@walkhi/code-relax 0.1.0-beta.3 → 0.1.0-beta.31

package/dist/src/project-remove.mjs

@@ -0,0 +1,55 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { readRecord, writeRecord } from './service-lifecycle.mjs';
+import { withDesktopProjectRegistration } from './platform/desktop-project-registration.mjs';
+
+const pending = new Map();
+const uuid = /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i;
+
+export async function removeWorkstationProject(server, stateRoot, codexDataRoot, projectId, body, dependencies = {}) {
+  if (!projectId || !uuid.test(body.idempotencyKey || '')) throw Object.assign(new Error('项目移除标识无效。'), { statusCode: 400 });
+  const record = path.join(stateRoot, 'project-remove-operations', `${body.idempotencyKey}.json`);
+  const running = pending.get(record);
+  if (running) {
+    if (running.projectId !== projectId) throw Object.assign(new Error('同一请求不能移除其他项目。'), { statusCode: 409 });
+    return running.promise;
+  }
+  const promise = perform().finally(() => pending.delete(record));
+  pending.set(record, { projectId, promise });
+  return promise;
+
+  async function perform() {
+    await fs.mkdir(path.dirname(record), { recursive: true });
+    const operation = readRecord(record) || { projectId };
+    if (operation.projectId !== projectId) throw Object.assign(new Error('移除标识已用于其他项目。'), { statusCode: 409 });
+    if (operation.result) return operation.result;
+    const save = () => writeRecord(record, operation);
+    const registration = dependencies.registration || withDesktopProjectRegistration;
+    return registration({ stateRoot, codexDataRoot, operationId: body.idempotencyKey, operation: 'remove',
+      confirmed: body.confirmDesktopRestart === true, serverUrl: server.url }, async desktop => {
+      if (!operation.project) {
+        operation.project = (await server.request('project/read', { projectId })).project;
+        if (operation.project.id !== projectId) throw new Error('项目身份不一致，未执行移除。');
+        save();
+      }
+      const removeNative = async () => {
+        if (operation.nativeDeleted) return;
+        if (operation.deleteAttempted) {
+          // An explicit retry first resolves an earlier unknown response.
+          try { await server.request('project/read', { projectId }); }
+          catch (error) {
+            if (error.message !== `project not found: ${projectId}`) throw error;
+            operation.nativeDeleted = true; save(); return;
+          }
+        }
+        operation.deleteAttempted = true; save();
+        await server.request('project/delete', { projectId });
+        operation.nativeDeleted = true; save();
+      };
+      const desktopRemoval = await desktop.remove(operation.project, operation, save, removeNative);
+      operation.result = { projectId, desktopRemoval };
+      save();
+      return operation.result;
+    });
+  }
+}

package/dist/src/project-update.mjs

@@ -0,0 +1,56 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { readRecord, writeRecord } from './service-lifecycle.mjs';
+import { projectRoots, projectSummary } from './project-management.mjs';
+import { withDesktopProjectRegistration } from './platform/desktop-project-registration.mjs';
+
+const pending = new Map();
+const fail = message => { throw Object.assign(new Error(message), { statusCode: 409 }); };
+const rootKey = roots => JSON.stringify(roots.map(root => process.platform === 'win32' ? path.normalize(root.path).toLowerCase() : path.normalize(root.path)));
+const same = (a, b) => a.name === b.name && rootKey(a.roots) === rootKey(b.roots);
+
+export async function updateWorkstationProject(server, stateRoot, codexDataRoot, projectId, body, dependencies = {}) {
+  const name = typeof body.name === 'string' ? body.name.trim() : '';
+  if (!name || !Array.isArray(body.roots) || body.roots.some(root => typeof root?.path !== 'string' || !path.isAbsolute(root.path.trim()))
+    || !/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(body.idempotencyKey || '')) fail('项目名称、文件夹或操作标识无效。');
+  const target = { name, roots: body.roots.map(root => ({ path: path.normalize(root.path.trim()) })) };
+  const signature = createHash('sha256').update(JSON.stringify({ projectId, ...target })).digest('hex');
+  const record = path.join(stateRoot, 'project-update-operations', `${body.idempotencyKey}.json`);
+  const active = pending.get(record);
+  if (active) { if (active.signature !== signature) fail('同一请求不能修改其他项目内容。'); return active.promise; }
+  const promise = perform().finally(() => pending.delete(record));
+  pending.set(record, { signature, promise }); return promise;
+
+  async function perform() {
+    await fs.mkdir(path.dirname(record), { recursive: true });
+    const operation = readRecord(record) || { signature };
+    if (operation.signature !== signature) fail('项目编辑标识已用于其他内容。');
+    if (operation.result) return operation.result;
+    const save = () => writeRecord(record, operation);
+    const rpc = (method, params) => server.request(method, params);
+    try {
+      return await (dependencies.registration || withDesktopProjectRegistration)({ stateRoot, codexDataRoot,
+        operationId: body.idempotencyKey, operation: 'update', confirmed: body.confirmDesktopRestart === true, serverUrl: server.url }, async desktop => {
+        const current = (await rpc('project/read', { projectId })).project;
+        if (current.id !== projectId) fail('项目身份不一致。');
+        operation.previousProject ||= current;
+        if (!same(current, operation.previousProject) && !same(current, target)) fail('项目已被其他操作修改，请刷新后重新编辑。');
+        let project = current;
+        if (!same(current, target)) {
+          const rootsChanged = rootKey(current.roots) !== rootKey(target.roots);
+          const roots = rootsChanged ? await projectRoots(rpc, target.roots) : current.roots;
+          operation.updateAttempted = true; save();
+          project = (await rpc('project/update', { projectId, name, roots })).project;
+        }
+        save();
+        const desktopRegistration = await desktop.register(project, operation, save);
+        operation.result = { project: projectSummary(project), desktopRegistration }; save(); return operation.result;
+      });
+    } catch (error) {
+      error.details = { ...error.details, projectUpdatePending: operation.updateAttempted === true };
+      if (operation.updateAttempted) error.message += ' 请继续完成本次同步，会先核对已有修改。';
+      throw error;
+    }
+  }
+}

package/dist/src/runtime-discovery.mjs

@@ -0,0 +1,47 @@
+import { discoverCodex, resolveCodexRuntime, runtimeFingerprint } from './platform/codex-runtime.mjs';
+
+// Advisory discovery is independent of execution health. Failure here must never
+// disable an already running app-server or cause an automatic process restart.
+export class RuntimeDiscovery {
+  constructor({ stateRoot, host, url, interval = 60000 }) {
+    Object.assign(this, { stateRoot, host, url, interval });
+    this.state = {};
+  }
+  start() { this.stopped = false; void this.tick(); }
+  stop() { this.stopped = true; clearTimeout(this.timer); }
+  async sample() {
+    const errors = [];
+    try {
+      const candidates = discoverCodex();
+      const signature = JSON.stringify(candidates.map(candidate => {
+        try { return [candidate.executable, runtimeFingerprint(candidate.executable)]; }
+        catch (error) { return [candidate.executable, error.message]; }
+      }));
+      if (signature !== this.signature) {
+        await resolveCodexRuntime(this.stateRoot, { refresh: true });
+        this.signature = signature;
+      }
+    } catch (error) { errors.push(error.message); }
+    try {
+      if (this.host.desktopIntegration === false) {
+        this.state = { desktop: { state: 'unsupported', integrationSupported: false }, checkedAt: new Date().toISOString() };
+        if (errors.length) this.state.discoveryError = errors.join('\n');
+        return this.state;
+      }
+      const desktop = await this.host.inspect();
+      const attached = desktop.running && await this.host.sharedServiceUrl() === this.url;
+      this.state = { desktop: { state: !desktop.running ? 'stopped' : attached ? 'managed' : 'ordinary',
+        installed: Boolean(desktop.desktop), attachedToManagedServer: Boolean(attached) },
+        desktopRestartRecommended: Boolean(desktop.running && !attached), checkedAt: new Date().toISOString() };
+    } catch (error) {
+      errors.push(error.message);
+      this.state = { checkedAt: new Date().toISOString() };
+    }
+    if (errors.length) this.state.discoveryError = errors.join('\n');
+    return this.state;
+  }
+  async tick() {
+    await this.sample();
+    if (!this.stopped) { this.timer = setTimeout(() => this.tick(), this.interval); this.timer.unref?.(); }
+  }
+}

