@walkhi/code-relax 0.1.0-beta.26 → 0.1.0-beta.28

package/dist/src/self-relay/server.mjs

@@ -1,849 +1,894 @@
-import { privacyPage } from './privacy-page.mjs';
-import http from 'node:http';
-import fs from 'node:fs';
-import { isIP } from 'node:net';
-import { deviceStore, validId } from './device-store.mjs';
-import { randomUUID, timingSafeEqual } from 'node:crypto';
-import { WebSocketServer } from 'ws';
-import { secret, digest, matches, validSecret, send, decode } from './wire.mjs';
-import { readDebugAllowlist, debugAllowed } from './debug-allowlist.mjs';
-import { validProbeSignal } from './p2p-probe.mjs';
-import { MAX_ADMIN_REQUEST_BYTES, relayAdminState } from './admin-state.mjs';
-import { openRelayMysql } from './mysql-state.mjs';
-import { openEmailAccounts } from './email-accounts.mjs';
-import { usageMeter, usageReport } from './usage-meter.mjs';
-import { relayDiagnostics } from './diagnostics.mjs';
-
-// Always loopback; a TLS reverse proxy supplies the private-trial Internet endpoint.
-export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlMs = 120000,
-  maxConnections = 128, maxClientsPerHost = 16, maxPayload = 8 * 1024 * 1024, stateFile,
-  maxRelaySessions = 8, adminStateFile, mysqlConfigFile, accountConfigFile, usageDiagnosticKeyFile,
-  publicRelayUrl = '', appDownloadUrl = '', debugAllowlistFile, log = () => {} } = {}) {
-  if (!validSecret(hostKey)) throw new Error('Invalid host credential');
-  if (!Number.isSafeInteger(maxClientsPerHost) || maxClientsPerHost < 1 || maxClientsPerHost > 64) throw new Error('Invalid mobile device limit');
-  if (!Number.isSafeInteger(maxRelaySessions) || maxRelaySessions < 1 || maxRelaySessions > 256) throw new Error('Invalid relay session limit');
-  if (publicRelayUrl) relayPublicAddress(publicRelayUrl);
-  // Harmony's native WebSocket supplies the endpoint Origin automatically.
-  // libwebsockets can use http even for WSS; trust only the configured endpoint.
-  const nativeOrigins = publicRelayUrl ? ['http:', 'https:'].map(protocol => `${protocol}//${new URL(publicRelayUrl).host}`) : [];
-  if (appDownloadUrl && !/^https:\/\/[^\s]+$/.test(appDownloadUrl)) throw new Error('Invalid app download URL');
-  const hostHash = digest(hostKey), rooms = new Map();
-  const database = mysqlConfigFile ? await openRelayMysql(mysqlConfigFile, maxRelaySessions) : null;
-  if (accountConfigFile && !database?.schemaVersions.includes('003_relay_usage')) throw new Error('Relay account and usage schema is required');
-  const accounts = accountConfigFile ? openEmailAccounts(database.pool, accountConfigFile) : null;
-  const meter = accounts ? usageMeter(database.pool) : null;
-  const cancelledAccountIds = new Set();
-  const accountCancellationWork = new Map();
-  const diagnostics = database?.schemaVersions.includes('006_relay_diagnostics')
-    ? relayDiagnostics(database.pool, error => log({ event: 'relay-diagnostic-error', message: error.message })) : null;
-  const adminAccessFile = '/etc/codex-relay/admin-access.json';
-  const adminAccessKey = fs.existsSync(adminAccessFile) ? JSON.parse(fs.readFileSync(adminAccessFile, 'utf8')).key : '';
-  if (adminAccessKey && !validSecret(adminAccessKey)) throw new Error('Invalid admin access key');
-  const diagnosticKey = usageDiagnosticKeyFile ? fs.readFileSync(usageDiagnosticKeyFile, 'utf8').trim() : '';
-  if (diagnosticKey && !/^[A-Za-z0-9_-]{43}$/.test(diagnosticKey)) throw new Error('Invalid usage diagnostic key');
-  const store = database?.devices || deviceStore(stateFile);
-  const debugAllowlist = readDebugAllowlist(debugAllowlistFile);
-  const adminState = database?.admin || relayAdminState(adminStateFile, maxRelaySessions);
-  let activeRelaySessions = 0;
-  for (const record of store.entries()) rooms.set(record.id, { ...record, durable: true, connections: new Map(), observers: new Map(), uploadClients: new Map() });
-  let commitTail = Promise.resolve();
-  function queueStore(operation) {
-    const pending = commitTail.then(operation);
-    commitTail = pending.catch(() => {});
-    return pending;
-  }
-  function commit(room, changes) {
-    return queueStore(async () => {
-      changes = typeof changes === 'function' ? changes(room) : changes;
-      const next = { ...room, ...changes, updatedAt: new Date().toISOString() };
-      if (room.durable) {
-        const { id, hostHash, clients, revision, status, createdAt, updatedAt, officialComputer } = next;
-        await store.save({ id, hostHash, clients, revision, status, createdAt, updatedAt, ...(officialComputer ? { officialComputer } : {}) });
-      }
-      Object.assign(room, changes, { updatedAt: next.updatedAt });
-    });
-  }
-  function registerRoom(id, durable, credential) {
-    return queueStore(async () => {
-      // Resolve concurrent first connections before writing the device identity.
-      if (durable && rooms.has(id)) return rooms.get(id);
-      const now = new Date().toISOString();
-      const record = { id, revision: 0, status: 'active', clients: [], createdAt: now, updatedAt: now,
-        ...(durable ? { hostHash: digest(credential) } : {}) };
-      if (durable) await store.save(record);
-      const room = { ...record, durable, connections: new Map(), observers: new Map(), uploadClients: new Map() };
-      rooms.set(id, room);
-      return room;
-    });
-  }
-  function invitation(room) {
-    const code = secret(); room.pairingHash = digest(code); room.expires = Date.now() + pairingTtlMs;
-    return { code, expires: room.expires };
-  }
-  let listenUrl = '';
-  let adminTail = Promise.resolve();
-  function relayUrl(request) {
-    if (publicRelayUrl) return relayPublicAddress(publicRelayUrl);
-    const host = request.headers.host || new URL(listenUrl).host;
-    const secure = request.socket.encrypted || request.headers['x-forwarded-proto'] === 'https';
-    return `${secure ? 'wss' : 'ws'}://${host}/relay`;
-  }
-  function findInvitation(code) {
-    if (!validSecret(code)) return undefined;
-    return [...rooms.values()].find(room => room.status === 'active' && room.pairingHash && Date.now() < room.expires && matches(code, room.pairingHash));
-  }
-  const server = http.createServer((request, response) => {
-    const target = new URL(request.url || '/', `http://${request.headers.host || 'localhost'}`);
-    if (target.pathname === '/admin' || target.pathname.startsWith('/admin/')) {
-      adminTail = adminTail.then(() => handleAdmin(request, response, target)).catch(() => {
-        if (!response.headersSent) adminReply(response, 500, { error: 'Admin operation failed' });
-      });
-      return;
-    }
-    if (target.pathname === '/account/privacy' && request.method === 'GET') {
-      response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-cache',
-        'Content-Security-Policy': "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
-        'X-Content-Type-Options': 'nosniff' });
-      response.end(privacyPage); return;
-    }
-    if (accounts && target.pathname.startsWith('/account/')) {
-      void handleAccount(request, response, target).catch(() => accountReply(response, 500, { error: 'Account operation failed' }));
-      return;
-    }
-    if (request.method === 'GET' && target.pathname === '/announcement') {
-      const body = JSON.stringify({ announcement: adminState.read().announcement });
-      response.writeHead(200, pairingHeaders('application/json; charset=utf-8', body)); response.end(body); return;
-    }
-    if (request.method !== 'GET' || !['/pair', '/pair/resolve'].includes(target.pathname)) {
-      response.writeHead(404, { 'Cache-Control': 'no-store' }); response.end(); return;
-    }
-    const code = target.searchParams.get('invite') || '';
-    const room = findInvitation(code);
-    if (!room) {
-      const json = target.pathname === '/pair/resolve' || /application\/json/i.test(request.headers.accept || '');
-      const body = json ? JSON.stringify({ error: '配对邀请已过期或已使用' }) : pairingPage({ expired: true });
-      response.writeHead(410, pairingHeaders(json ? 'application/json; charset=utf-8' : 'text/html; charset=utf-8', body)); response.end(body); return;
-    }
-    if (target.pathname === '/pair/resolve' || /application\/json/i.test(request.headers.accept || '')) {
-      const body = JSON.stringify({ version: 6, relayUrl: relayUrl(request), room: room.id, expires: room.expires });
-      response.writeHead(200, pairingHeaders('application/json; charset=utf-8', body)); response.end(body); return;
-    }
-    const secure = request.socket.encrypted || request.headers['x-forwarded-proto'] === 'https';
-    const current = new URL(target.pathname + target.search, `${secure ? 'https' : 'http'}://${request.headers.host || new URL(listenUrl).host}`);
-    const body = pairingPage({ deepLink: `codex-remote://pair?url=${encodeURIComponent(current.href)}`, expires: room.expires, appDownloadUrl });
-    response.writeHead(200, pairingHeaders('text/html; charset=utf-8', body)); response.end(body);
-  });
-  function adminReply(response, status, body, type = 'application/json; charset=utf-8') {
-    const value = typeof body === 'string' ? body : JSON.stringify(body);
-    response.writeHead(status, { 'Content-Type': type, 'Content-Length': Buffer.byteLength(value), 'Cache-Control': 'no-store',
-      'X-Content-Type-Options': 'nosniff', 'Content-Security-Policy': "default-src 'self'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'" });
-    response.end(value);
-  }
-  function accountReply(response, status, body) {
-    if (response.headersSent || response.destroyed) return;
-    const value = JSON.stringify(body);
-    response.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Content-Length': Buffer.byteLength(value),
-      'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff' });
-    response.end(value);
-  }
-  function cancelAccountConnections(userId, token) {
-    const pending = accountCancellationWork.get(userId);
-    if (pending) return pending;
-    if (cancelledAccountIds.has(userId)) return Promise.resolve();
-    cancelledAccountIds.add(userId);
-    const work = (async () => {
-      try { await accounts.cancelAccount(token); }
-      catch (failure) { cancelledAccountIds.delete(userId); throw failure; }
-      for (const room of rooms.values()) {
-        for (const [key, arm] of room.usageArms || []) if (arm.userId === userId) room.usageArms.delete(key);
-        for (const [key, task] of room.usageTasks || []) if (task.userId === userId) room.usageTasks.delete(key);
-        for (const [clientId, connection] of room.connections) {
-          if (connection.userId !== userId) continue;
-          releaseRelay(connection); room.connections.delete(clientId);
-          if (room.host) send(room.host, { type: 'detach', session: connection.session });
-          connection.ws.close(4431, 'Account cancelled');
-        }
-        for (const [clientId, observer] of room.observers) {
-          if (observer.userId !== userId) continue;
-          room.observers.delete(clientId); observer.ws.close(4431, 'Account cancelled');
-        }
-        for (const [clientId, upload] of room.uploadClients) {
-          if (upload.userId !== userId) continue;
-          room.uploadClients.delete(clientId);
-          if (room.uploadHost) send(room.uploadHost, { type: 'file-close', session: upload.session });
-          upload.ws.close(4431, 'Account cancelled');
-        }
-      }
-    })().finally(() => accountCancellationWork.delete(userId));
-    accountCancellationWork.set(userId, work);
-    return work;
-  }
-  async function handleAccount(request, response, target) {
-    try {
-      if (target.pathname === '/account/config' && request.method === 'GET') {
-        accountReply(response, 200, { captchaAppId: accounts.captchaAppId }); return;
-      }
-      const bearer = /^Bearer ([A-Za-z0-9_-]{43})$/.exec(request.headers.authorization || '')?.[1];
-      if (target.pathname === '/account/me' && request.method === 'GET') {
-        const user = await accounts.current(bearer);
-        accountReply(response, 200, { user, usage: await accounts.usage(user.id) }); return;
-      }
-      if (target.pathname === '/account/logout' && request.method === 'POST') {
-        accountReply(response, 200, await accounts.logout(bearer)); return;
-      }
-      if (target.pathname === '/account/me' && request.method === 'DELETE') {
-        const user = await accounts.current(bearer);
-        await cancelAccountConnections(user.id, bearer);
-        accountReply(response, 200, { ok: true }); return;
-      }
-      if (request.method !== 'POST' || request.headers['content-type'] !== 'application/json') {
-        accountReply(response, 404, { error: 'Account route not found' }); return;
-      }
-      const body = JSON.parse(await readBody(request, 4096));
-      if (!body || typeof body !== 'object' || Array.isArray(body)) { accountReply(response, 400, { error: 'Invalid request body' }); return; }
