@walkhi/code-relax 0.1.0-beta.27 → 0.1.0-beta.29

package/dist/src/self-relay/lifecycle.mjs

@@ -33,14 +33,14 @@ async function loadConfig(stateRoot) {
       (pairing.protocol === 'http:' && pairing.hostname !== '127.0.0.1')) throw new Error('self-relay-config.json 的 pairingUrl 必须是 HTTPS /pair 地址。');
   return { ...config, url: resolved, pairingUrl: pairing.href };
 }
-export async function selfRelay(command, stateRoot) {
+export async function selfRelay(command, stateRoot, details) {
   const session = readRecord(path.join(stateRoot, 'bridge-session.json'));
   if (!session) {
     if (command === 'relay-status') return { running: false, displayText: '桌面服务未运行。' };
     if (command === 'relay-stop') return { stopped: true, displayText: '中继连接已停止。' };
     throw new Error('桌面服务尚未运行，请先执行 relax start。');
   }
-  return controlRequest(session, 'POST', command);
+  return controlRequest(session, 'POST', command, details);
 }
 
 async function createRelayRuntime(stateRoot) {
@@ -186,6 +186,22 @@ async function createRelayRuntime(stateRoot) {
     await connector.command('revoke'); paired = false; clientCount = 0; attachedCount = 0; qrPath = undefined; expiresAt = 0;
     return { ...status(), displayText: '全部移动设备授权已撤销；重新添加请调用 relax pair --json。' };
   }
+  async function invite(command, details) {
+    if (!online || closing) throw new Error('中继尚未连接，请先执行 relax start。');
+    const result = await connector.command(command, command === 'invite-create' ? { expires: details.expires } : command === 'invite-revoke' ? { id: details.id } : {});
+    if (command === 'invite-create') {
+      const link = new URL(config.pairingUrl);
+      link.searchParams.set('invite', result.code);
+      const inviteQrPath = path.join(stateRoot, `self-relay-long-qr-${result.id}.png`);
+      try { await QRCode.toFile(inviteQrPath, link.href, { width: 640, margin: 3 }); }
+      catch (error) { throw new Error(`二维码保存失败：${error.message}。邀请 ID：${result.id}；请执行 relax pair-revoke ${result.id} 废止。`); }
+      return { invitationId: result.id, deviceId: result.room, expiresAt: new Date(result.expires).toISOString(), qrPath: inviteQrPath,
+        displayText: `长期配对邀请已创建。邀请 ID：${result.id}\n截止：${new Date(result.expires).toISOString()}` };
+    }
+    if (command === 'invite-list') return { invitations: result.invitations,
+      displayText: result.invitations.length ? result.invitations.map(item => `${item.id}  ${new Date(item.expires).toISOString()}${Date.now() >= item.expires ? '（已过期）' : ''}`).join('\n') : '本工作站没有长期配对邀请。' };
+    return { invitationId: result.id, revoked: result.revoked, displayText: '长期邀请已废止；已配对手机的独立授权保持不变。' };
+  }
   async function refreshLan() {
     if (!online || closing) throw new Error('中继尚未连接，未更新局域网候选。');
     await refreshHealth();
@@ -201,14 +217,14 @@ async function createRelayRuntime(stateRoot) {
     }
     return status();
   };
-  try { await connect(); return { status, inspect, pair, revoke, refreshLan, shutdown }; }
+  try { await connect(); return { status, inspect, pair, revoke, invite, refreshLan, shutdown }; }
   catch (error) { await shutdown(); throw error; }
 }
 
 export function createRelayManager(stateRoot) {
   let current;
   let operation = Promise.resolve();
-  const run = command => {
+  const run = (command, details = {}) => {
     const next = operation.then(async () => {
       if (command === 'relay-status') return current ? current.inspect() : { running: false, displayText: '中继连接未运行。' };
       if (command === 'relay-stop') {
@@ -216,10 +232,12 @@ export function createRelayManager(stateRoot) {
         return { stopped: true, displayText: '中继连接已停止；桌面服务和 Codex 内核保持运行。' };
       }
       if (!current) {
+        if (command.startsWith('invite-')) throw new Error('请先执行 relax start 连接中继。');
         if (command === 'relay-revoke') throw new Error('请先启动中继连接，再撤销移动端授权。');
         current = await createRelayRuntime(stateRoot);
         return command === 'relay-pair' && current.status().relayConnected ? current.pair() : current.status();
       }
+      if (command.startsWith('invite-')) return current.invite(command, details);
       if (command === 'relay-revoke') return current.revoke();
       if (command === 'relay-pair' || (current.status().relayConnected && !current.status().paired && !current.status().qrPath)) return current.pair();
       if (command === 'relay-start' && current.status().relayConnected) return current.refreshLan();

package/dist/src/self-relay/long-pairing.mjs

@@ -0,0 +1,40 @@
+import fs from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { validId } from './device-store.mjs';
+import { digest, matches, secret } from './wire.mjs';
+
+// Operator-owned file, separate from device state. Only hashes are retained here.
