@walkhi/code-relax 0.1.0-beta.29 → 0.1.0-beta.30

package/README.md

@@ -1,4 +1,6 @@
-# Code Relax 桌面服务（Windows 私测包）
+# Code Relax 工作站服务
+
+Windows 与 Mac 的统一 npm 分发源码已就绪：主包按操作系统和 CPU 自动安装对应原生组件，普通用户无需自行编译。此结构尚未发布，线上 beta.29 仍为 Windows 包；Mac 原生包需在测试机编译验收。开发者使用 `npm run pack:release -- --output <新的输出目录>` 生成统一主包与当前平台组件包，详见 [npm 分发](../docs/npm-distribution.md)。
 
 桌面服务让 HarmonyOS 客户端控制 Windows 上的Codex 内核。当前要求 Windows x64、Node >=22.12，以及已登录的 Codex Desktop 配套内核或独立 Codex CLI；npm 包不包含 Node，也不修改官方程序文件。
 
@@ -19,13 +21,14 @@ npm i -g @walkhi/code-relax@beta --allow-scripts=@walkhi/code-relax --foreground
 ```powershell
 relax start           # 启动/复用桌面服务、Codex 内核和已配置的 Code Relax 中继
 relax pair            # 启动/复用服务并打开配对二维码
-relax doctor          # 集中查看服务、待启用内核更新、登录自启和最近恢复结果
+relax doctor          # 查看工作站是否正常及需要处理的问题
+relax diag        # 输出供客服或技术人员使用的详细诊断报告
 relax kernel-restart --confirm # 重启内核并启用已选更新，等待新内核就绪
 ```
 
 Codex 内核由官方 `codex app-server --listen ws://127.0.0.1:45839` 提供执行服务，Desktop 和桌面服务均可连接；它只监听回环地址。桌面服务独立报告内核健康、Desktop 接入和手机可写状态；Desktop 退出后，手机仍可操作内核中的任务。同一 thread 已被另一个实例持有时，手机只读且可重新检测。
 
-发现待启用内核更新时，手机“重启并更新”和 `relax kernel-restart --confirm` 复用同一受控停启流程：先验证候选，再停止旧内核，确认新内核协议就绪后恢复 Desktop，并按清单清理不再运行的旧版保留目录。手机工作站详情可确认让 Desktop 接入Codex 内核，独立进程逐步执行并保留桌面服务/中继连接，见[启用流程](../docs/shared-recovery.md)。本机恢复命令为 `relax desktop-recover --confirm`，查看恢复结果用 `relax doctor`。桌面服务状态匹配且健康时直接复用；未知进程占用 45831/45839 时拒绝接管。
+发现待启用内核更新时，手机“重启并更新”和 `relax kernel-restart --confirm` 复用同一受控停启流程：先验证候选，再停止旧内核，确认新内核协议就绪后恢复 Desktop，并按清单清理不再运行的旧版保留目录。手机工作站详情可确认让 Desktop 接入Codex 内核，独立进程逐步执行并保留桌面服务/中继连接，见[启用流程](../docs/shared-recovery.md)。本机恢复命令为 `relax desktop-recover --confirm`，查看恢复记录用 `relax diag`。桌面服务状态匹配且健康时直接复用；未知进程占用 45831/45839 时拒绝接管。
 
 Codex 内核通过隐藏控制台启动，使后续控制台子进程继承隐藏窗口。手机的项目、任务列表和新建任务均使用Codex 内核，不依赖 Desktop 工具管道；项目和任务 ID 保持原生值。
 
@@ -78,3 +81,9 @@ npm uninstall -g @walkhi/code-relax
 ## 发布边界
 
 registry 测试包使用 `@walkhi/code-relax@beta`，主 CLI 为 `relax`，并保留 `code-relax` 兼容入口。安装摘要通过 `--foreground-scripts` 显示，首次安装或启动链迁移时干净重启 Desktop，分别报告已安装与实际运行版本；登录启动使用当前用户任务计划。通信协议仍为 7。详细规则见 [npm 分发](../docs/npm-distribution.md)。
+
+### CLI 输出（2026-10-15）
+
+安装和启动成功后只显示结果与 `relax pair` 入口；配对成功显示二维码文件。`relax doctor` 报告工作站健康及实际问题，独立的 `relax diag` 默认用可读文本输出系统、Node、服务进程、逐项检查和 Desktop 接入排障记录；常规命令不再提供 `--detail`；`--json` 保留给安装器等现有程序调用。服务未运行或内核未就绪判为失败；未连接局域网只提示，不阻断中继使用。手机连通性不作为 CLI 检查项，doctor 不创建配对邀请。
+
+`doctor` 默认逐项说明安装文件、工作站服务和 Codex 内核的当前状态，问题集中给出处理方法。上次 Desktop 接入记录仅由 `diag` 读取，并明确标注排障用途；常规 `doctor` 不读取该记录，不参与当前健康判定，不拼接互相矛盾的阶段消息与最终错误。