-      if (target.pathname === '/account/email/request') {
-        const ip = request.headers['x-real-ip'] || request.socket.remoteAddress || '';
-        if (typeof ip !== 'string' || !isIP(ip)) { accountReply(response, 400, { error: 'Invalid client address' }); return; }
-        accountReply(response, 202, await accounts.requestCode(body, ip));
-      } else if (target.pathname === '/account/email/verify') {
-        accountReply(response, 200, await accounts.verifyCode(body));
-      } else accountReply(response, 404, { error: 'Account route not found' });
-    } catch (failure) {
-      accountReply(response, failure.status || 503, { error: failure.status ? failure.message : 'Account service unavailable' });
-    }
-  }
-  async function handleAdmin(request, response, target) {
-    const accessKey = request.headers['x-code-relax-admin-key'];
-    const internalAccess = adminAccessKey && validSecret(accessKey) &&
-      timingSafeEqual(Buffer.from(accessKey), Buffer.from(adminAccessKey));
-    const token = /^Bearer ([A-Za-z0-9_-]{43})$/.exec(request.headers.authorization || '')?.[1];
-    const diagnosticRoute = ['/admin/api/usage-diagnostics', '/admin/api/usage-diagnostics/drain'].includes(target.pathname);
-    const diagnosticAccess = diagnosticRoute && diagnosticKey && token &&
-      timingSafeEqual(Buffer.from(token), Buffer.from(diagnosticKey));
-    if (!internalAccess && !diagnosticAccess) { adminReply(response, 404, { error: 'Not found' }); return; }
-    if (request.method === 'GET' && target.pathname === '/admin/api/status') {
-      const state = adminState.read();
-      adminReply(response, 200, { maxRelaySessions: state.maxRelaySessions, activeRelaySessions,
-        activeExemptRelaySessions: [...rooms.values()].reduce((sum, room) => sum + [...room.connections.values()].filter(connection => connection.relayExempt).length, 0),
-        websocketConnections: wss.clients.size, onlineComputers: [...rooms.values()].filter(room => room.host).length,
-        activePhones: [...rooms.values()].reduce((sum, room) => sum + room.connections.size, 0),
-        processRssBytes: process.memoryUsage().rss, processUptimeSeconds: process.uptime(),
-        announcement: state.announcement, announcements: state.announcements }); return;
-    }
-    if (request.method === 'GET' && target.pathname === '/admin/api/usage' && meter) {
-      const page = Number(target.searchParams.get('page') || '1');
-      const view = target.searchParams.get('view') || 'user';
-      if (!Number.isSafeInteger(page) || page < 1 || page > 100000 ||
-          !['user', 'computer'].includes(view) || target.searchParams.has('user') ||
-          target.searchParams.has('computer')) {
-        adminReply(response, 400, { error: 'Invalid usage query' }); return;
-      }
-      adminReply(response, 200, await usageReport(database.pool, page, view)); return;
-    }
-    const diagnosticSource = target.searchParams.get('source') || 'usage';
-    if (target.pathname.startsWith('/admin/api/usage-diagnostics') && !['usage', 'account-cleanup'].includes(diagnosticSource)) {
-      adminReply(response, 400, { error: 'Invalid diagnostic source' }); return;
-    }
-    if (diagnostics && target.pathname === '/admin/api/usage-diagnostics') {
-      if (request.method === 'GET') adminReply(response, 200, await diagnostics.read(diagnosticSource));
-      else if (request.method === 'DELETE') adminReply(response, 200, await diagnostics.clear(diagnosticSource));
-      else adminReply(response, 405, { error: 'Unsupported diagnostic request' });
-      return;
-    }
-    if (diagnostics && target.pathname === '/admin/api/usage-diagnostics/drain') {
-      if (request.method === 'POST') adminReply(response, 200, await diagnostics.drain(diagnosticSource));
-      else adminReply(response, 405, { error: 'Unsupported diagnostic request' });
-      return;
-    }
-    if (!['PUT', 'DELETE'].includes(request.method || '') || request.headers['content-type'] !== 'application/json' ||
-        request.headers['x-code-relax-admin'] !== '1') { adminReply(response, 405, { error: 'Unsupported admin request' }); return; }
-    try {
-      const body = request.method === 'DELETE' ? {} : JSON.parse(await readBody(request, MAX_ADMIN_REQUEST_BYTES));
-      if (target.pathname === '/admin/api/settings' && request.method === 'PUT') {
-        const state = await adminState.setMaxRelaySessions(body.maxRelaySessions);
-        log({ event: 'admin-relay-limit-updated', maxRelaySessions: state.maxRelaySessions });
-      } else if (target.pathname === '/admin/api/announcements' && request.method === 'PUT') {
-        const state = await adminState.createAnnouncement(body.title, body.message, body.publish === true);
-        if (body.publish === true) {
-          broadcastAnnouncement(state.announcement);
-          log({ event: 'admin-announcement-published', announcementId: state.announcement.id });
-        } else log({ event: 'admin-announcement-draft-created', announcementId: state.announcements[0].id });
-      } else if (target.pathname.startsWith('/admin/api/announcements/')) {
-        const parts = target.pathname.slice('/admin/api/announcements/'.length).split('/');
-        const id = parts[0];
-        if (!/^[\w-]{16,128}$/.test(id)) { adminReply(response, 404, { error: 'Admin route not found' }); return; }
-        if (parts.length === 1 && request.method === 'PUT') {
-          await adminState.updateDraft(id, body.title, body.message);
-          log({ event: 'admin-announcement-draft-updated', announcementId: id });
-        } else if (parts.length === 1 && request.method === 'DELETE') {
-          await adminState.deleteAnnouncement(id);
-          log({ event: 'admin-announcement-deleted', announcementId: id });
-        } else if (parts.length === 2 && parts[1] === 'publish' && request.method === 'PUT') {
-          const state = await adminState.publishDraft(id, body.title, body.message);
-          broadcastAnnouncement(state.announcement);
-          log({ event: 'admin-announcement-published', announcementId: id });
-        } else if (parts.length === 2 && parts[1] === 'withdraw' && request.method === 'PUT') {
-          const state = await adminState.withdraw(id);
-          broadcastAnnouncement(state.announcement);
-          log({ event: 'admin-announcement-withdrawn', announcementId: id });
-        } else { adminReply(response, 404, { error: 'Admin route not found' }); return; }
-      } else { adminReply(response, 404, { error: 'Admin route not found' }); return; }
-      adminReply(response, 200, { ok: true });
-    } catch (error) { adminReply(response, 400, { error: error.message }); }
-  }
-  function broadcastAnnouncement(announcement) {
-    for (const room of rooms.values()) {
-      for (const observer of room.observers.values()) send(observer.ws, { type: 'announcement', announcement });
-      for (const connection of room.connections.values()) send(connection.ws, { type: 'announcement', announcement });
-    }
-  }
-  function releaseRelay(connection) {
-    if (!connection?.relayAdmitted) return;
-    connection.relayAdmitted = false; activeRelaySessions = Math.max(0, activeRelaySessions - 1);
-  }
-  function admitRelay(connection, room) {
-    if (connection.relayAdmitted || connection.relayExempt) return true;
-    if (connection.capacityExempt) {
-      connection.relayExempt = true;
-      log({ event: 'relay-capacity-exempt', device: room.id }); return true;
-    }
-    const limit = adminState.read().maxRelaySessions;
-    if (activeRelaySessions >= limit) {
-      log({ event: 'relay-capacity-rejected', device: room.id, activeRelaySessions, maxRelaySessions: limit }); return false;
-    }
-    connection.relayAdmitted = true; activeRelaySessions++;
-    log({ event: 'relay-capacity-admitted', device: room.id, activeRelaySessions, maxRelaySessions: limit }); return true;
-  }
-  const wss = new WebSocketServer({ noServer: true, maxPayload, perMessageDeflate: {
-    serverNoContextTakeover: true, clientNoContextTakeover: true,
-    threshold: 1024, concurrencyLimit: 4, zlibDeflateOptions: { level: 3 },
-  } });
-  let admissionStart = Date.now(), admissions = 0;
-  server.on('upgrade', (request, socket, head) => {
-    if (request.url !== '/relay' || (request.headers.origin && request.headers.origin !== 'null' && !nativeOrigins.includes(request.headers.origin))) {
-      log({ event: 'upgrade-rejected', reason: request.url !== '/relay' ? 'path' : 'origin' });
-      socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n'); return;
-    }
-    if (Date.now() - admissionStart >= 60000) { admissionStart = Date.now(); admissions = 0; }
-    if (wss.clients.size >= maxConnections || ++admissions > 240) {
-      socket.end('HTTP/1.1 429 Too Many Requests\r\nConnection: close\r\n\r\n'); return;
-    }
-    wss.handleUpgrade(request, socket, head, ws => wss.emit('connection', ws));
-  });
-  wss.on('connection', ws => {
-    let role, room, session, clientId, alive = true;
-    const authTimer = setTimeout(() => ws.close(1008, 'Authentication timeout'), 5000);
-    ws.on('pong', () => { alive = true; });
-    const heartbeat = setInterval(() => {
-      sampleInboundQueue();
-      if (!alive) ws.terminate(); else { alive = false; ws.ping(); }
-    }, 30000);
-    const fail = (code = 4401, reason = 'Device authorization rejected') => ws.close(code, reason);
-    const queueClientMessage = (connection, message, pause = 0) => {
-      const bytes = Buffer.byteLength(JSON.stringify(message));
-      connection.queuedBytes = (connection.queuedBytes || 0) + bytes;
-      if (connection.queuedBytes > 40 * 1024 * 1024) {
-        connection.ws.close(1013, 'Receiver too slow'); return;
-      }
-      connection.outbound = (connection.outbound || Promise.resolve()).then(async () => {
-        if (pause > 0) await new Promise(resolve => setTimeout(resolve, pause));
-        connection.queuedBytes -= bytes;
-        send(connection.ws, message);
-      }).catch(() => connection.ws.close(1011, 'Relay delivery failed'));
-    };
-    ws.on('error', () => {}); // close owns routing cleanup.
-    ws.on('close', (code, reason) => {
-      log({ event: 'closed', role: role || 'unauthenticated', device: room?.id, code, reason: reason.toString() });
-      clearTimeout(authTimer); clearInterval(heartbeat);
-      if (role === 'host' && room?.host === ws) {
-        for (const task of room.usageTasks?.values() || []) {
-          void meter?.lost(task).catch(error => log({ event: 'usage-error', message: error.message }));
-        }
-        room.usageTasks?.clear(); room.usageArms?.clear();
-        room.host = undefined; room.hostName = undefined; room.lanCandidates = [];
-        room.uploadHost?.close(4410, 'Computer offline');
-        for (const client of room.uploadClients?.values() || []) client.ws.close(code === 4432 ? 4432 : 4410, code === 4432 ? 'Computer inbound queue limit exceeded' : 'Computer offline');
-        for (const observer of room.observers.values()) send(observer.ws, { type: 'observing', online: false });
-        if (!room.durable) rooms.delete(room.id);
-        for (const connection of room.connections.values()) connection.ws.close(
-          code === 4432 ? 4432 : 4410,
-          code === 4432 ? 'Computer inbound queue limit exceeded' : 'Computer offline; authorization retained');
-      } else if (role === 'client' && room?.connections.get(clientId)?.ws === ws) {
-        const connection = room.connections.get(clientId);
-        releaseRelay(connection);
-        room.connections.delete(clientId);
-        if (room.host) send(room.host, { type: 'detach', session });
-      } else if (role === 'observer' && room?.observers.get(clientId)?.ws === ws) {
-        room.observers.delete(clientId);
-      } else if (role === 'file-host' && room?.uploadHost === ws) {
-        room.uploadHost = undefined;
-        for (const client of room.uploadClients?.values() || []) client.ws.close(code === 4432 ? 4432 : 4410, code === 4432 ? 'File receiver inbound queue limit exceeded' : 'File receiver offline');
-      } else if (role === 'file-client' && room?.uploadClients?.get(clientId)?.ws === ws) {
-        room.uploadClients.delete(clientId);
-        if (room.uploadHost) send(room.uploadHost, { type: 'file-close', session });
-      }
-    });
-    let messageTail = Promise.resolve();
-    // Include the in-flight message: async database work must not permit an
-    // unbounded chain of closures retaining incoming payloads.
-    let pendingMessages = 0, pendingBytes = 0;
-    const maxPendingMessages = 128, maxPendingBytes = 16 * 1024 * 1024;
-    let sampleStarted = Date.now(), peakMessages = 0, peakBytes = 0, maxWaitMs = 0, receivedMessages = 0;
-    function sampleInboundQueue() {
-      const now = Date.now();
-      if (now - sampleStarted < 60000) return;
-      // Summarize only intervals with an actual backlog; never log payloads or credentials.