+export function longPairing(file) {
+  function read() {
+    if (!file || !fs.existsSync(file)) return [];
+    const data = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (data.version !== 1 || !Array.isArray(data.invitations) || data.invitations.some(item =>
+      !validId(item.id) || !validId(item.room) || !/^[a-f0-9]{64}$/.test(item.hash) ||
+      !Number.isSafeInteger(item.expires))) throw new Error('Invalid long pairing invitations');
+    return data.invitations;
+  }
+  function write(invitations) {
+    if (!file) throw new Error('Long pairing file is not configured');
+    const temporary = `${file}.${randomUUID()}.tmp`;
+    try {
+      fs.writeFileSync(temporary, JSON.stringify({ version: 1, invitations }), { mode: 0o600, flag: 'wx' });
+      fs.renameSync(temporary, file);
+    } finally { fs.rmSync(temporary, { force: true }); }
+  }
+  return {
+    list: () => read().map(({ hash, ...item }) => item),
+    find: code => read().find(item => Date.now() < item.expires && matches(code, item.hash)),
+    create(room, expires) {
+      if (!validId(room) || !Number.isSafeInteger(expires) || expires <= Date.now()) throw new Error('Invalid invitation room or expiry');
+      const invitations = read(), code = secret();
+      const item = { id: randomUUID(), room, expires, hash: digest(code) };
+      write([...invitations, item]);
+      return { id: item.id, room, expires, code };
+    },
+    revoke(id) {
+      const invitations = read();
+      if (!invitations.some(item => item.id === id)) throw new Error('Invitation not found');
+      write(invitations.filter(item => item.id !== id));
+    },
+  };
+}

package/dist/src/self-relay/p2p-probe.mjs

@@ -1,123 +1,152 @@
-import { randomUUID } from 'node:crypto';
-import P2pDiagnostics from '../../shared/p2p-diagnostics.cjs';
-import P2pDataFramer from '../../shared/p2p-data-channel.cjs';
-
-const PROBE_UDP_PORT_RANGE = Object.freeze({ begin: 42000, end: 42031 });
-const HIGH_WATER = 1024 * 1024;
-const LOW_WATER = 512 * 1024;
-const MAX_QUEUED = 16 * 1024 * 1024;
-
-export async function createP2pProbe({ signal, report = () => {}, onData = () => {}, iceServers = [] }) {
-  if (!validProbeIceServers(iceServers)) throw new Error('Invalid probe STUN configuration');
-  const { default: rtc } = await import('node-datachannel');
-  const peer = new rtc.PeerConnection('code-relax-probe', {
-    iceServers,
-    maxMessageSize: 65536,
-    portRangeBegin: PROBE_UDP_PORT_RANGE.begin,
-    portRangeEnd: PROBE_UDP_PORT_RANGE.end
-  });
-  const diagnostic = new P2pDiagnostics();
-  const framer = new P2pDataFramer();
-  const dataPrefix = randomUUID().replaceAll('-', '');
-  let channel, closed = false, answered = false, candidates = [], verified = false, remoteDirect = false;
-  let pingReceived = false, pongReceived = false, dataSerial = 0, queuedBytes = 0;
-  const outbound = [];
-  const nonce = randomUUID();
-  const timer = setTimeout(() => finish(verified ? 'closed' : 'timeout'), 15000);
-  function finish(state) {
-    if (closed) return;
-    closed = true; clearTimeout(timer); candidates = []; queuedBytes = 0; outbound.length = 0; framer.reset();
-    const summary = diagnostic.snapshot(state);
-    channel?.close(); peer.close(); report(state, summary);
-  }
-  function verify() {
-    if (verified || !pingReceived || !pongReceived) return;
-    verified = true; clearTimeout(timer);
-    report(remoteDirect ? 'direct' : 'verified', diagnostic.snapshot('verified'));
-    pump();
-  }
-  function pump() {
-    if (!verified || !remoteDirect || closed || !channel?.isOpen()) return;
-    try {
-      while (outbound.length && channel.bufferedAmount() < HIGH_WATER) {