package/dist/bin/codex-remote.mjs

@@ -1,29 +1,32 @@
 #!/usr/bin/env node
 import { phonePairingSteps, desktopSetupSteps, pairingDisplayText } from '../src/onboarding.mjs';
 import { lifecycle, readRecord, writeRecord } from '../src/service-lifecycle.mjs';
-import { runtimePaths } from '../src/platform/windows/runtime-paths.mjs';
-import * as host from '../src/platform/windows/service-host.mjs';
+import { runtimePaths } from '../src/platform/runtime-paths.mjs';
+import * as host from '../src/platform/service-host.mjs';
 import { installService, uninstallService, packageRoot } from '../src/service-install.mjs';
 import { installSkill, removeSkill, inspectSkill } from '../src/skill-install.mjs';
-import { doctor } from '../src/service-doctor.mjs';
+import { doctor, formatDoctorOutput } from '../src/service-doctor.mjs';
 import { launchDesktop } from '../src/desktop-launcher.mjs';
-import { desktopHost, removeDesktopShortcut, residentStartup, resolveStateRoot } from '../src/platform/windows/desktop-host.mjs';
+import { desktopHost, removeDesktopShortcut, residentStartup, resolveStateRoot } from '../src/platform/desktop-host.mjs';
 import { selfRelay } from '../src/self-relay/lifecycle.mjs';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
+import { executableKey } from '../src/platform/path-identity.mjs';
 import fs from 'node:fs';
 import { spawn } from 'node:child_process';
 import { setTimeout as delay } from 'node:timers/promises';
 import { requestRecovery, recoveryWarning } from '../src/shared-recovery.mjs';
-import { configureManagedEnvironment, clearManagedEnvironment } from '../src/platform/windows/user-environment.mjs';
-import { resolveCodexRuntime } from '../src/platform/windows/codex-runtime.mjs';
+import { configureManagedEnvironment, clearManagedEnvironment } from '../src/platform/user-environment.mjs';
+import { resolveCodexRuntime } from '../src/platform/codex-runtime.mjs';
 import { controlRequest } from '../src/service-control.mjs';
 import { processAlive } from '../src/background-process.mjs';
+import { prepareNativePackage } from '../src/platform/native-package.mjs';
 import { managedAppServerUrl } from '../src/managed-app-server.mjs';
 import { readDotsTasks } from '../src/dots-task-catalog.mjs';
+import { installDesktopHelper, desktopHelperStatus, removeDesktopHelper } from '../src/platform/windows/desktop-helper.mjs';
 
-const help = `Code Relax（Windows）
-用法：relax <命令> [--json]；下列命令均可用
+const help = `Code Relax（Windows / macOS）
+用法：relax <命令>
 常用指令：
   start   启动或复用桌面服务和 Codex 内核，并恢复已配置的 Code Relax 中继
   pair    启动或复用桌面服务，并打开一次性配对二维码
@@ -33,12 +36,17 @@ const help = `Code Relax（Windows）
   dots-tasks 读取当前 ChatGPT 账号的 Dots 委派任务与最近轮次状态
 维护指令：
   setup   部署并启动桌面服务、Codex 内核和登录自启动；安全配置 Desktop 后续接入
-  doctor  检查服务、内核更新、登录自启、最近恢复结果、网络和 Skill
+  setup --desktop-helper （Windows）同时安装受保护的桌面操作辅助服务，首次需要工作站 UAC 授权
+  desktop-helper-install （Windows）单独安装桌面操作辅助服务，保持现有桌面服务和 Codex 内核
+  desktop-helper-status （Windows）查看桌面操作辅助服务状态
+  desktop-helper-remove （Windows）移除桌面操作辅助服务，需要工作站 UAC 授权
+  doctor  简单检查工作站是否正常
+  diag 输出详细诊断报告，供客服或技术人员排查
   kernel-restart --confirm 重启 Codex 内核并启用已选更新；等待新内核就绪
   desktop-recover --confirm 重新打开 Desktop 并接入 Codex 内核；不强制重启已有内核
   uninstall 停止并移除固定目录服务和本包 Skill，清理自有 Desktop 环境变量，保留其他配置与附件
 默认监听 0.0.0.0，移动端与电脑需在同一受信任局域网。
---json 输出机器可读结果；统一二维码不含 LAN 地址、桌面服务凭据或中继地址。`;
+--json 仅供安装脚本等程序调用。`;
 
