readDebugAllowlist, debugAllowed } from './debug-allowlist.mjs';
 import { validProbeSignal } from './p2p-probe.mjs';
 import { relayAdminState } from './admin-state.mjs';
 import { openRelayMysql } from './mysql-state.mjs';
-import { adminPage } from './admin-page.mjs';
 import { openEmailAccounts } from './email-accounts.mjs';
 import { usageMeter, usageReport } from './usage-meter.mjs';
 import { relayDiagnostics } from './diagnostics.mjs';
 
-// Always loopback; a TLS reverse proxy supplies the private-trial Internet endpoint.
+// Always loopback; a TLS reverse proxy supplies the private-trial Internet endpoint.
 export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlMs = 120000,
-  maxConnections = 32, maxClientsPerHost = 16, maxPayload = 8 * 1024 * 1024, stateFile,
+  maxConnections = 128, maxClientsPerHost = 16, maxPayload = 8 * 1024 * 1024, stateFile,
   maxRelaySessions = 8, adminStateFile, mysqlConfigFile, accountConfigFile, usageDiagnosticKeyFile,
   publicRelayUrl = '', appDownloadUrl = '', debugAllowlistFile, log = () => {} } = {}) {
   if (!validSecret(hostKey)) throw new Error('Invalid host credential');
@@ -32,8 +32,12 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
   if (accountConfigFile && !database?.schemaVersions.includes('003_relay_usage')) throw new Error('Relay account and usage schema is required');
   const accounts = accountConfigFile ? openEmailAccounts(database.pool, accountConfigFile) : null;
   const meter = accounts ? usageMeter(database.pool) : null;
+  const cancelledAccountIds = new Set();
   const diagnostics = database?.schemaVersions.includes('006_relay_diagnostics')
     ? relayDiagnostics(database.pool, error => log({ event: 'relay-diagnostic-error', message: error.message })) : null;
+  const adminAccessFile = '/etc/codex-relay/admin-access.json';
+  const adminAccessKey = fs.existsSync(adminAccessFile) ? JSON.parse(fs.readFileSync(adminAccessFile, 'utf8')).key : '';
+  if (adminAccessKey && !validSecret(adminAccessKey)) throw new Error('Invalid admin access key');
   const diagnosticKey = usageDiagnosticKeyFile ? fs.readFileSync(usageDiagnosticKeyFile, 'utf8').trim() : '';
   if (diagnosticKey && !/^[A-Za-z0-9_-]{43}$/.test(diagnosticKey)) throw new Error('Invalid usage diagnostic key');
   const store = database?.devices || deviceStore(stateFile);
@@ -42,23 +46,39 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
   let activeRelaySessions = 0;
   for (const record of store.entries()) rooms.set(record.id, { ...record, durable: true, connections: new Map(), observers: new Map(), uploadClients: new Map() });
   let commitTail = Promise.resolve();
+  function queueStore(operation) {
+    const pending = commitTail.then(operation);
+    commitTail = pending.catch(() => {});
+    return pending;
+  }
   function commit(room, changes) {
-    const operation = commitTail.then(async () => {
-    changes = typeof changes === 'function' ? changes(room) : changes;
-    const next = { ...room, ...changes, updatedAt: new Date().toISOString() };
-    if (room.durable) {
-      const { id, hostHash, clients, revision, status, createdAt, updatedAt, officialComputer } = next;
-      await store.save({ id, hostHash, clients, revision, status, createdAt, updatedAt, ...(officialComputer ? { officialComputer } : {}) });
-    }
-    Object.assign(room, changes, { updatedAt: next.updatedAt });
+    return queueStore(async () => {
+      changes = typeof changes === 'function' ? changes(room) : changes;
+      const next = { ...room, ...changes, updatedAt: new Date().toISOString() };
+      if (room.durable) {
+        const { id, hostHash, clients, revision, status, createdAt, updatedAt, officialComputer } = next;
+        await store.save({ id, hostHash, clients, revision, status, createdAt, updatedAt, ...(officialComputer ? { officialComputer } : {}) });
+      }
+      Object.assign(room, changes, { updatedAt: next.updatedAt });
     });
-    commitTail = operation.catch(() => {});
-    return operation;
-  }
-  function invitation(room) {
-    const code = secret(); room.pairingHash = digest(code); room.expires = Date.now() + pairingTtlMs;
-    return { code, expires: room.expires };
-  }
+  }
+  function registerRoom(id, durable, credential) {
+    return queueStore(async () => {
+      // Resolve concurrent first connections before writing the device identity.
