@walkhi/code-relax 0.1.0-beta.30 → 0.1.0-beta.32

package/dist/bin/release-upload-server.mjs

@@ -0,0 +1,174 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import http from 'node:http';
+import { createHash, randomUUID } from 'node:crypto';
+import { pipeline } from 'node:stream/promises';
+import { Transform, Readable } from 'node:stream';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { fileURLToPath } from 'node:url';
+import { verifyReleaseIdentity, createUploadSigner } from '../relay-admin/release-oidc.mjs';
+import { androidReleaseStorage } from '../relay-admin/android-release-storage.mjs';
+import { readAndroidCatalog } from '../src/self-relay/android-releases.mjs';
+
+import { readHarmonyConfig, validateHarmonyMetadata, checkHarmonyVersion, verifyHarmony, activateHarmony } from '../relay-admin/harmony-release.mjs';
+
+const execute = promisify(execFile);
+const config = JSON.parse(fs.readFileSync('/etc/codex-relay/android-releases.json', 'utf8'));
+const credential = JSON.parse(fs.readFileSync('/etc/codex-relay/tencent-monitor.json', 'utf8'));
+const storage = androidReleaseStorage('/etc/codex-relay/android-releases.json', '/etc/codex-relay/tencent-monitor.json');
+const signUpload = createUploadSigner(config, { secretId: credential.secretId, secretKey: credential.secretKey });
+const stateDir = '/var/lib/codex-relay/release-publisher';
+fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+const cosCall = (method, args) => new Promise((resolve, reject) => storage.cos[method](args, (e, r) => e ? reject(e) : resolve(r)));
+const object = key => ({ Bucket: config.bucket, Region: config.region, Key: key });
+const identityKey = p => `${p.repository_id}/${p.run_id}/${p.run_attempt}/${p.sha}`;
+const filename = id => path.join(stateDir, id + '.json');
+function save(row) {
+  const temp = filename(row.intentId) + '.' + randomUUID();
+  fs.writeFileSync(temp, JSON.stringify(row), { mode: 0o600 }); fs.renameSync(temp, filename(row.intentId));
+}
+const read = id => fs.existsSync(filename(id)) ? JSON.parse(fs.readFileSync(filename(id))) : null;
+const publicState = row => ({ ok: true, intentId: row.intentId, status: row.status, result: row.result, error: row.error });
+async function readJson(req) {
+  const chunks = []; let size = 0;
+  for await (const chunk of req) { size += chunk.length; if (size > 16384) throw Error('Request too large'); chunks.push(chunk); }
+  return JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}');
+}
+function metadataFrom(data, claims, target) {
+  const { packageName, versionCode, versionName, size, sha256, contentMd5, certificateSha256, notes,
+    buildCommit, artifactId, runId, sourceCommit, verifyOnly } = data;
+  if (!Number.isSafeInteger(versionCode) || versionCode < 1 || versionCode > 2100000000
+    || !/^[a-f0-9]{64}$/.test(sha256)
+    || !Number.isSafeInteger(size) || size < 1 || size > 200 * 1024 * 1024
+    || typeof notes !== 'string' || notes.length > 2000 || !/^[A-Za-z0-9+/]{22}==$/.test(contentMd5)
+    || !/^\d+$/.test(artifactId) || runId !== claims.run_id || sourceCommit !== claims.sha
+    || typeof verifyOnly !== 'boolean' || !/^[a-f0-9]{40}$/.test(buildCommit)) throw Error('Invalid metadata');
+  if (target === 'hap') validateHarmonyMetadata(data, readHarmonyConfig());
+  else if (packageName !== 'com.walkhi.codexremote' || !/^\d+\.\d+\.\d+\.\d+$/.test(versionName)
+    || !versionName.endsWith('.' + versionCode) || certificateSha256 !== config.certificateSha256) throw Error('Invalid Android identity');
+  return { target, ...(target === 'hap' ? { files: data.files } : {}), packageName, versionCode, versionName, size, sha256, contentMd5, certificateSha256, notes,
+    buildCommit, artifactId, runId, sourceCommit, verifyOnly };
+}
+let busy = false;
+const server = http.createServer(async (req, res) => {
