@walkhi/code-relax 0.1.0-beta.30 → 0.1.0-beta.32

package/dist/src/workstation-downloads.mjs

@@ -1,120 +1,120 @@
-import fs from 'node:fs/promises';
-import { constants } from 'node:fs';
-import path from 'node:path';
-import crypto from 'node:crypto';
-import { fileRevision, FILE_PART_BYTES, FILE_READ_LIMIT } from './file-transfer-range.mjs';
-import { readRecord, writeRecord } from './service-lifecycle.mjs';
-
-const fail = (message, statusCode = 400) => { throw Object.assign(new Error(message), { statusCode }); };
-const pathKey = value => process.platform === 'win32' ? value.toLowerCase() : value;
-const validName = value => typeof value === 'string' && value.length > 0
-  && !/[<>:"/\\|?*\x00-\x1f]/.test(value) && !/[ .]$/.test(value) && !['.', '..'].includes(value)
-  && !/^(?:con|prn|aux|nul|com[1-9¹²³]|lpt[1-9¹²³])(?:\.|$)/i.test(value);
-
-// A saved copy belongs to the authorized external asset, rather than its current chat page.
-export class WorkstationDownloads {
-  constructor(stateRoot) {
-    this.recordPath = path.join(stateRoot, 'external-file-copies.json');
-    this.copies = readRecord(this.recordPath) || {};
-  }
-
-  async copy(sourceId) {
-    const record = this.copies[sourceId];
-    if (!record) return null;
-    try {
-      const stat = await fs.stat(record.path);
-      return stat.isFile() && fileRevision(stat) === record.revision && stat.size === record.size ? record : null;
-    } catch (error) { if (['ENOENT', 'ENOTDIR'].includes(error.code)) return null; throw error; }
-  }
-
-  async folder(rpc, locations, selection) {
-    let root;
-    if (selection.target === 'downloads') root = locations.downloads;
-    else if (selection.target === 'project' && typeof selection.projectId === 'string' && selection.projectId) {
-      const { project } = await rpc('project/read', { projectId: selection.projectId });
-      const selected = selection.root || project.roots[0]?.path;
-      root = project.roots.find(item => pathKey(item.path) === pathKey(selected))?.path;
-    }
-    if (!root || !path.isAbsolute(root)) fail('请选择电脑项目或下载目录。');
-    const relative = selection.path || '';
-    if (typeof relative !== 'string' || relative.split('/').some(part => part && !validName(part))) fail('子文件夹路径无效。');
-    const realRoot = await fs.realpath(root), target = path.join(realRoot, ...relative.split('/'));
-    const realTarget = await fs.realpath(target), difference = path.relative(realRoot, realTarget);
-    if (difference === '..' || difference.startsWith('..' + path.sep) || path.isAbsolute(difference)) fail('只能选择当前目录内的子文件夹。');
-    if (!(await fs.stat(realTarget)).isDirectory()) fail('所选路径不是文件夹。');
-    return { root, path: relative, absolutePath: target, realPath: realTarget,
-      parent: relative ? relative.split('/').slice(0, -1).join('/') : null };
-  }
-
-  async browse(rpc, locations, selection) {
-    const folder = await this.folder(rpc, locations, selection);
-    const entries = (await fs.readdir(folder.realPath, { withFileTypes: true })).filter(entry => entry.isDirectory())
-      .map(entry => ({ name: entry.name, path: [folder.path, entry.name].filter(Boolean).join('/') }))
-      .sort((a, b) => a.name.localeCompare(b.name, 'zh-CN', { numeric: true }));
-    const { realPath, ...visible } = folder;
-    return { ...visible, entries };
-  }
-
-  async save(rpc, locations, selection, asset, readPart, signal) {
-    const folder = await this.folder(rpc, locations, selection);
-    const partial = path.join(folder.realPath, `.code-relax-${crypto.randomUUID()}.download.part`);
-    let handle, result, created = false;
-    try {
-      signal?.throwIfAborted();
-      handle = await fs.open(partial, 'wx', 0o600);
-      created = true;
-      let offset = 0, size, revision, name, mimeType;
-      do {
-        signal?.throwIfAborted();
-        const query = new URLSearchParams({ offset: String(offset), length: String(FILE_PART_BYTES) });
-        if (revision) query.set('revision', revision);
-        const part = await readPart(asset, query);
-        signal?.throwIfAborted();
-        if (offset === 0) {
-          size = part.size; revision = part.revision; name = part.name || asset.name; mimeType = part.mimeType || asset.mimeType;
-          if (!validName(name)) fail('文件名无效，请修正来源文件的名称。');
-          if (!Number.isSafeInteger(size) || size < 1 || size > FILE_READ_LIMIT || !revision) fail('文件大小无效或超过 20 MiB 上限。');
-        }
-        if (part.size !== size || part.revision !== revision || part.offset !== offset
-          || !part.bytes?.length || part.bytes.length > Math.min(FILE_PART_BYTES, size - offset)) fail('文件内容发生变化或分片不完整。', 409);
-        let written = 0;
-        while (written < part.bytes.length) {
-          const { bytesWritten } = await handle.write(part.bytes, written, part.bytes.length - written, offset + written);
-          if (!bytesWritten) fail('电脑文件写入不完整。', 502);
-          written += bytesWritten;
-        }
-        offset += part.bytes.length;
-      } while (offset < size);
-      await handle.close(); handle = null;
-      signal?.throwIfAborted();
-      // Recheck the destination after the remote read, before creating the final copy.