package/dist/src/self-relay/account-cleanup.mjs

@@ -0,0 +1,30 @@
+// Process one account per transaction; foreign keys keep incomplete deletion atomic.
+export async function purgeCancelledAccounts(pool, scopeHash) {
+  let purged = 0;
+  for (;;) {
+    const db = await pool.getConnection();
+    try {
+      await db.beginTransaction();
+      const [rows] = await db.query(`SELECT id FROM users WHERE status='cancelled'
+        AND cancelled_at <= UTC_TIMESTAMP(3) - INTERVAL 1 DAY
+        ORDER BY cancelled_at LIMIT 1 FOR UPDATE`);
+      if (!rows.length) { await db.commit(); return purged; }
+      const id = rows[0].id;
+      const [identities] = await db.execute("SELECT normalized_value FROM user_login_identities WHERE user_id=? AND kind='email'", [id]);
+      for (const { normalized_value: email } of identities) {
+        await db.execute('DELETE FROM email_login_challenges WHERE email=?', [email]);
+        await db.execute('DELETE FROM email_send_limits WHERE scope_hash=?', [scopeHash(`email:${email}`)]);
+        await db.execute('DELETE FROM relay_admin_emails WHERE email=?', [email]);
+      }
+      for (const table of ['user_sessions', 'relay_usage_actions', 'relay_usage_sessions',
+        'relay_usage_user_days', 'relay_usage_budgets', 'relay_usage_entitlements',
+        'relay_usage_totals', 'user_login_identities']) {
+        await db.execute(`DELETE FROM ${table} WHERE user_id=?`, [id]);
+      }
+      await db.execute('UPDATE computers SET owner_user_id=NULL WHERE owner_user_id=?', [id]);
+      await db.execute('DELETE FROM users WHERE id=?', [id]);
+      await db.commit(); purged++;
+    } catch (error) { await db.rollback(); throw error; }
+    finally { db.release(); }
+  }
+}

package/dist/src/self-relay/account-connections.mjs

@@ -0,0 +1,52 @@
+import { digest } from './wire.mjs';
+
+// Register before the asynchronous database check so logout also invalidates
+// handshakes whose successful authentication response has not arrived yet.
+export function accountConnections() {
+  const sessions = new Map();
+  return {
+    track(token, onInvalid) {
+      const key = digest(token);
+      const entries = sessions.get(key) || new Set();
+      sessions.set(key, entries);
+      let active = true, expires = Infinity, timer;
+      function dispose() {
+        active = false;
+        clearTimeout(timer);
+        entries.delete(entry);
+        if (!entries.size && sessions.get(key) === entries) sessions.delete(key);
+      }
+      function invalidate() {
+        if (!active) return;
+        dispose();
+        onInvalid();
+      }
+      function valid() {
+        if (active && Date.now() >= expires) invalidate();
+        return active;
+      }
+      function schedule() {
+        if (!valid()) return;
+        // Login lasts 30 days, longer than Node's maximum timer delay.
+        timer = setTimeout(schedule, Math.min(expires - Date.now(), 0x7fffffff));
+        timer.unref();
+      }
+      const entry = {
+        activate(expiresAt) {
+          if (!active) return false;
+          expires = Date.parse(expiresAt);
+          if (!Number.isFinite(expires)) { invalidate(); return false; }
+          schedule();
+          return active;
+        },
+        valid, dispose, invalidate,
+      };
+      entries.add(entry);
+      return entry;
+    },
+    revoke(token) {
+      const entries = sessions.get(digest(token));
+      if (entries) for (const entry of [...entries]) entry.invalidate();
+    },
+  };
+}

package/dist/src/self-relay/admin-cloud.mjs

@@ -0,0 +1,101 @@
+import fs from 'node:fs';
+import tencentcloud from 'tencentcloud-sdk-nodejs-common';
+
+const INSTANCE_ID = 'lhins-byrs7n8o';
+const REGION = 'ap-beijing';
+const { CommonClient } = tencentcloud;
+const METRICS = [
+  ['LighthouseOutratio', 'outRatioPercent', 10],
+  ['LighthouseOuttraffic', 'outMbps', 10],
+  ['LighthouseIntraffic', 'inMbps', 10],
+  ['CpuUsage', 'cpuPercent', 10],
+  ['MemUsage', 'memoryPercent', 10],
+  ['DiskUsage', 'diskPercent', 60],
+  ['CpuLoad1', 'cpuLoad1', 10],
+];
+
+function latestPoint(result) {
+  const point = result?.DataPoints?.[0];
+  if (!point?.Values?.length || !point?.Timestamps?.length) return null;
+  const index = point.Values.length - 1;
+  const value = Number(point.Values[index]);
+  const timestamp = Number(point.Timestamps[index]);
+  return Number.isFinite(value) && Number.isFinite(timestamp)
+    ? { value, sampledAt: new Date(timestamp * 1000).toISOString() } : null;
+}
+
+export function startAdminCloud({ credentialFile = process.env.CREDENTIALS_DIRECTORY
+  ? `${process.env.CREDENTIALS_DIRECTORY}/tencent-monitor.json` : null,
+  metricIntervalMs = 60000, trafficIntervalMs = 300000 } = {}) {
+  if (!credentialFile) return { read: () => ({ configured: false }), close() {} };
+  const { secretId, secretKey } = JSON.parse(fs.readFileSync(credentialFile, 'utf8'));
+  if (!secretId || !secretKey) throw new Error('Tencent monitor credentials are incomplete');
+  const credential = { secretId, secretKey };
+  const profile = { httpProfile: { reqTimeout: 8 } };
+  const monitor = new CommonClient('monitor.tencentcloudapi.com', '2018-07-24',
+    { credential, region: REGION, profile });
+  const lighthouse = new CommonClient('lighthouse.tencentcloudapi.com', '2020-03-24',
+    { credential, region: REGION, profile });
+  let closed = false;
+  let metricBusy = false;
+  let trafficBusy = false;
+  const current = { configured: true, metricAvailable: false, trafficAvailable: false,
+    outRatioPercent: null, outMbps: null, inMbps: null, metricSampledAt: null,
+    cpuPercent: null, memoryPercent: null, diskPercent: null, cpuLoad1: null,
+    trafficUsedBytes: null, trafficTotalBytes: null, trafficRemainingBytes: null,
+    trafficStartAt: null, trafficEndAt: null, trafficSampledAt: null };
+
+  async function sampleMetrics() {
+    if (metricBusy || closed) return;
+    metricBusy = true;
+    const end = new Date();
+    const base = { Namespace: 'QCE/LIGHTHOUSE',
+      StartTime: new Date(end.getTime() - 180000).toISOString(), EndTime: end.toISOString(),
+      Instances: [{ Dimensions: [{ Name: 'InstanceId', Value: INSTANCE_ID }] }] };
+    try {
+      const values = await Promise.allSettled(METRICS.map(([MetricName, , Period]) =>
+        monitor.request('GetMonitorData', { ...base, MetricName, Period })));
+      if (closed) return;
+      const samples = values.map(result => result.status === 'fulfilled' ? latestPoint(result.value) : null);
+      for (let index = 0; index < METRICS.length; index++) {
+        const [, field] = METRICS[index];
+        const value = samples[index]?.value ?? null;
+        current[field] = value !== null && (field === 'outMbps' || field === 'inMbps') ? value * 8 : value;
+      }
+      current.metricSampledAt = samples.reduce((latest, sample) => sample?.sampledAt > latest
+        ? sample.sampledAt : latest, '') || null;
+      current.metricAvailable = Boolean(current.metricSampledAt);
+    } catch {
+      current.metricAvailable = false;
+    } finally { metricBusy = false; }
+  }
+
+  async function sampleTraffic() {
+    if (trafficBusy || closed) return;
+    trafficBusy = true;
+    try {
+      const data = await lighthouse.request('DescribeInstancesTrafficPackages', { InstanceIds: [INSTANCE_ID] });
+      if (closed) return;
+      const packages = data?.InstanceTrafficPackageSet?.find(item => item.InstanceId === INSTANCE_ID)?.TrafficPackageSet || [];
+      const active = packages.find(item => Date.parse(item.StartTime) <= Date.now()
+        && Date.parse(item.EndTime) >= Date.now()) || packages[0];
+      current.trafficUsedBytes = active?.TrafficUsed ?? null;
+      current.trafficTotalBytes = active?.TrafficPackageTotal ?? null;
+      current.trafficRemainingBytes = active?.TrafficPackageRemaining ?? null;
+      current.trafficStartAt = active?.StartTime ?? null;
+      current.trafficEndAt = active?.EndTime ?? null;
+      current.trafficSampledAt = active ? new Date().toISOString() : null;
+      current.trafficAvailable = Boolean(active);
+    } catch {
+      current.trafficAvailable = false;
+    } finally { trafficBusy = false; }
+  }
+
+  void sampleMetrics();
+  void sampleTraffic();
+  const metricTimer = setInterval(sampleMetrics, metricIntervalMs);
+  const trafficTimer = setInterval(sampleTraffic, trafficIntervalMs);
+  metricTimer.unref();
+  trafficTimer.unref();
+  return { read: () => ({ ...current }), close() { closed = true; clearInterval(metricTimer); clearInterval(trafficTimer); } };
+}