-        const item = outbound[0], frame = framer.frame(item);
-        if (!channel.sendMessage(frame)) return;
-        if (framer.commit(item)) { outbound.shift(); queuedBytes -= item.bytes; }
-      }
-    } catch { diagnostic.error = 'channel'; finish('failed'); }
-  }
-  function sendData(payload) {
-    if (!verified || !remoteDirect || closed || !channel?.isOpen()) return false;
-    let item;
-    try { item = framer.create(payload, `${dataPrefix}-${++dataSerial}`); }
-    catch { return false; }
-    if (queuedBytes + item.bytes > MAX_QUEUED) return false;
-    outbound.push(item); queuedBytes += item.bytes; pump(); return true;
-  }
-  peer.onIceStateChange(state => { if (!closed) diagnostic.ice = state; });
-  peer.onGatheringStateChange(state => { if (!closed) diagnostic.gathering = state; });
-  peer.onStateChange(state => { if (!closed && (state === 'failed' || state === 'closed')) { diagnostic.error = 'peer'; finish('failed'); } });
-  peer.onLocalDescription((sdp, type) => { if (!closed) { diagnostic.offer = type === 'offer'; signal({ kind: type, sdp, iceServers, direct: 1 }); } });
-  peer.onLocalCandidate((candidate, mid) => { if (!closed) { diagnostic.candidate('local', candidate); signal({ kind: 'candidate', candidate, mid }); } });
-  channel = peer.createDataChannel('code-relax-probe-v1');
-  channel.setBufferedAmountLowThreshold(LOW_WATER);
-  channel.onBufferedAmountLow(pump);
-  channel.onOpen(() => { if (!closed) { diagnostic.open = true; channel.sendMessage(JSON.stringify({ type: 'ping', nonce })); } });
-  channel.onError(() => { if (!closed) diagnostic.error = 'channel'; finish('failed'); });
-  channel.onClosed(() => finish('closed'));
-  channel.onMessage(value => {
-    try {
-      if (closed || typeof value !== 'string' || value.length > 65536) throw new Error('Invalid P2P frame');
-      const message = JSON.parse(value);
-      const data = framer.accept(message);
-      if (data.handled) {
-        if (!verified || !remoteDirect) throw new Error('P2P transport not verified');
-        if (data.complete) onData(data.payload);
-        return;
-      }
-      if (message.type === 'ping' && /^[\w-]{16,128}$/.test(message.nonce)) {
-        diagnostic.ping = true; pingReceived = true;
-        channel.sendMessage(JSON.stringify({ type: 'pong', nonce: message.nonce }));
-      } else if (message.type === 'pong' && message.nonce === nonce) {
-        diagnostic.pong = true; pongReceived = true;
-      } else throw new Error('Invalid P2P response');
-      verify();
-    } catch { diagnostic.error = 'frame'; finish('failed'); }
-  });
-  return {
-    receive(message) {
-      if (closed) return;
-      if (message.kind === 'answer' && !answered) {
-        try { peer.setRemoteDescription(message.sdp, 'answer'); }
-        catch { diagnostic.error = 'description'; finish('failed'); return; }
-        answered = true; remoteDirect = message.direct === 1; diagnostic.answer = true;
-        for (const item of candidates) peer.addRemoteCandidate(item.candidate, item.mid);
-        candidates = [];
-      } else if (message.kind === 'candidate') {
-        diagnostic.candidate('remote', message.candidate);
-        if (answered) peer.addRemoteCandidate(message.candidate, message.mid);
-        else if (candidates.length < 64) candidates.push(message);
-        else finish('failed');
-      } else if (message.kind === 'close') finish('closed');
-      else finish('failed');
-    },
-    send: sendData,
-    close() { finish('closed'); }
-  };
-}
-
-export function validProbeSignal(value) {
-  if (!value || value.version !== 1 || !/^[\w-]{16,128}$/.test(value.probeId || '')) return false;