-      const current = await this.folder(rpc, locations, selection);
-      if (pathKey(current.realPath) !== pathKey(folder.realPath)) fail('目标目录发生变化，请重新选择。', 409);
-      const extension = path.extname(name), body = name.slice(0, name.length - extension.length);
-      for (let number = 0; ; number++) {
-        const filename = number ? `${body} (${number})${extension}` : name;
-        const destination = path.join(folder.realPath, filename);
-        try {
-          await fs.copyFile(partial, destination, constants.COPYFILE_EXCL);
-          const stat = await fs.stat(destination);
-          if (stat.size !== size) { await fs.unlink(destination); fail('电脑副本大小核对失败。', 502); }
-          result = { path: destination, name: filename, size, revision: fileRevision(stat), mimeType };
-          break;
-        } catch (error) { if (error.code !== 'EEXIST') throw error; }
-      }
-      this.copies[asset.id] = result;
-      try { writeRecord(this.recordPath, this.copies); }
-      catch (error) { result.warning = '文件已保存，副本记录未能持久保存；重启后请从原文件重新选择。'; console.error('电脑副本记录保存失败', error); }
-      return result;
-    } finally {
-      await handle?.close();
-      if (created) {
-        try { await fs.rm(partial, { force: true }); }
-        catch (error) {
-          if (!result) throw error;
-          result.warning = '文件已保存，下载临时文件未能清理。'; console.error('电脑下载临时文件清理失败', error);
-        }
-      }
-    }
-  }
-}
+import fs from 'node:fs/promises';
+import { constants } from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { fileRevision, FILE_PART_BYTES, FILE_READ_LIMIT } from './file-transfer-range.mjs';
+import { readRecord, writeRecord } from './service-lifecycle.mjs';
+
+const fail = (message, statusCode = 400) => { throw Object.assign(new Error(message), { statusCode }); };
+const pathKey = value => process.platform === 'win32' ? value.toLowerCase() : value;
+const validName = value => typeof value === 'string' && value.length > 0
+  && !/[<>:"/\\|?*\x00-\x1f]/.test(value) && !/[ .]$/.test(value) && !['.', '..'].includes(value)
+  && !/^(?:con|prn|aux|nul|com[1-9¹²³]|lpt[1-9¹²³])(?:\.|$)/i.test(value);
+
+// A saved copy belongs to the authorized external asset, rather than its current chat page.