 function currentNodeExecutable() {
   const link = process.env.NVM_SYMLINK && path.join(process.env.NVM_SYMLINK, 'node.exe');
@@ -59,16 +67,25 @@ async function main() {
   const options = flags.filter(flag => flag !== '--json');
   const longPair = command === 'pair' && options.length === 2 && options[0] === '--expires';
   const revokeInvite = command === 'pair-revoke' && options.length === 1 && /^[\w-]{16,128}$/.test(options[0]);
-  if (!['kernel-restart', 'desktop-recover', 'setup', 'doctor', 'uninstall', 'start', 'pair', 'pair-list', 'pair-revoke', 'dots-tasks'].includes(command)
-    || (!longPair && !revokeInvite && (command === 'pair-revoke' || options.some(flag => !(['kernel-restart', 'desktop-recover'].includes(command) && flag === '--confirm'))))) {
+  if (!['kernel-restart', 'desktop-recover', 'setup', 'doctor', 'diag', 'uninstall', 'start', 'pair', 'pair-list', 'pair-revoke', 'dots-tasks', 'desktop-helper-install', 'desktop-helper-status', 'desktop-helper-remove'].includes(command)
+    || (!longPair && !revokeInvite && (command === 'pair-revoke' || options.some(flag => !((['kernel-restart', 'desktop-recover'].includes(command) && flag === '--confirm') || (command === 'setup' && flag === '--desktop-helper')))))) {
     throw new Error('无效命令或参数。使用 --help 查看用法。');
   }
   const inviteExpires = longPair ? Date.parse(options[1]) : undefined;
   if (longPair && (!/(Z|[+-]\d{2}:\d{2})$/.test(options[1]) || !Number.isSafeInteger(inviteExpires) || inviteExpires <= Date.now())) {
     throw new Error('截止时间必须在未来且含时区，例如 2026-11-01T00:00:00+08:00。');
   }
-  if (process.platform !== 'win32') throw new Error('当前被控端仅支持 Windows。');
+  if (!['win32', 'darwin'].includes(process.platform)) throw new Error('工作站目前支持 Windows 和 macOS。');
+  if (process.platform !== 'win32' && (command.startsWith('desktop-helper-') || options.includes('--desktop-helper')))
+    throw new Error('Mac 版不提供远程桌面画面、鼠标和键盘控制。');
+  if (command === 'desktop-recover' && desktopHost.desktopIntegration === false)
+    throw new Error('Mac 的 Codex Desktop 自动接入尚未支持。');
   const json = flags.includes('--json');
+  if (['desktop-helper-install', 'desktop-helper-status', 'desktop-helper-remove'].includes(command)) {
+    const result = command === 'desktop-helper-install' ? await installDesktopHelper() : command === 'desktop-helper-remove' ? await removeDesktopHelper() : await desktopHelperStatus();
+    console.log(json ? JSON.stringify(result) : result.removed ? '桌面操作辅助服务已移除。' : result.running ? '桌面操作辅助服务已就绪，手机可按需获取画面并确认点击。' : '桌面操作辅助服务尚未就绪，请运行 relax desktop-helper-install。');
+    return;
+  }
   if (command === 'dots-tasks') {
     const result = await readDotsTasks(managedAppServerUrl);
     const statuses = { completed: '完成', inProgress: '进行中', failed: '失败', interrupted: '已中断' };
@@ -83,7 +100,7 @@ async function main() {
   const installationPath = path.join(serviceRoot, 'installation.json');
   const [nodeMajor, nodeMinor] = process.versions.node.split('.').map(Number);
   const currentNodeSupported = nodeMajor > 22 || (nodeMajor === 22 && nodeMinor >= 12);
-  const installed = path.resolve(fileURLToPath(import.meta.url)).toLowerCase() === installedEntry.toLowerCase();
+  const installed = executableKey(fileURLToPath(import.meta.url)) === executableKey(installedEntry);
   const installation = readRecord(installationPath);
   if (installation?.nodeExecutable && !fs.existsSync(installation.nodeExecutable) && currentNodeSupported
     && ['start', 'pair', 'doctor'].includes(command)) {
@@ -166,19 +183,21 @@ async function main() {
     if (longPair) await selfRelay('relay-start', stateRoot);
     const result = await selfRelay(longPair ? 'invite-create' : 'relay-pair', stateRoot, longPair ? { expires: inviteExpires } : undefined);
     if (!json && result.qrPath) {
-      const viewer = spawn('explorer.exe', [result.qrPath], { detached: true, stdio: 'ignore', windowsHide: true });
+      const viewer = spawn(process.platform === 'darwin' ? '/usr/bin/open' : 'explorer.exe', [result.qrPath], { detached: true, stdio: 'ignore', windowsHide: true });
+      viewer.once('error', error => console.error(`无法打开二维码：${error.message}`));
       viewer.unref();
     }
-    console.log(json ? JSON.stringify(result) : `${result.displayText}\n二维码：${result.qrPath}`);
+    console.log(json ? JSON.stringify(result) : `配对二维码已生成。\n${result.displayText}\n二维码文件：${result.qrPath}`);
     return;
   }
-  if (command === 'doctor') {
-    const result = await doctor({ paths, host, service, ensureAutostart });
-    console.log(json ? JSON.stringify(result) : result.checks.map(item => `[${item.status}] ${item.message}`).join('\n'));
+  if (command === 'doctor' || command === 'diag') {
+    const result = await doctor({ paths, host, service, ensureAutostart, diagnostics: command === 'diag' });
+    console.log(json ? JSON.stringify(result) : formatDoctorOutput(result, command === 'diag'));
     if (!result.ready) process.exitCode = 1;
     return;
   }
   if (command === 'uninstall') {
+    const desktopHelper = process.platform === 'win32' ? await removeDesktopHelper() : { removed: false, supported: false };
     const skill = inspectSkill();
     let environment;
     const result = await uninstallService(paths, service, async () => {
@@ -188,14 +207,18 @@ async function main() {
       if (installation?.nodeExecutable) await residentStartup({ serviceRoot, nodeExecutable: installation.nodeExecutable }, 'disable');
     });
     result.environment = environment;
+    result.desktopHelper = desktopHelper;
     result.skill = skill.managed ? removeSkill() : { removed: false, message: '未移除自定义或未安装的 Skill。' };
-    result.message = environment?.preserved
-      ? '固定目录服务已卸载；检测到用户自定义的 CODEX_APP_SERVER_WS_URL，已保留。配置、附件和可能仍在执行任务的 app-server 也已保留；重启 Windows可结束该进程。npm 命令入口可再用 npm uninstall -g @walkhi/code-relax 移除。'