-  if (['start', 'close'].includes(value.kind)) return true;
-  if (['offer', 'answer'].includes(value.kind)) return typeof value.sdp === 'string' && value.sdp.length <= 65536 &&
-    (value.direct === undefined || value.direct === 0 || value.direct === 1) &&
-    (value.iceServers === undefined || validProbeIceServers(value.iceServers));
-  if (value.kind === 'candidate') return typeof value.candidate === 'string' && value.candidate.length <= 2048 &&
-    typeof value.mid === 'string' && value.mid.length <= 64;
-  return false;
-}
-
-export function validProbeIceServers(value) {
-  return Array.isArray(value) && value.length <= 4 && value.every(item =>
-    typeof item === 'string' && /^stun:[a-zA-Z0-9.-]+:[0-9]{1,5}$/.test(item) && Number(item.split(':').at(-1)) <= 65535);
-}
+import { randomUUID } from 'node:crypto';
+import P2pDiagnostics from '../../shared/p2p-diagnostics.cjs';
+import P2pDataFramer from '../../shared/p2p-data-channel.cjs';
+import FileChannel from '../../shared/p2p-file-channel.cjs';
+
+const PROBE_UDP_PORT_RANGE = Object.freeze({ begin: 42000, end: 42031 });
+const HIGH_WATER = 1024 * 1024;
+const LOW_WATER = 512 * 1024;
+const MAX_QUEUED = 16 * 1024 * 1024;
+
+export async function createP2pProbe({ signal, report = () => {}, onData = () => {}, onFileChannel, iceServers = [] }) {
+  if (!validProbeIceServers(iceServers)) throw new Error('Invalid probe STUN configuration');
+  const { default: rtc } = await import('node-datachannel');
+  const peer = new rtc.PeerConnection('code-relax-probe', {
+    iceServers,
+    maxMessageSize: 65536,
+    portRangeBegin: PROBE_UDP_PORT_RANGE.begin,
+    portRangeEnd: PROBE_UDP_PORT_RANGE.end
+  });
+  const diagnostic = new P2pDiagnostics();
+  const framer = new P2pDataFramer();
+  const dataPrefix = randomUUID().replaceAll('-', '');
+  let channel, closed = false, answered = false, candidates = [], verified = false, remoteDirect = false;
+  let pingReceived = false, pongReceived = false, dataSerial = 0, queuedBytes = 0;
+  const outbound = [];
+  const files = new Map();
+  const nonce = randomUUID();
+  const timer = setTimeout(() => finish(verified ? 'closed' : 'timeout'), 15000);
+  function finish(state) {
+    if (closed) return;
+    closed = true; clearTimeout(timer); candidates = []; queuedBytes = 0; outbound.length = 0; framer.reset();
+    for (const socket of files.values()) socket.close(1011);
+    files.clear();
+    const summary = diagnostic.snapshot(state);
+    channel?.close(); peer.close(); report(state, summary);
+  }
+  function verify() {
+    if (verified || !pingReceived || !pongReceived) return;
+    verified = true; clearTimeout(timer);
+    report(remoteDirect ? 'direct' : 'verified', diagnostic.snapshot('verified'));
+    pump();
+    for (const raw of files.keys()) activateFile(raw);
+  }
+  function activateFile(raw) {
+    const socket = files.get(raw);
+    if (!socket || socket.readyState !== 0 || !raw.isOpen() || !verified || !remoteDirect || closed) return;
+    socket.opened();
+    raw.sendMessage('{"type":"rtc-file-ready"}');
+  }
+  peer.onDataChannel(raw => {
+    if (closed || !onFileChannel || raw.getLabel() !== 'code-relax-file-v1' || files.size >= 4) { raw.close(); return; }
+    const socket = new FileChannel({ buffered: () => raw.bufferedAmount(),
+      send: value => typeof value === 'string' ? raw.sendMessage(value) : raw.sendMessageBinary(value), close: () => raw.close() });
+    files.set(raw, socket);
+    socket.addEventListener('close', () => files.delete(raw));
+    try { onFileChannel(socket); }
+    catch { socket.close(1011); return; }
+    raw.setBufferedAmountLowThreshold(128 * 1024);