+  const reply = (code, data) => { if (!res.destroyed) { res.writeHead(code, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }); res.end(JSON.stringify(data)); } };
+  let claims;
+  try { claims = await verifyReleaseIdentity((req.headers.authorization || '').replace(/^Bearer /, '')); }
+  catch { reply(401, { ok: false, error: 'OIDC_REJECTED' }); return; }
+  const target = /^\/code-relax\/publish\/(android|hap)\/intents(?:\/|$)/.exec(req.url || '')?.[1];
+  if (!target) { reply(404, { ok: false, error: 'NOT_FOUND' }); return; }
+  const prefix = `/code-relax/publish/${target}/intents`;
+  try {
+    if (req.method === 'POST' && req.url === prefix) {
+      let metadata;
+      try { metadata = metadataFrom(await readJson(req), claims, target); } catch { reply(400, { ok: false, error: 'INVALID_RELEASE' }); return; }
+      if (!metadata.verifyOnly && target === 'hap') {
+        try { checkHarmonyVersion(metadata); } catch { reply(409, { ok: false, error: 'VERSION_CONFLICT' }); return; }
+      }
+      if (!metadata.verifyOnly && target === 'android') {
+        const catalog = readAndroidCatalog(config.catalogFile);
+        const previous = catalog.releases.find(x => x.versionCode === metadata.versionCode);
+        if (catalog.latestVersionCode > metadata.versionCode || (previous && previous.sha256 !== metadata.sha256)) {
+          reply(409, { ok: false, error: 'VERSION_CONFLICT' }); return;
+        }
+      }
+      const identity = identityKey(claims);
+      const intentId = createHash('sha256').update(JSON.stringify({ identity, metadata })).digest('hex');
+      let row = read(intentId);
+      if (row && row.status !== 'prepared') { reply(200, publicState(row)); return; }
+      const key = metadata.verifyOnly ? `code-relax/android/ci-verification/${claims.run_id}/${intentId}.apk`
+        : `code-relax/android/${metadata.versionCode}/Code-Relax-${metadata.sha256.slice(0, 16)}.apk`;
+      const keys = target === 'hap' ? metadata.files.map(f => metadata.verifyOnly
+        ? `code-relax/harmony/ci-verification/${claims.run_id}/${intentId}/${f.name}`
+        : `code-relax/harmony/${metadata.versionCode}/${f.name}`) : [key];
+      row ??= { intentId, identity, metadata, key, keys, status: 'prepared' };
+      save(row);
+      const grant = target === 'hap' ? { uploads: await Promise.all(metadata.files.map(async (f, i) => ({ name: f.name,
+        ...await signUpload(keys[i], f, i === 1 ? 'application/json' : i === 2 ? 'image/png' : 'application/octet-stream') }))) }
+        : await signUpload(key, metadata);
+      reply(200, { ...publicState(row), ...grant }); return;
+    }
+    const match = new RegExp(`^${prefix}/([a-f0-9]{64})(/complete)?$`).exec(req.url || '');
+    if (!match || !((!match[2] && req.method === 'GET') || (match[2] && req.method === 'POST'))) {
+      reply(404, { ok: false, error: 'NOT_FOUND' }); return;
+    }
+    const row = read(match[1]);
+    if (!row || row.identity !== identityKey(claims) || (row.metadata.target || 'android') !== target) { reply(404, { ok: false, error: 'INTENT_NOT_FOUND' }); return; }
+    if (match[2] && row.status === 'prepared') {
+      if (busy) { reply(409, { ok: false, error: 'PUBLICATION_BUSY' }); return; }
+      busy = true; row.status = 'validating'; save(row);
+      void complete(row).finally(() => { busy = false; });
+    }
+    reply(row.status === 'validating' ? 202 : 200, publicState(row));
+  } catch (error) {
+    console.error(JSON.stringify({ event: 'release-api-failed', code: /^[A-Za-z.]+$/.test(error.code || '') ? error.code : 'io-or-provider' }));
+    reply(503, { ok: false, error: 'RELEASE_UNAVAILABLE' });
+  }
+});
+async function complete(row) {
+  const { metadata, key } = row;
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'code-relax-release-'));
+  const apk = path.join(dir, 'release.apk'), json = path.join(dir, 'release.json');