package/dist/src/self-relay/admin-page.mjs

@@ -0,0 +1,80 @@
+import { adminUiTokens, adminFooterStyles } from './admin-style.mjs';
+
+export function adminPage(basePath = '/admin') {
+  return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="color-scheme" content="only light"><meta name="theme-color" content="#f5f7fa"><title>Code Relax 管理</title><style>${adminUiTokens}${adminFooterStyles}</style>
+<style>@media(max-width:600px){body main{padding:12px 12px 40px}header.page-head{align-items:center;gap:8px;margin-bottom:8px}header.page-head h1{font-size:20px;line-height:1.2;margin:0}main .nav{gap:0;margin-bottom:12px}main .nav button{padding:8px 11px}main .stack,main .grid{gap:10px}main .card{padding:12px}main .hero strong{font-size:20px}main .throughput{grid-template-columns:repeat(2,minmax(0,1fr));gap:6px;margin-top:10px}main .metrics{gap:6px}main .metric{display:flex;flex-direction:row-reverse;align-items:center;justify-content:space-between;gap:6px;min-width:0;padding:9px 10px}main .metric strong{font-size:17px;margin:0;white-space:nowrap}main .metric span{font-size:11px}main .card-head{margin-bottom:10px}}</style>
+<style>@media(max-width:600px){main .throughput .metric strong{font-size:17px}}</style>
+<style>.metric.warn{border-color:#946d38;background:#352a1b}.metric.warn strong{color:#ffd192}.metric.critical{border-color:#a65b58;background:#38211f}.metric.critical strong{color:#ffb1a9}.state.critical{background:#72342e;color:#ffe1dc}#trafficTimeline.critical .quota-fill{background:#d46a60}</style>
+<style>.quota-timeline{display:grid;gap:9px;margin-top:18px}.quota-timeline[hidden]{display:none}.quota-heading{display:flex;align-items:center;justify-content:space-between;gap:12px;color:#b7c8ba;font-size:12px;font-variant-numeric:tabular-nums}.quota-heading strong{font-size:13px}.quota-pace{font-weight:700;color:#7bc993}.quota-pace.ahead{color:#e9b46f}.quota-track{position:relative;height:13px;border:1px solid #526154;border-radius:7px;background:#5c6e6030}.quota-fill{position:absolute;inset:0 auto 0 0;border-radius:6px;background:#48ae78}.quota-timeline.ahead .quota-fill{background:#d39b4c}.quota-now{position:absolute;top:-5px;bottom:-5px;width:2px;background:#d8e3db;box-shadow:0 0 0 1px #162019;transform:translateX(-1px)}.quota-now:before{position:absolute;top:-1px;left:50%;width:7px;height:7px;background:#d8e3db;transform:translate(-50%,-50%) rotate(45deg);content:""}.quota-period{display:flex;justify-content:space-between;gap:12px;color:#91a394;font-size:11px}.quota-period span:last-child{text-align:right}</style>
+<style>
+:root{color-scheme:only light;font:14px/1.5 system-ui,"Microsoft YaHei",sans-serif;background:#f5f7fa;color:#17212b}*{box-sizing:border-box}body{margin:0}button,input,textarea{font:inherit}button{cursor:pointer;border:1px solid transparent;border-radius:9px;padding:9px 14px;background:#397e58;color:white;font-weight:600}button:hover{background:#46966b}button:disabled{opacity:.45;cursor:default}button.secondary{background:#26352c;color:#c8d7cd;border-color:#405548}button.danger{background:transparent;color:#eaa29c;border-color:#734947}button:focus-visible,input:focus-visible,textarea:focus-visible{outline:2px solid #8ad2a0;outline-offset:2px}
+main{max-width:1180px;margin:auto;padding:28px 24px 70px}h1{font-size:29px;line-height:1.2;margin:6px 0 8px}h2{font-size:18px;margin:0}h3{font-size:15px;margin:0}p{margin:0}.eyebrow{color:#83b598;letter-spacing:.12em;font-size:11px;font-weight:700}.subtle,.hint,.note{color:#a3b4a8}.hint,.note{font-size:12px}.note{margin-top:15px}.page-head{display:flex;align-items:end;justify-content:space-between;gap:16px;margin-bottom:22px}.page-head .subtle{margin-top:6px}.nav{display:flex;gap:7px;border-bottom:1px solid #34463a;margin-bottom:22px;overflow:auto}.nav button{border:0;border-bottom:2px solid transparent;border-radius:0;background:transparent;color:#b6c9bb;padding:12px 17px;white-space:nowrap}.nav button[aria-current=page]{color:#b9efca;border-bottom-color:#8ad2a0;background:#1a2b20}.page[hidden]{display:none}.stack{display:grid;gap:18px}.grid{display:grid;grid-template-columns:minmax(0,1.25fr) minmax(290px,.75fr);gap:18px;align-items:start}.card{background:#19241d;border:1px solid #34463a;border-radius:16px;padding:22px;box-shadow:0 12px 30px #080e0a24}.card-head{margin-bottom:18px}.hero{display:flex;align-items:start;justify-content:space-between;gap:18px;flex-wrap:wrap}.hero strong{font-size:26px}.state{border-radius:100px;padding:5px 10px;font-size:12px;font-weight:700;color:#c9f2d5;background:#28583b}.state.warn{background:#62491c;color:#ffe4a8}.state.down{background:#63302c;color:#ffd1c8}.throughput,.metrics{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:10px}.throughput{margin-top:20px}.metrics{grid-template-columns:repeat(3,minmax(0,1fr))}.metric{background:#111b15;border:1px solid #2b3c30;border-radius:11px;padding:14px;color:#9eafa3;font-size:12px}.metric strong{display:block;color:#f0f6f0;font-size:25px;line-height:1.2;margin-bottom:5px;font-variant-numeric:tabular-nums}.metric small{display:block;color:#80b893}.throughput .metric strong{font-size:32px}.detail{display:grid;gap:10px}.detail div{display:flex;justify-content:space-between;gap:12px;border-bottom:1px solid #2b3c30;padding-bottom:10px}.detail div:last-child{border:0;padding:0}.field{display:grid;gap:7px;margin:15px 0}.field label{font-size:13px;font-weight:600;color:#c5d7c9}input,textarea{width:100%;background:#101913;border:1px solid #45614d;border-radius:9px;color:#f1f7f1;padding:10px 12px}textarea{min-height:145px;resize:vertical}.actions{display:flex;flex-wrap:wrap;gap:9px;align-items:center}.current{border:1px solid #385841;background:#112017;border-radius:11px;padding:15px;margin-bottom:18px}.current.empty{border-color:#34463a;background:#111b15}.badge{display:inline-block;background:#28583b;color:#c9f2d5;border-radius:100px;padding:2px 8px;font-size:11px;font-weight:700}.current h3,.history h3{margin:8px 0 4px;overflow-wrap:anywhere}.current p,.history p{white-space:pre-wrap;overflow-wrap:anywhere;color:#c1d1c5}.date{font-size:12px;color:#94a99a}.history{display:grid;gap:10px}.history-item{border:1px solid #34463a;background:#141e17;border-radius:11px;padding:15px}.history-item.active{border-color:#4d865e}.history-item p{margin:8px 0 12px;max-height:4.5em;overflow:hidden}.history-item .actions button{padding:6px 10px;font-size:12px}.empty-note{padding:24px;border:1px dashed #415748;border-radius:10px;color:#a3b4a8;text-align:center}.status{min-height:24px;margin-top:16px;color:#96d4a9}.status.error{color:#f0aaa2}@media(max-width:800px){main{padding:24px 16px 50px}.grid{grid-template-columns:1fr}.metrics{grid-template-columns:repeat(2,minmax(0,1fr))}}@media(max-width:500px){.page-head{align-items:start}.card{padding:17px}.throughput{grid-template-columns:1fr}.metric{padding:10px}.metric strong{font-size:21px}}