+    raw.onBufferedAmountLow(() => socket.pump());
+    raw.onOpen(() => activateFile(raw));
+    raw.onClosed(() => socket.close(1011)); raw.onError(() => socket.close(1011));
+    raw.onMessage(value => {
+      if (!verified || !remoteDirect || closed || socket.readyState !== 1) { socket.close(1008); return; }
+      socket.receive(value);
+    });
+    activateFile(raw);
+  });
+  function pump() {
+    if (!verified || !remoteDirect || closed || !channel?.isOpen()) return;
+    try {
+      while (outbound.length && channel.bufferedAmount() < HIGH_WATER) {
+        const item = outbound[0], frame = framer.frame(item);
+        if (!channel.sendMessage(frame)) return;
+        if (framer.commit(item)) { outbound.shift(); queuedBytes -= item.bytes; }
+      }
+    } catch { diagnostic.error = 'channel'; finish('failed'); }
+  }
+  function sendData(payload) {
+    if (!verified || !remoteDirect || closed || !channel?.isOpen()) return false;
+    let item;
+    try { item = framer.create(payload, `${dataPrefix}-${++dataSerial}`); }
+    catch { return false; }
+    if (queuedBytes + item.bytes > MAX_QUEUED) return false;
+    outbound.push(item); queuedBytes += item.bytes; pump(); return true;
+  }
+  peer.onIceStateChange(state => { if (!closed) diagnostic.ice = state; });
+  peer.onGatheringStateChange(state => { if (!closed) diagnostic.gathering = state; });
+  peer.onStateChange(state => { if (!closed && (state === 'failed' || state === 'closed')) { diagnostic.error = 'peer'; finish('failed'); } });
+  peer.onLocalDescription((sdp, type) => { if (!closed) { diagnostic.offer = type === 'offer'; signal({ kind: type, sdp, iceServers, direct: 1 }); } });
+  peer.onLocalCandidate((candidate, mid) => { if (!closed) { diagnostic.candidate('local', candidate); signal({ kind: 'candidate', candidate, mid }); } });
+  channel = peer.createDataChannel('code-relax-probe-v1');
+  channel.setBufferedAmountLowThreshold(LOW_WATER);
+  channel.onBufferedAmountLow(pump);
+  channel.onOpen(() => { if (!closed) { diagnostic.open = true; channel.sendMessage(JSON.stringify({ type: 'ping', nonce })); } });
+  channel.onError(() => { if (!closed) diagnostic.error = 'channel'; finish('failed'); });
+  channel.onClosed(() => finish('closed'));
+  channel.onMessage(value => {
+    try {
+      if (closed || typeof value !== 'string' || value.length > 65536) throw new Error('Invalid P2P frame');
+      const message = JSON.parse(value);
+      const data = framer.accept(message);
+      if (data.handled) {
+        if (!verified || !remoteDirect) throw new Error('P2P transport not verified');
+        if (data.complete) onData(data.payload);
+        return;
+      }
+      if (message.type === 'ping' && /^[\w-]{16,128}$/.test(message.nonce)) {
+        diagnostic.ping = true; pingReceived = true;
+        channel.sendMessage(JSON.stringify({ type: 'pong', nonce: message.nonce }));
+      } else if (message.type === 'pong' && message.nonce === nonce) {
+        diagnostic.pong = true; pongReceived = true;
+      } else throw new Error('Invalid P2P response');
+      verify();
+    } catch { diagnostic.error = 'frame'; finish('failed'); }
+  });
+  return {
+    receive(message) {
+      if (closed) return;
+      if (message.kind === 'answer' && !answered) {
+        try { peer.setRemoteDescription(message.sdp, 'answer'); }
+        catch { diagnostic.error = 'description'; finish('failed'); return; }
+        answered = true; remoteDirect = message.direct === 1; diagnostic.answer = true;
+        for (const item of candidates) peer.addRemoteCandidate(item.candidate, item.mid);
+        candidates = [];
+      } else if (message.kind === 'candidate') {