+  const hap = metadata.target === 'hap';
+  const files = hap ? metadata.files : [{ ...metadata, name: 'release.apk' }];
+  let stage = 'download';
+  try {
+    for (const [i, file] of files.entries()) {
+      const ticket = await cosCall('getObjectUrl', { ...object(row.keys?.[i] || key), Sign: true, Method: 'GET', Protocol: 'https:', Expires: 300 });
+      const response = await fetch(ticket.Url, { signal: AbortSignal.timeout(120000) });
+      if (!response.ok || Number(response.headers.get('content-length')) !== file.size) throw Error();
+      let size = 0; const hash = createHash('sha256'), md5 = createHash('md5');
+      await pipeline(Readable.fromWeb(response.body), new Transform({ transform(chunk, encoding, next) {
+        size += chunk.length; if (size > file.size) return next(Error('Oversize'));
+        hash.update(chunk); md5.update(chunk); next(null, chunk);
+      } }), fs.createWriteStream(path.join(dir, file.name), { flags: 'wx', mode: 0o600 }));
+      if (size !== file.size || hash.digest('hex') !== file.sha256 || md5.digest('base64') !== file.contentMd5) throw Error();
+      const unsigned = new URL(ticket.Url); unsigned.search = '';
+      if (!hap && (await fetch(unsigned, { method: 'HEAD', signal: AbortSignal.timeout(15000) })).status !== 403) throw Error();
+    }
+    if (hap) {
+      stage = 'harmony-signature';
+      await verifyHarmony(dir, metadata, readHarmonyConfig());
+      row.result = { sha256: metadata.sha256, versionCode: metadata.versionCode, size: metadata.size };
+      if (metadata.verifyOnly) row.status = 'verified';
+      else { stage = 'harmony-publish'; row.result = await activateHarmony(metadata, storage, row.keys); row.status = 'published'; }
+      save(row); return;
+    }
+    stage = 'signature';
+    const { stdout: signature } = await execute('/usr/bin/apksigner', ['verify', '--print-certs', apk], {
+      timeout: 30000, env: { ...process.env, JAVA_TOOL_OPTIONS: '-Xmx256m' } });
+    const certificates = [...signature.matchAll(/^Signer #\d+ certificate SHA-256 digest: ([a-f0-9]{64})$/gm)];
+    if (certificates.length !== 1 || certificates[0][1] !== metadata.certificateSha256) throw Error();
+    stage = 'identity';
+    const { stdout: badging } = await execute('/usr/bin/aapt', ['dump', 'badging', apk], { timeout: 30000 });
+    const identity = /^package: name='([^']+)' versionCode='(\d+)' versionName='([^']+)'/m.exec(badging);
+    if (!identity || identity[1] !== metadata.packageName || Number(identity[2]) !== metadata.versionCode
+      || identity[3] !== metadata.versionName || /^application-debuggable/m.test(badging)) throw Error();
+    row.result = { sha256: metadata.sha256, versionCode: metadata.versionCode, size: metadata.size };
+    if (metadata.verifyOnly) row.status = 'verified';
+    else {
+      stage = 'publish';
+      fs.writeFileSync(json, JSON.stringify(metadata), { mode: 0o600 });
+      const { stdout } = await execute(process.execPath, [fileURLToPath(new URL('./publish-android-release.mjs', import.meta.url)), apk, json, '--existing-object'], { timeout: 240000 });
+      row.result = JSON.parse(stdout.trim()); row.status = 'published';
+    }
+    save(row);
+  } catch (error) {
+    row.status = 'failed'; row.error = `RELEASE_${stage.toUpperCase()}_FAILED`; save(row);
+    console.error(JSON.stringify({ event: 'release-validation-failed', intentId: row.intentId, stage, code: /^[A-Za-z0-9_.-]+$/.test(error.code || '') ? error.code : 'validation' }));
+  } finally {
+    for (const file of [...files.map(f => path.join(dir, f.name)), json]) fs.rmSync(file, { force: true }); fs.rmdirSync(dir);
+    // Verification objects remain private evidence; the deployment identity has no DeleteObject grant.
+  }
+}
+// A restart never blindly launches an interrupted publisher a second time.