+      if (durable && rooms.has(id)) return rooms.get(id);
+      const now = new Date().toISOString();
+      const record = { id, revision: 0, status: 'active', clients: [], createdAt: now, updatedAt: now,
+        ...(durable ? { hostHash: digest(credential) } : {}) };
+      if (durable) await store.save(record);
+      const room = { ...record, durable, connections: new Map(), observers: new Map(), uploadClients: new Map() };
+      rooms.set(id, room);
+      return room;
+    });
+  }
+  function invitation(room) {
+    const code = secret(); room.pairingHash = digest(code); room.expires = Date.now() + pairingTtlMs;
+    return { code, expires: room.expires };
+  }
   let listenUrl = '';
   let adminTail = Promise.resolve();
   function relayUrl(request) {
@@ -79,6 +99,12 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
       });
       return;
     }
+    if (target.pathname === '/account/privacy' && request.method === 'GET') {
+      response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-cache',
+        'Content-Security-Policy': "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+        'X-Content-Type-Options': 'nosniff' });
+      response.end(privacyPage); return;
+    }
     if (accounts && target.pathname.startsWith('/account/')) {
       void handleAccount(request, response, target).catch(() => accountReply(response, 500, { error: 'Account operation failed' }));
       return;
@@ -132,6 +158,33 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
       if (target.pathname === '/account/logout' && request.method === 'POST') {
         accountReply(response, 200, await accounts.logout(bearer)); return;
       }
+      if (target.pathname === '/account/me' && request.method === 'DELETE') {
+        const user = await accounts.current(bearer);
+        cancelledAccountIds.add(user.id);
+        try { await accounts.cancelAccount(bearer); }
+        catch (failure) { cancelledAccountIds.delete(user.id); throw failure; }
+        for (const room of rooms.values()) {
+          for (const [key, arm] of room.usageArms || []) if (arm.userId === user.id) room.usageArms.delete(key);
+          for (const [key, task] of room.usageTasks || []) if (task.userId === user.id) room.usageTasks.delete(key);
+          for (const [clientId, connection] of room.connections) {
+            if (connection.userId !== user.id) continue;
+            releaseRelay(connection); room.connections.delete(clientId);
+            if (room.host) send(room.host, { type: 'detach', session: connection.session });
+            connection.ws.close(4431, 'Account cancelled');
+          }
+          for (const [clientId, observer] of room.observers) {
+            if (observer.userId !== user.id) continue;
+            room.observers.delete(clientId); observer.ws.close(4431, 'Account cancelled');
+          }
+          for (const [clientId, upload] of room.uploadClients) {
+            if (upload.userId !== user.id) continue;
+            room.uploadClients.delete(clientId);
+            if (room.uploadHost) send(room.uploadHost, { type: 'file-close', session: upload.session });
+            upload.ws.close(4431, 'Account cancelled');
+          }
+        }
+        accountReply(response, 200, { ok: true }); return;
+      }
       if (request.method !== 'POST' || request.headers['content-type'] !== 'application/json') {
         accountReply(response, 404, { error: 'Account route not found' }); return;
       }
@@ -149,26 +202,14 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
     }
   }
   async function handleAdmin(request, response, target) {
-    if (request.method === 'GET' && target.pathname === '/admin') {
-      adminReply(response, 200, adminPage(), 'text/html; charset=utf-8'); return;
-    }
-    if (target.pathname.startsWith('/admin/api/')) {
-      const token = /^Bearer ([A-Za-z0-9_-]{43})$/.exec(request.headers.authorization || '')?.[1];
-      const diagnosticRoute = target.pathname === '/admin/api/usage-diagnostics' ||
-        target.pathname === '/admin/api/usage-diagnostics/drain';
