@walkhi/code-relax 0.1.0-beta.50 → 0.1.0-beta.59

package/dist/bin/publish-android-release.mjs

@@ -1,63 +1,63 @@
-#!/usr/bin/env node
-import fs from 'node:fs';
-import path from 'node:path';
-import { createHash } from 'node:crypto';
-import { androidReleaseStorage } from '../relay-admin/android-release-storage.mjs';
-import { readAndroidCatalog } from '../src/self-relay/android-releases.mjs';
-import { readPublicManifest, updatePublicAndroid } from '../src/self-relay/public-releases.mjs';
-
-// This administrative command runs only on the deployment host; no keys cross SSH.
-const [apkFile, metadataFile, mode] = process.argv.slice(2);
-if (mode && mode !== '--existing-object') throw new Error('Invalid publication mode');
-if (!apkFile || !metadataFile) throw new Error('Usage: publish-android-release.mjs APK METADATA');
-const storage = androidReleaseStorage('/etc/codex-relay/android-releases.json', '/etc/codex-relay/tencent-monitor.json');
-const metadata = JSON.parse(fs.readFileSync(metadataFile, 'utf8'));
-if (metadata.packageName !== 'com.walkhi.codexremote' || !/^[a-f0-9]{64}$/.test(metadata.certificateSha256)) throw new Error('Invalid APK identity');
-const { certificateSha256: expectedCertificate } = JSON.parse(fs.readFileSync('/etc/codex-relay/android-releases.json', 'utf8'));
-if (!/^[a-f0-9]{64}$/.test(expectedCertificate) || metadata.certificateSha256 !== expectedCertificate) throw new Error('APK signing certificate does not match release configuration');
-const bytes = fs.readFileSync(apkFile), sha256 = createHash('sha256').update(bytes).digest('hex');
-if (sha256 !== metadata.sha256 || bytes.length !== metadata.size) throw new Error('Uploaded APK integrity mismatch');
-const { versionCode, versionName, size, notes, certificateSha256 } = metadata;
-const release = { versionCode, versionName, size, sha256, notes, certificateSha256,
-  objectKey: `code-relax/android/${versionCode}/Code-Relax-${sha256.slice(0, 16)}.apk` };
-const catalogFile = storage.catalogFile, temporary = catalogFile + '.new', lock = catalogFile + '.lock';
-const lockHandle = fs.openSync(lock, 'wx', 0o600);
-try {
-  readPublicManifest();
-  const catalog = fs.existsSync(catalogFile) ? readAndroidCatalog(catalogFile) : { releases: [] };
-  const previous = catalog.releases.find(item => item.versionCode === versionCode);
-  if (previous && previous.sha256 !== sha256) throw new Error('A different APK already uses this versionCode');
-  if (catalog.latestVersionCode > versionCode) throw new Error('Refusing to publish an older version as latest');
-  const next = { latestVersionCode: versionCode, releases: [...catalog.releases.filter(item => item.versionCode !== versionCode), release] };
-  fs.writeFileSync(temporary, JSON.stringify(next, null, 2) + '\n', { mode: 0o640 });
-  readAndroidCatalog(temporary);
-  if (!previous && mode !== '--existing-object') {
-    await new Promise((resolve, reject) => storage.cos.putObject({ ...storage.object(release), Body: bytes,
-      ContentLength: bytes.length, ContentType: 'application/vnd.android.package-archive',
-      ContentDisposition: `attachment; filename="Code-Relax-${versionName}.apk"`
-    }, (error, value) => error ? reject(error) : resolve(value)));
-  }
-  // Validate the exact signed GET that website and App use, before switching latest.
-  const ticket = await storage.signDownload(release);
-  const response = await fetch(ticket.url, { signal: AbortSignal.timeout(120000) });
-  if (!response.ok) throw new Error(`Signed download failed: HTTP ${response.status}`);
-  const downloaded = Buffer.from(await response.arrayBuffer());
-  if (downloaded.length !== size || createHash('sha256').update(downloaded).digest('hex') !== sha256) throw new Error('Stored APK integrity mismatch');
-  const unsigned = new URL(ticket.url); unsigned.search = '';
-  const denied = await fetch(unsigned, { method: 'HEAD', signal: AbortSignal.timeout(15000) });
-  if (denied.status !== 403) throw new Error(`Private object check failed: HTTP ${denied.status}`);
-  const owner = fs.statSync(path.dirname(catalogFile));
-  fs.chownSync(temporary, owner.uid, owner.gid);
-  fs.renameSync(temporary, catalogFile);
-  updatePublicAndroid(release);
-  console.log(JSON.stringify({ published: true, versionCode, versionName, size, sha256, unsignedStatus: denied.status,
-    entry: 'https://www.coderelax.cn/code-relax/android' }));
-} catch (error) {
-  // COS errors can carry signed request details. Keep CLI output credential-free.