+        diagnostic.candidate('remote', message.candidate);
+        if (answered) peer.addRemoteCandidate(message.candidate, message.mid);
+        else if (candidates.length < 64) candidates.push(message);
+        else finish('failed');
+      } else if (message.kind === 'close') finish('closed');
+      else finish('failed');
+    },
+    send: sendData,
+    close() { finish('closed'); }
+  };
+}
+
+export function validProbeSignal(value) {
+  if (!value || value.version !== 1 || !/^[\w-]{16,128}$/.test(value.probeId || '')) return false;
+  if (['start', 'close'].includes(value.kind)) return true;
+  if (['offer', 'answer'].includes(value.kind)) return typeof value.sdp === 'string' && value.sdp.length <= 65536 &&
+    (value.direct === undefined || value.direct === 0 || value.direct === 1) &&
+    (value.iceServers === undefined || validProbeIceServers(value.iceServers));
+  if (value.kind === 'candidate') return typeof value.candidate === 'string' && value.candidate.length <= 2048 &&
+    typeof value.mid === 'string' && value.mid.length <= 64;
+  return false;
+}
+
+export function validProbeIceServers(value) {
+  return Array.isArray(value) && value.length <= 4 && value.every(item =>
+    typeof item === 'string' && /^stun:[a-zA-Z0-9.-]+:[0-9]{1,5}$/.test(item) && Number(item.split(':').at(-1)) <= 65535);
+}

package/dist/src/self-relay/rtc-file-bridge.mjs

@@ -0,0 +1,41 @@
+import WebSocket from 'ws';
+import { loopbackUrl } from './wire.mjs';
+
+// The RTC peer belongs to an authenticated relay chat session. Its teardown
+// closes this channel on logout, expiry, revocation or signaling disconnect.
+export function attachRtcFile(channel, connection, authorized) {
+  let local, authenticated = false;
+  const timer = setTimeout(() => channel.close(1008), 5000);
+  channel.addEventListener('close', () => { clearTimeout(timer); local?.terminate(); });
+  channel.onmessage = event => {
+    try {
+      if (!authorized()) throw new Error('File authorization expired');
+      if (!local) {
+        if (typeof event.data !== 'string') throw new Error('File authentication required');
+        const auth = JSON.parse(event.data);
+        if (auth.type !== 'auth' || !['upload', 'download'].includes(auth.purpose)) throw new Error('Invalid file purpose');
+        const url = new URL(connection.url); url.pathname = '/api/file-transfer';
+        loopbackUrl(url.href, '/api/file-transfer');
+        local = new WebSocket(url.href, { maxPayload: 512 * 1024, perMessageDeflate: false });
+        local.on('open', () => {
+          if (!authorized() || channel.readyState !== 1) { local.terminate(); return; }
+          local.send(JSON.stringify({ type: 'auth', token: connection.token, purpose: auth.purpose }));
+        });
+        local.on('message', (bytes, binary) => {
+          if (!authorized() || channel.readyState !== 1) { channel.close(4401); return; }
+          try {
+            if (!authenticated) {
+              if (binary || JSON.parse(bytes.toString()).type !== 'ready') throw new Error('File authentication failed');
+              authenticated = true; clearTimeout(timer);
+            }
+            channel.send(binary ? bytes : bytes.toString());
+          } catch { channel.close(1011); }
+        });
+        local.on('close', () => channel.close(1011)); local.on('error', () => channel.close(1011));
+        return;
+      }
+      if (!authenticated || local.readyState !== WebSocket.OPEN || local.bufferedAmount > 1024 * 1024) throw new Error('File channel unavailable');
+      local.send(typeof event.data === 'string' ? event.data : Buffer.from(event.data));
+    } catch { channel.close(1008); }
+  };
+}