+</style><style>
+.announcement-toolbar{display:flex;align-items:center;justify-content:space-between;gap:12px;flex-wrap:wrap;margin-bottom:18px}.announcement-toolbar h2{font-size:20px}.announcement-controls{display:flex;align-items:center;gap:9px;flex-wrap:wrap}.announcement-controls input{width:min(230px,100%)}.announcement-controls select{width:auto;min-width:108px}select{font:inherit;background:#101913;border:1px solid #45614d;border-radius:9px;color:#f1f7f1;padding:10px 12px}.announcement-list{display:grid;gap:9px}.announcement-row{display:grid;grid-template-columns:minmax(0,1fr) 90px 145px minmax(220px,auto);align-items:center;gap:14px;border:1px solid #34463a;border-radius:11px;padding:14px;background:#141e17}.announcement-row.active{border-color:#4d865e}.announcement-row h3{overflow-wrap:anywhere}.announcement-row p{color:#a3b4a8;font-size:12px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.announcement-row .actions{justify-content:flex-end;gap:6px}.announcement-row .actions button{padding:6px 9px;font-size:12px}.announcement-row .date{font-variant-numeric:tabular-nums}.announcement-status{display:inline-block;width:max-content;padding:3px 8px;border-radius:100px;font-size:11px;font-weight:700;color:#cad7ce;background:#334038}.announcement-status.active{background:#28583b;color:#c9f2d5}.announcement-status.draft{background:#4d462c;color:#ffe4a8}.announcement-empty{padding:32px;text-align:center;color:#a3b4a8}dialog{width:min(570px,calc(100% - 28px));max-height:calc(100vh - 36px);overflow:auto;background:#19241d;color:#edf4ee;border:1px solid #45614d;border-radius:16px;padding:22px;box-shadow:0 24px 70px #050905bb}dialog::backdrop{background:#050905bb}.editor-head{display:flex;align-items:center;justify-content:space-between;gap:10px}.editor-head button{padding:4px 10px}.editor-actions{display:flex;justify-content:flex-end;gap:8px;flex-wrap:wrap;margin-top:18px}.editor-actions[hidden]{display:none}dialog textarea{min-height:200px}dialog input:disabled,dialog textarea:disabled{opacity:.8}.hero-meta{display:flex;align-items:center;gap:10px}.hero-meta .hint{white-space:nowrap}.quota-card .card-head{display:flex;align-items:center;justify-content:space-between;gap:10px}.quota-card .card-head .hint{white-space:nowrap}@media(max-width:800px){.announcement-row{grid-template-columns:minmax(0,1fr) auto;gap:8px}.announcement-row .date{grid-column:1}.announcement-row .actions{grid-column:2;grid-row:2;align-self:end}.announcement-row .announcement-status{grid-column:2;grid-row:1}.announcement-toolbar{align-items:stretch}.announcement-controls{width:100%}.announcement-controls input{flex:1;min-width:110px}}@media(max-width:500px){.announcement-row{padding:11px}.announcement-row .actions button{padding:5px 7px;font-size:11px}.announcement-controls select{min-width:96px}.hero{align-items:center;flex-wrap:nowrap}.hero strong{font-size:20px}.hero-meta{gap:6px}.hero-meta .hint{font-size:11px}.hero-meta .state{padding:3px 7px}}
+</style><style>
+:root{color-scheme:only light;background:#f5f7fa;color:#17212b}body{min-height:100vh;background:radial-gradient(circle at 16% 15%,#cfe6d7aa 0,transparent 28%),radial-gradient(circle at 86% 76%,#dbece0aa 0,transparent 26%),linear-gradient(#1f4a2d0b 1px,transparent 1px),linear-gradient(90deg,#1f4a2d0b 1px,transparent 1px),#f5f7fa;background-size:auto,auto,32px 32px,32px 32px,auto}
+button{background:#e0f0e5;color:#235d3a;border-color:#a9cbb4}button:hover{background:#cce5d4;color:#194d31;border-color:#84b995}button.secondary{background:#f4f8f5;color:#315f42;border-color:#c8daca}button.secondary:hover{background:#e8f2eb;color:#235d3a;border-color:#a9cbb4}button.danger{background:#fff8f6;color:#a34c43;border-color:#e6c5c0}button.danger:hover{background:#fdece8;color:#993b32;border-color:#dba7a0}button:focus-visible,input:focus-visible,textarea:focus-visible,select:focus-visible{outline-color:#4b9b66}
+.subtle,.hint,.note{color:#607168}.page-head{justify-content:flex-start;align-items:center;gap:26px;margin-bottom:18px}.page-head h1{flex:none;color:#26332b}.page-head .nav{min-width:0;gap:4px;margin:0;border:0}.page-head .nav button{flex:none}.nav button{color:#607168}.nav button:hover{background:#eef5f0;color:#286e43}.nav button[aria-current=page]{color:#286e43;border-bottom-color:#68b582;background:#e4f1e8}.nav button[aria-current=page]:hover{background:#d8ebdd;color:#235d3a}.card{background:#ffffffee;border-color:#d5ddd8;box-shadow:0 10px 24px #263a2d0a}.metric{background:#f8faf8;border-color:#dce5df;color:#607168}.metric strong{color:#26332b}.metric small{color:#43865b}.metric.warn{background:#fff6e7;border-color:#e8c890}.metric.warn strong{color:#985d16}.metric.critical{background:#fff0ec;border-color:#dfaaa1}.metric.critical strong{color:#a5443b}
+.state,.badge,.announcement-status.active{background:#e4f1e8;color:#286e43}.state.warn,.announcement-status.draft{background:#fff1d8;color:#895711}.state.down,.state.critical{background:#fbe6e2;color:#a13e35}.traffic-usage{color:#52645a;font-size:13px;font-variant-numeric:tabular-nums}.quota-card .quota-timeline{margin-top:12px}.quota-heading{color:#52645a}.quota-heading .warn{color:#985d16}.quota-heading .critical{color:#a5443b}.quota-pace{color:#28764a}.quota-pace.ahead{color:#a87326}.quota-track{border-color:#cfdbd2;background:#e9f0eb}.quota-fill{background:#68b582}.quota-timeline.ahead .quota-fill,.quota-timeline.warn .quota-fill{background:#d39b4c}.quota-now{background:#52645a;box-shadow:0 0 0 1px #fff}.quota-now:before{background:#52645a}.quota-period{color:#77857d}
+.field label{color:#3b5142}input,textarea,select,.announcement-controls select{background:#fff;border-color:#c6d4cb;color:#26332b}input::placeholder,textarea::placeholder{color:#89988d}.date{color:#77857d}.announcement-row{background:#fff;border-color:#d5ddd8}.announcement-row.active{border-color:#a9c6b3;box-shadow:inset 3px 0 #68b582}.announcement-row p{color:#607168}.announcement-status{background:#edf1ee;color:#52645a}.announcement-empty{color:#607168}dialog{background:#fff;color:#26332b;border-color:#c6d4cb;box-shadow:0 24px 70px #263a2d33}dialog::backdrop{background:#172c20a8}.status{color:#28764a}.status.error{color:#a5443b}.relay-heading{display:flex;align-items:center;justify-content:space-between;gap:10px;margin-bottom:10px}.overview-sample{display:flex;justify-content:flex-end}.throughput{margin-top:12px}.throughput .metric{padding:10px 12px}.throughput .metric strong{font-size:20px}@media(max-width:600px){header.page-head{gap:8px}header.page-head h1{font-size:18px}.page-head .nav{gap:2px}.page-head .nav button{padding:7px 6px;font-size:12px}main .throughput{margin-top:8px}main .throughput .metric{padding:7px 8px}main .throughput .metric strong{font-size:14px}}