+export class WorkstationDownloads {
+  constructor(stateRoot) {
+    this.recordPath = path.join(stateRoot, 'external-file-copies.json');
+    this.copies = readRecord(this.recordPath) || {};
+  }
+
+  async copy(sourceId) {
+    const record = this.copies[sourceId];
+    if (!record) return null;
+    try {
+      const stat = await fs.stat(record.path);
+      return stat.isFile() && fileRevision(stat) === record.revision && stat.size === record.size ? record : null;
+    } catch (error) { if (['ENOENT', 'ENOTDIR'].includes(error.code)) return null; throw error; }
+  }
+
+  async folder(rpc, locations, selection) {
+    let root;
+    if (selection.target === 'downloads') root = locations.downloads;
+    else if (selection.target === 'project' && typeof selection.projectId === 'string' && selection.projectId) {
+      const { project } = await rpc('project/read', { projectId: selection.projectId });
+      const selected = selection.root || project.roots[0]?.path;
+      root = project.roots.find(item => pathKey(item.path) === pathKey(selected))?.path;
+    }
+    if (!root || !path.isAbsolute(root)) fail('请选择电脑项目或下载目录。');
+    const relative = selection.path || '';
+    if (typeof relative !== 'string' || relative.split('/').some(part => part && !validName(part))) fail('子文件夹路径无效。');
+    const realRoot = await fs.realpath(root), target = path.join(realRoot, ...relative.split('/'));
+    const realTarget = await fs.realpath(target), difference = path.relative(realRoot, realTarget);
+    if (difference === '..' || difference.startsWith('..' + path.sep) || path.isAbsolute(difference)) fail('只能选择当前目录内的子文件夹。');
+    if (!(await fs.stat(realTarget)).isDirectory()) fail('所选路径不是文件夹。');
+    return { root, path: relative, absolutePath: target, realPath: realTarget,
+      parent: relative ? relative.split('/').slice(0, -1).join('/') : null };
+  }
+
+  async browse(rpc, locations, selection) {
+    const folder = await this.folder(rpc, locations, selection);
+    const entries = (await fs.readdir(folder.realPath, { withFileTypes: true })).filter(entry => entry.isDirectory())
+      .map(entry => ({ name: entry.name, path: [folder.path, entry.name].filter(Boolean).join('/') }))
+      .sort((a, b) => a.name.localeCompare(b.name, 'zh-CN', { numeric: true }));
+    const { realPath, ...visible } = folder;
+    return { ...visible, entries };
+  }
+
+  async save(rpc, locations, selection, asset, readPart, signal) {
+    const folder = await this.folder(rpc, locations, selection);
+    const partial = path.join(folder.realPath, `.code-relax-${crypto.randomUUID()}.download.part`);
+    let handle, result, created = false;
+    try {
+      signal?.throwIfAborted();
+      handle = await fs.open(partial, 'wx', 0o600);
+      created = true;
+      let offset = 0, size, revision, name, mimeType;
+      do {
+        signal?.throwIfAborted();
+        const query = new URLSearchParams({ offset: String(offset), length: String(FILE_PART_BYTES) });
+        if (revision) query.set('revision', revision);
+        const part = await readPart(asset, query);
+        signal?.throwIfAborted();
+        if (offset === 0) {
+          size = part.size; revision = part.revision; name = part.name || asset.name; mimeType = part.mimeType || asset.mimeType;
+          if (!validName(name)) fail('文件名无效，请修正来源文件的名称。');
+          if (!Number.isSafeInteger(size) || size < 1 || size > FILE_READ_LIMIT || !revision) fail('文件大小无效或超过 20 MiB 上限。');
+        }
+        if (part.size !== size || part.revision !== revision || part.offset !== offset
+          || !part.bytes?.length || part.bytes.length > Math.min(FILE_PART_BYTES, size - offset)) fail('文件内容发生变化或分片不完整。', 409);
+        let written = 0;
+        while (written < part.bytes.length) {
+          const { bytesWritten } = await handle.write(part.bytes, written, part.bytes.length - written, offset + written);
+          if (!bytesWritten) fail('电脑文件写入不完整。', 502);
+          written += bytesWritten;
+        }
+        offset += part.bytes.length;
+      } while (offset < size);
+      await handle.close(); handle = null;
+      signal?.throwIfAborted();
+      // Recheck the destination after the remote read, before creating the final copy.