+for (const name of fs.readdirSync(stateDir).filter(x => /^[a-f0-9]{64}\.json$/.test(x))) {
+  const row = read(name.slice(0, -5));
+  if (row.status === 'validating') { row.status = 'failed'; row.error = 'INTERRUPTED_CHECK_LATEST'; save(row); }
+}
+server.requestTimeout = 15000;
+server.listen(45852, '127.0.0.1');
+process.on('SIGTERM', () => { server.close(); const timer = setInterval(() => { if (!busy) { clearInterval(timer); process.exit(0); } }, 250); });

package/dist/bin/self-relay-admin.mjs

@@ -1,8 +1,8 @@
-import { startAdminServer } from '../src/self-relay/admin-server.mjs';
-
-const port = Number(process.env.RELAY_ADMIN_PORT || 45851);
-if (!Number.isSafeInteger(port) || port < 1 || port > 65535) throw new Error('Invalid RELAY_ADMIN_PORT');
-const server = await startAdminServer({ port });
-console.log(JSON.stringify({ service: 'codex-relay-admin', port: server.port }));
-await new Promise(resolve => { process.once('SIGTERM', resolve); process.once('SIGINT', resolve); });
-await server.close();
+import { startAdminServer } from '../src/self-relay/admin-server.mjs';
+
+const port = Number(process.env.RELAY_ADMIN_PORT || 45851);
+if (!Number.isSafeInteger(port) || port < 1 || port > 65535) throw new Error('Invalid RELAY_ADMIN_PORT');
+const server = await startAdminServer({ port });
+console.log(JSON.stringify({ service: 'codex-relay-admin', port: server.port }));
+await new Promise(resolve => { process.once('SIGTERM', resolve); process.once('SIGINT', resolve); });
+await server.close();

package/dist/bin/self-relay-demo.mjs

@@ -1,33 +1,33 @@
-#!/usr/bin/env node
-import { startRelayDemo } from '../src/self-relay/demo.mjs';
-import fs from 'node:fs';
-import { spawnSync } from 'node:child_process';
-
-const mode = 'lan-shared';
-let remoteRelay;
-if (process.env.RELAY_URL) {
-  let hostKey;
-  const sshIndex = process.argv.indexOf('--ssh-host');
-  if (sshIndex !== -1) {
-    const host = process.argv[sshIndex + 1];
-    if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(host || '')) throw new Error('Invalid SSH alias');
-    const result = spawnSync('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10', host,
-      'sudo -n cat /etc/codex-relay/host.key'], { encoding: 'utf8', timeout: 15000, windowsHide: true });
-    if (result.error || result.status !== 0) throw new Error('Cannot read relay credential through SSH');
-    hostKey = result.stdout.trim();
-  } else hostKey = fs.readFileSync(process.env.RELAY_HOST_KEY_FILE, 'utf8').trim();
-  remoteRelay = { url: process.env.RELAY_URL, hostKey };
-}
-const demo = await startRelayDemo({ mode, remoteRelay });
-let client;
-try {
-  client = demo.connect(); await client.ready;
-  const health = await client.request('/api/health');
-  if (health.status !== 200 || health.body.transportMode !== mode) throw new Error('Relay validation failed');
-  console.log(JSON.stringify({ ok: true, simulated: true, mode, relay: demo.relay.url,
-    bridge: demo.bridgeUrl, message: '中继 → 连接器 → 模拟桌面服务已连通；未连接 Codex，未执行任务。' }, null, 2));
-  if (!process.argv.includes('--check')) {
-    console.log('验证连接保持运行。Ctrl+C 停止全部模拟进程内服务。');
-    await new Promise(resolve => { process.once('SIGINT', resolve); process.once('SIGTERM', resolve); });
-  }
-} finally { client?.close(); await demo.close(); }
+#!/usr/bin/env node
+import { startRelayDemo } from '../src/self-relay/demo.mjs';
+import fs from 'node:fs';
+import { spawnSync } from 'node:child_process';
+
+const mode = 'lan-shared';
+let remoteRelay;
+if (process.env.RELAY_URL) {
+  let hostKey;
+  const sshIndex = process.argv.indexOf('--ssh-host');
+  if (sshIndex !== -1) {
+    const host = process.argv[sshIndex + 1];
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(host || '')) throw new Error('Invalid SSH alias');
+    const result = spawnSync('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10', host,
+      'sudo -n cat /etc/codex-relay/host.key'], { encoding: 'utf8', timeout: 15000, windowsHide: true });
+    if (result.error || result.status !== 0) throw new Error('Cannot read relay credential through SSH');