-      const keyAccepted = diagnosticRoute && diagnosticKey && token &&
-        timingSafeEqual(Buffer.from(token), Buffer.from(diagnosticKey));
-      let email;
-      if (!keyAccepted) {
-        try { email = (await accounts.current(token)).email; }
-        catch { adminReply(response, 401, { error: '请先登录管理员账号' }); return; }
-        const [allowed] = await database.pool.execute('SELECT email FROM relay_admin_emails WHERE email=?', [email]);
-        if (!allowed.length) { adminReply(response, 403, { error: '此账号没有后台管理权限' }); return; }
-      }
-      if (target.pathname === '/admin/api/session' && request.method === 'GET') {
-        adminReply(response, 200, { email }); return;
-      }
-    }
+    const accessKey = request.headers['x-code-relax-admin-key'];
+    const internalAccess = adminAccessKey && validSecret(accessKey) &&
+      timingSafeEqual(Buffer.from(accessKey), Buffer.from(adminAccessKey));
+    const token = /^Bearer ([A-Za-z0-9_-]{43})$/.exec(request.headers.authorization || '')?.[1];
+    const diagnosticRoute = ['/admin/api/usage-diagnostics', '/admin/api/usage-diagnostics/drain'].includes(target.pathname);
+    const diagnosticAccess = diagnosticRoute && diagnosticKey && token &&
+      timingSafeEqual(Buffer.from(token), Buffer.from(diagnosticKey));
+    if (!internalAccess && !diagnosticAccess) { adminReply(response, 404, { error: 'Not found' }); return; }
     if (request.method === 'GET' && target.pathname === '/admin/api/status') {
       const state = adminState.read();
       adminReply(response, 200, { maxRelaySessions: state.maxRelaySessions, activeRelaySessions,
@@ -188,14 +229,18 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
       }
       adminReply(response, 200, await usageReport(database.pool, page, view)); return;
     }
+    const diagnosticSource = target.searchParams.get('source') || 'usage';
+    if (target.pathname.startsWith('/admin/api/usage-diagnostics') && !['usage', 'account-cleanup'].includes(diagnosticSource)) {
+      adminReply(response, 400, { error: 'Invalid diagnostic source' }); return;
+    }
     if (diagnostics && target.pathname === '/admin/api/usage-diagnostics') {
-      if (request.method === 'GET') adminReply(response, 200, await diagnostics.read('usage'));
-      else if (request.method === 'DELETE') adminReply(response, 200, await diagnostics.clear('usage'));
+      if (request.method === 'GET') adminReply(response, 200, await diagnostics.read(diagnosticSource));
+      else if (request.method === 'DELETE') adminReply(response, 200, await diagnostics.clear(diagnosticSource));
       else adminReply(response, 405, { error: 'Unsupported diagnostic request' });
       return;
     }
     if (diagnostics && target.pathname === '/admin/api/usage-diagnostics/drain') {
-      if (request.method === 'POST') adminReply(response, 200, await diagnostics.drain('usage'));
+      if (request.method === 'POST') adminReply(response, 200, await diagnostics.drain(diagnosticSource));
       else adminReply(response, 405, { error: 'Unsupported diagnostic request' });
       return;
     }
@@ -262,23 +307,26 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
     serverNoContextTakeover: true, clientNoContextTakeover: true,
     threshold: 1024, concurrencyLimit: 4, zlibDeflateOptions: { level: 3 },
   } });
-  let admissionStart = Date.now(), admissions = 0;
-  server.on('upgrade', (request, socket, head) => {
+  let admissionStart = Date.now(), admissions = 0;
+  server.on('upgrade', (request, socket, head) => {
     if (request.url !== '/relay' || (request.headers.origin && request.headers.origin !== 'null' && !nativeOrigins.includes(request.headers.origin))) {
       log({ event: 'upgrade-rejected', reason: request.url !== '/relay' ? 'path' : 'origin' });
-      socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n'); return;
-    }
-    if (Date.now() - admissionStart >= 60000) { admissionStart = Date.now(); admissions = 0; }
-    if (wss.clients.size >= maxConnections || ++admissions > 60) {
-      socket.end('HTTP/1.1 429 Too Many Requests\r\nConnection: close\r\n\r\n'); return;
-    }