+      const current = await this.folder(rpc, locations, selection);
+      if (pathKey(current.realPath) !== pathKey(folder.realPath)) fail('目标目录发生变化，请重新选择。', 409);
+      const extension = path.extname(name), body = name.slice(0, name.length - extension.length);
+      for (let number = 0; ; number++) {
+        const filename = number ? `${body} (${number})${extension}` : name;
+        const destination = path.join(folder.realPath, filename);
+        try {
+          await fs.copyFile(partial, destination, constants.COPYFILE_EXCL);
+          const stat = await fs.stat(destination);
+          if (stat.size !== size) { await fs.unlink(destination); fail('电脑副本大小核对失败。', 502); }
+          result = { path: destination, name: filename, size, revision: fileRevision(stat), mimeType };
+          break;
+        } catch (error) { if (error.code !== 'EEXIST') throw error; }
+      }
+      this.copies[asset.id] = result;
+      try { writeRecord(this.recordPath, this.copies); }
+      catch (error) { result.warning = '文件已保存，副本记录未能持久保存；重启后请从原文件重新选择。'; console.error('电脑副本记录保存失败', error); }
+      return result;
+    } finally {
+      await handle?.close();
+      if (created) {
+        try { await fs.rm(partial, { force: true }); }
+        catch (error) {
+          if (!result) throw error;
+          result.warning = '文件已保存，下载临时文件未能清理。'; console.error('电脑下载临时文件清理失败', error);
+        }
+      }
+    }
+  }
+}

package/dist/tools/rtc-route-helper.ps1

@@ -1,99 +1,99 @@
-param(
-  [Parameter(Mandatory = $true)][string]$Token,
-  [int]$IdleSeconds = 1800
-)
-
-$ErrorActionPreference = 'Stop'
-$pipeName = 'CodeRelaxRtcRouteHelper'
-$leases = @{}
-$pipeSecurity = [System.IO.Pipes.PipeSecurity]::new()
-$currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
-$pipeSecurity.AddAccessRule([System.IO.Pipes.PipeAccessRule]::new($currentUser, [System.IO.Pipes.PipeAccessRights]::ReadWrite,
-  [System.Security.AccessControl.AccessControlType]::Allow))
-$pipeSecurity.AddAccessRule([System.IO.Pipes.PipeAccessRule]::new([System.Security.Principal.SecurityIdentifier]::new('S-1-5-18'),
-  [System.IO.Pipes.PipeAccessRights]::FullControl, [System.Security.AccessControl.AccessControlType]::Allow))
-$pipeSecurity.AddAccessRule([System.IO.Pipes.PipeAccessRule]::new([System.Security.Principal.SecurityIdentifier]::new('S-1-5-32-544'),
-  [System.IO.Pipes.PipeAccessRights]::FullControl, [System.Security.AccessControl.AccessControlType]::Allow))
-
-function Test-PublicIpv4([string]$Address) {
-  $parts = $Address.Split('.')
-  if ($parts.Count -ne 4) { return $false }
-  try { $bytes = $parts | ForEach-Object { [byte]$_ } } catch { return $false }
-  $a = $bytes[0]; $b = $bytes[1]
-  return $a -ne 0 -and $a -ne 10 -and $a -ne 127 -and $a -lt 224 -and -not ($a -eq 169 -and $b -eq 254) -and
-    -not ($a -eq 172 -and $b -ge 16 -and $b -le 31) -and -not ($a -eq 192 -and $b -eq 168) -and
-    -not ($a -eq 100 -and $b -ge 64 -and $b -le 127) -and -not ($a -eq 198 -and ($b -eq 18 -or $b -eq 19))
-}
-
-function Get-PhysicalDefaultRoute {
-  $routes = Get-NetRoute -DestinationPrefix '0.0.0.0/0' -AddressFamily IPv4 | Where-Object {
-    $adapter = Get-NetAdapter -InterfaceIndex $_.InterfaceIndex -ErrorAction SilentlyContinue
-    $_.NextHop -and $_.NextHop -ne '0.0.0.0' -and $adapter.Status -eq 'Up' -and $adapter.HardwareInterface -eq $true -and $adapter.Virtual -ne $true
-  } | Sort-Object @{ Expression = { $_.RouteMetric + $_.InterfaceMetric } }
-  foreach ($route in $routes) {
-    $adapter = Get-NetAdapter -InterfaceIndex $route.InterfaceIndex -ErrorAction SilentlyContinue
-    if ($adapter.Name -notmatch 'Mihomo|Meta|Tunnel|VPN|TAP|Wintun') { return $route }
-  }
-  throw '找不到活动物理 IPv4 默认路由'
-}
-
-function Clear-ExpiredRoutes {
-  $now = Get-Date
-  foreach ($address in @($leases.Keys)) {
-    if ($leases[$address].expires -gt $now) { continue }