+</style><style>
+#metrics{grid-template-columns:repeat(5,minmax(0,1fr))}.relay-heading{margin-bottom:14px}.resource-head{display:flex;align-items:center;justify-content:space-between;gap:10px}.resource-head .hint{white-space:nowrap}.resource-card .throughput{border-top:1px solid #dce5df;padding-top:10px;margin-top:12px}.resource-card .throughput .metric{display:flex;flex-direction:row-reverse;align-items:center;justify-content:space-between;gap:8px;padding:8px 10px}.resource-card .throughput .metric strong{font-size:16px;margin:0;white-space:nowrap}
+@media(max-width:800px){#metrics{grid-template-columns:repeat(2,minmax(0,1fr))}}
+@media(max-width:600px){.resource-card .throughput .metric strong{font-size:14px}}
+</style><style>main:not(.authenticated)>:not(#adminLogin){display:none!important}#adminLogin{max-width:430px;margin:10vh auto}#adminLogin[hidden]{display:none}.usage-toolbar{display:flex;align-items:center;justify-content:space-between;gap:12px;flex-wrap:wrap;margin-bottom:16px}.usage-views,.usage-pages{display:flex;align-items:center;gap:8px}.usage-views button[aria-pressed=true]{background:#286e43;color:#fff}.usage-rows{display:grid;gap:8px}.usage-row{display:grid;gap:8px;padding:12px 14px;border:1px solid var(--admin-row-border);border-radius:var(--admin-control-radius);background:var(--admin-row)}.usage-row-head{display:flex;align-items:baseline;justify-content:space-between;gap:12px;min-width:0}.usage-row-head span{min-width:0;overflow-wrap:anywhere}.usage-row-head small{flex-shrink:0;white-space:nowrap}.usage-row strong{font-variant-numeric:tabular-nums}.usage-row small{text-align:right}.usage-pages{margin-top:16px}</style></head><body><main class="authenticated">
+<header class="page-head"><h1>中继管理</h1><nav class="nav" aria-label="管理页面"><button type="button" data-page="overview" aria-current="page">运行概览</button><button type="button" data-page="announcements">系统公告</button><button type="button" data-page="settings">容量设置</button><button type="button" data-page="usage">使用统计</button></nav></header>
+<section id="overview" class="page stack"><section class="card" aria-label="中继连接与转发"><div class="relay-heading"><h2>中继连接与转发</h2><span id="healthText" class="state">读取中</span></div><div id="metrics" class="metrics"></div></section><div class="grid"><section class="card resource-card" aria-label="服务器资源"><div class="card-head resource-head"><h2>服务器资源</h2><span id="sampleTime" class="hint">等待采样</span></div><div id="serverMetrics" class="metrics"></div><div class="throughput" id="throughput"></div></section><section class="card quota-card"><div class="card-head"><h2>流量包</h2><span id="trafficNote" class="hint">等待更新</span></div><p id="trafficUsage" class="traffic-usage">—</p><div id="trafficTimeline" class="quota-timeline" hidden><div class="quota-heading"><strong id="trafficRemaining">流量剩余 —</strong><span id="trafficPace" class="quota-pace">—×</span><span id="timeRemaining">时间剩余 —</span></div><div id="quotaTrack" class="quota-track" role="img"><span id="quotaFill" class="quota-fill"></span><span id="quotaNow" class="quota-now"></span></div><div class="quota-period"><span id="trafficEnd">到期 —</span><span id="trafficStart">本期开始 —</span></div></div></section></div></section>
+<section id="announcements" class="page" hidden><section class="card"><div class="announcement-toolbar"><div><h2>公告管理</h2><p id="announcementCount" class="hint">正在读取</p></div><button id="newAnnouncement" type="button">新建公告</button></div><div class="announcement-controls"><input id="announcementSearch" type="search" aria-label="搜索公告" placeholder="搜索标题或正文"><select id="announcementFilter" aria-label="筛选状态"><option value="all">全部状态</option><option value="active">发布中</option><option value="draft">草稿</option><option value="withdrawn">已撤下</option></select></div><div id="announcementList" class="announcement-list" style="margin-top:14px"></div></section></section>
+<dialog id="announcementEditor" aria-labelledby="editorHeading"><div class="editor-head"><h2 id="editorHeading">新建公告</h2><button id="closeEditor" class="secondary" type="button" aria-label="关闭">关闭</button></div><div class="field"><label for="title">标题</label><input id="title" maxlength="80" placeholder="输入公告标题"></div><div class="field"><label for="message">正文</label><textarea id="message" maxlength="2000" placeholder="输入公告内容"></textarea></div><p id="editorNote" class="hint"></p><p id="editorError" class="status error" role="alert" hidden></p><div id="editorActions" class="editor-actions"><button id="saveDraft" class="secondary" type="button">保存草稿</button><button id="publish" type="button">发布公告</button></div></dialog>
+<section id="settings" class="page stack" hidden><section class="card"><div class="card-head"><h2>服务器转发容量</h2><p class="hint">只限制经 WSS 转发的普通会话，WebRTC 直连与白名单转发不占用此额度</p></div><div class="field"><label for="limit">最大并发会话</label><input id="limit" type="number" min="1" max="256"></div><button id="saveLimit" type="button">保存设置</button><p class="note">当前上限是人工配置值，不随 CPU 或带宽自动改变。</p></section></section>
+<section id="usage" class="page" hidden><section class="card"><div class="usage-toolbar"><div><h2>今日使用统计</h2><p id="usageCount" class="hint">正在读取</p></div><div class="usage-views"><button id="usageUsers" type="button" class="secondary" aria-pressed="true">用户</button><button id="usageComputers" type="button" class="secondary" aria-pressed="false">工作站</button><button id="usageRefresh" type="button" class="secondary">刷新</button></div></div><div id="usageRows" class="usage-rows"></div><div class="usage-pages"><button id="usagePrev" type="button" class="secondary">上一页</button><span id="usagePageText" class="hint"></span><button id="usageNext" type="button" class="secondary">下一页</button></div><p id="usageError" class="status error" role="alert"></p></section></section><p id="result" class="status" role="status" aria-live="polite"></p>
+</main><footer class="admin-footer">网站备案号：京ICP备2026027643号-2</footer><script>
+const el=id=>document.getElementById(id);let snapshot=null;
+const request=async(path,options={})=>{const response=await fetch(path,{...options,referrerPolicy:'no-referrer'});const body=await response.json();if(!response.ok)throw new Error(body.error||('HTTP '+response.status));return body};
+function setResult(message,error=false){el('result').textContent=message;el('result').classList.toggle('error',error)}
+function node(tag,className,value){const item=document.createElement(tag);if(className)item.className=className;if(value!==undefined)item.textContent=value;return item}
+function metric(value,label,extra,tone){const item=node('div','metric'+(tone?' '+tone:''));item.append(node('strong','',value),node('span','',label));if(extra)item.append(node('small','',extra));return item}