-    wss.handleUpgrade(request, socket, head, ws => wss.emit('connection', ws));
-  });
+      socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n'); return;
+    }
+    if (Date.now() - admissionStart >= 60000) { admissionStart = Date.now(); admissions = 0; }
+    if (wss.clients.size >= maxConnections || ++admissions > 240) {
+      socket.end('HTTP/1.1 429 Too Many Requests\r\nConnection: close\r\n\r\n'); return;
+    }
+    wss.handleUpgrade(request, socket, head, ws => wss.emit('connection', ws));
+  });
   wss.on('connection', ws => {
     let role, room, session, clientId, alive = true;
-    const authTimer = setTimeout(() => ws.close(1008, 'Authentication timeout'), 5000);
-    ws.on('pong', () => { alive = true; });
-    const heartbeat = setInterval(() => { if (!alive) ws.terminate(); else { alive = false; ws.ping(); } }, 30000);
+    const authTimer = setTimeout(() => ws.close(1008, 'Authentication timeout'), 5000);
+    ws.on('pong', () => { alive = true; });
+    const heartbeat = setInterval(() => {
+      sampleInboundQueue();
+      if (!alive) ws.terminate(); else { alive = false; ws.ping(); }
+    }, 30000);
     const fail = (code = 4401, reason = 'Device authorization rejected') => ws.close(code, reason);
     const queueClientMessage = (connection, message, pause = 0) => {
       const bytes = Buffer.byteLength(JSON.stringify(message));
@@ -292,10 +340,10 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
         send(connection.ws, message);
       }).catch(() => connection.ws.close(1011, 'Relay delivery failed'));
     };
-    ws.on('error', () => {}); // close owns routing cleanup.
+    ws.on('error', () => {}); // close owns routing cleanup.
     ws.on('close', (code, reason) => {
-      log({ event: 'closed', role: role || 'unauthenticated', device: room?.id, code, reason: reason.toString() });
-      clearTimeout(authTimer); clearInterval(heartbeat);
+      log({ event: 'closed', role: role || 'unauthenticated', device: room?.id, code, reason: reason.toString() });
+      clearTimeout(authTimer); clearInterval(heartbeat);
       if (role === 'host' && room?.host === ws) {
         for (const task of room.usageTasks?.values() || []) {
           void meter?.lost(task).catch(error => log({ event: 'usage-error', message: error.message }));
@@ -303,10 +351,12 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
         room.usageTasks?.clear(); room.usageArms?.clear();
         room.host = undefined; room.hostName = undefined; room.lanCandidates = [];
         room.uploadHost?.close(4410, 'Computer offline');
-        for (const client of room.uploadClients?.values() || []) client.ws.close(4410, 'Computer offline');
+        for (const client of room.uploadClients?.values() || []) client.ws.close(code === 4432 ? 4432 : 4410, code === 4432 ? 'Computer inbound queue limit exceeded' : 'Computer offline');
         for (const observer of room.observers.values()) send(observer.ws, { type: 'observing', online: false });
         if (!room.durable) rooms.delete(room.id);
-        for (const connection of room.connections.values()) connection.ws.close(4410, 'Computer offline; authorization retained');
+        for (const connection of room.connections.values()) connection.ws.close(
+          code === 4432 ? 4432 : 4410,
+          code === 4432 ? 'Computer inbound queue limit exceeded' : 'Computer offline; authorization retained');
       } else if (role === 'client' && room?.connections.get(clientId)?.ws === ws) {
         const connection = room.connections.get(clientId);
         releaseRelay(connection);
@@ -316,18 +366,57 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
         room.observers.delete(clientId);
       } else if (role === 'file-host' && room?.uploadHost === ws) {
         room.uploadHost = undefined;
-        for (const client of room.uploadClients?.values() || []) client.ws.close(4410, 'File receiver offline');
+        for (const client of room.uploadClients?.values() || []) client.ws.close(code === 4432 ? 4432 : 4410, code === 4432 ? 'File receiver inbound queue limit exceeded' : 'File receiver offline');