-    $lease = $leases[$address]
-    if ($lease.created) {
-      Get-NetRoute -DestinationPrefix "$address/32" -InterfaceIndex $lease.ifIndex -NextHop $lease.nextHop -ErrorAction SilentlyContinue |
-        Remove-NetRoute -Confirm:$false -ErrorAction SilentlyContinue
-    }
-    $leases.Remove($address)
-  }
-}
-
-function Clear-AllRoutes {
-  foreach ($address in @($leases.Keys)) {
-    $lease = $leases[$address]
-    if ($lease.created) {
-      Get-NetRoute -DestinationPrefix "$address/32" -InterfaceIndex $lease.ifIndex -NextHop $lease.nextHop -ErrorAction SilentlyContinue |
-        Remove-NetRoute -Confirm:$false -ErrorAction SilentlyContinue
-    }
-    $leases.Remove($address)
-  }
-}
-
-try {
-  $deadline = (Get-Date).AddSeconds($IdleSeconds)
-  while ((Get-Date) -lt $deadline) {
-    Clear-ExpiredRoutes
-    $server = [System.IO.Pipes.NamedPipeServerStream]::new($pipeName, [System.IO.Pipes.PipeDirection]::InOut, 1,
-      [System.IO.Pipes.PipeTransmissionMode]::Byte, [System.IO.Pipes.PipeOptions]::Asynchronous, 0, 0, $pipeSecurity)
-  $writer = $null
-  try {
-      $wait = $server.WaitForConnectionAsync()
-      if (-not $wait.Wait(1000)) { continue }
-      $reader = [System.IO.StreamReader]::new($server)
-      $writer = [System.IO.StreamWriter]::new($server); $writer.AutoFlush = $true
-      $request = $reader.ReadLine() | ConvertFrom-Json
-      if ($request.token -cne $Token -or $request.action -ne 'add') { throw '请求未授权' }
-      $ttl = [Math]::Min([Math]::Max([int]$request.ttlSeconds, 15), 180)
-      $route = Get-PhysicalDefaultRoute
-      $rawAddresses = @($request.addresses)
-      $addresses = @($rawAddresses | Where-Object { Test-PublicIpv4 $_ } | Select-Object -Unique)
-      if ($addresses.Count -ne $rawAddresses.Count -or $addresses.Count -gt 8) { throw '路由目标无效' }
-      foreach ($address in $addresses) {
-        $created = $leases[$address].created -eq $true
-        if (-not $leases.ContainsKey($address) -and -not (Get-NetRoute -DestinationPrefix "$address/32" -InterfaceIndex $route.InterfaceIndex -NextHop $route.NextHop -ErrorAction SilentlyContinue)) {
-          New-NetRoute -DestinationPrefix "$address/32" -InterfaceIndex $route.InterfaceIndex -NextHop $route.NextHop -RouteMetric 5 -PolicyStore ActiveStore | Out-Null
-          $created = $true
-        }
-        $leases[$address] = @{ expires = (Get-Date).AddSeconds($ttl); ifIndex = $route.InterfaceIndex; nextHop = $route.NextHop; created = $created }
-      }
-      $writer.WriteLine((@{ ok = $true; count = $addresses.Count } | ConvertTo-Json -Compress))
-    }
-    catch {
-      if ($writer) { $writer.WriteLine((@{ ok = $false; error = $_.Exception.Message } | ConvertTo-Json -Compress)) }
-    }
-    finally { $server.Dispose() }
-  }
-}
-finally { Clear-AllRoutes }
+param(
+  [Parameter(Mandatory = $true)][string]$Token,
+  [int]$IdleSeconds = 1800
+)
+
+$ErrorActionPreference = 'Stop'
+$pipeName = 'CodeRelaxRtcRouteHelper'
+$leases = @{}
+$pipeSecurity = [System.IO.Pipes.PipeSecurity]::new()
+$currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$pipeSecurity.AddAccessRule([System.IO.Pipes.PipeAccessRule]::new($currentUser, [System.IO.Pipes.PipeAccessRights]::ReadWrite,
+  [System.Security.AccessControl.AccessControlType]::Allow))
+$pipeSecurity.AddAccessRule([System.IO.Pipes.PipeAccessRule]::new([System.Security.Principal.SecurityIdentifier]::new('S-1-5-18'),
+  [System.IO.Pipes.PipeAccessRights]::FullControl, [System.Security.AccessControl.AccessControlType]::Allow))
+$pipeSecurity.AddAccessRule([System.IO.Pipes.PipeAccessRule]::new([System.Security.Principal.SecurityIdentifier]::new('S-1-5-32-544'),
+  [System.IO.Pipes.PipeAccessRights]::FullControl, [System.Security.AccessControl.AccessControlType]::Allow))
+
+function Test-PublicIpv4([string]$Address) {
+  $parts = $Address.Split('.')