-      if (peakMessages > 1) log({ event: 'inbound-queue-sample', role: role || 'unauthenticated',
-        windowMs: now - sampleStarted, receivedMessages, peakMessages, peakBytes, maxWaitMs,
-        pendingMessages, pendingBytes });
-      sampleStarted = now; peakMessages = pendingMessages; peakBytes = pendingBytes;
-      maxWaitMs = 0; receivedMessages = 0;
-    }
-    ws.on('message', (bytes, binary) => {
-      if (ws.readyState !== ws.OPEN) return;
-      const size = bytes.length;
-      if (pendingMessages >= maxPendingMessages || pendingBytes + size > maxPendingBytes) {
-        log({ event: 'inbound-queue-limit', role: role || 'unauthenticated',
-          pendingMessages, pendingBytes, incomingBytes: size, maxWaitMs });
-        ws.close(4432, 'Inbound queue limit exceeded');
-        return;
-      }
-      pendingMessages++; pendingBytes += size;
-      receivedMessages++;
-      peakMessages = Math.max(peakMessages, pendingMessages); peakBytes = Math.max(peakBytes, pendingBytes);
-      const enqueuedAt = Date.now();
-      messageTail = messageTail.then(async () => {
-      try {
-        maxWaitMs = Math.max(maxWaitMs, Date.now() - enqueuedAt);
-        if (ws.readyState !== ws.OPEN) return;
-        const message = decode(bytes, binary);
-        if (!role) {
-          let userId;
-          if (!['host', 'file-host', 'observe'].includes(message.type) &&
-              !(['pair', 'resume'].includes(message.type) && message.management === true)) {
-            if (!['pair', 'resume', 'observe', 'file-client'].includes(message.type)) return fail();
-            if (!accounts || !validSecret(message.accountToken)) return fail(4431, 'Account login required');
-            try { userId = (await accounts.current(message.accountToken)).id; }
-            catch { return fail(4431, 'Account session invalid'); }
-            if (ws.readyState !== ws.OPEN) return;
-            if (cancelledAccountIds.has(userId)) return fail(4431, 'Account cancelled');
-          }
-          if (message.type === 'file-host') {
-            room = rooms.get(message.deviceId);
-            if (!room?.host || room.status !== 'active' || !matches(message.deviceSecret, room.hostHash)) return fail();
-            role = 'file-host'; clearTimeout(authTimer);
-            room.uploadClients ||= new Map();
-            room.uploadHost?.close(4409, 'File receiver replaced');
-            room.uploadHost = ws;
-            send(ws, { type: 'file-host-ready' }); return;
-          }
-          if (message.type === 'file-client') {
-            room = rooms.get(message.room);
-            const client = room?.clients.find(item => item.id === message.clientId);
-            if (!room?.host || !room.uploadHost || room.status !== 'active' || !client ||
-                !matches(message.credential, client.hash)) return fail();
-            room.uploadClients ||= new Map();
-            if (room.uploadClients.has(message.clientId) ||
-                [...rooms.values()].reduce((sum, item) => sum + (item.uploadClients?.size || 0), 0) >= 2) {
-              return fail(4429, 'Too many file uploads');
-            }
-            role = 'file-client'; clientId = message.clientId; session = randomUUID(); clearTimeout(authTimer);
-            room.uploadClients.set(clientId, { ws, session, userId });
-            send(room.uploadHost, { type: 'file-open', session }); return;
-          }
-          if (message.type === 'host') {
-            const durable = message.deviceId !== undefined;
-            if (durable && (!validId(message.deviceId) || !validSecret(message.deviceSecret))) return fail();
-            if (!durable && stateFile) return fail(4406, 'Device protocol upgrade required');
-            let lanCandidates, hostName;
-            try {
-              lanCandidates = normalizeLanCandidates(message.lanCandidates);
-              hostName = normalizeHostName(message.hostName);
-            }
-            catch { return fail(1008, 'Invalid LAN candidates'); }
-            room = durable ? rooms.get(message.deviceId) : undefined;
-            if (!room) {
-              if (!durable && !matches(message.key, hostHash)) return fail();
-              room = await registerRoom(durable ? message.deviceId : randomUUID(), durable, message.deviceSecret);
-              if (ws.readyState !== ws.OPEN) return;
-            }
-            if (durable && (room.status !== 'active' || !matches(message.deviceSecret, room.hostHash))) return fail();
-            const oldHost = room.host;
-            room.observers ||= new Map();
-            if (oldHost && oldHost !== ws) {
-              for (const task of room.usageTasks?.values() || []) {
-                try { await meter?.lost(task); } catch (error) { log({ event: 'usage-error', message: error.message }); }
-              }
-              room.usageTasks?.clear(); room.usageArms?.clear();
-            }
-            room.host = ws; room.hostName = hostName; room.lanCandidates = lanCandidates;
-            room.usageTasks ||= new Map(); room.usageArms ||= new Map();
-            if (oldHost && oldHost !== ws) room.uploadHost?.close(4409, 'Computer connection replaced');
-            room.p2pProbe = message.p2pProbe === 1; room.p2pProbeRepeat = message.p2pProbeRepeat === true;
-            role = 'host'; clearTimeout(authTimer);
-            if (oldHost && oldHost !== ws) {
-              oldHost.close(4409, 'Computer connection replaced');
-              for (const connection of room.connections.values()) connection.ws.close(4410, 'Computer reconnecting');
-            }
-            for (const observer of room.observers.values()) {
-              send(observer.ws, { type: 'observing', online: true });
-              send(observer.ws, { type: 'computer-info', hostName: room.hostName });
-              send(observer.ws, { type: 'lan-candidates', candidates: room.lanCandidates });
-            }
-            const invite = room.clients.length ? {} : invitation(room);
-            send(ws, { type: 'registered', protocolVersion: 7, room: room.id, paired: room.clients.length > 0,
-              clientCount: room.clients.length, clients: room.clients, revision: room.revision, ...invite }); return;
-          }
-          room = rooms.get(message.room);
-          if (!room || room.status !== 'active') return fail();
-          let credential;
-          if (message.type === 'pair' && !room.pairingInProgress && room.pairingHash && Date.now() < room.expires && matches(message.code, room.pairingHash)) {
-            if (!room.host) return fail(4410, 'Computer offline; authorization retained');
-            credential = message.credential || secret();
-            clientId = message.clientId || (!room.durable ? randomUUID() : undefined);
-            if (!validSecret(credential) || !validId(clientId)) return fail();
-            const existing = room.clients.find(client => client.id === clientId);
-            if (!existing && room.clients.length >= maxClientsPerHost) return fail(4429, 'Mobile device limit reached');
-            const now = new Date().toISOString();
-            const client = { id: clientId, hash: digest(credential), createdAt: existing?.createdAt || now, updatedAt: now };
-            room.pairingInProgress = true;
-            try {
-              await commit(room, current => ({ clients: [...current.clients.filter(item => item.id !== clientId), client], revision: current.revision + 1 }));
-              room.pairingHash = undefined;
-            } finally { room.pairingInProgress = false; }
-            if (!room.host) return fail(4410, 'Computer offline; authorization retained');
-            send(room.host, { type: 'authorization-changed', clients: room.clients, revision: room.revision });
-          } else {
-            clientId = message.clientId;
-            const client = room.clients.find(item => item.id === clientId) ||
-              (!room.durable && !clientId ? room.clients.find(item => matches(message.credential, item.hash)) : undefined);
-            if (client) clientId = client.id;
-            if (!['resume', 'pair', 'observe'].includes(message.type) || !client || !matches(message.credential, client.hash)) {
-            return fail(message.type === 'pair' ? 4408 : 4401, message.type === 'pair' ? 'Pairing code expired or used' : 'Device authorization rejected');
-            }
-          }
-          if (ws.readyState !== ws.OPEN) return;
-          if (cancelledAccountIds.has(userId)) return fail(4431, 'Account cancelled');
-          if (message.type === 'observe') {
-            role = 'observer'; clearTimeout(authTimer); room.observers ||= new Map();
-            const oldObserver = room.observers.get(clientId);
-            if (oldObserver?.ws && oldObserver.ws !== ws) oldObserver.ws.close(4409, 'Metadata connection replaced by same identity');
-            room.observers.set(clientId, { ws, userId });
-            send(ws, { type: 'observing', online: Boolean(room.host) });
-            send(ws, { type: 'debug-permissions', enabled: debugAllowed(debugAllowlist, room.id, room.clients.find(client => client.id === clientId)) });
-            const announcement = adminState.read().announcement;
-            if (announcement) send(ws, { type: 'announcement', announcement });
-            if (room.hostName) send(ws, { type: 'computer-info', hostName: room.hostName });
-            if (room.lanCandidates?.length) send(ws, { type: 'lan-candidates', candidates: room.lanCandidates });
-            if (room.officialComputer) send(ws, { type: 'official-computer', computer: room.officialComputer });
-            return;
-          }
-          if (!room.host) return fail(4410, 'Computer offline; authorization retained');
-          const oldConnection = room.connections.get(clientId);
-          role = 'client'; clearTimeout(authTimer); session = randomUUID();
-          if (oldConnection?.ws && oldConnection.ws !== ws) {
-            releaseRelay(oldConnection);
-            send(room.host, { type: 'detach', session: oldConnection.session });
-            oldConnection.ws.close(4409, 'Phone connection replaced by same identity');
-          }
-          room.connections.set(clientId, { ws, session, p2pProbe: Boolean(userId) && room.p2pProbe && message.p2pProbe === 1,
-            userId,
-            repeat: room.p2pProbeRepeat, signals: 0, probeStarted: 0, outbound: Promise.resolve(), queuedBytes: 0,
-            relayAdmitted: false, relayExempt: false,
-            capacityExempt: debugAllowed(debugAllowlist, room.id, room.clients.find(client => client.id === clientId)) });
-          send(ws, { type: 'paired', protocolVersion: 7, room: room.id, clientId, revision: room.revision, ...(credential ? { credential } : {}) });
-          send(ws, { type: 'computer-info', hostName: room.hostName });
-          if (room.lanCandidates?.length) send(ws, { type: 'lan-candidates', candidates: room.lanCandidates });
-          const announcement = adminState.read().announcement;
-          if (announcement) send(ws, { type: 'announcement', announcement });
-          send(room.host, { type: 'attach', session, clientId, p2pProbe: room.connections.get(clientId).p2pProbe ? 1 : 0 }); return;
-        }
-        if (role === 'host') {
-          if (room.host !== ws) return;
-          if (meter && ['usage-arm', 'usage-message', 'usage-cancel', 'usage-turn', 'usage-observer-lost'].includes(message.type)) {
-            if (message.type === 'usage-observer-lost') {
-              for (const task of room.usageTasks.values()) {
-                try { await meter.lost(task); } catch (error) { log({ event: 'usage-error', message: error.message }); }
-              }
-              room.usageTasks.clear();
-              return;
-            }
-            const armKey = `${message.session}:${message.requestId}`;
-            const connection = [...room.connections.values()].find(item => item.session === message.session);
-            if (message.type === 'usage-arm') {
-              if (!connection?.userId || !Number.isSafeInteger(message.requestId) || message.requestId < 1 ||
-                  (message.threadId !== null && (!plainText(message.threadId, 128, false)))) {
-                diagnostics?.record('usage', 'arm-rejected', !connection?.userId ? 'account-missing' : 'invalid-request');
-                return;
-              }
-              for (const [key, arm] of room.usageArms) if (Date.now() - arm.at > 120000) room.usageArms.delete(key);
-              if (room.usageArms.size >= 256) return;
-              room.usageArms.set(armKey, { userId: connection.userId,
-                clientId: [...room.connections.entries()].find(([, item]) => item === connection)?.[0],
-                session: message.session, at: Date.now() });
-              return;
-            }
-            if (message.type === 'usage-cancel') {
-              room.usageArms.delete(armKey); return;
-            }
-            if (message.type === 'usage-message') {
-              const arm = room.usageArms.get(armKey);
-              room.usageArms.delete(armKey);
-              if (!arm || Date.now() - arm.at > 120000 || !plainText(message.messageKey, 128, false)) {
-                diagnostics?.record('usage', 'message-rejected', !arm ? 'arm-missing' : 'expired-or-invalid');
-                return;
-              }
-              try {
-                await meter.action(arm, room.id, arm.clientId, 'message', message.messageKey);
-                if (['start', 'steer'].includes(message.turnKind) &&
-                    plainText(message.threadId, 80, false) && plainText(message.turnId, 80, false)) {
-                  const key = `${message.threadId}:${message.turnId}`;
-                  if (key.length <= 128) {
-                    const counted = await meter.action(arm, room.id, arm.clientId, 'turn', key);
-                    if (counted && message.turnKind === 'steer') diagnostics?.record('usage', 'turn-recovered', 'steer');
-                    if (!room.usageTasks.has(key) && message.observerReady === true && message.completed !== true &&
-                        (message.turnKind === 'start' || message.active === true)) {
-                      const task = await meter.turnOrigin(room.id, key);
-                      if (task) {
-                        await meter.pulse(task, true, room.id, task.clientId, counted ? key : randomUUID());
-                        room.usageTasks.set(key, task);
-                      }
-                    }
-                  }
-                }
-              } catch (error) { diagnostics?.record('usage', 'message-error', 'database'); log({ event: 'usage-error', message: error.message }); }
-              return;
-            }
-            if (!['turn/started', 'turn/completed', 'heartbeat', 'resume', 'inactive'].includes(message.method) ||
-                !plainText(message.threadId, 80, false) || !plainText(message.turnId, 80, false)) return;
-            const key = `${message.threadId}:${message.turnId}`;
-            if (key.length > 128) return;
-            let task = room.usageTasks.get(key);
-            try {
-              if (message.method === 'resume' && !task) {
-                task = await meter.turnOrigin(room.id, key);
-                if (!task) { diagnostics?.record('usage', 'turn-resume', 'origin-missing'); return; }
-                await meter.pulse(task, true, room.id, task.clientId, `${key}:${randomUUID()}`);
-                diagnostics?.record('usage', 'turn-resume', 'confirmed');
-                room.usageTasks.set(key, task);
-              } else if (task && message.method === 'heartbeat') await meter.pulse(task, true, room.id, task.clientId);
-              else if (task && message.method === 'inactive') {
-                await meter.lost(task);
-                room.usageTasks.delete(key);
-              }
-              else if (task && message.method === 'turn/completed') {
-                await meter.pulse(task, false, room.id, task.clientId);
-                room.usageTasks.delete(key);
-              }
-            } catch (error) { log({ event: 'usage-error', message: error.message }); }
-            return;
-          }
-          if (message.type === 'lan-candidates') {
-            room.lanCandidates = normalizeLanCandidates(message.candidates);
-            for (const connection of room.connections.values()) send(connection.ws, { type: 'lan-candidates', candidates: room.lanCandidates });
-            for (const observer of room.observers.values()) send(observer.ws, { type: 'lan-candidates', candidates: room.lanCandidates });
-            return;
-          }
-          if (message.type === 'status') {
-            send(ws, { type: 'status', commandId: message.commandId, paired: room.clients.length > 0, clientCount: room.clients.length, revision: room.revision }); return;
-          }
-          if (message.type === 'pair-code') {
-            send(ws, { type: 'pair-code', commandId: message.commandId, room: room.id, ...invitation(room) }); return;
-          }
-          if (message.type === 'revoke') {
-            await commit(room, current => ({ clients: [], revision: current.revision + 1 }));
-            room.pairingHash = undefined;
-            for (const connection of room.connections.values()) {
-              releaseRelay(connection);
-              send(ws, { type: 'detach', session: connection.session });
-              connection.ws.close(4401, 'Device authorization revoked');
-            }
-            room.connections.clear();
-            for (const client of room.uploadClients?.values() || []) client.ws.close(4401, 'Device authorization revoked');
-            room.uploadClients?.clear();
-            for (const observer of room.observers.values()) observer.ws.close(4401, 'Device authorization revoked');
-            room.observers.clear();
-            send(ws, { type: 'authorization-changed', clients: [], revision: room.revision });
-            send(ws, { type: 'revoked', commandId: message.commandId, room: room.id }); return;
-          }
-          const connection = [...room.connections.values()].find(item => item.session === message.session);
-          if (!connection) return; // Late frames from an ended session.