       } else if (role === 'file-client' && room?.uploadClients?.get(clientId)?.ws === ws) {
         room.uploadClients.delete(clientId);
         if (room.uploadHost) send(room.uploadHost, { type: 'file-close', session });
       }
-    });
+    });
     let messageTail = Promise.resolve();
+    // Include the in-flight message: async database work must not permit an
+    // unbounded chain of closures retaining incoming payloads.
+    let pendingMessages = 0, pendingBytes = 0;
+    const maxPendingMessages = 128, maxPendingBytes = 16 * 1024 * 1024;
+    let sampleStarted = Date.now(), peakMessages = 0, peakBytes = 0, maxWaitMs = 0, receivedMessages = 0;
+    function sampleInboundQueue() {
+      const now = Date.now();
+      if (now - sampleStarted < 60000) return;
+      // Summarize only intervals with an actual backlog; never log payloads or credentials.
+      if (peakMessages > 1) log({ event: 'inbound-queue-sample', role: role || 'unauthenticated',
+        windowMs: now - sampleStarted, receivedMessages, peakMessages, peakBytes, maxWaitMs,
+        pendingMessages, pendingBytes });
+      sampleStarted = now; peakMessages = pendingMessages; peakBytes = pendingBytes;
+      maxWaitMs = 0; receivedMessages = 0;
+    }
     ws.on('message', (bytes, binary) => {
+      if (ws.readyState !== ws.OPEN) return;
+      const size = bytes.length;
+      if (pendingMessages >= maxPendingMessages || pendingBytes + size > maxPendingBytes) {
+        log({ event: 'inbound-queue-limit', role: role || 'unauthenticated',
+          pendingMessages, pendingBytes, incomingBytes: size, maxWaitMs });
+        ws.close(4432, 'Inbound queue limit exceeded');
+        return;
+      }
+      pendingMessages++; pendingBytes += size;
+      receivedMessages++;
+      peakMessages = Math.max(peakMessages, pendingMessages); peakBytes = Math.max(peakBytes, pendingBytes);
+      const enqueuedAt = Date.now();
       messageTail = messageTail.then(async () => {
       try {
+        maxWaitMs = Math.max(maxWaitMs, Date.now() - enqueuedAt);
+        if (ws.readyState !== ws.OPEN) return;
         const message = decode(bytes, binary);
         if (!role) {
+          let userId;
+          if (!['host', 'file-host', 'observe'].includes(message.type) &&
+              !(['pair', 'resume'].includes(message.type) && message.management === true)) {
+            if (!['pair', 'resume', 'observe', 'file-client'].includes(message.type)) return fail();
+            if (!accounts || !validSecret(message.accountToken)) return fail(4431, 'Account login required');
+            try { userId = (await accounts.current(message.accountToken)).id; }
+            catch { return fail(4431, 'Account session invalid'); }
+            if (ws.readyState !== ws.OPEN) return;
+            if (cancelledAccountIds.has(userId)) return fail(4431, 'Account cancelled');
+          }
           if (message.type === 'file-host') {
             room = rooms.get(message.deviceId);
             if (!room?.host || room.status !== 'active' || !matches(message.deviceSecret, room.hostHash)) return fail();
@@ -348,7 +437,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
               return fail(4429, 'Too many file uploads');
             }
             role = 'file-client'; clientId = message.clientId; session = randomUUID(); clearTimeout(authTimer);
-            room.uploadClients.set(clientId, { ws, session });
+            room.uploadClients.set(clientId, { ws, session, userId });
             send(room.uploadHost, { type: 'file-open', session }); return;
           }
           if (message.type === 'host') {
@@ -362,18 +451,12 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
             }
             catch { return fail(1008, 'Invalid LAN candidates'); }
             room = durable ? rooms.get(message.deviceId) : undefined;
-            if (room && (room.status !== 'active' || !matches(message.deviceSecret, room.hostHash))) return fail();
             if (!room) {
-              // Durable computers prove future ownership with their generated device secret.