+  if ($parts.Count -ne 4) { return $false }
+  try { $bytes = $parts | ForEach-Object { [byte]$_ } } catch { return $false }
+  $a = $bytes[0]; $b = $bytes[1]
+  return $a -ne 0 -and $a -ne 10 -and $a -ne 127 -and $a -lt 224 -and -not ($a -eq 169 -and $b -eq 254) -and
+    -not ($a -eq 172 -and $b -ge 16 -and $b -le 31) -and -not ($a -eq 192 -and $b -eq 168) -and
+    -not ($a -eq 100 -and $b -ge 64 -and $b -le 127) -and -not ($a -eq 198 -and ($b -eq 18 -or $b -eq 19))
+}
+
+function Get-PhysicalDefaultRoute {
+  $routes = Get-NetRoute -DestinationPrefix '0.0.0.0/0' -AddressFamily IPv4 | Where-Object {
+    $adapter = Get-NetAdapter -InterfaceIndex $_.InterfaceIndex -ErrorAction SilentlyContinue
+    $_.NextHop -and $_.NextHop -ne '0.0.0.0' -and $adapter.Status -eq 'Up' -and $adapter.HardwareInterface -eq $true -and $adapter.Virtual -ne $true
+  } | Sort-Object @{ Expression = { $_.RouteMetric + $_.InterfaceMetric } }
+  foreach ($route in $routes) {
+    $adapter = Get-NetAdapter -InterfaceIndex $route.InterfaceIndex -ErrorAction SilentlyContinue
+    if ($adapter.Name -notmatch 'Mihomo|Meta|Tunnel|VPN|TAP|Wintun') { return $route }
+  }
+  throw '找不到活动物理 IPv4 默认路由'
+}
+
+function Clear-ExpiredRoutes {
+  $now = Get-Date
+  foreach ($address in @($leases.Keys)) {
+    if ($leases[$address].expires -gt $now) { continue }
+    $lease = $leases[$address]
+    if ($lease.created) {
+      Get-NetRoute -DestinationPrefix "$address/32" -InterfaceIndex $lease.ifIndex -NextHop $lease.nextHop -ErrorAction SilentlyContinue |
+        Remove-NetRoute -Confirm:$false -ErrorAction SilentlyContinue
+    }
+    $leases.Remove($address)
+  }
+}
+
+function Clear-AllRoutes {
+  foreach ($address in @($leases.Keys)) {
+    $lease = $leases[$address]
+    if ($lease.created) {
+      Get-NetRoute -DestinationPrefix "$address/32" -InterfaceIndex $lease.ifIndex -NextHop $lease.nextHop -ErrorAction SilentlyContinue |
+        Remove-NetRoute -Confirm:$false -ErrorAction SilentlyContinue
+    }
+    $leases.Remove($address)
+  }
+}
+
+try {
+  $deadline = (Get-Date).AddSeconds($IdleSeconds)
+  while ((Get-Date) -lt $deadline) {
+    Clear-ExpiredRoutes
+    $server = [System.IO.Pipes.NamedPipeServerStream]::new($pipeName, [System.IO.Pipes.PipeDirection]::InOut, 1,
+      [System.IO.Pipes.PipeTransmissionMode]::Byte, [System.IO.Pipes.PipeOptions]::Asynchronous, 0, 0, $pipeSecurity)
+  $writer = $null
+  try {
+      $wait = $server.WaitForConnectionAsync()
+      if (-not $wait.Wait(1000)) { continue }
+      $reader = [System.IO.StreamReader]::new($server)
+      $writer = [System.IO.StreamWriter]::new($server); $writer.AutoFlush = $true
+      $request = $reader.ReadLine() | ConvertFrom-Json
+      if ($request.token -cne $Token -or $request.action -ne 'add') { throw '请求未授权' }
+      $ttl = [Math]::Min([Math]::Max([int]$request.ttlSeconds, 15), 180)
+      $route = Get-PhysicalDefaultRoute
+      $rawAddresses = @($request.addresses)
+      $addresses = @($rawAddresses | Where-Object { Test-PublicIpv4 $_ } | Select-Object -Unique)
+      if ($addresses.Count -ne $rawAddresses.Count -or $addresses.Count -gt 8) { throw '路由目标无效' }
+      foreach ($address in $addresses) {
+        $created = $leases[$address].created -eq $true
+        if (-not $leases.ContainsKey($address) -and -not (Get-NetRoute -DestinationPrefix "$address/32" -InterfaceIndex $route.InterfaceIndex -NextHop $route.NextHop -ErrorAction SilentlyContinue)) {