+    hostKey = result.stdout.trim();
+  } else hostKey = fs.readFileSync(process.env.RELAY_HOST_KEY_FILE, 'utf8').trim();
+  remoteRelay = { url: process.env.RELAY_URL, hostKey };
+}
+const demo = await startRelayDemo({ mode, remoteRelay });
+let client;
+try {
+  client = demo.connect(); await client.ready;
+  const health = await client.request('/api/health');
+  if (health.status !== 200 || health.body.transportMode !== mode) throw new Error('Relay validation failed');
+  console.log(JSON.stringify({ ok: true, simulated: true, mode, relay: demo.relay.url,
+    bridge: demo.bridgeUrl, message: '中继 → 连接器 → 模拟桌面服务已连通；未连接 Codex，未执行任务。' }, null, 2));
+  if (!process.argv.includes('--check')) {
+    console.log('验证连接保持运行。Ctrl+C 停止全部模拟进程内服务。');
+    await new Promise(resolve => { process.once('SIGINT', resolve); process.once('SIGTERM', resolve); });
+  }
+} finally { client?.close(); await demo.close(); }

package/dist/bin/self-relay-server.mjs

@@ -1,66 +1,66 @@
-#!/usr/bin/env node
-import fs from 'node:fs';
-import serviceEndpoints from '../shared/service-endpoints.cjs';
-import { deviceStore, validId } from '../src/self-relay/device-store.mjs';
-import { openRelayMysql } from '../src/self-relay/mysql-state.mjs';
-import { startSelfRelay } from '../src/self-relay/server.mjs';
-import { updateDebugAllowlist } from '../src/self-relay/debug-allowlist.mjs';
-
-const keyFile = process.env.RELAY_HOST_KEY_FILE;
-if (!keyFile) throw new Error('RELAY_HOST_KEY_FILE is required');
-const hostKey = fs.readFileSync(keyFile, 'utf8').trim();
-const port = Number(process.env.RELAY_PORT || 45850);
-if (!Number.isInteger(port) || port < 1024 || port > 65535) throw new Error('Invalid RELAY_PORT');
-const stateFile = process.env.RELAY_STATE_FILE;
-const mysqlConfigFile = process.env.RELAY_MYSQL_CONFIG_FILE;
-const accountConfigFile = process.env.RELAY_ACCOUNT_CONFIG_FILE;
-const longPairingFile = process.env.RELAY_LONG_PAIRING_FILE || '/var/lib/codex-relay/long-pairing.json';
-if (!stateFile && !mysqlConfigFile) throw new Error('RELAY_STATE_FILE or RELAY_MYSQL_CONFIG_FILE is required');
-const debugAllowlistFile = process.env.RELAY_DEBUG_ALLOWLIST_FILE || '/etc/codex-relay/debug-allowlist.json';
-const adminStateFile = process.env.RELAY_ADMIN_STATE_FILE || '/var/lib/codex-relay/admin.json';
-const maxRelaySessions = Number(process.env.RELAY_MAX_RELAY_SESSIONS || 8);
-if (!Number.isSafeInteger(maxRelaySessions) || maxRelaySessions < 1 || maxRelaySessions > 256) throw new Error('Invalid RELAY_MAX_RELAY_SESSIONS');
-const debugCommand = process.argv.find(value => ['--debug-list', '--debug-allow', '--debug-deny'].includes(value));
-if (debugCommand) {
-  const database = mysqlConfigFile ? await openRelayMysql(mysqlConfigFile, maxRelaySessions) : null;
-  const records = (database?.devices || deviceStore(stateFile)).entries();
-  if (debugCommand === '--debug-list') {
-    console.log(JSON.stringify(records.map(record => ({
-      deviceId: record.id, status: record.status, clientCount: record.clients.length,
-    })), null, 2));
-  } else {
-    const index = process.argv.indexOf(debugCommand), deviceId = process.argv[index + 1];
-    if (!validId(deviceId)) throw new Error('Invalid device ID');
-    const record = records.find(record => record.id === deviceId && record.status === 'active');
-    if (!record && debugCommand === '--debug-allow') throw new Error('Active paired device not found');
-    updateDebugAllowlist(debugAllowlistFile, deviceId, debugCommand === '--debug-allow');
-    console.log('Debug allowlist updated; restart relay to apply.');
-  }
-  if (database) await database.close();
-  process.exit(0);
-}
-if (process.argv.includes('--init-state')) { if (mysqlConfigFile) throw new Error('Use migrations for MySQL mode'); deviceStore(stateFile, { initialize: true }); console.log('Device store initialized'); process.exit(0); }
-const revokeIndex = process.argv.indexOf('--revoke-host');
-if (revokeIndex >= 0) {
-  // Run only with the service stopped: this is an offline administrator operation.