-          if (message.type === 'data' && typeof message.payload === 'string') queueClientMessage(connection, { type: 'data', payload: message.payload });
-          else if (message.type === 'ready') queueClientMessage(connection, { type: 'ready', p2pProbe: connection.p2pProbe ? 1 : 0,
-            p2pProbeRepeat: connection.p2pProbe && connection.repeat });
-          else if (message.type === 'p2p-probe' && connection.p2pProbe && validProbeSignal(message)) {
-            const diagnostic = message.purpose === 'diagnostic';
-            if (message.purpose && !diagnostic) return fail(1008, 'Invalid probe purpose');
-            if ((diagnostic ? connection.diagnosticProbeId : connection.probeId) !== message.probeId) return;
-            if (++connection[diagnostic ? 'diagnosticSignals' : 'signals'] > 150) return fail(1008, 'Probe signal limit');
-            send(connection.ws, { ...message, session: undefined });
-          }
-          else if (message.type === 'detach') connection.ws.close(1011, 'Local Bridge unavailable');
-          else fail();
-        } else if (role === 'file-host' && room.uploadHost === ws) {
-          const client = [...room.uploadClients.values()].find(item => item.session === message.session);
-          if (!client) return;
-          if (message.type === 'file-frame' && typeof message.payload === 'string' && message.payload.length <= 512 * 1024) {
-            if (client.ws.bufferedAmount > 1024 * 1024) return client.ws.close(1013, 'File receiver too slow');
-            send(client.ws, { type: 'file-frame', payload: message.payload });
-          } else if (message.type === 'file-close') client.ws.close(1011, 'File receiver unavailable');
-          else fail(1008, 'Invalid file frame');
-        } else if (role === 'file-client' && room.uploadClients?.get(clientId)?.ws === ws) {
-          if (message.type !== 'file-frame' || typeof message.payload !== 'string' || message.payload.length > 512 * 1024) return fail(1008, 'Invalid file frame');
-          if (room.uploadHost?.bufferedAmount > 1024 * 1024) return fail(1013, 'File receiver too slow');
-          send(room.uploadHost, { type: 'file-frame', session, payload: message.payload });
-        } else if (role === 'observer' && room.observers.get(clientId)?.ws === ws && message.type === 'official-computer') {
-          const computer = normalizeOfficialComputer(message);
-          await commit(room, { officialComputer: computer });
-          send(ws, { type: 'official-computer-saved', computer });
-        } else if (role === 'client' && room.connections.get(clientId)?.ws === ws && message.type === 'p2p-probe') {
-          const connection = room.connections.get(clientId);
-          if (!connection.p2pProbe || !validProbeSignal(message)) return fail(1008, 'Invalid probe signal');
-          const diagnostic = message.purpose === 'diagnostic';
-          if (message.purpose && !diagnostic) return fail(1008, 'Invalid probe purpose');
-          const idField = diagnostic ? 'diagnosticProbeId' : 'probeId';
-          const signalsField = diagnostic ? 'diagnosticSignals' : 'signals';
-          const startedField = diagnostic ? 'diagnosticProbeStarted' : 'probeStarted';
-          if (message.kind === 'start') {
-            if (connection[idField] && (!connection.repeat || Date.now() - connection[startedField] < 2000)) {
-              send(ws, { type: 'p2p-probe', version: 1, probeId: message.probeId,
-                ...(diagnostic ? { purpose: 'diagnostic' } : {}), kind: 'close' }); return;
-            }
-            connection[idField] = message.probeId; connection[signalsField] = 0; connection[startedField] = Date.now();
-          }
-          if (connection[idField] !== message.probeId) return;
-          if (++connection[signalsField] > 150) return fail(1008, 'Probe signal limit');
-          send(room.host, { ...message, session });
-          if (diagnostic && message.kind === 'close') connection.diagnosticProbeId = undefined;
-        } else if (room.connections.get(clientId)?.ws === ws && message.type === 'p2p-route' && message.direct === 1) {
-          releaseRelay(room.connections.get(clientId));
-        } else if (room.connections.get(clientId)?.ws === ws && message.type === 'data' && typeof message.payload === 'string') {
-          const connection = room.connections.get(clientId);
-          if (!connection.userId && !managementPayload(message.payload)) return fail(4431, 'Account login required');
-          if (connection.userId && !controlPayload(message.payload) && !admitRelay(connection, room)) {
-            ws.close(4428, 'Server busy'); return;
-          }
-          send(room.host, { type: 'data', session, payload: message.payload });
-        } else fail();
-      } catch (error) { log({ event: 'request-error', role, message: 'Relay operation failed' }); ws.close(1011, 'Relay operation failed'); }
-      finally { pendingMessages--; pendingBytes -= size; }
-      }).catch(() => ws.close(1011, 'Relay operation failed'));
-    });
-  });
-  await new Promise((resolve, reject) => { server.once('error', reject); server.listen(port, '127.0.0.1', resolve); });
-  listenUrl = `ws://127.0.0.1:${server.address().port}/relay`;
-  return {
-    url: listenUrl, hostKey,
-    async close() {
-      for (const ws of wss.clients) ws.terminate();
-      await new Promise(resolve => wss.close(resolve));
-      await new Promise(resolve => server.close(resolve));
-      if (database) await database.close();
-    },
-  };
-}
-
-function relayPublicAddress(value) {
-  const parsed = new URL(value);
-  if (!['ws:', 'wss:'].includes(parsed.protocol) || parsed.pathname !== '/relay' || parsed.search || parsed.hash || parsed.username || parsed.password) {
-    throw new Error('Invalid public relay URL');
-  }
-  return parsed.href;
-}
-
-function pairingHeaders(type, body) {
-  return { 'Content-Type': type, 'Content-Length': Buffer.byteLength(body), 'Cache-Control': 'no-store',
-    'X-Content-Type-Options': 'nosniff', 'Referrer-Policy': 'no-referrer',
-    'Content-Security-Policy': "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'" };
-}
-
-function pairingPage({ deepLink = '', expires = 0, appDownloadUrl = '', expired = false }) {
-  const open = deepLink ? `<a class="primary" href="${escapeHtml(deepLink)}">打开 Code Relax</a>` : '';
-  const download = appDownloadUrl ? `<a href="${escapeHtml(appDownloadUrl)}">安装 Code Relax</a>` : '<p>尚未安装时，请通过当前私测渠道安装 App，再重新打开此页面。</p>';
-  const text = expired ? '这条设备配对邀请已过期或已经使用，请在电脑重新生成。'
-    : `这是一次性设备配对邀请，有效期至 ${escapeHtml(new Date(expires).toLocaleString('zh-CN', { timeZone: 'Asia/Shanghai' }))}。每台移动设备只需配对一次。`;
-  return `<!doctype html><html lang="zh-CN"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Code Relax 配对</title><style>body{margin:0;background:#0d1210;color:#eef4f0;font:16px system-ui,sans-serif}main{max-width:520px;margin:12vh auto;padding:32px}h1{font-size:28px}p{color:#aab7af;line-height:1.7}a{display:block;margin-top:16px;padding:14px 18px;border:1px solid #496257;border-radius:12px;color:#dce9e1;text-align:center;text-decoration:none}.primary{background:#1f5a40;border-color:#367c5b}</style><main><h1>Code Relax</h1><p>${text}</p>${expired ? '' : open + download}</main></html>`;
-}
-
-function escapeHtml(value) {
-  return String(value).replace(/[&<>"']/g, character => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[character]);
-}
-
-function normalizeLanCandidates(value) {
-  if (value === undefined) return [];
-  if (!Array.isArray(value) || value.length > 8) throw new Error('Invalid LAN candidates');
-  return value.map(candidate => {
-    const endpoint = new URL(candidate?.address || '');
-    if (endpoint.protocol !== 'http:' || !endpoint.port || endpoint.pathname !== '/' || endpoint.search || endpoint.hash ||
-        endpoint.username || endpoint.password || !privateIpv4(endpoint.hostname) ||
-        !['wifi', 'ethernet'].includes(candidate.networkType) || !plainLabel(candidate.networkName) || !plainLabel(candidate.interfaceName)) {
-      throw new Error('Invalid LAN candidate');
-    }
-    return { address: endpoint.href.replace(/\/$/, ''), networkType: candidate.networkType,
-      networkName: candidate.networkName.trim(), interfaceName: candidate.interfaceName.trim() };
-  });
-}
-
-function normalizeHostName(value) {
-  if (!plainLabel(value)) throw new Error('Invalid host name');
-  return value.trim();
-}
-
-function normalizeOfficialComputer(value) {
-  if (!plainText(value.environmentId, 256, false) || !plainText(value.name ?? '', 80, true) ||
-      !plainText(value.hostname ?? '', 80, true)) throw new Error('Invalid official computer');
-  return { environmentId: value.environmentId.trim(), name: (value.name || '').trim(),
-    hostname: (value.hostname || '').trim(), updatedAt: new Date().toISOString() };
-}
-
-function privateIpv4(value) {
-  const parts = value.split('.').map(Number);
-  if (parts.length !== 4 || parts.some(part => !Number.isInteger(part) || part < 0 || part > 255)) return false;
-  return parts[0] === 10 || (parts[0] === 192 && parts[1] === 168) ||
-    (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31) ||
-    (parts[0] === 100 && parts[1] >= 64 && parts[1] <= 127);
-}
-
-function plainLabel(value) {
-  return typeof value === 'string' && value.trim().length > 0 && value.trim().length <= 80 && !/[\u0000-\u001f\u007f]/.test(value);
-}
-
-
-function plainText(value, limit, empty) {
-  return typeof value === 'string' && (empty || value.trim().length > 0) && value.trim().length <= limit && !/[\u0000-\u001f\u007f]/.test(value);
-}
-
-// Device-authorized management must not become an anonymous chat tunnel.
-function managementPayload(value) {
-  try {
-    const message = JSON.parse(value);
-    if (['unsubscribe', 'cancel', 'response-ack'].includes(message.type)) return true;
-    if (message.type === 'subscribe') return message.path === '/api/shared-recovery/events';
-    if (message.type !== 'request') return false;
-    const method = message.method || 'GET';
-    if (method === 'GET') return ['/api/health', '/api/official-remote/status'].includes(message.path) ||
-      /^\/api\/threads\/[0-9a-f-]{28,64}\/model-changes(?:\?|$)/i.test(message.path);
-    return method === 'POST' && message.path === '/api/official-remote/pairing';
-  } catch { return false; }
-}
-
-function controlPayload(value) {
-  try {
-    const message = JSON.parse(value);
-    if (message.type === 'unsubscribe') return true;
-    return ['request', 'subscribe'].includes(message.type) && typeof message.path === 'string' &&
-      (message.path === '/api/health' || message.path.startsWith('/api/shared-recovery'));
-  } catch { return false; }
-}
-
-function readBody(request, limit) {
-  return new Promise((resolve, reject) => {
-    let value = '';
-    request.setEncoding('utf8');
-    request.on('data', chunk => {
-      value += chunk;
-      if (Buffer.byteLength(value) > limit) { reject(new Error('Admin request too large')); request.destroy(); }
-    });
-    request.on('end', () => resolve(value)); request.on('error', reject);
-  });
-}
+import { privacyPage } from './privacy-page.mjs';
+import http from 'node:http';
+import fs from 'node:fs';
+import { isIP } from 'node:net';
+import { deviceStore, validId } from './device-store.mjs';
+import { randomUUID, timingSafeEqual } from 'node:crypto';
+import { WebSocketServer } from 'ws';
+import { secret, digest, matches, validSecret, send, decode } from './wire.mjs';
+import { routedFileBytes, parseFileBytes } from './file-wire.mjs';
+import { readDebugAllowlist, debugAllowed } from './debug-allowlist.mjs';
+import { validProbeSignal } from './p2p-probe.mjs';
+import { MAX_ADMIN_REQUEST_BYTES, relayAdminState } from './admin-state.mjs';
+import { openRelayMysql } from './mysql-state.mjs';
+import { openEmailAccounts } from './email-accounts.mjs';
+import { accountConnections } from './account-connections.mjs';
+import { usageMeter, usageReport } from './usage-meter.mjs';
+import { relayDiagnostics } from './diagnostics.mjs';
+
+// Always loopback; a TLS reverse proxy supplies the private-trial Internet endpoint.