-  console.error('Android publication failed:', error?.code || (error?.name === 'Error' ? error.message : 'storage-request-failed'));
-  process.exitCode = 1;
-} finally {
-  fs.closeSync(lockHandle);
-  fs.unlinkSync(lock);
-  if (fs.existsSync(temporary)) fs.unlinkSync(temporary);
-}
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { androidReleaseStorage } from '../relay-admin/android-release-storage.mjs';
+import { readAndroidCatalog } from '../src/self-relay/android-releases.mjs';
+import { readPublicManifest, updatePublicAndroid } from '../src/self-relay/public-releases.mjs';
+
+// This administrative command runs only on the deployment host; no keys cross SSH.
+const [apkFile, metadataFile, mode] = process.argv.slice(2);
+if (mode && mode !== '--existing-object') throw new Error('Invalid publication mode');
+if (!apkFile || !metadataFile) throw new Error('Usage: publish-android-release.mjs APK METADATA');
+const storage = androidReleaseStorage('/etc/codex-relay/android-releases.json', '/etc/codex-relay/tencent-monitor.json');
+const metadata = JSON.parse(fs.readFileSync(metadataFile, 'utf8'));
+if (metadata.packageName !== 'com.walkhi.codexremote' || !/^[a-f0-9]{64}$/.test(metadata.certificateSha256)) throw new Error('Invalid APK identity');
+const { certificateSha256: expectedCertificate } = JSON.parse(fs.readFileSync('/etc/codex-relay/android-releases.json', 'utf8'));
+if (!/^[a-f0-9]{64}$/.test(expectedCertificate) || metadata.certificateSha256 !== expectedCertificate) throw new Error('APK signing certificate does not match release configuration');
+const bytes = fs.readFileSync(apkFile), sha256 = createHash('sha256').update(bytes).digest('hex');
+if (sha256 !== metadata.sha256 || bytes.length !== metadata.size) throw new Error('Uploaded APK integrity mismatch');
+const { versionCode, versionName, size, notes, certificateSha256 } = metadata;
+const release = { versionCode, versionName, size, sha256, notes, certificateSha256,
+  objectKey: `code-relax/android/${versionCode}/Code-Relax-${sha256.slice(0, 16)}.apk` };
+const catalogFile = storage.catalogFile, temporary = catalogFile + '.new', lock = catalogFile + '.lock';
+const lockHandle = fs.openSync(lock, 'wx', 0o600);
+try {
+  readPublicManifest();
+  const catalog = fs.existsSync(catalogFile) ? readAndroidCatalog(catalogFile) : { releases: [] };
+  const previous = catalog.releases.find(item => item.versionCode === versionCode);
+  if (previous && previous.sha256 !== sha256) throw new Error('A different APK already uses this versionCode');
+  if (catalog.latestVersionCode > versionCode) throw new Error('Refusing to publish an older version as latest');
+  const next = { latestVersionCode: versionCode, releases: [...catalog.releases.filter(item => item.versionCode !== versionCode), release] };
+  fs.writeFileSync(temporary, JSON.stringify(next, null, 2) + '\n', { mode: 0o640 });
+  readAndroidCatalog(temporary);
+  if (!previous && mode !== '--existing-object') {
+    await new Promise((resolve, reject) => storage.cos.putObject({ ...storage.object(release), Body: bytes,
+      ContentLength: bytes.length, ContentType: 'application/vnd.android.package-archive',
+      ContentDisposition: `attachment; filename="Code-Relax-${versionName}.apk"`
+    }, (error, value) => error ? reject(error) : resolve(value)));
+  }
+  // Validate the exact signed GET that website and App use, before switching latest.