-      : '固定目录服务已卸载；Code Relax 设置的 app-server 环境变量已清理，其他配置、附件和可能仍在执行任务的 app-server 已保留；重启 Windows可结束该进程。npm 命令入口可再用 npm uninstall -g @walkhi/code-relax 移除。';
+    result.message = process.platform === 'darwin'
+      ? '固定目录服务已卸载；配置、附件、钥匙串凭据和可能仍在执行任务的 Codex 内核已保留。'
+      : environment?.preserved
+      ? '固定目录服务已卸载；检测到用户自定义的 CODEX_APP_SERVER_WS_URL，已保留。配置、附件和可能仍在执行任务的 app-server 也已保留；重启电脑可结束该进程。npm 命令入口可再用 npm uninstall -g @walkhi/code-relax 移除。'
+      : '固定目录服务已卸载；Code Relax 设置的 app-server 环境变量已清理，其他配置、附件和可能仍在执行任务的 app-server 已保留；重启电脑可结束该进程。npm 命令入口可再用 npm uninstall -g @walkhi/code-relax 移除。';
     console.log(json ? JSON.stringify(result) : `${result.message}\n${result.skill.message}`);
     return;
   }
   if (command === 'setup') {
+    prepareNativePackage(packageRoot(path.dirname(fileURLToPath(import.meta.url))));
     const [major, minor] = process.versions.node.split('.').map(Number);
     if (major < 22 || (major === 22 && minor < 12)) throw new Error('需要 Node >=22.12。');
     const physicalStateRoot = await resolveStateRoot(stateRoot);
@@ -209,7 +232,7 @@ async function main() {
     const hadInstalledService = fs.existsSync(path.join(serviceRoot, 'installation.json'));
     const previousInstallation = readRecord(path.join(serviceRoot, 'installation.json'));
     if (previousInstallation?.nodeExecutable) await removeDesktopShortcut({ serviceRoot, nodeExecutable: previousInstallation.nodeExecutable });
-    const desktopBeforeSetup = await desktopHost.inspect();
+    const desktopBeforeSetup = desktopHost.desktopIntegration === false ? { running: false, desktop: null } : await desktopHost.inspect();
     const runtime = await resolveCodexRuntime(physicalStateRoot, { refresh: true });
     const desktopNeedsAttach = desktopBeforeSetup.running && !await host.sharedServiceUrl();
     const previous = hadInstalledService ? await service.status() : { processRunning: false };
@@ -258,7 +281,7 @@ async function main() {
       throw new Error(bridge.managedAppServer?.error || '桌面服务已安装，但 Codex 内核未就绪；未写入 Desktop 环境变量。');
     }
     const environment = desktopBeforeSetup.desktop
-      ? await configureManagedEnvironment(physicalStateRoot) : { configured: false, reason: 'desktop-not-installed' };
+      ? await configureManagedEnvironment(physicalStateRoot) : { configured: false, reason: desktopHost.desktopIntegration === false ? 'desktop-integration-unsupported' : 'desktop-not-installed' };
     let managedAppServerMigrated = false;
     const managedAppServerMigration = {
       required: bridge.managedAppServer.launcherRestartRequired === true,
@@ -268,7 +291,7 @@ async function main() {
     let desktopRestarted = false;
     let desktopRestartReason = null;
     if (managedAppServerMigration.required) {
-      const desktopInfo = await desktopHost.inspect();
+      const desktopInfo = desktopHost.desktopIntegration === false ? { running: false } : await desktopHost.inspect();
       const desktopAttached = desktopInfo.running
         && (bridge.desktop?.attachedToManagedServer === true || Boolean(await host.sharedServiceUrl()));
       if (desktopAttached) await desktopHost.closeDesktop(desktopInfo.desktop);
@@ -314,31 +337,25 @@ async function main() {
       launcherRevision: bridge.managedAppServer.launcherRevision ?? null };
     installed.desktopRestarted = desktopRestarted;
     installed.desktopRestartReason = desktopRestartReason;
-    const migrationText = managedAppServerMigrated ? '已自动重建旧启动链的 app-server；安装前尚未完成的任务可能已中断。\n' : '';
-    const restartText = desktopRestarted
-      ? 'Codex Desktop 已干净重启并重新接入 Codex 内核。'
-      : desktopBeforeSetup.desktop ? 'Codex Desktop 使用同一 Codex 内核；移动端控制不依赖 Desktop 是否打开。'
-      : '使用独立 Codex CLI；无需安装 Codex Desktop。';
-    console.log(json ? JSON.stringify({ ...installed, nextSteps: desktopSetupSteps, displayText: `${migrationText}${desktopSetupSteps.join('\n')}\n${restartText}` }) : `桌面服务已安装：${installed.serviceRoot}\n使用已安装的 Node：${installed.nodeExecutable}\nCodex 内核已就绪；首次联网可能需要 Windows 防火墙授权。\n${migrationText}${desktopSetupSteps.join('\n')}\n${restartText}`);
+    if (options.includes('--desktop-helper')) installed.desktopHelper = await installDesktopHelper();
+    const migrationText = managedAppServerMigrated ? 'Codex 内核已更新并重启；请检查安装前正在进行的任务。\n' : '';
+    const displayText = `Code Relax ${installed.version} 安装成功。\n${migrationText}${desktopSetupSteps.join('\n')}`;
+    console.log(json ? JSON.stringify({ ...installed, nextSteps: desktopSetupSteps, displayText }) : displayText);
     return;
   }
   if (!json && command === 'start') console.log('正在检查电脑连接并准备桌面服务…');
   await ensureAutostart();
   const result = await service[command]();
   const { accessUrl, qrPath: _legacyQrPath, ...metadata } = result;
-  const notice = '本机服务检查通过，移动端连通性尚未验证。若电脑弹出 Node 网络访问提示，请先处理 Windows 防火墙授权，再用移动端连接。';
   let relay;
   if (fs.existsSync(path.join(stateRoot, 'self-relay-config.json'))) relay = await selfRelay('relay-status', stateRoot);
   const nextSteps = phonePairingSteps(metadata.transportMode, relay?.paired === true);
-  const displayText = pairingDisplayText(nextSteps, notice);
+  const displayText = pairingDisplayText(nextSteps);
   const output = { ...metadata, ...(relay ? { relayConnected: relay.relayConnected,
     paired: relay.paired, clientCount: relay.clientCount, ...(relay.qrPath ? { qrPath: relay.qrPath, expiresAt: relay.expiresAt } : {}) } : {}),
-    nextSteps, displayText, mode: 'lan', listenAddress: '0.0.0.0', address: new URL(accessUrl).host,
-    lanAccess: 'unverified', notice };
+    nextSteps, displayText, mode: 'lan', listenAddress: '0.0.0.0', address: new URL(accessUrl).host };
   if (json) console.log(JSON.stringify(output));
   else {
-    console.log('电脑连接检查通过 · 桌面服务已就绪');
-    console.log(`局域网模式：监听 0.0.0.0:${result.port}，连接地址 ${output.address}，PID ${result.pid}`);
     if (relay?.qrPath) console.log(`配对二维码：${relay.qrPath}`);
     console.log(displayText);
   }