-  if (!process.argv.includes('--offline')) throw new Error('Stop the relay service and supply --offline');
-  const id = process.argv[revokeIndex + 1];
-  if (!validId(id)) throw new Error('Invalid device ID');
-  const database = mysqlConfigFile ? await openRelayMysql(mysqlConfigFile, maxRelaySessions) : null;
-  const store = database?.devices || deviceStore(stateFile), record = store.entries().find(item => item.id === id);
-  if (!record) throw new Error('Device not found');
-  await store.save({ ...record, status: 'revoked', clients: [], revision: record.revision + 1, updatedAt: new Date().toISOString() });
-  if (database) await database.close();
-  console.log('Computer and phone authorization revoked'); process.exit(0);
-}
-const relay = await startSelfRelay({ port, hostKey, stateFile, mysqlConfigFile, accountConfigFile, debugAllowlistFile, adminStateFile, maxRelaySessions,
-  longPairingFile,
-  androidReleaseConfigFile: process.env.RELAY_ANDROID_RELEASE_CONFIG_FILE,
-  androidReleaseCredentialFile: process.env.CREDENTIALS_DIRECTORY ? `${process.env.CREDENTIALS_DIRECTORY}/tencent-monitor.json` : undefined,
-  usageDiagnosticKeyFile: process.env.RELAY_USAGE_DIAGNOSTIC_KEY_FILE,
-  publicRelayUrl: process.env.RELAY_PUBLIC_URL || serviceEndpoints.relayUrl, appDownloadUrl: process.env.RELAY_APP_DOWNLOAD_URL || serviceEndpoints.installUrl,
-  log: entry => console.log(JSON.stringify({ time: new Date().toISOString(), ...entry })) });
-console.log(JSON.stringify({ service: 'codex-self-relay', listen: relay.url, maxConnections: 128, maxRelaySessions,
-  maxFrameMiB: 8, encryption: 'TLS must be supplied by reverse proxy; no end-to-end encryption' }));
-await new Promise(resolve => { process.once('SIGTERM', resolve); process.once('SIGINT', resolve); });
-await relay.close();
+#!/usr/bin/env node
+import fs from 'node:fs';
+import serviceEndpoints from '../shared/service-endpoints.cjs';
+import { deviceStore, validId } from '../src/self-relay/device-store.mjs';
+import { openRelayMysql } from '../src/self-relay/mysql-state.mjs';
+import { startSelfRelay } from '../src/self-relay/server.mjs';
+import { updateDebugAllowlist } from '../src/self-relay/debug-allowlist.mjs';
+
+const keyFile = process.env.RELAY_HOST_KEY_FILE;
+if (!keyFile) throw new Error('RELAY_HOST_KEY_FILE is required');
+const hostKey = fs.readFileSync(keyFile, 'utf8').trim();
+const port = Number(process.env.RELAY_PORT || 45850);
+if (!Number.isInteger(port) || port < 1024 || port > 65535) throw new Error('Invalid RELAY_PORT');
+const stateFile = process.env.RELAY_STATE_FILE;
+const mysqlConfigFile = process.env.RELAY_MYSQL_CONFIG_FILE;
+const accountConfigFile = process.env.RELAY_ACCOUNT_CONFIG_FILE;
+const longPairingFile = process.env.RELAY_LONG_PAIRING_FILE || '/var/lib/codex-relay/long-pairing.json';
+if (!stateFile && !mysqlConfigFile) throw new Error('RELAY_STATE_FILE or RELAY_MYSQL_CONFIG_FILE is required');
+const debugAllowlistFile = process.env.RELAY_DEBUG_ALLOWLIST_FILE || '/etc/codex-relay/debug-allowlist.json';
+const adminStateFile = process.env.RELAY_ADMIN_STATE_FILE || '/var/lib/codex-relay/admin.json';
+const maxRelaySessions = Number(process.env.RELAY_MAX_RELAY_SESSIONS || 8);
+if (!Number.isSafeInteger(maxRelaySessions) || maxRelaySessions < 1 || maxRelaySessions > 256) throw new Error('Invalid RELAY_MAX_RELAY_SESSIONS');
+const debugCommand = process.argv.find(value => ['--debug-list', '--debug-allow', '--debug-deny'].includes(value));
+if (debugCommand) {
+  const database = mysqlConfigFile ? await openRelayMysql(mysqlConfigFile, maxRelaySessions) : null;
+  const records = (database?.devices || deviceStore(stateFile)).entries();
+  if (debugCommand === '--debug-list') {
+    console.log(JSON.stringify(records.map(record => ({
+      deviceId: record.id, status: record.status, clientCount: record.clients.length,
+    })), null, 2));
+  } else {
+    const index = process.argv.indexOf(debugCommand), deviceId = process.argv[index + 1];
+    if (!validId(deviceId)) throw new Error('Invalid device ID');
+    const record = records.find(record => record.id === deviceId && record.status === 'active');
+    if (!record && debugCommand === '--debug-allow') throw new Error('Active paired device not found');
+    updateDebugAllowlist(debugAllowlistFile, deviceId, debugCommand === '--debug-allow');
+    console.log('Debug allowlist updated; restart relay to apply.');
+  }
+  if (database) await database.close();
+  process.exit(0);
+}
+if (process.argv.includes('--init-state')) { if (mysqlConfigFile) throw new Error('Use migrations for MySQL mode'); deviceStore(stateFile, { initialize: true }); console.log('Device store initialized'); process.exit(0); }
+const revokeIndex = process.argv.indexOf('--revoke-host');
+if (revokeIndex >= 0) {
+  // Run only with the service stopped: this is an offline administrator operation.