+export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlMs = 120000,
+  maxConnections = 128, maxClientsPerHost = 16, maxPayload = 8 * 1024 * 1024, stateFile,
+  maxRelaySessions = 8, adminStateFile, mysqlConfigFile, accountConfigFile, usageDiagnosticKeyFile,
+  publicRelayUrl = '', appDownloadUrl = '', debugAllowlistFile, log = () => {} } = {}) {
+  if (!validSecret(hostKey)) throw new Error('Invalid host credential');
+  if (!Number.isSafeInteger(maxClientsPerHost) || maxClientsPerHost < 1 || maxClientsPerHost > 64) throw new Error('Invalid mobile device limit');
+  if (!Number.isSafeInteger(maxRelaySessions) || maxRelaySessions < 1 || maxRelaySessions > 256) throw new Error('Invalid relay session limit');
+  if (publicRelayUrl) relayPublicAddress(publicRelayUrl);
+  // Harmony's native WebSocket supplies the endpoint Origin automatically.
+  // libwebsockets can use http even for WSS; trust only the configured endpoint.
+  const nativeOrigins = publicRelayUrl ? ['http:', 'https:'].map(protocol => `${protocol}//${new URL(publicRelayUrl).host}`) : [];
+  if (appDownloadUrl && !/^https:\/\/[^\s]+$/.test(appDownloadUrl)) throw new Error('Invalid app download URL');
+  const hostHash = digest(hostKey), rooms = new Map();
+  const database = mysqlConfigFile ? await openRelayMysql(mysqlConfigFile, maxRelaySessions) : null;
+  if (accountConfigFile && !database?.schemaVersions.includes('003_relay_usage')) throw new Error('Relay account and usage schema is required');
+  const accounts = accountConfigFile ? openEmailAccounts(database.pool, accountConfigFile) : null;
+  const accountSockets = accountConnections();
+  const meter = accounts ? usageMeter(database.pool) : null;
+  const cancelledAccountIds = new Set();
+  const accountCancellationWork = new Map();
+  const diagnostics = database?.schemaVersions.includes('006_relay_diagnostics')
+    ? relayDiagnostics(database.pool, error => log({ event: 'relay-diagnostic-error', message: error.message })) : null;
+  const adminAccessFile = '/etc/codex-relay/admin-access.json';
+  const adminAccessKey = fs.existsSync(adminAccessFile) ? JSON.parse(fs.readFileSync(adminAccessFile, 'utf8')).key : '';
+  if (adminAccessKey && !validSecret(adminAccessKey)) throw new Error('Invalid admin access key');
+  const diagnosticKey = usageDiagnosticKeyFile ? fs.readFileSync(usageDiagnosticKeyFile, 'utf8').trim() : '';
+  if (diagnosticKey && !/^[A-Za-z0-9_-]{43}$/.test(diagnosticKey)) throw new Error('Invalid usage diagnostic key');
+  const store = database?.devices || deviceStore(stateFile);
+  const debugAllowlist = readDebugAllowlist(debugAllowlistFile);
+  const adminState = database?.admin || relayAdminState(adminStateFile, maxRelaySessions);
+  let activeRelaySessions = 0;
+  for (const record of store.entries()) rooms.set(record.id, { ...record, durable: true, connections: new Map(), observers: new Map(), uploadClients: new Map() });
+  let commitTail = Promise.resolve();
+  function queueStore(operation) {
+    const pending = commitTail.then(operation);
+    commitTail = pending.catch(() => {});
+    return pending;
+  }
+  function commit(room, changes) {
+    return queueStore(async () => {
+      changes = typeof changes === 'function' ? changes(room) : changes;
+      const next = { ...room, ...changes, updatedAt: new Date().toISOString() };
+      if (room.durable) {
+        const { id, hostHash, clients, revision, status, createdAt, updatedAt, officialComputer } = next;
+        await store.save({ id, hostHash, clients, revision, status, createdAt, updatedAt, ...(officialComputer ? { officialComputer } : {}) });
+      }
+      Object.assign(room, changes, { updatedAt: next.updatedAt });
+    });
+  }
+  function registerRoom(id, durable, credential) {
+    return queueStore(async () => {
+      // Resolve concurrent first connections before writing the device identity.
+      if (durable && rooms.has(id)) return rooms.get(id);
+      const now = new Date().toISOString();
+      const record = { id, revision: 0, status: 'active', clients: [], createdAt: now, updatedAt: now,
+        ...(durable ? { hostHash: digest(credential) } : {}) };
+      if (durable) await store.save(record);
+      const room = { ...record, durable, connections: new Map(), observers: new Map(), uploadClients: new Map() };
+      rooms.set(id, room);
+      return room;
+    });
+  }
+  function invitation(room) {
+    const code = secret(); room.pairingHash = digest(code); room.expires = Date.now() + pairingTtlMs;
+    return { code, expires: room.expires };
+  }
+  let listenUrl = '';
+  let adminTail = Promise.resolve();
+  function relayUrl(request) {
+    if (publicRelayUrl) return relayPublicAddress(publicRelayUrl);
+    const host = request.headers.host || new URL(listenUrl).host;
+    const secure = request.socket.encrypted || request.headers['x-forwarded-proto'] === 'https';
+    return `${secure ? 'wss' : 'ws'}://${host}/relay`;
+  }
+  function findInvitation(code) {
+    if (!validSecret(code)) return undefined;
+    return [...rooms.values()].find(room => room.status === 'active' && room.pairingHash && Date.now() < room.expires && matches(code, room.pairingHash));
+  }
+  const server = http.createServer((request, response) => {
+    const target = new URL(request.url || '/', `http://${request.headers.host || 'localhost'}`);
+    if (target.pathname === '/admin' || target.pathname.startsWith('/admin/')) {
+      adminTail = adminTail.then(() => handleAdmin(request, response, target)).catch(() => {
+        if (!response.headersSent) adminReply(response, 500, { error: 'Admin operation failed' });
+      });
+      return;
+    }
+    if (target.pathname === '/account/privacy' && request.method === 'GET') {
+      response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-cache',
+        'Content-Security-Policy': "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+        'X-Content-Type-Options': 'nosniff' });
+      response.end(privacyPage); return;
+    }
+    if (accounts && target.pathname.startsWith('/account/')) {
+      void handleAccount(request, response, target).catch(() => accountReply(response, 500, { error: 'Account operation failed' }));
+      return;
+    }
+    if (request.method === 'GET' && target.pathname === '/announcement') {
+      const body = JSON.stringify({ announcement: adminState.read().announcement });
+      response.writeHead(200, pairingHeaders('application/json; charset=utf-8', body)); response.end(body); return;
+    }
+    if (request.method !== 'GET' || !['/pair', '/pair/resolve'].includes(target.pathname)) {
+      response.writeHead(404, { 'Cache-Control': 'no-store' }); response.end(); return;
+    }
+    const code = target.searchParams.get('invite') || '';
+    const room = findInvitation(code);
+    if (!room) {
+      const json = target.pathname === '/pair/resolve' || /application\/json/i.test(request.headers.accept || '');
+      const body = json ? JSON.stringify({ error: '配对邀请已过期或已使用' }) : pairingPage({ expired: true });
+      response.writeHead(410, pairingHeaders(json ? 'application/json; charset=utf-8' : 'text/html; charset=utf-8', body)); response.end(body); return;
+    }
+    if (target.pathname === '/pair/resolve' || /application\/json/i.test(request.headers.accept || '')) {
+      const body = JSON.stringify({ version: 6, relayUrl: relayUrl(request), room: room.id, expires: room.expires });
+      response.writeHead(200, pairingHeaders('application/json; charset=utf-8', body)); response.end(body); return;
+    }
+    const secure = request.socket.encrypted || request.headers['x-forwarded-proto'] === 'https';
+    const current = new URL(target.pathname + target.search, `${secure ? 'https' : 'http'}://${request.headers.host || new URL(listenUrl).host}`);
+    const body = pairingPage({ deepLink: `codex-remote://pair?url=${encodeURIComponent(current.href)}`, expires: room.expires, appDownloadUrl });
+    response.writeHead(200, pairingHeaders('text/html; charset=utf-8', body)); response.end(body);
+  });
+  function adminReply(response, status, body, type = 'application/json; charset=utf-8') {
+    const value = typeof body === 'string' ? body : JSON.stringify(body);
+    response.writeHead(status, { 'Content-Type': type, 'Content-Length': Buffer.byteLength(value), 'Cache-Control': 'no-store',
+      'X-Content-Type-Options': 'nosniff', 'Content-Security-Policy': "default-src 'self'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'" });
+    response.end(value);
+  }
+  function accountReply(response, status, body) {
+    if (response.headersSent || response.destroyed) return;
+    const value = JSON.stringify(body);
+    response.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Content-Length': Buffer.byteLength(value),
+      'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff' });
+    response.end(value);
+  }
+  function cancelAccountConnections(userId, token) {
+    const pending = accountCancellationWork.get(userId);
+    if (pending) return pending;
+    if (cancelledAccountIds.has(userId)) return Promise.resolve();
+    cancelledAccountIds.add(userId);
+    const work = (async () => {
+      try { await accounts.cancelAccount(token); }
+      catch (failure) { cancelledAccountIds.delete(userId); throw failure; }
+      for (const room of rooms.values()) {
+        for (const [key, arm] of room.usageArms || []) if (arm.userId === userId) room.usageArms.delete(key);
+        for (const [key, task] of room.usageTasks || []) if (task.userId === userId) room.usageTasks.delete(key);
+        for (const [clientId, connection] of room.connections) {
+          if (connection.userId !== userId) continue;
+          releaseRelay(connection); room.connections.delete(clientId);
+          if (room.host) send(room.host, { type: 'detach', session: connection.session });
+          connection.ws.close(4431, 'Account cancelled');
+        }
+        for (const [clientId, observer] of room.observers) {
+          if (observer.userId !== userId) continue;
+          room.observers.delete(clientId); observer.ws.close(4431, 'Account cancelled');
+        }
+        for (const [clientId, upload] of room.uploadClients) {
+          if (upload.userId !== userId) continue;
+          room.uploadClients.delete(clientId);
+          if (room.uploadHost) send(room.uploadHost, { type: 'file-close', session: upload.session });
+          upload.ws.close(4431, 'Account cancelled');
+        }
+      }
+    })().finally(() => accountCancellationWork.delete(userId));
+    accountCancellationWork.set(userId, work);
+    return work;
+  }
+  async function handleAccount(request, response, target) {
+    try {
+      if (target.pathname === '/account/config' && request.method === 'GET') {
+        accountReply(response, 200, { captchaAppId: accounts.captchaAppId }); return;
+      }
+      const bearer = /^Bearer ([A-Za-z0-9_-]{43})$/.exec(request.headers.authorization || '')?.[1];
+      if (target.pathname === '/account/me' && request.method === 'GET') {
+        const user = await accounts.current(bearer);
+        accountReply(response, 200, { user, usage: await accounts.usage(user.id) }); return;
+      }
+      if (target.pathname === '/account/logout' && request.method === 'POST') {
+        const result = await accounts.logout(bearer);
+        accountSockets.revoke(bearer);
+        accountReply(response, 200, result); return;
+      }
+      if (target.pathname === '/account/me' && request.method === 'DELETE') {
+        const user = await accounts.current(bearer);
+        await cancelAccountConnections(user.id, bearer);
+        accountReply(response, 200, { ok: true }); return;
+      }
+      if (request.method !== 'POST' || request.headers['content-type'] !== 'application/json') {
+        accountReply(response, 404, { error: 'Account route not found' }); return;
+      }
+      const body = JSON.parse(await readBody(request, 4096));
+      if (!body || typeof body !== 'object' || Array.isArray(body)) { accountReply(response, 400, { error: 'Invalid request body' }); return; }
+      if (target.pathname === '/account/email/request') {
+        const ip = request.headers['x-real-ip'] || request.socket.remoteAddress || '';
+        if (typeof ip !== 'string' || !isIP(ip)) { accountReply(response, 400, { error: 'Invalid client address' }); return; }
+        accountReply(response, 202, await accounts.requestCode(body, ip));
+      } else if (target.pathname === '/account/email/verify') {
+        accountReply(response, 200, await accounts.verifyCode(body));
+      } else accountReply(response, 404, { error: 'Account route not found' });
+    } catch (failure) {
+      accountReply(response, failure.status || 503, { error: failure.status ? failure.message : 'Account service unavailable' });
+    }
+  }
+  async function handleAdmin(request, response, target) {
+    const accessKey = request.headers['x-code-relax-admin-key'];