package/dist/bin/manage-relay-admin.mjs

@@ -1,20 +1,20 @@
-#!/usr/bin/env node
-import fs from 'node:fs';
-import mysql from 'mysql2/promise';
-
-const path = process.env.RELAY_MYSQL_CONFIG_FILE;
-const action = process.argv[2];
-const email = (process.argv[3] || '').trim().toLowerCase();
-if (!path || !['--grant', '--revoke', '--list'].includes(action) ||
-    (action !== '--list' && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email))) {
-  throw new Error('Use --grant EMAIL, --revoke EMAIL or --list with RELAY_MYSQL_CONFIG_FILE');
-}
-const db = await mysql.createConnection({ ...JSON.parse(fs.readFileSync(path, 'utf8')),
-  dateStrings: true, timezone: 'Z', multipleStatements: false });
-try {
-  if (action === '--grant') await db.execute(`INSERT INTO relay_admin_emails (email,granted_at)
-    VALUES (?,UTC_TIMESTAMP(3)) ON DUPLICATE KEY UPDATE email=VALUES(email)`, [email]);
-  else if (action === '--revoke') await db.execute('DELETE FROM relay_admin_emails WHERE email=?', [email]);
-  const [rows] = await db.query('SELECT email FROM relay_admin_emails ORDER BY email');
-  console.log(JSON.stringify({ admins: rows.map(row => row.email) }));
-} finally { await db.end(); }
+#!/usr/bin/env node
+import fs from 'node:fs';
+import mysql from 'mysql2/promise';
+
+const path = process.env.RELAY_MYSQL_CONFIG_FILE;
+const action = process.argv[2];
+const email = (process.argv[3] || '').trim().toLowerCase();
+if (!path || !['--grant', '--revoke', '--list'].includes(action) ||
+    (action !== '--list' && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email))) {
+  throw new Error('Use --grant EMAIL, --revoke EMAIL or --list with RELAY_MYSQL_CONFIG_FILE');
+}
+const db = await mysql.createConnection({ ...JSON.parse(fs.readFileSync(path, 'utf8')),
+  dateStrings: true, timezone: 'Z', multipleStatements: false });
+try {
+  if (action === '--grant') await db.execute(`INSERT INTO relay_admin_emails (email,granted_at)
+    VALUES (?,UTC_TIMESTAMP(3)) ON DUPLICATE KEY UPDATE email=VALUES(email)`, [email]);
+  else if (action === '--revoke') await db.execute('DELETE FROM relay_admin_emails WHERE email=?', [email]);
+  const [rows] = await db.query('SELECT email FROM relay_admin_emails ORDER BY email');
+  console.log(JSON.stringify({ admins: rows.map(row => row.email) }));
+} finally { await db.end(); }