+  if (!process.argv.includes('--offline')) throw new Error('Stop the relay service and supply --offline');
+  const id = process.argv[revokeIndex + 1];
+  if (!validId(id)) throw new Error('Invalid device ID');
+  const database = mysqlConfigFile ? await openRelayMysql(mysqlConfigFile, maxRelaySessions) : null;
+  const store = database?.devices || deviceStore(stateFile), record = store.entries().find(item => item.id === id);
+  if (!record) throw new Error('Device not found');
+  await store.save({ ...record, status: 'revoked', clients: [], revision: record.revision + 1, updatedAt: new Date().toISOString() });
+  if (database) await database.close();
+  console.log('Computer and phone authorization revoked'); process.exit(0);
+}
+const relay = await startSelfRelay({ port, hostKey, stateFile, mysqlConfigFile, accountConfigFile, debugAllowlistFile, adminStateFile, maxRelaySessions,
+  longPairingFile,
+  androidReleaseConfigFile: process.env.RELAY_ANDROID_RELEASE_CONFIG_FILE,
+  androidReleaseCredentialFile: process.env.CREDENTIALS_DIRECTORY ? `${process.env.CREDENTIALS_DIRECTORY}/tencent-monitor.json` : undefined,
+  usageDiagnosticKeyFile: process.env.RELAY_USAGE_DIAGNOSTIC_KEY_FILE,
+  publicRelayUrl: process.env.RELAY_PUBLIC_URL || serviceEndpoints.relayUrl, appDownloadUrl: process.env.RELAY_APP_DOWNLOAD_URL || serviceEndpoints.installUrl,
+  log: entry => console.log(JSON.stringify({ time: new Date().toISOString(), ...entry })) });
+console.log(JSON.stringify({ service: 'codex-self-relay', listen: relay.url, maxConnections: 128, maxRelaySessions,
+  maxFrameMiB: 8, encryption: 'TLS must be supplied by reverse proxy; no end-to-end encryption' }));
+await new Promise(resolve => { process.once('SIGTERM', resolve); process.once('SIGINT', resolve); });
+await relay.close();

package/dist/build-platform.json

@@ -1 +1 @@
-{"layout":"npm-platform-packages","version":"0.1.0-beta.30"}
+{"layout":"npm-platform-packages","version":"0.1.0-beta.32"}

package/dist/get-lan-networks.ps1

@@ -1,40 +1,40 @@
-[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
-
-$profiles = @{}
-Get-NetConnectionProfile -ErrorAction SilentlyContinue | ForEach-Object {
-    $profiles[[int]$_.InterfaceIndex] = [string]$_.Name
-}
-
-$networks = [System.Net.NetworkInformation.NetworkInterface]::GetAllNetworkInterfaces() |
-    Where-Object {
-        $_.OperationalStatus -eq 'Up' -and
-        $_.NetworkInterfaceType -in @('Wireless80211', 'Ethernet') -and
-        $_.GetIPProperties().GatewayAddresses.Count -gt 0
-    } | ForEach-Object {
-        $adapter = $_
-        $properties = $adapter.GetIPProperties()
-        $interfaceIndex = $properties.GetIPv4Properties().Index
-        $networkType = if ($adapter.NetworkInterfaceType -eq 'Wireless80211') { 'wifi' } else { 'ethernet' }
-        $networkName = $profiles[$interfaceIndex]
-        if ($networkType -eq 'wifi') {
-            $wlan = (& netsh wlan show interfaces interface="$($adapter.Name)" 2>$null) -join "`n"
-            $ssid = [regex]::Match($wlan, '(?m)^\s*SSID\s*:\s*(.*?)\s*$')
-            if ($ssid.Success -and -not [string]::IsNullOrWhiteSpace($ssid.Groups[1].Value)) {
-                $networkName = $ssid.Groups[1].Value.Trim()
-            }
-        }
-        if ([string]::IsNullOrWhiteSpace($networkName)) { $networkName = $adapter.Name }
-        $properties.UnicastAddresses | Where-Object {
-            $_.Address.AddressFamily -eq 'InterNetwork' -and
-            $_.Address.IPAddressToString -match '^(192\.168\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|100\.(6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\.)'