+    const internalAccess = adminAccessKey && validSecret(accessKey) &&
+      timingSafeEqual(Buffer.from(accessKey), Buffer.from(adminAccessKey));
+    const token = /^Bearer ([A-Za-z0-9_-]{43})$/.exec(request.headers.authorization || '')?.[1];
+    const diagnosticRoute = ['/admin/api/usage-diagnostics', '/admin/api/usage-diagnostics/drain'].includes(target.pathname);
+    const diagnosticAccess = diagnosticRoute && diagnosticKey && token &&
+      timingSafeEqual(Buffer.from(token), Buffer.from(diagnosticKey));
+    if (!internalAccess && !diagnosticAccess) { adminReply(response, 404, { error: 'Not found' }); return; }
+    if (request.method === 'GET' && target.pathname === '/admin/api/status') {
+      const state = adminState.read();
+      adminReply(response, 200, { maxRelaySessions: state.maxRelaySessions, activeRelaySessions,
+        activeExemptRelaySessions: [...rooms.values()].reduce((sum, room) => sum + [...room.connections.values()].filter(connection => connection.relayExempt).length, 0),
+        websocketConnections: wss.clients.size, onlineComputers: [...rooms.values()].filter(room => room.host).length,
+        activePhones: [...rooms.values()].reduce((sum, room) => sum + room.connections.size, 0),
+        processRssBytes: process.memoryUsage().rss, processUptimeSeconds: process.uptime(),
+        announcement: state.announcement, announcements: state.announcements }); return;
+    }
+    if (request.method === 'GET' && target.pathname === '/admin/api/usage' && meter) {
+      const page = Number(target.searchParams.get('page') || '1');
+      const view = target.searchParams.get('view') || 'user';
+      if (!Number.isSafeInteger(page) || page < 1 || page > 100000 ||
+          !['user', 'computer'].includes(view) || target.searchParams.has('user') ||
+          target.searchParams.has('computer')) {
+        adminReply(response, 400, { error: 'Invalid usage query' }); return;
+      }
+      adminReply(response, 200, await usageReport(database.pool, page, view)); return;
+    }
+    const diagnosticSource = target.searchParams.get('source') || 'usage';
+    if (target.pathname.startsWith('/admin/api/usage-diagnostics') && !['usage', 'account-cleanup'].includes(diagnosticSource)) {
+      adminReply(response, 400, { error: 'Invalid diagnostic source' }); return;
+    }
+    if (diagnostics && target.pathname === '/admin/api/usage-diagnostics') {
+      if (request.method === 'GET') adminReply(response, 200, await diagnostics.read(diagnosticSource));
+      else if (request.method === 'DELETE') adminReply(response, 200, await diagnostics.clear(diagnosticSource));
+      else adminReply(response, 405, { error: 'Unsupported diagnostic request' });
+      return;
+    }
+    if (diagnostics && target.pathname === '/admin/api/usage-diagnostics/drain') {
+      if (request.method === 'POST') adminReply(response, 200, await diagnostics.drain(diagnosticSource));
+      else adminReply(response, 405, { error: 'Unsupported diagnostic request' });
+      return;
+    }
+    if (!['PUT', 'DELETE'].includes(request.method || '') || request.headers['content-type'] !== 'application/json' ||
+        request.headers['x-code-relax-admin'] !== '1') { adminReply(response, 405, { error: 'Unsupported admin request' }); return; }
+    try {
+      const body = request.method === 'DELETE' ? {} : JSON.parse(await readBody(request, MAX_ADMIN_REQUEST_BYTES));
+      if (target.pathname === '/admin/api/settings' && request.method === 'PUT') {
+        const state = await adminState.setMaxRelaySessions(body.maxRelaySessions);
+        log({ event: 'admin-relay-limit-updated', maxRelaySessions: state.maxRelaySessions });
+      } else if (target.pathname === '/admin/api/announcements' && request.method === 'PUT') {
+        const state = await adminState.createAnnouncement(body.title, body.message, body.publish === true);
+        if (body.publish === true) {
+          broadcastAnnouncement(state.announcement);
+          log({ event: 'admin-announcement-published', announcementId: state.announcement.id });
+        } else log({ event: 'admin-announcement-draft-created', announcementId: state.announcements[0].id });
+      } else if (target.pathname.startsWith('/admin/api/announcements/')) {
+        const parts = target.pathname.slice('/admin/api/announcements/'.length).split('/');
+        const id = parts[0];
+        if (!/^[\w-]{16,128}$/.test(id)) { adminReply(response, 404, { error: 'Admin route not found' }); return; }
+        if (parts.length === 1 && request.method === 'PUT') {
+          await adminState.updateDraft(id, body.title, body.message);
+          log({ event: 'admin-announcement-draft-updated', announcementId: id });
+        } else if (parts.length === 1 && request.method === 'DELETE') {
+          await adminState.deleteAnnouncement(id);
+          log({ event: 'admin-announcement-deleted', announcementId: id });
+        } else if (parts.length === 2 && parts[1] === 'publish' && request.method === 'PUT') {
+          const state = await adminState.publishDraft(id, body.title, body.message);
+          broadcastAnnouncement(state.announcement);
+          log({ event: 'admin-announcement-published', announcementId: id });
+        } else if (parts.length === 2 && parts[1] === 'withdraw' && request.method === 'PUT') {
+          const state = await adminState.withdraw(id);
+          broadcastAnnouncement(state.announcement);
+          log({ event: 'admin-announcement-withdrawn', announcementId: id });
+        } else { adminReply(response, 404, { error: 'Admin route not found' }); return; }
+      } else { adminReply(response, 404, { error: 'Admin route not found' }); return; }
+      adminReply(response, 200, { ok: true });
+    } catch (error) { adminReply(response, 400, { error: error.message }); }
+  }
+  function broadcastAnnouncement(announcement) {
+    for (const room of rooms.values()) {
+      for (const observer of room.observers.values()) send(observer.ws, { type: 'announcement', announcement });
+      for (const connection of room.connections.values()) send(connection.ws, { type: 'announcement', announcement });
+    }
+  }
+  function releaseRelay(connection) {
+    if (!connection?.relayAdmitted) return;
+    connection.relayAdmitted = false; activeRelaySessions = Math.max(0, activeRelaySessions - 1);
+  }
+  function admitRelay(connection, room) {
+    if (connection.relayAdmitted || connection.relayExempt) return true;
+    if (connection.capacityExempt) {
+      connection.relayExempt = true;
+      log({ event: 'relay-capacity-exempt', device: room.id }); return true;
+    }
+    const limit = adminState.read().maxRelaySessions;
+    if (activeRelaySessions >= limit) {
+      log({ event: 'relay-capacity-rejected', device: room.id, activeRelaySessions, maxRelaySessions: limit }); return false;
+    }
+    connection.relayAdmitted = true; activeRelaySessions++;
+    log({ event: 'relay-capacity-admitted', device: room.id, activeRelaySessions, maxRelaySessions: limit }); return true;
+  }
+  const wss = new WebSocketServer({ noServer: true, maxPayload, perMessageDeflate: {
+    serverNoContextTakeover: true, clientNoContextTakeover: true,
+    threshold: 1024, concurrencyLimit: 4, zlibDeflateOptions: { level: 3 },
+  } });
+  let admissionStart = Date.now(), admissions = 0;
+  server.on('upgrade', (request, socket, head) => {
+    if (request.url !== '/relay' || (request.headers.origin && request.headers.origin !== 'null' && !nativeOrigins.includes(request.headers.origin))) {
+      log({ event: 'upgrade-rejected', reason: request.url !== '/relay' ? 'path' : 'origin' });
+      socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n'); return;
+    }
+    if (Date.now() - admissionStart >= 60000) { admissionStart = Date.now(); admissions = 0; }
+    if (wss.clients.size >= maxConnections || ++admissions > 240) {
+      socket.end('HTTP/1.1 429 Too Many Requests\r\nConnection: close\r\n\r\n'); return;
+    }
+    wss.handleUpgrade(request, socket, head, ws => wss.emit('connection', ws));
+  });
+  wss.on('connection', ws => {
+    let role, room, session, clientId, alive = true;
+    let accountConnection;
+    function invalidateAccountConnection() {
+      if (role === 'client' && room?.connections.get(clientId)?.ws === ws) {
+        releaseRelay(room.connections.get(clientId));
+        room.connections.delete(clientId);
+        // Detach also closes the workstation RTC peer; closing only the
+        // phone's signaling socket would leave the direct data path alive.
+        if (room.host) send(room.host, { type: 'detach', session });
+      } else if (role === 'file-client' && room?.uploadClients.get(session)?.ws === ws) {
+        room.uploadClients.delete(session);
+        if (room.uploadHost) send(room.uploadHost, { type: 'file-close', session });
+      }
+      ws.close(4431, 'Account session invalid');
+    }
+    const authTimer = setTimeout(() => ws.close(1008, 'Authentication timeout'), 5000);
+    ws.on('pong', () => { alive = true; });
+    const heartbeat = setInterval(() => {
+      sampleInboundQueue();
+      if (!alive) ws.terminate(); else { alive = false; ws.ping(); }
+    }, 30000);
+    const fail = (code = 4401, reason = 'Device authorization rejected') => ws.close(code, reason);
+    const queueClientMessage = (connection, message, pause = 0) => {
+      const bytes = Buffer.byteLength(JSON.stringify(message));
+      connection.queuedBytes = (connection.queuedBytes || 0) + bytes;
+      if (connection.queuedBytes > 40 * 1024 * 1024) {
+        connection.ws.close(1013, 'Receiver too slow'); return;
+      }
+      connection.outbound = (connection.outbound || Promise.resolve()).then(async () => {
+        if (pause > 0) await new Promise(resolve => setTimeout(resolve, pause));
+        connection.queuedBytes -= bytes;
+        send(connection.ws, message);
+      }).catch(() => connection.ws.close(1011, 'Relay delivery failed'));
+    };
+    ws.on('error', () => {}); // close owns routing cleanup.
+    ws.on('close', (code, reason) => {
+      log({ event: 'closed', role: role || 'unauthenticated', device: room?.id, code, reason: reason.toString() });
+      clearTimeout(authTimer); clearInterval(heartbeat);
+      accountConnection?.dispose();
+      if (role === 'host' && room?.host === ws) {
+        for (const task of room.usageTasks?.values() || []) {
+          void meter?.lost(task).catch(error => log({ event: 'usage-error', message: error.message }));
+        }
+        room.usageTasks?.clear(); room.usageArms?.clear();
+        room.host = undefined; room.hostName = undefined; room.lanCandidates = [];
+        room.uploadHost?.close(4410, 'Computer offline');
+        for (const client of room.uploadClients?.values() || []) client.ws.close(code === 4432 ? 4432 : 4410, code === 4432 ? 'Computer inbound queue limit exceeded' : 'Computer offline');
+        for (const observer of room.observers.values()) send(observer.ws, { type: 'observing', online: false });
+        if (!room.durable) rooms.delete(room.id);
+        for (const connection of room.connections.values()) connection.ws.close(
+          code === 4432 ? 4432 : 4410,
+          code === 4432 ? 'Computer inbound queue limit exceeded' : 'Computer offline; authorization retained');
+      } else if (role === 'client' && room?.connections.get(clientId)?.ws === ws) {
+        const connection = room.connections.get(clientId);
+        releaseRelay(connection);
+        room.connections.delete(clientId);
+        if (room.host) send(room.host, { type: 'detach', session });
+      } else if (role === 'observer' && room?.observers.get(clientId)?.ws === ws) {
+        room.observers.delete(clientId);
+      } else if (role === 'file-host' && room?.uploadHost === ws) {
+        room.uploadHost = undefined;
+        for (const client of room.uploadClients?.values() || []) client.ws.close(code === 4432 ? 4432 : 4410, code === 4432 ? 'File receiver inbound queue limit exceeded' : 'File receiver offline');
+      } else if (role === 'file-client' && room?.uploadClients?.get(session)?.ws === ws) {
+        room.uploadClients.delete(session);
+        if (room.uploadHost) send(room.uploadHost, { type: 'file-close', session });
+      }
+    });
+    let messageTail = Promise.resolve();
+    // Include the in-flight message: async database work must not permit an
+    // unbounded chain of closures retaining incoming payloads.
+    let pendingMessages = 0, pendingBytes = 0;
+    const maxPendingMessages = 128, maxPendingBytes = 16 * 1024 * 1024;
+    let sampleStarted = Date.now(), peakMessages = 0, peakBytes = 0, maxWaitMs = 0, receivedMessages = 0;
+    function sampleInboundQueue() {
+      const now = Date.now();
+      if (now - sampleStarted < 60000) return;
+      // Summarize only intervals with an actual backlog; never log payloads or credentials.