+  const ticket = await storage.signDownload(release);
+  const response = await fetch(ticket.url, { signal: AbortSignal.timeout(120000) });
+  if (!response.ok) throw new Error(`Signed download failed: HTTP ${response.status}`);
+  const downloaded = Buffer.from(await response.arrayBuffer());
+  if (downloaded.length !== size || createHash('sha256').update(downloaded).digest('hex') !== sha256) throw new Error('Stored APK integrity mismatch');
+  const unsigned = new URL(ticket.url); unsigned.search = '';
+  const denied = await fetch(unsigned, { method: 'HEAD', signal: AbortSignal.timeout(15000) });
+  if (denied.status !== 403) throw new Error(`Private object check failed: HTTP ${denied.status}`);
+  const owner = fs.statSync(path.dirname(catalogFile));
+  fs.chownSync(temporary, owner.uid, owner.gid);
+  fs.renameSync(temporary, catalogFile);
+  updatePublicAndroid(release);
+  console.log(JSON.stringify({ published: true, versionCode, versionName, size, sha256, unsignedStatus: denied.status,
+    entry: 'https://www.coderelax.cn/code-relax/android' }));
+} catch (error) {
+  // COS errors can carry signed request details. Keep CLI output credential-free.
+  console.error('Android publication failed:', error?.code || (error?.name === 'Error' ? error.message : 'storage-request-failed'));
+  process.exitCode = 1;
+} finally {
+  fs.closeSync(lockHandle);
+  fs.unlinkSync(lock);
+  if (fs.existsSync(temporary)) fs.unlinkSync(temporary);
+}

package/dist/bin/release-upload-server.mjs

@@ -1,190 +1,190 @@
-#!/usr/bin/env node
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import http from 'node:http';
-import { createHash, randomUUID } from 'node:crypto';
-import { pipeline } from 'node:stream/promises';
-import { Transform, Readable } from 'node:stream';
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-import { fileURLToPath } from 'node:url';
-import { verifyReleaseIdentity, createUploadSigner } from '../relay-admin/release-oidc.mjs';
-import { androidReleaseStorage } from '../relay-admin/android-release-storage.mjs';
-import { readAndroidCatalog } from '../src/self-relay/android-releases.mjs';
-import { updatePublicWorkstations } from '../src/self-relay/public-releases.mjs';
-
-import { readHarmonyConfig, validateHarmonyMetadata, checkHarmonyVersion, verifyHarmony, activateHarmony } from '../relay-admin/harmony-release.mjs';
-
-const execute = promisify(execFile);
-const config = JSON.parse(fs.readFileSync('/etc/codex-relay/android-releases.json', 'utf8'));
-const credential = JSON.parse(fs.readFileSync('/etc/codex-relay/tencent-monitor.json', 'utf8'));
-const storage = androidReleaseStorage('/etc/codex-relay/android-releases.json', '/etc/codex-relay/tencent-monitor.json');
-const signUpload = createUploadSigner(config, { secretId: credential.secretId, secretKey: credential.secretKey });
-const stateDir = '/var/lib/codex-relay/release-publisher';
-fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
-const cosCall = (method, args) => new Promise((resolve, reject) => storage.cos[method](args, (e, r) => e ? reject(e) : resolve(r)));
-const object = key => ({ Bucket: config.bucket, Region: config.region, Key: key });
-const identityKey = p => `${p.repository_id}/${p.run_id}/${p.run_attempt}/${p.sha}`;
-const filename = id => path.join(stateDir, id + '.json');
-function save(row) {
-  const temp = filename(row.intentId) + '.' + randomUUID();
-  fs.writeFileSync(temp, JSON.stringify(row), { mode: 0o600 }); fs.renameSync(temp, filename(row.intentId));
-}
-const read = id => fs.existsSync(filename(id)) ? JSON.parse(fs.readFileSync(filename(id))) : null;
-const publicState = row => ({ ok: true, intentId: row.intentId, status: row.status, result: row.result, error: row.error });
-async function readJson(req) {
-  const chunks = []; let size = 0;
-  for await (const chunk of req) { size += chunk.length; if (size > 16384) throw Error('Request too large'); chunks.push(chunk); }
-  return JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}');
-}
-function metadataFrom(data, claims, target) {
-  const { packageName, versionCode, versionName, size, sha256, contentMd5, certificateSha256, notes,
-    buildCommit, artifactId, runId, sourceCommit, verifyOnly } = data;