+function toneAbove(value,warn,critical){return typeof value==='number'&&Number.isFinite(value)?value>=critical?'critical':value>=warn?'warn':'':''}
+function toneBelow(value,warn,critical){return typeof value==='number'&&Number.isFinite(value)?value<=critical?'critical':value<=warn?'warn':'':''}
+function number(value,digits=0){return typeof value==='number'&&Number.isFinite(value)?value.toFixed(digits):'—'}
+function date(value){return new Date(value).toLocaleString('zh-CN')}
+function renderTrafficTimeline(cloud,available){const start=Date.parse(cloud.trafficStartAt);const end=Date.parse(cloud.trafficEndAt);const total=Number(cloud.trafficTotalBytes);const remaining=Number(cloud.trafficRemainingBytes);const valid=available&&Number.isFinite(start)&&Number.isFinite(end)&&end>start&&cloud.trafficTotalBytes!=null&&cloud.trafficRemainingBytes!=null&&total>0&&Number.isFinite(remaining);const timeline=el('trafficTimeline');timeline.hidden=!valid;if(!valid)return;
+const clamp=value=>Math.max(0,Math.min(100,value));const quotaLeft=clamp(remaining/total*100);const timeLeft=clamp((end-Date.now())/(end-start)*100);const used=100-quotaLeft;const elapsed=100-timeLeft;const pace=elapsed>0?used/elapsed:null;
+timeline.classList.toggle('ahead',pace!==null&&pace>1);timeline.classList.toggle('warn',quotaLeft<=20);timeline.classList.toggle('critical',quotaLeft<=10);el('trafficRemaining').textContent='流量剩余 '+number(quotaLeft,1)+'%';el('trafficRemaining').className=toneBelow(quotaLeft,20,10);el('timeRemaining').textContent='时间剩余 '+number(timeLeft,1)+'%';el('trafficPace').textContent=pace===null?'—×':number(pace,2)+'×';el('trafficPace').classList.toggle('ahead',pace!==null&&pace>1);
+el('quotaFill').style.width=quotaLeft+'%';el('quotaNow').style.left=timeLeft+'%';el('quotaTrack').setAttribute('aria-label','流量剩余 '+number(quotaLeft,1)+'%，时间剩余 '+number(timeLeft,1)+'%');el('trafficStart').textContent='本期开始 '+date(cloud.trafficStartAt);el('trafficEnd').textContent='到期 '+date(cloud.trafficEndAt)}
+function renderOverview(state){const cloud=state.cloud||{};const relay=state.relayAvailable!==false;const cloudFresh=cloud.metricAvailable&&Date.now()-Date.parse(cloud.metricSampledAt)<180000;const trafficFresh=cloud.trafficAvailable&&Date.now()-Date.parse(cloud.trafficSampledAt)<900000;const occupancy=state.maxRelaySessions?state.activeRelaySessions/state.maxRelaySessions:0;const high=occupancy>=.9||(cloudFresh&&(cloud.cpuPercent>=85||cloud.memoryPercent>=90||cloud.diskPercent>=90||cloud.outRatioPercent>=90));const caution=occupancy>=.75||(cloudFresh&&(cloud.cpuPercent>=65||cloud.memoryPercent>=80||cloud.diskPercent>=80||cloud.outRatioPercent>=70));const label=!relay?'中继不可用':high?'压力较高':!cloudFresh?'云监控数据过期':caution?'需要关注':'压力正常';
+el('healthText').textContent=label;el('healthText').className='state'+(!relay||!cloudFresh&&!high?' down':high?' critical':caution?' warn':'');el('sampleTime').textContent=cloudFresh?'采样时间 '+new Date(cloud.metricSampledAt).toLocaleTimeString('zh-CN',{hour:'2-digit',minute:'2-digit'}):'等待采样';
+el('throughput').replaceChildren(metric(cloudFresh?number(cloud.outMbps,2)+' Mbps':'—','公网发送'),metric(cloudFresh?number(cloud.inMbps,2)+' Mbps':'—','公网接收'));
+el('serverMetrics').replaceChildren(metric(cloudFresh?number(cloud.cpuPercent,1)+'%':'—','CPU 使用率',null,cloudFresh?toneAbove(cloud.cpuPercent,65,85):''),metric(cloudFresh?number(cloud.memoryPercent,1)+'%':'—','内存使用率',null,cloudFresh?toneAbove(cloud.memoryPercent,80,90):''),metric(cloudFresh?number(cloud.diskPercent,1)+'%':'—','系统盘使用率',null,cloudFresh?toneAbove(cloud.diskPercent,80,90):''),metric(cloudFresh?number(cloud.cpuLoad1,2):'—','1 分钟负载'),metric(cloudFresh?number(cloud.outRatioPercent,1)+'%':'—','出口带宽使用率',null,cloudFresh?toneAbove(cloud.outRatioPercent,70,90):''));
+const gb=value=>value==null?'—':number(Number(value)/1073741824,2)+' GB';
+el('trafficUsage').textContent=trafficFresh?'已用 '+gb(cloud.trafficUsedBytes)+' / '+gb(cloud.trafficTotalBytes):'流量暂不可用';
+el('trafficNote').textContent=trafficFresh?'更新时间 '+new Date(cloud.trafficSampledAt).toLocaleTimeString('zh-CN',{hour:'2-digit',minute:'2-digit'}):'暂不可用';
+renderTrafficTimeline(cloud,trafficFresh);
+el('metrics').replaceChildren(metric(number(state.activeRelaySessions)+' / '+number(state.maxRelaySessions),'受限转发',null,state.maxRelaySessions?toneAbove(state.activeRelaySessions/state.maxRelaySessions,.75,.9):''),metric(number(state.activeExemptRelaySessions),'白名单转发'),metric(number(state.websocketConnections),'WebSocket 连接'),metric(number(state.onlineComputers),'在线工作站'),metric(number(state.activePhones),'活动移动端'))}
+let editorItem=null,editorMode='new',writing=false;
+function openEditor(item=null,duplicate=false){editorItem=duplicate?null:item;editorMode=duplicate?'new':item?.status==='draft'?'draft':item?'view':'new';el('editorHeading').textContent=duplicate?'复制为新公告':editorMode==='draft'?'编辑草稿':editorMode==='view'?'查看公告':'新建公告';el('title').value=item?.title||'';el('message').value=item?.message||'';el('title').disabled=editorMode==='view';el('message').disabled=editorMode==='view';el('editorActions').hidden=editorMode==='view';el('editorNote').textContent=editorMode==='view'?'已发布内容只读；可复制为新公告再修改。':'发布后会立即替换当前公告并通知在线设备。';el('editorError').hidden=true;el('announcementEditor').showModal();if(editorMode!=='view')el('title').focus()}
+function action(label,className,handler,disabled=false){const button=node('button',className,label);button.type='button';button.disabled=disabled;button.addEventListener('click',handler);return button}
+function renderAnnouncements(state){const available=state.relayAvailable!==false;const items=state.announcements||[];const filter=el('announcementFilter').value;const query=el('announcementSearch').value.trim().toLocaleLowerCase();const visible=items.filter(item=>(filter==='all'||item.status===filter)&&(!query||(item.title+' '+item.message).toLocaleLowerCase().includes(query)));el('newAnnouncement').disabled=!available;el('announcementCount').textContent=available?'共 '+items.length+' 条 · 发布中 '+items.filter(item=>item.status==='active').length+' 条':'中继暂不可用';const list=el('announcementList');list.replaceChildren();if(!visible.length){list.append(node('div','announcement-empty',available?items.length?'没有符合条件的公告':'暂无公告，点击“新建公告”开始':'暂时无法读取公告'));return}
+for(const item of visible){const row=node('article','announcement-row'+(item.status==='active'?' active':''));const summary=node('div');summary.append(node('h3','',item.title),node('p','',item.message));const status=node('span','announcement-status '+item.status,{active:'发布中',draft:'草稿',withdrawn:'已撤下'}[item.status]||'未知');const when=node('span','date',(item.status==='draft'?'修改 ':'发布 ')+date(item.status==='draft'?item.updatedAt:item.publishedAt));const actions=node('div','actions');const path='/admin/api/announcements/'+encodeURIComponent(item.id);