+      if (peakMessages > 1) log({ event: 'inbound-queue-sample', role: role || 'unauthenticated',
+        windowMs: now - sampleStarted, receivedMessages, peakMessages, peakBytes, maxWaitMs,
+        pendingMessages, pendingBytes });
+      sampleStarted = now; peakMessages = pendingMessages; peakBytes = pendingBytes;
+      maxWaitMs = 0; receivedMessages = 0;
+    }
+    ws.on('message', (bytes, binary) => {
+      if (ws.readyState !== ws.OPEN) return;
+      const size = bytes.length;
+      if (pendingMessages >= maxPendingMessages || pendingBytes + size > maxPendingBytes) {
+        log({ event: 'inbound-queue-limit', role: role || 'unauthenticated',
+          pendingMessages, pendingBytes, incomingBytes: size, maxWaitMs });
+        ws.close(4432, 'Inbound queue limit exceeded');
+        return;
+      }
+      pendingMessages++; pendingBytes += size;
+      receivedMessages++;
+      peakMessages = Math.max(peakMessages, pendingMessages); peakBytes = Math.max(peakBytes, pendingBytes);
+      const enqueuedAt = Date.now();
+      messageTail = messageTail.then(async () => {
+      try {
+        maxWaitMs = Math.max(maxWaitMs, Date.now() - enqueuedAt);
+        if (ws.readyState !== ws.OPEN) return;
+        if (accountConnection && !accountConnection.valid()) return;
+        if (binary) {
+          if (role === 'file-host' && room.uploadHost === ws) {
+            const frame = parseFileBytes(bytes);
+            const client = room.uploadClients.get(frame.session);
+            if (!client || client.ws.readyState !== ws.OPEN) return;
+            if (client.ws.bufferedAmount > 1024 * 1024) return client.ws.close(1013, 'File receiver too slow');
+            client.ws.send(frame.data); return;
+          }
+          if (role === 'file-client' && room.uploadClients?.get(session)?.ws === ws) {
+            if (room.uploadHost?.readyState !== ws.OPEN) return fail(4410, 'File receiver offline');
+            if (room.uploadHost.bufferedAmount > 1024 * 1024) return fail(1013, 'File receiver too slow');
+            room.uploadHost.send(routedFileBytes(session, bytes)); return;
+          }
+          return fail(1008, 'Invalid binary frame');
+        }
+        const message = decode(bytes, binary);
+        if (!role) {
+          let userId;
+          if (!['host', 'file-host', 'observe'].includes(message.type) &&
+              !(['pair', 'resume'].includes(message.type) && message.management === true)) {
+            if (!['pair', 'resume', 'observe', 'file-client'].includes(message.type)) return fail();
+            if (!accounts || !validSecret(message.accountToken)) return fail(4431, 'Account login required');
+            accountConnection = accountSockets.track(message.accountToken, invalidateAccountConnection);
+            try {
+              const user = await accounts.current(message.accountToken);
+              if (!accountConnection.activate(user.expiresAt)) return;
+              userId = user.id;
+            }
+            catch { return fail(4431, 'Account session invalid'); }
+            if (ws.readyState !== ws.OPEN) return;
+            if (cancelledAccountIds.has(userId)) return fail(4431, 'Account cancelled');
+          }
+          if (message.type === 'file-host') {
+            room = rooms.get(message.deviceId);
+            if (!room?.host || room.status !== 'active' || !matches(message.deviceSecret, room.hostHash)) return fail();
+            role = 'file-host'; clearTimeout(authTimer);
+            room.uploadClients ||= new Map();
+            room.uploadHost?.close(4409, 'File receiver replaced');
+            room.uploadHost = ws;
+            send(ws, { type: 'file-host-ready' }); return;
+          }
+          if (message.type === 'file-client') {
+            room = rooms.get(message.room);
+            const client = room?.clients.find(item => item.id === message.clientId);
+            if (!room?.host || !room.uploadHost || room.status !== 'active' || !client ||
+                !matches(message.credential, client.hash)) return fail();
+            room.uploadClients ||= new Map();
+            if (!['upload', 'download'].includes(message.purpose)) return fail(1008, 'Invalid file purpose');
+            const same = [...room.uploadClients.values()].filter(item => item.clientId === message.clientId && item.purpose === message.purpose);
+            const all = [...rooms.values()].flatMap(item => [...(item.uploadClients?.values() || [])]);
+            if (same.length >= (message.purpose === 'upload' ? 1 : 3) ||
+                all.length >= 8 || (message.purpose === 'upload' && all.filter(item => item.purpose === 'upload').length >= 2)) {
+              return fail(4429, 'Too many file transfers');
+            }
+            role = 'file-client'; clientId = message.clientId; session = randomUUID(); clearTimeout(authTimer);
+            room.uploadClients.set(session, { ws, session, clientId, userId, purpose: message.purpose });
+            send(room.uploadHost, { type: 'file-open', session, purpose: message.purpose }); return;
+          }
+          if (message.type === 'host') {
+            const durable = message.deviceId !== undefined;
+            if (durable && (!validId(message.deviceId) || !validSecret(message.deviceSecret))) return fail();
+            if (!durable && stateFile) return fail(4406, 'Device protocol upgrade required');
+            let lanCandidates, hostName;
+            try {
+              lanCandidates = normalizeLanCandidates(message.lanCandidates);
+              hostName = normalizeHostName(message.hostName);
+            }
+            catch { return fail(1008, 'Invalid LAN candidates'); }
+            room = durable ? rooms.get(message.deviceId) : undefined;
+            if (!room) {
+              if (!durable && !matches(message.key, hostHash)) return fail();
+              room = await registerRoom(durable ? message.deviceId : randomUUID(), durable, message.deviceSecret);
+              if (ws.readyState !== ws.OPEN) return;
+            }
+            if (durable && (room.status !== 'active' || !matches(message.deviceSecret, room.hostHash))) return fail();
+            const oldHost = room.host;
+            room.observers ||= new Map();
+            if (oldHost && oldHost !== ws) {
+              for (const task of room.usageTasks?.values() || []) {
+                try { await meter?.lost(task); } catch (error) { log({ event: 'usage-error', message: error.message }); }
+              }
+              room.usageTasks?.clear(); room.usageArms?.clear();
+            }
+            room.host = ws; room.hostName = hostName; room.lanCandidates = lanCandidates;
+            room.usageTasks ||= new Map(); room.usageArms ||= new Map();
+            if (oldHost && oldHost !== ws) room.uploadHost?.close(4409, 'Computer connection replaced');
+            room.p2pProbe = message.p2pProbe === 1; room.p2pProbeRepeat = message.p2pProbeRepeat === true;
+            role = 'host'; clearTimeout(authTimer);
+            if (oldHost && oldHost !== ws) {
+              oldHost.close(4409, 'Computer connection replaced');
+              for (const connection of room.connections.values()) connection.ws.close(4410, 'Computer reconnecting');
+            }
+            for (const observer of room.observers.values()) {
+              send(observer.ws, { type: 'observing', online: true });
+              send(observer.ws, { type: 'computer-info', hostName: room.hostName });
+              send(observer.ws, { type: 'lan-candidates', candidates: room.lanCandidates });
+            }
+            const invite = room.clients.length ? {} : invitation(room);
+            send(ws, { type: 'registered', protocolVersion: 7, room: room.id, paired: room.clients.length > 0,
+              clientCount: room.clients.length, clients: room.clients, revision: room.revision, ...invite }); return;
+          }
+          room = rooms.get(message.room);
+          if (!room || room.status !== 'active') return fail();
+          let credential;
+          if (message.type === 'pair' && !room.pairingInProgress && room.pairingHash && Date.now() < room.expires && matches(message.code, room.pairingHash)) {
+            if (!room.host) return fail(4410, 'Computer offline; authorization retained');
+            credential = message.credential || secret();
+            clientId = message.clientId || (!room.durable ? randomUUID() : undefined);
+            if (!validSecret(credential) || !validId(clientId)) return fail();
+            const existing = room.clients.find(client => client.id === clientId);
+            if (!existing && room.clients.length >= maxClientsPerHost) return fail(4429, 'Mobile device limit reached');
+            const now = new Date().toISOString();
+            const client = { id: clientId, hash: digest(credential), createdAt: existing?.createdAt || now, updatedAt: now };
+            room.pairingInProgress = true;
+            try {
+              await commit(room, current => ({ clients: [...current.clients.filter(item => item.id !== clientId), client], revision: current.revision + 1 }));
+              room.pairingHash = undefined;
+            } finally { room.pairingInProgress = false; }
+            if (!room.host) return fail(4410, 'Computer offline; authorization retained');
+            send(room.host, { type: 'authorization-changed', clients: room.clients, revision: room.revision });
+          } else {
+            clientId = message.clientId;
+            const client = room.clients.find(item => item.id === clientId) ||
+              (!room.durable && !clientId ? room.clients.find(item => matches(message.credential, item.hash)) : undefined);
+            if (client) clientId = client.id;
+            if (!['resume', 'pair', 'observe'].includes(message.type) || !client || !matches(message.credential, client.hash)) {
+            return fail(message.type === 'pair' ? 4408 : 4401, message.type === 'pair' ? 'Pairing code expired or used' : 'Device authorization rejected');
+            }
+          }
+          if (ws.readyState !== ws.OPEN) return;
+          if (accountConnection && !accountConnection.valid()) return;
+          if (cancelledAccountIds.has(userId)) return fail(4431, 'Account cancelled');
+          if (message.type === 'observe') {
+            role = 'observer'; clearTimeout(authTimer); room.observers ||= new Map();
+            const oldObserver = room.observers.get(clientId);
+            if (oldObserver?.ws && oldObserver.ws !== ws) oldObserver.ws.close(4409, 'Metadata connection replaced by same identity');
+            room.observers.set(clientId, { ws, userId });
+            send(ws, { type: 'observing', online: Boolean(room.host) });
+            send(ws, { type: 'debug-permissions', enabled: debugAllowed(debugAllowlist, room.id, room.clients.find(client => client.id === clientId)) });
+            const announcement = adminState.read().announcement;
+            if (announcement) send(ws, { type: 'announcement', announcement });
+            if (room.hostName) send(ws, { type: 'computer-info', hostName: room.hostName });
+            if (room.lanCandidates?.length) send(ws, { type: 'lan-candidates', candidates: room.lanCandidates });
+            if (room.officialComputer) send(ws, { type: 'official-computer', computer: room.officialComputer });
+            return;
+          }
+          if (!room.host) return fail(4410, 'Computer offline; authorization retained');
+          const oldConnection = room.connections.get(clientId);
+          role = 'client'; clearTimeout(authTimer); session = randomUUID();
+          if (oldConnection?.ws && oldConnection.ws !== ws) {
+            releaseRelay(oldConnection);
+            send(room.host, { type: 'detach', session: oldConnection.session });
+            oldConnection.ws.close(4409, 'Phone connection replaced by same identity');
+          }
+          room.connections.set(clientId, { ws, session, p2pProbe: Boolean(userId) && room.p2pProbe && message.p2pProbe === 1,
+            userId,
+            repeat: room.p2pProbeRepeat, signals: 0, probeStarted: 0, outbound: Promise.resolve(), queuedBytes: 0,
+            relayAdmitted: false, relayExempt: false,
+            capacityExempt: debugAllowed(debugAllowlist, room.id, room.clients.find(client => client.id === clientId)) });
+          send(ws, { type: 'paired', protocolVersion: 7, room: room.id, clientId, revision: room.revision, ...(credential ? { credential } : {}) });
+          send(ws, { type: 'computer-info', hostName: room.hostName });
+          if (room.lanCandidates?.length) send(ws, { type: 'lan-candidates', candidates: room.lanCandidates });
+          const announcement = adminState.read().announcement;
+          if (announcement) send(ws, { type: 'announcement', announcement });
+          send(room.host, { type: 'attach', session, clientId, p2pProbe: room.connections.get(clientId).p2pProbe ? 1 : 0 }); return;
+        }
+        if (role === 'host') {
+          if (room.host !== ws) return;
+          if (meter && ['usage-arm', 'usage-message', 'usage-cancel', 'usage-turn', 'usage-observer-lost'].includes(message.type)) {
+            if (message.type === 'usage-observer-lost') {
+              for (const task of room.usageTasks.values()) {
+                try { await meter.lost(task); } catch (error) { log({ event: 'usage-error', message: error.message }); }
+              }
+              room.usageTasks.clear();
+              return;
+            }
+            const armKey = `${message.session}:${message.requestId}`;
+            const connection = [...room.connections.values()].find(item => item.session === message.session);
+            if (message.type === 'usage-arm') {
+              if (!connection?.userId || !Number.isSafeInteger(message.requestId) || message.requestId < 1 ||
+                  (message.threadId !== null && (!plainText(message.threadId, 128, false)))) {
+                diagnostics?.record('usage', 'arm-rejected', !connection?.userId ? 'account-missing' : 'invalid-request');
+                return;
+              }
+              for (const [key, arm] of room.usageArms) if (Date.now() - arm.at > 120000) room.usageArms.delete(key);
+              if (room.usageArms.size >= 256) return;
+              room.usageArms.set(armKey, { userId: connection.userId,
+                clientId: [...room.connections.entries()].find(([, item]) => item === connection)?.[0],
+                session: message.session, at: Date.now() });
+              return;
+            }
+            if (message.type === 'usage-cancel') {
+              room.usageArms.delete(armKey); return;
+            }
+            if (message.type === 'usage-message') {
+              const arm = room.usageArms.get(armKey);
+              room.usageArms.delete(armKey);
+              if (!arm || Date.now() - arm.at > 120000 || !plainText(message.messageKey, 128, false)) {
+                diagnostics?.record('usage', 'message-rejected', !arm ? 'arm-missing' : 'expired-or-invalid');
+                return;
+              }
+              try {
+                await meter.action(arm, room.id, arm.clientId, 'message', message.messageKey);
+                if (['start', 'steer'].includes(message.turnKind) &&
+                    plainText(message.threadId, 80, false) && plainText(message.turnId, 80, false)) {
+                  const key = `${message.threadId}:${message.turnId}`;
+                  if (key.length <= 128) {
+                    const counted = await meter.action(arm, room.id, arm.clientId, 'turn', key);
+                    if (counted && message.turnKind === 'steer') diagnostics?.record('usage', 'turn-recovered', 'steer');
+                    if (!room.usageTasks.has(key) && message.observerReady === true && message.completed !== true &&
+                        (message.turnKind === 'start' || message.active === true)) {
+                      const task = await meter.turnOrigin(room.id, key);
+                      if (task) {
+                        await meter.pulse(task, true, room.id, task.clientId, counted ? key : randomUUID());
+                        room.usageTasks.set(key, task);
+                      }
+                    }
+                  }
+                }
+              } catch (error) { diagnostics?.record('usage', 'message-error', 'database'); log({ event: 'usage-error', message: error.message }); }
+              return;
+            }
+            if (!['turn/started', 'turn/completed', 'heartbeat', 'resume', 'inactive'].includes(message.method) ||
+                !plainText(message.threadId, 80, false) || !plainText(message.turnId, 80, false)) return;
+            const key = `${message.threadId}:${message.turnId}`;
+            if (key.length > 128) return;
+            let task = room.usageTasks.get(key);
+            try {
+              if (message.method === 'resume' && !task) {
+                task = await meter.turnOrigin(room.id, key);
+                if (!task) { diagnostics?.record('usage', 'turn-resume', 'origin-missing'); return; }
+                await meter.pulse(task, true, room.id, task.clientId, `${key}:${randomUUID()}`);
+                diagnostics?.record('usage', 'turn-resume', 'confirmed');
+                room.usageTasks.set(key, task);
+              } else if (task && message.method === 'heartbeat') await meter.pulse(task, true, room.id, task.clientId);
+              else if (task && message.method === 'inactive') {
+                await meter.lost(task);
+                room.usageTasks.delete(key);
+              }
+              else if (task && message.method === 'turn/completed') {
+                await meter.pulse(task, false, room.id, task.clientId);
+                room.usageTasks.delete(key);
+              }
+            } catch (error) { log({ event: 'usage-error', message: error.message }); }
+            return;
+          }
+          if (message.type === 'lan-candidates') {
+            room.lanCandidates = normalizeLanCandidates(message.candidates);
+            for (const connection of room.connections.values()) send(connection.ws, { type: 'lan-candidates', candidates: room.lanCandidates });
+            for (const observer of room.observers.values()) send(observer.ws, { type: 'lan-candidates', candidates: room.lanCandidates });
+            return;
+          }
+          if (message.type === 'status') {
+            send(ws, { type: 'status', commandId: message.commandId, paired: room.clients.length > 0, clientCount: room.clients.length, revision: room.revision }); return;
+          }
+          if (message.type === 'pair-code') {
+            send(ws, { type: 'pair-code', commandId: message.commandId, room: room.id, ...invitation(room) }); return;
+          }
+          if (message.type === 'revoke') {
+            await commit(room, current => ({ clients: [], revision: current.revision + 1 }));
+            room.pairingHash = undefined;
+            for (const connection of room.connections.values()) {
+              releaseRelay(connection);
+              send(ws, { type: 'detach', session: connection.session });
+              connection.ws.close(4401, 'Device authorization revoked');
+            }
+            room.connections.clear();
+            for (const client of room.uploadClients?.values() || []) client.ws.close(4401, 'Device authorization revoked');
+            room.uploadClients?.clear();
+            for (const observer of room.observers.values()) observer.ws.close(4401, 'Device authorization revoked');
+            room.observers.clear();
+            send(ws, { type: 'authorization-changed', clients: [], revision: room.revision });
+            send(ws, { type: 'revoked', commandId: message.commandId, room: room.id }); return;
+          }
+          const connection = [...room.connections.values()].find(item => item.session === message.session);
+          if (!connection) return; // Late frames from an ended session.