-              // The legacy deployment key remains accepted, but is no longer required for first registration.
               if (!durable && !matches(message.key, hostHash)) return fail();
-              if (rooms.size >= 256) return fail(4429, 'Device limit reached');
-              const now = new Date().toISOString();
-              room = { id: durable ? message.deviceId : randomUUID(), durable,
-                revision: 0, status: 'active', clients: [], connections: new Map(), observers: new Map(), uploadClients: new Map(), createdAt: now, updatedAt: now,
-                ...(durable ? { hostHash: digest(message.deviceSecret) } : {}) };
-              await commit(room, {}); rooms.set(room.id, room);
-            }
+              room = await registerRoom(durable ? message.deviceId : randomUUID(), durable, message.deviceSecret);
+              if (ws.readyState !== ws.OPEN) return;
+            }
+            if (durable && (room.status !== 'active' || !matches(message.deviceSecret, room.hostHash))) return fail();
             const oldHost = room.host;
             room.observers ||= new Map();
             if (oldHost && oldHost !== ws) {
@@ -417,6 +500,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
               await commit(room, current => ({ clients: [...current.clients.filter(item => item.id !== clientId), client], revision: current.revision + 1 }));
               room.pairingHash = undefined;
             } finally { room.pairingInProgress = false; }
+            if (!room.host) return fail(4410, 'Computer offline; authorization retained');
             send(room.host, { type: 'authorization-changed', clients: room.clients, revision: room.revision });
           } else {
             clientId = message.clientId;
@@ -427,11 +511,13 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
             return fail(message.type === 'pair' ? 4408 : 4401, message.type === 'pair' ? 'Pairing code expired or used' : 'Device authorization rejected');
             }
           }
+          if (ws.readyState !== ws.OPEN) return;
+          if (cancelledAccountIds.has(userId)) return fail(4431, 'Account cancelled');
           if (message.type === 'observe') {
             role = 'observer'; clearTimeout(authTimer); room.observers ||= new Map();
             const oldObserver = room.observers.get(clientId);
             if (oldObserver?.ws && oldObserver.ws !== ws) oldObserver.ws.close(4409, 'Metadata connection replaced by same identity');
-            room.observers.set(clientId, { ws });
+            room.observers.set(clientId, { ws, userId });
             send(ws, { type: 'observing', online: Boolean(room.host) });
             send(ws, { type: 'debug-permissions', enabled: debugAllowed(debugAllowlist, room.id, room.clients.find(client => client.id === clientId)) });
             const announcement = adminState.read().announcement;
@@ -442,11 +528,6 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
             return;
           }
           if (!room.host) return fail(4410, 'Computer offline; authorization retained');
-          let userId;
-          if (accounts && message.accountToken !== undefined) {
-            try { userId = (await accounts.current(message.accountToken)).id; }
-            catch { return fail(4431, 'Account session invalid'); }
-          }
           const oldConnection = room.connections.get(clientId);
           role = 'client'; clearTimeout(authTimer); session = randomUUID();
           if (oldConnection?.ws && oldConnection.ws !== ws) {
@@ -454,7 +535,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
             send(room.host, { type: 'detach', session: oldConnection.session });