package/dist/bin/migrate-relay-db.mjs

@@ -1,109 +1,109 @@
-#!/usr/bin/env node
-import fs from 'node:fs';
-import { createHash } from 'node:crypto';
-import { fileURLToPath } from 'node:url';
-import mysql from 'mysql2/promise';
-import { relaySchemaVersions } from '../database/versions.mjs';
-import { deviceStore } from '../src/self-relay/device-store.mjs';
-import { relayAdminState } from '../src/self-relay/admin-state.mjs';
-
-const command = process.argv[2];
-if (!['--schema', '--import', '--check'].includes(command) || !process.env.RELAY_MYSQL_CONFIG_FILE) {
-  throw new Error('Use --schema, --import or --check with RELAY_MYSQL_CONFIG_FILE');
-}
-const config = JSON.parse(fs.readFileSync(process.env.RELAY_MYSQL_CONFIG_FILE, 'utf8'));
-const db = await mysql.createConnection({ ...config, dateStrings: true, timezone: 'Z', multipleStatements: false });
-const sqlTime = value => value.replace('T', ' ').replace(/Z$/, '');
-const migrations = relaySchemaVersions;
-try {
-  if (command === '--schema') {
-    const [existing] = await db.query("SHOW TABLES LIKE 'schema_migrations'");
-    const [applied] = existing.length ? await db.query('SELECT version, sha256 FROM schema_migrations') : [[]];
-    const known = new Map(applied.map(row => [row.version, row.sha256]));
-    if (known.size !== applied.length || [...known.keys()].some(version => !migrations.includes(version))) throw new Error('Unexpected schema version');
-    for (const version of migrations) {
-      const source = fs.readFileSync(fileURLToPath(new URL(`../database/${version}.sql`, import.meta.url)), 'utf8');
-      const sha256 = createHash('sha256').update(source).digest('hex');
-      if (known.has(version)) {
-        if (known.get(version) !== sha256) throw new Error(`Migration changed: ${version}`);
-        continue;
-      }
-      if (version !== migrations[0] && !known.has(migrations[migrations.indexOf(version) - 1])) throw new Error('Previous migration missing');
-      const statements = source.split('\n').filter(line => !line.trimStart().startsWith('--')).join('\n');
-      for (const statement of statements.split(';').map(item => item.trim()).filter(Boolean)) await db.query(statement);
-      await db.execute('INSERT INTO schema_migrations (version, sha256) VALUES (?,?)', [version, sha256]);
-      known.set(version, sha256);
-      console.log(JSON.stringify({ schema: version, sha256 }));
-    }
-  } else {
-    const [versions] = await db.query('SELECT version FROM schema_migrations');
-    if (!versions.some(row => row.version === '001_relay_core') || versions.some(row => !migrations.includes(row.version))) throw new Error('Unexpected schema version');
-    if (command === '--check') {
-      const names = ['computers', 'mobile_authorizations', 'official_computers', 'announcements', 'relay_settings', 'users', 'user_login_identities'];
-      if (versions.some(row => row.version === '002_email_accounts')) names.push('email_login_challenges', 'user_sessions', 'email_send_limits');
-      if (versions.some(row => row.version === '003_relay_usage')) names.push('relay_admin_emails', 'relay_usage_settings', 'relay_usage_totals', 'relay_usage_computer_totals', 'relay_usage_entitlements', 'relay_usage_budgets', 'relay_usage_computer_budgets', 'relay_usage_sessions');
-      if (versions.some(row => row.version === '004_relay_usage_actions')) names.push('relay_usage_actions');
-      if (versions.some(row => row.version === '006_relay_diagnostics')) names.push('relay_diagnostics');
-      if (versions.some(row => row.version === '007_relay_usage_daily')) names.push('relay_usage_user_days', 'relay_usage_computer_days');
-      const counts = {};
-      for (const name of names) { const [rows] = await db.query(`SELECT COUNT(*) AS count FROM ${name}`); counts[name] = rows[0].count; }
-      if (process.env.RELAY_STATE_FILE && process.env.RELAY_ADMIN_STATE_FILE) {
-        const devices = deviceStore(process.env.RELAY_STATE_FILE).entries();
-        const admin = relayAdminState(process.env.RELAY_ADMIN_STATE_FILE, 8).read();
-        const expected = { computers: devices.length,
-          mobile_authorizations: devices.reduce((sum, item) => sum + item.clients.length, 0),
-          official_computers: devices.filter(item => item.officialComputer).length,
-          announcements: admin.announcements.length, relay_settings: 1 };
-        if (Object.keys(expected).some(name => counts[name] !== expected[name])) throw new Error('Imported row counts differ from JSON');
-        const [saved] = await db.query('SELECT id,host_hash,status,revision FROM computers');
-        const original = new Map(devices.map(item => [item.id, item]));
-        for (const row of saved) {
-          const item = original.get(row.id);
-          if (!item || item.hostHash !== row.host_hash || item.status !== row.status || item.revision !== Number(row.revision)) {
-            throw new Error('Imported computer identity differs from JSON');
-          }
-        }
-        const [authorized] = await db.query('SELECT computer_id,client_id,credential_hash FROM mobile_authorizations');
-        for (const row of authorized) {
-          const item = original.get(row.computer_id)?.clients.find(client => client.id === row.client_id);
-          if (!item || item.hash !== row.credential_hash) throw new Error('Imported mobile authorization differs from JSON');
-        }
-        const [settings] = await db.query('SELECT max_relay_sessions FROM relay_settings WHERE id=1');
-        if (settings[0]?.max_relay_sessions !== admin.maxRelaySessions) throw new Error('Imported relay setting differs from JSON');
-        console.log(JSON.stringify({ verified: true, counts }));
-      } else console.log(JSON.stringify(counts));
-    } else {
-      const stateFile = process.env.RELAY_STATE_FILE, adminFile = process.env.RELAY_ADMIN_STATE_FILE;
-      if (!stateFile || !adminFile) throw new Error('RELAY_STATE_FILE and RELAY_ADMIN_STATE_FILE required for import');
-      const devices = deviceStore(stateFile).entries();
-      const admin = relayAdminState(adminFile, 8).read();
-      const [existing] = await db.query('SELECT (SELECT COUNT(*) FROM computers) AS computers, (SELECT COUNT(*) FROM relay_settings) AS settings');
-      if (existing[0].computers || existing[0].settings) throw new Error('Import target is not empty');
-      await db.beginTransaction();
-      try {
-        for (const item of devices) {
-          await db.execute('INSERT INTO computers (id,host_hash,status,revision,created_at,updated_at) VALUES (?,?,?,?,?,?)',
-            [item.id, item.hostHash, item.status, item.revision, sqlTime(item.createdAt), sqlTime(item.updatedAt)]);
-          for (const client of item.clients) await db.execute(
-            'INSERT INTO mobile_authorizations (computer_id,client_id,credential_hash,created_at,updated_at) VALUES (?,?,?,?,?)',
-            [item.id, client.id, client.hash, sqlTime(client.createdAt), sqlTime(client.updatedAt)]);
-          if (item.officialComputer) {
-            const official = item.officialComputer;
-            await db.execute('INSERT INTO official_computers (computer_id,environment_id,name,hostname,updated_at) VALUES (?,?,?,?,?)',
-              [item.id, official.environmentId, official.name, official.hostname, sqlTime(official.updatedAt)]);
-          }
-        }
-        await db.execute('INSERT INTO relay_settings (id,max_relay_sessions,updated_at) VALUES (1,?,UTC_TIMESTAMP(3))', [admin.maxRelaySessions]);
-        for (const item of admin.announcements) await db.execute(
-          'INSERT INTO announcements (id,title,message,status,created_at,updated_at,published_at) VALUES (?,?,?,?,?,?,?)',
-          [item.id, item.title, item.message, item.status, sqlTime(item.createdAt), sqlTime(item.updatedAt),
-            item.publishedAt ? sqlTime(item.publishedAt) : null]);
-        await db.commit();
-      } catch (error) { await db.rollback(); throw error; }
-      console.log(JSON.stringify({ imported: true, computers: devices.length,
-        mobileAuthorizations: devices.reduce((sum, item) => sum + item.clients.length, 0),
-        officialComputers: devices.filter(item => item.officialComputer).length,
-        announcements: admin.announcements.length }));
-    }