+          if (message.type === 'data' && typeof message.payload === 'string') queueClientMessage(connection, { type: 'data', payload: message.payload });
+          else if (message.type === 'ready') queueClientMessage(connection, { type: 'ready', p2pProbe: connection.p2pProbe ? 1 : 0,
+            p2pProbeRepeat: connection.p2pProbe && connection.repeat });
+          else if (message.type === 'p2p-probe' && connection.p2pProbe && validProbeSignal(message)) {
+            const diagnostic = message.purpose === 'diagnostic';
+            if (message.purpose && !diagnostic) return fail(1008, 'Invalid probe purpose');
+            if ((diagnostic ? connection.diagnosticProbeId : connection.probeId) !== message.probeId) return;
+            if (++connection[diagnostic ? 'diagnosticSignals' : 'signals'] > 150) return fail(1008, 'Probe signal limit');
+            send(connection.ws, { ...message, session: undefined });
+          }
+          else if (message.type === 'detach') connection.ws.close(1011, 'Local Bridge unavailable');
+          else fail();
+        } else if (role === 'file-host' && room.uploadHost === ws) {
+          const client = room.uploadClients.get(message.session);
+          if (!client) return;
+          if (message.type === 'file-frame' && typeof message.payload === 'string' && message.payload.length <= 512 * 1024) {
+            if (client.ws.bufferedAmount > 1024 * 1024) return client.ws.close(1013, 'File receiver too slow');
+            send(client.ws, { type: 'file-frame', payload: message.payload });
+          } else if (message.type === 'file-close') client.ws.close(1011, 'File receiver unavailable');
+          else fail(1008, 'Invalid file frame');
+        } else if (role === 'file-client' && room.uploadClients?.get(session)?.ws === ws) {
+          if (message.type !== 'file-frame' || typeof message.payload !== 'string' || message.payload.length > 512 * 1024) return fail(1008, 'Invalid file frame');
+          if (room.uploadHost?.bufferedAmount > 1024 * 1024) return fail(1013, 'File receiver too slow');
+          send(room.uploadHost, { type: 'file-frame', session, payload: message.payload });
+        } else if (role === 'observer' && room.observers.get(clientId)?.ws === ws && message.type === 'official-computer') {
+          const computer = normalizeOfficialComputer(message);
+          await commit(room, { officialComputer: computer });
+          send(ws, { type: 'official-computer-saved', computer });
+        } else if (role === 'client' && room.connections.get(clientId)?.ws === ws && message.type === 'p2p-probe') {
+          const connection = room.connections.get(clientId);
+          if (!connection.p2pProbe || !validProbeSignal(message)) return fail(1008, 'Invalid probe signal');
+          const diagnostic = message.purpose === 'diagnostic';
+          if (message.purpose && !diagnostic) return fail(1008, 'Invalid probe purpose');
+          const idField = diagnostic ? 'diagnosticProbeId' : 'probeId';
+          const signalsField = diagnostic ? 'diagnosticSignals' : 'signals';
+          const startedField = diagnostic ? 'diagnosticProbeStarted' : 'probeStarted';
+          if (message.kind === 'start') {
+            if (connection[idField] && (!connection.repeat || Date.now() - connection[startedField] < 2000)) {
+              send(ws, { type: 'p2p-probe', version: 1, probeId: message.probeId,
+                ...(diagnostic ? { purpose: 'diagnostic' } : {}), kind: 'close' }); return;
+            }
+            connection[idField] = message.probeId; connection[signalsField] = 0; connection[startedField] = Date.now();
+          }
+          if (connection[idField] !== message.probeId) return;
+          if (++connection[signalsField] > 150) return fail(1008, 'Probe signal limit');
+          send(room.host, { ...message, session });
+          if (diagnostic && message.kind === 'close') connection.diagnosticProbeId = undefined;
+        } else if (room.connections.get(clientId)?.ws === ws && message.type === 'p2p-route' && message.direct === 1) {
+          releaseRelay(room.connections.get(clientId));
+        } else if (room.connections.get(clientId)?.ws === ws && message.type === 'data' && typeof message.payload === 'string') {
+          const connection = room.connections.get(clientId);
+          if (!connection.userId && !managementPayload(message.payload)) return fail(4431, 'Account login required');
+          if (connection.userId && !controlPayload(message.payload) && !admitRelay(connection, room)) {
+            ws.close(4428, 'Server busy'); return;
+          }
+          send(room.host, { type: 'data', session, payload: message.payload });
+        } else fail();
+      } catch (error) { log({ event: 'request-error', role, message: 'Relay operation failed' }); ws.close(1011, 'Relay operation failed'); }
+      finally { pendingMessages--; pendingBytes -= size; }
+      }).catch(() => ws.close(1011, 'Relay operation failed'));
+    });
+  });
+  await new Promise((resolve, reject) => { server.once('error', reject); server.listen(port, '127.0.0.1', resolve); });
+  listenUrl = `ws://127.0.0.1:${server.address().port}/relay`;
+  return {
+    url: listenUrl, hostKey,
+    async close() {
+      for (const ws of wss.clients) ws.terminate();
+      await new Promise(resolve => wss.close(resolve));
+      await new Promise(resolve => server.close(resolve));
+      if (database) await database.close();
+    },
+  };
+}
+
+function relayPublicAddress(value) {
+  const parsed = new URL(value);
+  if (!['ws:', 'wss:'].includes(parsed.protocol) || parsed.pathname !== '/relay' || parsed.search || parsed.hash || parsed.username || parsed.password) {
+    throw new Error('Invalid public relay URL');
+  }
+  return parsed.href;
+}
+
+function pairingHeaders(type, body) {
+  return { 'Content-Type': type, 'Content-Length': Buffer.byteLength(body), 'Cache-Control': 'no-store',
+    'X-Content-Type-Options': 'nosniff', 'Referrer-Policy': 'no-referrer',
+    'Content-Security-Policy': "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'" };
+}
+
+function pairingPage({ deepLink = '', expires = 0, appDownloadUrl = '', expired = false }) {
+  const open = deepLink ? `<a class="primary" href="${escapeHtml(deepLink)}">打开 Code Relax</a>` : '';
+  const download = appDownloadUrl ? `<a href="${escapeHtml(appDownloadUrl)}">安装 Code Relax</a>` : '<p>尚未安装时，请通过当前私测渠道安装 App，再重新打开此页面。</p>';
+  const text = expired ? '这条设备配对邀请已过期或已经使用，请在电脑重新生成。'
+    : `这是一次性设备配对邀请，有效期至 ${escapeHtml(new Date(expires).toLocaleString('zh-CN', { timeZone: 'Asia/Shanghai' }))}。每台移动设备只需配对一次。`;
+  return `<!doctype html><html lang="zh-CN"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Code Relax 配对</title><style>body{margin:0;background:#0d1210;color:#eef4f0;font:16px system-ui,sans-serif}main{max-width:520px;margin:12vh auto;padding:32px}h1{font-size:28px}p{color:#aab7af;line-height:1.7}a{display:block;margin-top:16px;padding:14px 18px;border:1px solid #496257;border-radius:12px;color:#dce9e1;text-align:center;text-decoration:none}.primary{background:#1f5a40;border-color:#367c5b}</style><main><h1>Code Relax</h1><p>${text}</p>${expired ? '' : open + download}</main></html>`;
+}
+
+function escapeHtml(value) {
+  return String(value).replace(/[&<>"']/g, character => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[character]);
+}
+
+function normalizeLanCandidates(value) {
+  if (value === undefined) return [];
+  if (!Array.isArray(value) || value.length > 8) throw new Error('Invalid LAN candidates');
+  return value.map(candidate => {
+    const endpoint = new URL(candidate?.address || '');
+    if (endpoint.protocol !== 'http:' || !endpoint.port || endpoint.pathname !== '/' || endpoint.search || endpoint.hash ||
+        endpoint.username || endpoint.password || !privateIpv4(endpoint.hostname) ||
+        !['wifi', 'ethernet'].includes(candidate.networkType) || !plainLabel(candidate.networkName) || !plainLabel(candidate.interfaceName)) {
+      throw new Error('Invalid LAN candidate');
+    }
+    return { address: endpoint.href.replace(/\/$/, ''), networkType: candidate.networkType,
+      networkName: candidate.networkName.trim(), interfaceName: candidate.interfaceName.trim() };
+  });
+}
+
+function normalizeHostName(value) {
+  if (!plainLabel(value)) throw new Error('Invalid host name');
+  return value.trim();
+}
+
+function normalizeOfficialComputer(value) {
+  if (!plainText(value.environmentId, 256, false) || !plainText(value.name ?? '', 80, true) ||
+      !plainText(value.hostname ?? '', 80, true)) throw new Error('Invalid official computer');
+  return { environmentId: value.environmentId.trim(), name: (value.name || '').trim(),
+    hostname: (value.hostname || '').trim(), updatedAt: new Date().toISOString() };
+}
+
+function privateIpv4(value) {
+  const parts = value.split('.').map(Number);
+  if (parts.length !== 4 || parts.some(part => !Number.isInteger(part) || part < 0 || part > 255)) return false;
+  return parts[0] === 10 || (parts[0] === 192 && parts[1] === 168) ||
+    (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31) ||
+    (parts[0] === 100 && parts[1] >= 64 && parts[1] <= 127);
+}
+
+function plainLabel(value) {
+  return typeof value === 'string' && value.trim().length > 0 && value.trim().length <= 80 && !/[\u0000-\u001f\u007f]/.test(value);
+}
+
+
+function plainText(value, limit, empty) {
+  return typeof value === 'string' && (empty || value.trim().length > 0) && value.trim().length <= limit && !/[\u0000-\u001f\u007f]/.test(value);
+}
+
+// Device-authorized management must not become an anonymous chat tunnel.
+function managementPayload(value) {
+  try {
+    const message = JSON.parse(value);
+    if (['unsubscribe', 'cancel', 'response-ack'].includes(message.type)) return true;
+    if (message.type === 'subscribe') return message.path === '/api/shared-recovery/events';
+    if (message.type !== 'request') return false;
+    const method = message.method || 'GET';
+    if (method === 'GET') return ['/api/health', '/api/official-remote/status'].includes(message.path) ||
+      /^\/api\/threads\/[0-9a-f-]{28,64}\/model-changes(?:\?|$)/i.test(message.path);
+    return method === 'POST' && message.path === '/api/official-remote/pairing';
+  } catch { return false; }
+}
+
+function controlPayload(value) {
+  try {
+    const message = JSON.parse(value);
+    if (message.type === 'unsubscribe') return true;
+    return ['request', 'subscribe'].includes(message.type) && typeof message.path === 'string' &&
+      (message.path === '/api/health' || message.path.startsWith('/api/shared-recovery'));
+  } catch { return false; }
+}
+
+function readBody(request, limit) {
+  return new Promise((resolve, reject) => {
+    let value = '';
+    request.setEncoding('utf8');
+    request.on('data', chunk => {
+      value += chunk;
+      if (Buffer.byteLength(value) > limit) { reject(new Error('Admin request too large')); request.destroy(); }
+    });
+    request.on('end', () => resolve(value)); request.on('error', reject);
+  });
+}