+if(item.status==='draft'){actions.append(action('编辑','secondary',()=>openEditor(item)),action('发布','',()=>{if(!snapshot.announcement||confirm('发布后将替换当前公告，确定发布？'))write('PUT',path+'/publish',{},'公告已发布')},!available),action('删除','danger',()=>{if(confirm('确定删除这条草稿？'))write('DELETE',path,{},'草稿已删除')},!available))}
+else if(item.status==='active'){actions.append(action('查看','secondary',()=>openEditor(item)),action('撤下','danger',()=>{if(confirm('确定撤下当前公告？'))write('PUT',path+'/withdraw',{},'公告已撤下')},!available))}
+else{actions.append(action('查看','secondary',()=>openEditor(item)),action('复制','secondary',()=>openEditor(item,true),!available),action('删除','danger',()=>{if(confirm('确定删除这条已撤下的公告？'))write('DELETE',path,{},'公告记录已删除')},!available))}
+row.append(summary,status,when,actions);list.append(row)}}
+function render(state){snapshot=state;renderOverview(state);renderAnnouncements(state);el('saveLimit').disabled=state.relayAvailable===false;if(document.activeElement!==el('limit'))el('limit').value=state.maxRelaySessions??''}
+async function load(){try{render(await request('/admin/api/status'));setResult('')}catch(error){snapshot=null;el('healthText').textContent='状态暂不可用';el('healthText').className='state down';for(const id of ['metrics','serverMetrics','throughput','announcementList'])el(id).replaceChildren();el('trafficTimeline').hidden=true;el('trafficUsage').textContent='—';el('announcementCount').textContent='暂时无法读取';el('saveLimit').disabled=true;setResult(error.message,true)}}
+async function write(method,path,body,message){if(writing)return false;writing=true;try{await request(path,{method,headers:{'Content-Type':'application/json','X-Code-Relax-Admin':'1'},body:JSON.stringify(body)});await load();setResult(message);return true}catch(error){setResult(error.message,true);if(el('announcementEditor').open){el('editorError').textContent=error.message;el('editorError').hidden=false}return false}finally{writing=false}}
+let usageView='user',usagePage=1,usageTotal=0;
+function usageDuration(value){const seconds=Math.floor(Number(value)||0),hours=Math.floor(seconds/3600),minutes=Math.floor(seconds%3600/60),rest=seconds%60;return hours?hours+' 小时 '+minutes+' 分钟':minutes?minutes+' 分钟 '+rest+' 秒':rest+' 秒'}
+function usageTime(value){return value?new Date(value.replace(' ','T')+'Z').toLocaleTimeString('zh-CN',{timeZone:'Asia/Shanghai',hour:'2-digit',minute:'2-digit',second:'2-digit',hour12:false}):'—'}
+async function loadUsage(){const view=usageView,page=usagePage;el('usageError').textContent='';el('usageCount').textContent='正在读取';try{const result=await request('/admin/api/usage?view='+view+'&page='+page);if(view!==usageView||page!==usagePage||el('usage').hidden)return;usageTotal=result.total;el('usageCount').textContent='今日有记录：'+usageTotal+(view==='user'?' 个用户':' 台工作站')+' · 北京时间';el('usagePageText').textContent='第 '+page+' / '+Math.max(1,Math.ceil(usageTotal/30))+' 页';el('usagePrev').disabled=page<=1;el('usageNext').disabled=page*30>=usageTotal;const rows=el('usageRows');rows.replaceChildren();if(!result.rows.length){rows.append(node('div','empty-note','今日暂无计时记录'));return}for(const item of result.rows){const row=node('div','usage-row');const counts=' · 消息 '+Number(item.message_count||0)+' · 轮次 '+Number(item.turn_count||0);const heading=node('div','usage-row-head');const title=node('span','',view==='user'?item.email:'工作站 …'+item.id.slice(-8));title.title=view==='user'?item.email:item.id;heading.append(title,node('small','hint','最后使用 '+usageTime(item.last_used_at)));row.append(heading,node('strong','',view==='user'?'任务 '+usageDuration(item.today_task_seconds)+counts:'任务 '+usageDuration(item.today_task_seconds)+' · 免费账号 '+usageDuration(item.today_free_task_seconds)+counts));rows.append(row)}}catch(error){if(view===usageView&&page===usagePage){usageTotal=0;el('usageCount').textContent='统计暂不可用';el('usageRows').replaceChildren();el('usagePageText').textContent='';el('usagePrev').disabled=true;el('usageNext').disabled=true;el('usageError').textContent=error.message}}}
+function setUsageView(view){if(usageView===view)return;usageView=view;usagePage=1;el('usageUsers').setAttribute('aria-pressed',String(view==='user'));el('usageComputers').setAttribute('aria-pressed',String(view==='computer'));void loadUsage()}
+el('usageUsers').onclick=()=>setUsageView('user');el('usageComputers').onclick=()=>setUsageView('computer');el('usageRefresh').onclick=()=>loadUsage();el('usagePrev').onclick=()=>{if(usagePage>1){usagePage--;void loadUsage()}};el('usageNext').onclick=()=>{if(usagePage*30<usageTotal){usagePage++;void loadUsage()}};
+function showPage(page){for(const button of document.querySelectorAll('[data-page]'))button.setAttribute('aria-current',button.dataset.page===page?'page':'false');for(const section of document.querySelectorAll('.page'))section.hidden=section.id!==page;history.replaceState(null,'','#'+page);if(page==='usage')void loadUsage();else void load()}
+for(const button of document.querySelectorAll('[data-page]'))button.addEventListener('click',()=>showPage(button.dataset.page));
+el('saveLimit').addEventListener('click',()=>write('PUT','/admin/api/settings',{maxRelaySessions:Number(el('limit').value)},'转发容量已保存'));
+el('newAnnouncement').addEventListener('click',()=>openEditor());el('closeEditor').addEventListener('click',()=>el('announcementEditor').close());el('announcementSearch').addEventListener('input',()=>{if(snapshot)renderAnnouncements(snapshot)});el('announcementFilter').addEventListener('change',()=>{if(snapshot)renderAnnouncements(snapshot)});
+async function saveAnnouncement(publish){const title=el('title').value.trim(),message=el('message').value.trim();if(!title||!message){el('editorError').textContent='请填写标题和正文';el('editorError').hidden=false;return}if(publish&&snapshot?.announcement&&snapshot.announcement.id!==editorItem?.id&&!confirm('发布后将替换当前公告，确定发布？'))return;const path=editorMode==='draft'?'/admin/api/announcements/'+encodeURIComponent(editorItem.id):'/admin/api/announcements';const target=publish&&editorMode==='draft'?path+'/publish':path;const body={title,message};if(publish&&editorMode==='new')body.publish=true;const ok=await write('PUT',target,body,publish?'公告已发布':'草稿已保存');if(ok)el('announcementEditor').close()}
+el('saveDraft').addEventListener('click',()=>saveAnnouncement(false));el('publish').addEventListener('click',()=>saveAnnouncement(true));
+showPage(['overview','announcements','settings','usage'].includes(location.hash.slice(1))?location.hash.slice(1):'overview');setInterval(()=>{if(!document.hidden&&!el('overview').hidden)load()},5000);
+</script></body></html>`.replaceAll('/admin/api/', basePath + '/api/');
+}