-  }
-} finally { await db.end(); }
+#!/usr/bin/env node
+import fs from 'node:fs';
+import { createHash } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import mysql from 'mysql2/promise';
+import { relaySchemaVersions } from '../database/versions.mjs';
+import { deviceStore } from '../src/self-relay/device-store.mjs';
+import { relayAdminState } from '../src/self-relay/admin-state.mjs';
+
+const command = process.argv[2];
+if (!['--schema', '--import', '--check'].includes(command) || !process.env.RELAY_MYSQL_CONFIG_FILE) {
+  throw new Error('Use --schema, --import or --check with RELAY_MYSQL_CONFIG_FILE');
+}
+const config = JSON.parse(fs.readFileSync(process.env.RELAY_MYSQL_CONFIG_FILE, 'utf8'));
+const db = await mysql.createConnection({ ...config, dateStrings: true, timezone: 'Z', multipleStatements: false });
+const sqlTime = value => value.replace('T', ' ').replace(/Z$/, '');
+const migrations = relaySchemaVersions;
+try {
+  if (command === '--schema') {
+    const [existing] = await db.query("SHOW TABLES LIKE 'schema_migrations'");
+    const [applied] = existing.length ? await db.query('SELECT version, sha256 FROM schema_migrations') : [[]];
+    const known = new Map(applied.map(row => [row.version, row.sha256]));
+    if (known.size !== applied.length || [...known.keys()].some(version => !migrations.includes(version))) throw new Error('Unexpected schema version');
+    for (const version of migrations) {
+      const source = fs.readFileSync(fileURLToPath(new URL(`../database/${version}.sql`, import.meta.url)), 'utf8');
+      const sha256 = createHash('sha256').update(source).digest('hex');
+      if (known.has(version)) {
+        if (known.get(version) !== sha256) throw new Error(`Migration changed: ${version}`);
+        continue;
+      }
+      if (version !== migrations[0] && !known.has(migrations[migrations.indexOf(version) - 1])) throw new Error('Previous migration missing');
+      const statements = source.split('\n').filter(line => !line.trimStart().startsWith('--')).join('\n');
+      for (const statement of statements.split(';').map(item => item.trim()).filter(Boolean)) await db.query(statement);
+      await db.execute('INSERT INTO schema_migrations (version, sha256) VALUES (?,?)', [version, sha256]);
+      known.set(version, sha256);
+      console.log(JSON.stringify({ schema: version, sha256 }));
+    }
+  } else {
+    const [versions] = await db.query('SELECT version FROM schema_migrations');
+    if (!versions.some(row => row.version === '001_relay_core') || versions.some(row => !migrations.includes(row.version))) throw new Error('Unexpected schema version');
+    if (command === '--check') {
+      const names = ['computers', 'mobile_authorizations', 'official_computers', 'announcements', 'relay_settings', 'users', 'user_login_identities'];
+      if (versions.some(row => row.version === '002_email_accounts')) names.push('email_login_challenges', 'user_sessions', 'email_send_limits');
+      if (versions.some(row => row.version === '003_relay_usage')) names.push('relay_admin_emails', 'relay_usage_settings', 'relay_usage_totals', 'relay_usage_computer_totals', 'relay_usage_entitlements', 'relay_usage_budgets', 'relay_usage_computer_budgets', 'relay_usage_sessions');
+      if (versions.some(row => row.version === '004_relay_usage_actions')) names.push('relay_usage_actions');
+      if (versions.some(row => row.version === '006_relay_diagnostics')) names.push('relay_diagnostics');
+      if (versions.some(row => row.version === '007_relay_usage_daily')) names.push('relay_usage_user_days', 'relay_usage_computer_days');
+      const counts = {};
+      for (const name of names) { const [rows] = await db.query(`SELECT COUNT(*) AS count FROM ${name}`); counts[name] = rows[0].count; }
+      if (process.env.RELAY_STATE_FILE && process.env.RELAY_ADMIN_STATE_FILE) {
+        const devices = deviceStore(process.env.RELAY_STATE_FILE).entries();
+        const admin = relayAdminState(process.env.RELAY_ADMIN_STATE_FILE, 8).read();
+        const expected = { computers: devices.length,
+          mobile_authorizations: devices.reduce((sum, item) => sum + item.clients.length, 0),
+          official_computers: devices.filter(item => item.officialComputer).length,
+          announcements: admin.announcements.length, relay_settings: 1 };
+        if (Object.keys(expected).some(name => counts[name] !== expected[name])) throw new Error('Imported row counts differ from JSON');
+        const [saved] = await db.query('SELECT id,host_hash,status,revision FROM computers');
+        const original = new Map(devices.map(item => [item.id, item]));
+        for (const row of saved) {
+          const item = original.get(row.id);
+          if (!item || item.hostHash !== row.host_hash || item.status !== row.status || item.revision !== Number(row.revision)) {
+            throw new Error('Imported computer identity differs from JSON');
+          }
+        }
+        const [authorized] = await db.query('SELECT computer_id,client_id,credential_hash FROM mobile_authorizations');
+        for (const row of authorized) {
+          const item = original.get(row.computer_id)?.clients.find(client => client.id === row.client_id);
+          if (!item || item.hash !== row.credential_hash) throw new Error('Imported mobile authorization differs from JSON');
+        }
+        const [settings] = await db.query('SELECT max_relay_sessions FROM relay_settings WHERE id=1');
+        if (settings[0]?.max_relay_sessions !== admin.maxRelaySessions) throw new Error('Imported relay setting differs from JSON');
+        console.log(JSON.stringify({ verified: true, counts }));
+      } else console.log(JSON.stringify(counts));
+    } else {
+      const stateFile = process.env.RELAY_STATE_FILE, adminFile = process.env.RELAY_ADMIN_STATE_FILE;
+      if (!stateFile || !adminFile) throw new Error('RELAY_STATE_FILE and RELAY_ADMIN_STATE_FILE required for import');
+      const devices = deviceStore(stateFile).entries();
+      const admin = relayAdminState(adminFile, 8).read();
+      const [existing] = await db.query('SELECT (SELECT COUNT(*) FROM computers) AS computers, (SELECT COUNT(*) FROM relay_settings) AS settings');
+      if (existing[0].computers || existing[0].settings) throw new Error('Import target is not empty');
+      await db.beginTransaction();
+      try {
+        for (const item of devices) {
+          await db.execute('INSERT INTO computers (id,host_hash,status,revision,created_at,updated_at) VALUES (?,?,?,?,?,?)',
+            [item.id, item.hostHash, item.status, item.revision, sqlTime(item.createdAt), sqlTime(item.updatedAt)]);
+          for (const client of item.clients) await db.execute(
+            'INSERT INTO mobile_authorizations (computer_id,client_id,credential_hash,created_at,updated_at) VALUES (?,?,?,?,?)',
+            [item.id, client.id, client.hash, sqlTime(client.createdAt), sqlTime(client.updatedAt)]);
+          if (item.officialComputer) {
+            const official = item.officialComputer;
+            await db.execute('INSERT INTO official_computers (computer_id,environment_id,name,hostname,updated_at) VALUES (?,?,?,?,?)',
+              [item.id, official.environmentId, official.name, official.hostname, sqlTime(official.updatedAt)]);
+          }
+        }
+        await db.execute('INSERT INTO relay_settings (id,max_relay_sessions,updated_at) VALUES (1,?,UTC_TIMESTAMP(3))', [admin.maxRelaySessions]);
+        for (const item of admin.announcements) await db.execute(
+          'INSERT INTO announcements (id,title,message,status,created_at,updated_at,published_at) VALUES (?,?,?,?,?,?,?)',
+          [item.id, item.title, item.message, item.status, sqlTime(item.createdAt), sqlTime(item.updatedAt),
+            item.publishedAt ? sqlTime(item.publishedAt) : null]);
+        await db.commit();
+      } catch (error) { await db.rollback(); throw error; }
+      console.log(JSON.stringify({ imported: true, computers: devices.length,
+        mobileAuthorizations: devices.reduce((sum, item) => sum + item.clients.length, 0),
+        officialComputers: devices.filter(item => item.officialComputer).length,
+        announcements: admin.announcements.length }));
+    }
+  }
+} finally { await db.end(); }