             oldConnection.ws.close(4409, 'Phone connection replaced by same identity');
           }
-          room.connections.set(clientId, { ws, session, p2pProbe: room.p2pProbe && message.p2pProbe === 1,
+          room.connections.set(clientId, { ws, session, p2pProbe: Boolean(userId) && room.p2pProbe && message.p2pProbe === 1,
             userId,
             repeat: room.p2pProbeRepeat, signals: 0, probeStarted: 0, outbound: Promise.resolve(), queuedBytes: 0,
             relayAdmitted: false, relayExempt: false,
@@ -465,7 +546,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
           const announcement = adminState.read().announcement;
           if (announcement) send(ws, { type: 'announcement', announcement });
           send(room.host, { type: 'attach', session, clientId, p2pProbe: room.connections.get(clientId).p2pProbe ? 1 : 0 }); return;
-        }
+        }
         if (role === 'host') {
           if (room.host !== ws) return;
           if (meter && ['usage-arm', 'usage-message', 'usage-cancel', 'usage-turn', 'usage-observer-lost'].includes(message.type)) {
@@ -627,15 +708,17 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
           releaseRelay(room.connections.get(clientId));
         } else if (room.connections.get(clientId)?.ws === ws && message.type === 'data' && typeof message.payload === 'string') {
           const connection = room.connections.get(clientId);
-          if (!controlPayload(message.payload) && !admitRelay(connection, room)) {
+          if (!connection.userId && !managementPayload(message.payload)) return fail(4431, 'Account login required');
+          if (connection.userId && !controlPayload(message.payload) && !admitRelay(connection, room)) {
             ws.close(4428, 'Server busy'); return;
           }
           send(room.host, { type: 'data', session, payload: message.payload });
-        } else fail();
+        } else fail();
       } catch (error) { log({ event: 'request-error', role, message: 'Relay operation failed' }); ws.close(1011, 'Relay operation failed'); }
+      finally { pendingMessages--; pendingBytes -= size; }
       }).catch(() => ws.close(1011, 'Relay operation failed'));
     });
-  });
+  });
   await new Promise((resolve, reject) => { server.once('error', reject); server.listen(port, '127.0.0.1', resolve); });
   listenUrl = `ws://127.0.0.1:${server.address().port}/relay`;
   return {
@@ -645,7 +728,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
       await new Promise(resolve => wss.close(resolve));
       await new Promise(resolve => server.close(resolve));
       if (database) await database.close();
-    },
+    },
   };
 }
 
@@ -719,6 +802,20 @@ function plainText(value, limit, empty) {
   return typeof value === 'string' && (empty || value.trim().length > 0) && value.trim().length <= limit && !/[\u0000-\u001f\u007f]/.test(value);
 }
 
+// Device-authorized management must not become an anonymous chat tunnel.
+function managementPayload(value) {
+  try {
+    const message = JSON.parse(value);
+    if (['unsubscribe', 'cancel', 'response-ack'].includes(message.type)) return true;
+    if (message.type === 'subscribe') return message.path === '/api/shared-recovery/events';
+    if (message.type !== 'request') return false;
+    const method = message.method || 'GET';
+    if (method === 'GET') return ['/api/health', '/api/official-remote/status'].includes(message.path) ||
+      /^\/api\/threads\/[0-9a-f-]{28,64}\/model-changes(?:\?|$)/i.test(message.path);
+    return method === 'POST' && message.path === '/api/official-remote/pairing';
+  } catch { return false; }
+}
+
 function controlPayload(value) {
   try {
     const message = JSON.parse(value);