+          New-NetRoute -DestinationPrefix "$address/32" -InterfaceIndex $route.InterfaceIndex -NextHop $route.NextHop -RouteMetric 5 -PolicyStore ActiveStore | Out-Null
+          $created = $true
+        }
+        $leases[$address] = @{ expires = (Get-Date).AddSeconds($ttl); ifIndex = $route.InterfaceIndex; nextHop = $route.NextHop; created = $created }
+      }
+      $writer.WriteLine((@{ ok = $true; count = $addresses.Count } | ConvertTo-Json -Compress))
+    }
+    catch {
+      if ($writer) { $writer.WriteLine((@{ ok = $false; error = $_.Exception.Message } | ConvertTo-Json -Compress)) }
+    }
+    finally { $server.Dispose() }
+  }
+}
+finally { Clear-AllRoutes }

package/dist/tools/start-rtc-route-helper.ps1

@@ -1,15 +1,15 @@
-$ErrorActionPreference = 'Stop'
-$roots = @(
-  (Join-Path $env:LOCALAPPDATA 'CodexRemote'),
-  (Join-Path $env:LOCALAPPDATA 'Packages\OpenAI.Codex_2p2nqsd0c76g0\LocalCache\Local\CodexRemote')
-)
-$config = $null
-foreach ($root in $roots) {
-  $path = Join-Path $root 'self-relay-config.json'
-  if (-not (Test-Path -LiteralPath $path)) { continue }
-  $value = Get-Content -LiteralPath $path -Raw -Encoding UTF8 | ConvertFrom-Json
-  if ($value.p2pWindowsRouteHelper -eq $true -and $value.p2pWindowsRouteHelperToken) { $config = $value; break }
-}
-if (-not $config) { throw '未找到已启用的 RTC 路由辅助配置' }
-$helper = Join-Path $PSScriptRoot 'rtc-route-helper.ps1'
-& $helper -Token $config.p2pWindowsRouteHelperToken -IdleSeconds 1800
+$ErrorActionPreference = 'Stop'
+$roots = @(
+  (Join-Path $env:LOCALAPPDATA 'CodexRemote'),
+  (Join-Path $env:LOCALAPPDATA 'Packages\OpenAI.Codex_2p2nqsd0c76g0\LocalCache\Local\CodexRemote')
+)
+$config = $null
+foreach ($root in $roots) {
+  $path = Join-Path $root 'self-relay-config.json'
+  if (-not (Test-Path -LiteralPath $path)) { continue }
+  $value = Get-Content -LiteralPath $path -Raw -Encoding UTF8 | ConvertFrom-Json
+  if ($value.p2pWindowsRouteHelper -eq $true -and $value.p2pWindowsRouteHelperToken) { $config = $value; break }
+}
+if (-not $config) { throw '未找到已启用的 RTC 路由辅助配置' }
+$helper = Join-Path $PSScriptRoot 'rtc-route-helper.ps1'
+& $helper -Token $config.p2pWindowsRouteHelperToken -IdleSeconds 1800

package/dist/web/vendor/markdown-it.LICENSE.txt

@@ -1,22 +1,22 @@
-Copyright (c) 2014 Vitaly Puzrin, Alex Kocharin.
-
-Permission is hereby granted, free of charge, to any person
-obtaining a copy of this software and associated documentation
-files (the "Software"), to deal in the Software without
-restriction, including without limitation the rights to use,
-copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the
-Software is furnished to do so, subject to the following
-conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
-OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
-HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
-WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
-OTHER DEALINGS IN THE SOFTWARE.
+Copyright (c) 2014 Vitaly Puzrin, Alex Kocharin.
+
+Permission is hereby granted, free of charge, to any person
+obtaining a copy of this software and associated documentation
+files (the "Software"), to deal in the Software without
+restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the
+Software is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.