package/dist/bin/publish-android-release.mjs

@@ -0,0 +1,58 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { androidReleaseStorage } from '../relay-admin/android-release-storage.mjs';
+import { readAndroidCatalog } from '../src/self-relay/android-releases.mjs';
+
+// This administrative command runs only on the deployment host; no keys cross SSH.
+const [apkFile, metadataFile] = process.argv.slice(2);
+if (!apkFile || !metadataFile) throw new Error('Usage: publish-android-release.mjs APK METADATA');
+const storage = androidReleaseStorage('/etc/codex-relay/android-releases.json', '/etc/codex-relay/tencent-monitor.json');
+const metadata = JSON.parse(fs.readFileSync(metadataFile, 'utf8'));
+if (metadata.packageName !== 'cn.walkhi.coderelax' || !/^[a-f0-9]{64}$/.test(metadata.certificateSha256)) throw new Error('Invalid APK identity');
+const bytes = fs.readFileSync(apkFile), sha256 = createHash('sha256').update(bytes).digest('hex');
+if (sha256 !== metadata.sha256 || bytes.length !== metadata.size) throw new Error('Uploaded APK integrity mismatch');
+const { versionCode, versionName, size, notes, certificateSha256 } = metadata;
+const release = { versionCode, versionName, size, sha256, notes, certificateSha256,
+  objectKey: `code-relax/android/${versionCode}/Code-Relax-${sha256.slice(0, 16)}.apk` };
+const catalogFile = storage.catalogFile, temporary = catalogFile + '.new', lock = catalogFile + '.lock';
+const lockHandle = fs.openSync(lock, 'wx', 0o600);
+try {
+  const catalog = fs.existsSync(catalogFile) ? readAndroidCatalog(catalogFile) : { releases: [] };
+  const previous = catalog.releases.find(item => item.versionCode === versionCode);
+  if (previous && previous.sha256 !== sha256) throw new Error('A different APK already uses this versionCode');
+  if (catalog.latestVersionCode > versionCode) throw new Error('Refusing to publish an older version as latest');
+  if (catalog.releases.length && catalog.releases.some(item => item.certificateSha256 !== certificateSha256)) throw new Error('APK signing certificate changed');
+  const next = { latestVersionCode: versionCode, releases: [...catalog.releases.filter(item => item.versionCode !== versionCode), release] };
+  fs.writeFileSync(temporary, JSON.stringify(next, null, 2) + '\n', { mode: 0o640 });
+  readAndroidCatalog(temporary);
+  if (!previous) {
+    await new Promise((resolve, reject) => storage.cos.putObject({ ...storage.object(release), Body: bytes,
+      ContentLength: bytes.length, ContentType: 'application/vnd.android.package-archive',
+      ContentDisposition: `attachment; filename="Code-Relax-${versionName}.apk"`
+    }, (error, value) => error ? reject(error) : resolve(value)));
+  }
+  // Validate the exact signed GET that website and App use, before switching latest.
+  const ticket = await storage.signDownload(release);
+  const response = await fetch(ticket.url, { signal: AbortSignal.timeout(120000) });
+  if (!response.ok) throw new Error(`Signed download failed: HTTP ${response.status}`);
+  const downloaded = Buffer.from(await response.arrayBuffer());
+  if (downloaded.length !== size || createHash('sha256').update(downloaded).digest('hex') !== sha256) throw new Error('Stored APK integrity mismatch');
+  const unsigned = new URL(ticket.url); unsigned.search = '';
+  const denied = await fetch(unsigned, { method: 'HEAD', signal: AbortSignal.timeout(15000) });
+  if (denied.status !== 403) throw new Error(`Private object check failed: HTTP ${denied.status}`);
+  const owner = fs.statSync(path.dirname(catalogFile));
+  fs.chownSync(temporary, owner.uid, owner.gid);
+  fs.renameSync(temporary, catalogFile);
+  console.log(JSON.stringify({ published: true, versionCode, versionName, size, sha256, unsignedStatus: denied.status,
+    entry: 'https://www.coderelax.cn/code-relax/android' }));
+} catch (error) {
+  // COS errors can carry signed request details. Keep CLI output credential-free.
+  console.error('Android publication failed:', error?.code || (error?.name === 'Error' ? error.message : 'storage-request-failed'));
+  process.exitCode = 1;
+} finally {
+  fs.closeSync(lockHandle);
+  fs.unlinkSync(lock);
+  if (fs.existsSync(temporary)) fs.unlinkSync(temporary);
+}

package/dist/bin/self-relay-admin.mjs

@@ -1,8 +1,8 @@
-import { startAdminServer } from '../src/self-relay/admin-server.mjs';
-
-const port = Number(process.env.RELAY_ADMIN_PORT || 45851);
-if (!Number.isSafeInteger(port) || port < 1 || port > 65535) throw new Error('Invalid RELAY_ADMIN_PORT');
-const server = await startAdminServer({ port });
-console.log(JSON.stringify({ service: 'codex-relay-admin', port: server.port }));
-await new Promise(resolve => { process.once('SIGTERM', resolve); process.once('SIGINT', resolve); });
-await server.close();
+import { startAdminServer } from '../src/self-relay/admin-server.mjs';
+
+const port = Number(process.env.RELAY_ADMIN_PORT || 45851);
+if (!Number.isSafeInteger(port) || port < 1 || port > 65535) throw new Error('Invalid RELAY_ADMIN_PORT');
+const server = await startAdminServer({ port });
+console.log(JSON.stringify({ service: 'codex-relay-admin', port: server.port }));
+await new Promise(resolve => { process.once('SIGTERM', resolve); process.once('SIGINT', resolve); });
+await server.close();