package/dist/src/self-relay/admin-server.mjs

@@ -0,0 +1,74 @@
+import http from 'node:http';
+import fs from 'node:fs';
+import { adminPage } from './admin-page.mjs';
+import { startAdminCloud } from './admin-cloud.mjs';
+import { MAX_ADMIN_REQUEST_BYTES } from './admin-state.mjs';
+
+function reply(response, status, body, type = 'application/json; charset=utf-8') {
+  const bytes = typeof body === 'string' ? body : JSON.stringify(body);
+  response.writeHead(status, { 'Content-Type': type, 'Content-Length': Buffer.byteLength(bytes),
+    'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff',
+    'Referrer-Policy': 'no-referrer', 'X-Robots-Tag': 'noindex, nofollow', 'X-Frame-Options': 'DENY' });
+  response.end(bytes);
+}
+
+export async function startAdminServer({ port = 45851, relayUrl = 'http://127.0.0.1:45850', accessFile = '/etc/codex-relay/admin-access.json' } = {}) {
+  const { key } = JSON.parse(fs.readFileSync(accessFile, 'utf8'));
+  if (!/^[A-Za-z0-9_-]{43}$/.test(key)) throw new Error('Invalid admin access key');
+  const basePath = '/admin/' + key;
+  const cloud = startAdminCloud();
+  const relayOrigin = new URL(relayUrl);
+  if (relayOrigin.hostname !== '127.0.0.1' || relayOrigin.protocol !== 'http:' || relayOrigin.pathname !== '/') {
+    cloud.close(); throw new Error('Admin relay endpoint must be loopback HTTP');
+  }
+  const server = http.createServer(async (request, response) => {
+    const target = new URL(request.url || '/', 'http://localhost');
+    if (request.method === 'GET' && target.pathname === '/admin/health') { reply(response, 200, { ok: true }); return; }
+    if (request.headers['sec-fetch-site'] === 'cross-site' && request.method !== 'GET') { reply(response, 403, { error: 'Cross-site request rejected' }); return; }
+    if (target.pathname !== basePath && !target.pathname.startsWith(basePath + '/')) { reply(response, 404, { error: 'Not found' }); return; }
+    target.pathname = '/admin' + target.pathname.slice(basePath.length);
+    if (request.method === 'GET' && ['/admin', '/admin/'].includes(target.pathname)) {
+      reply(response, 200, adminPage(basePath), 'text/html; charset=utf-8'); return;
+    }
+    if (request.method === 'GET' && target.pathname === '/admin/usage') {
+      response.writeHead(302, { Location: basePath + '#usage', 'Cache-Control': 'no-store' }); response.end(); return;
+    }
+    if (request.method === 'GET' && ['/admin/api/status', '/admin/api/session', '/admin/api/usage', '/admin/api/usage-diagnostics'].includes(target.pathname)) {
+      try {
+        const upstream = await fetch(new URL(target.pathname + target.search, relayOrigin), {
+          signal: AbortSignal.timeout(3000), headers: { 'X-Code-Relax-Admin-Key': key } });
+        const state = await upstream.json();
+        if (!upstream.ok) { reply(response, upstream.status, state); return; }
+        reply(response, 200, target.pathname === '/admin/api/status'
+          ? { ...state, relayAvailable: true, cloud: cloud.read() } : state);
+      } catch {
+        reply(response, 503, { error: '中继服务暂不可用' });
+      }
+      return;
+    }
+    if (!target.pathname.startsWith('/admin/api/') || !['PUT', 'DELETE', 'POST'].includes(request.method || '')) {
+      reply(response, 404, { error: 'Not found' }); return;
+    }
+    try {
+      const chunks = [];
+      let size = 0;
+      for await (const chunk of request) {
+        size += chunk.length;
+        if (size > MAX_ADMIN_REQUEST_BYTES) { reply(response, 413, { error: 'Admin request too large' }); return; }
+        chunks.push(chunk);
+      }
+      const upstream = await fetch(new URL(target.pathname + target.search, relayOrigin), {
+        method: request.method, signal: AbortSignal.timeout(3000),
+        headers: { 'Content-Type': request.headers['content-type'] || '',
+          'X-Code-Relax-Admin': request.headers['x-code-relax-admin'] || '',
+          'X-Code-Relax-Admin-Key': key },
+        body: Buffer.concat(chunks),
+      });
+      reply(response, upstream.status, await upstream.text());
+    } catch { reply(response, 503, { error: '中继服务暂不可用' }); }
+  });
+  try {
+    await new Promise((resolve, reject) => { server.once('error', reject); server.listen(port, '127.0.0.1', resolve); });
+  } catch (error) { cloud.close(); throw error; }
+  return { port: server.address().port, async close() { cloud.close(); await new Promise(resolve => server.close(resolve)); } };
+}