-        } | ForEach-Object {
-            [PSCustomObject]@{
-                address = $_.Address.IPAddressToString
-                networkType = $networkType
-                networkName = $networkName
-                interfaceName = [string]$adapter.Name
-            }
-        }
-    }
-
-ConvertTo-Json -InputObject @($networks) -Compress
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+
+$profiles = @{}
+Get-NetConnectionProfile -ErrorAction SilentlyContinue | ForEach-Object {
+    $profiles[[int]$_.InterfaceIndex] = [string]$_.Name
+}
+
+$networks = [System.Net.NetworkInformation.NetworkInterface]::GetAllNetworkInterfaces() |
+    Where-Object {
+        $_.OperationalStatus -eq 'Up' -and
+        $_.NetworkInterfaceType -in @('Wireless80211', 'Ethernet') -and
+        $_.GetIPProperties().GatewayAddresses.Count -gt 0
+    } | ForEach-Object {
+        $adapter = $_
+        $properties = $adapter.GetIPProperties()
+        $interfaceIndex = $properties.GetIPv4Properties().Index
+        $networkType = if ($adapter.NetworkInterfaceType -eq 'Wireless80211') { 'wifi' } else { 'ethernet' }
+        $networkName = $profiles[$interfaceIndex]
+        if ($networkType -eq 'wifi') {
+            $wlan = (& netsh wlan show interfaces interface="$($adapter.Name)" 2>$null) -join "`n"
+            $ssid = [regex]::Match($wlan, '(?m)^\s*SSID\s*:\s*(.*?)\s*$')
+            if ($ssid.Success -and -not [string]::IsNullOrWhiteSpace($ssid.Groups[1].Value)) {
+                $networkName = $ssid.Groups[1].Value.Trim()
+            }
+        }
+        if ([string]::IsNullOrWhiteSpace($networkName)) { $networkName = $adapter.Name }
+        $properties.UnicastAddresses | Where-Object {
+            $_.Address.AddressFamily -eq 'InterNetwork' -and
+            $_.Address.IPAddressToString -match '^(192\.168\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|100\.(6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\.)'
+        } | ForEach-Object {
+            [PSCustomObject]@{
+                address = $_.Address.IPAddressToString
+                networkType = $networkType
+                networkName = $networkName
+                interfaceName = [string]$adapter.Name
+            }
+        }
+    }
+
+ConvertTo-Json -InputObject @($networks) -Compress

package/dist/get-shared-service-url.ps1

@@ -1,6 +1,6 @@
-# Detect the Desktop connection, not merely a listening standalone server.
-$connections = @(Get-NetTCPConnection -RemotePort 45839 -State Established -ErrorAction SilentlyContinue | Where-Object {
-    $_.RemoteAddress -eq '127.0.0.1' -and
-    (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName -eq 'ChatGPT'
-})
-if ($connections.Count) { 'ws://127.0.0.1:45839' }
+# Detect the Desktop connection, not merely a listening standalone server.
+$connections = @(Get-NetTCPConnection -RemotePort 45839 -State Established -ErrorAction SilentlyContinue | Where-Object {
+    $_.RemoteAddress -eq '127.0.0.1' -and
+    (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName -eq 'ChatGPT'
+})
+if ($connections.Count) { 'ws://127.0.0.1:45839' }