-  if (!Number.isSafeInteger(versionCode) || versionCode < 1 || versionCode > 2100000000
-    || !/^[a-f0-9]{64}$/.test(sha256)
-    || !Number.isSafeInteger(size) || size < 1 || size > 200 * 1024 * 1024
-    || typeof notes !== 'string' || notes.length > 2000 || !/^[A-Za-z0-9+/]{22}==$/.test(contentMd5)
-    || !/^\d+$/.test(artifactId) || runId !== claims.run_id || sourceCommit !== claims.sha
-    || typeof verifyOnly !== 'boolean' || !/^[a-f0-9]{40}$/.test(buildCommit)) throw Error('Invalid metadata');
-  if (target === 'hap') validateHarmonyMetadata(data, readHarmonyConfig());
-  else if (packageName !== 'com.walkhi.codexremote' || !/^\d+\.\d+\.\d+\.\d+$/.test(versionName)
-    || !versionName.endsWith('.' + versionCode) || certificateSha256 !== config.certificateSha256) throw Error('Invalid Android identity');
-  return { target, ...(target === 'hap' ? { files: data.files } : {}), packageName, versionCode, versionName, size, sha256, contentMd5, certificateSha256, notes,
-    buildCommit, artifactId, runId, sourceCommit, verifyOnly };
-}
-let busy = false;
-const server = http.createServer(async (req, res) => {
-  const reply = (code, data) => { if (!res.destroyed) { res.writeHead(code, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }); res.end(JSON.stringify(data)); } };
-  let claims;
-  const npmStatus = req.url === '/code-relax/publish/npm/status';
-  try { claims = await verifyReleaseIdentity((req.headers.authorization || '').replace(/^Bearer /, ''), npmStatus ? 'npm' : 'mobile'); }
-  catch { reply(401, { ok: false, error: 'OIDC_REJECTED' }); return; }
-  if (npmStatus) {
-    try {
-      if (req.method !== 'POST') { reply(405, { ok: false, error: 'METHOD_NOT_ALLOWED' }); return; }
-      const { version } = await readJson(req);
-      const response = await fetch('https://registry.npmjs.org/@walkhi%2fcode-relax', { signal: AbortSignal.timeout(15000) });
-      if (!response.ok) throw Error('Registry unavailable');
-      const metadata = await response.json();
-      if (metadata['dist-tags']?.latest !== version || metadata['dist-tags']?.beta !== version
-        || !metadata.versions?.[version]) { reply(409, { ok: false, error: 'NPM_VERSION_MISMATCH' }); return; }
-      updatePublicWorkstations(version);
-      reply(200, { ok: true, version });
-    } catch { reply(500, { ok: false, error: 'NPM_STATUS_SYNC_FAILED' }); }
-    return;
-  }
-  const target = /^\/code-relax\/publish\/(android|hap)\/intents(?:\/|$)/.exec(req.url || '')?.[1];
-  if (!target) { reply(404, { ok: false, error: 'NOT_FOUND' }); return; }
-  const prefix = `/code-relax/publish/${target}/intents`;
-  try {
-    if (req.method === 'POST' && req.url === prefix) {
-      let metadata;
-      try { metadata = metadataFrom(await readJson(req), claims, target); } catch { reply(400, { ok: false, error: 'INVALID_RELEASE' }); return; }
-      if (!metadata.verifyOnly && target === 'hap') {
-        try { checkHarmonyVersion(metadata); } catch { reply(409, { ok: false, error: 'VERSION_CONFLICT' }); return; }
-      }
-      if (!metadata.verifyOnly && target === 'android') {
-        const catalog = readAndroidCatalog(config.catalogFile);
-        const previous = catalog.releases.find(x => x.versionCode === metadata.versionCode);
-        if (catalog.latestVersionCode > metadata.versionCode || (previous && previous.sha256 !== metadata.sha256)) {
-          reply(409, { ok: false, error: 'VERSION_CONFLICT' }); return;
-        }
-      }
-      const identity = identityKey(claims);
-      const intentId = createHash('sha256').update(JSON.stringify({ identity, metadata })).digest('hex');
-      let row = read(intentId);
-      if (row && row.status !== 'prepared') { reply(200, publicState(row)); return; }
-      const key = metadata.verifyOnly ? `code-relax/android/ci-verification/${claims.run_id}/${intentId}.apk`
-        : `code-relax/android/${metadata.versionCode}/Code-Relax-${metadata.sha256.slice(0, 16)}.apk`;
-      const keys = target === 'hap' ? metadata.files.map(f => metadata.verifyOnly
-        ? `code-relax/harmony/ci-verification/${claims.run_id}/${intentId}/${f.name}`
-        : `code-relax/harmony/${metadata.versionCode}/${f.name}`) : [key];
-      row ??= { intentId, identity, metadata, key, keys, status: 'prepared' };
-      save(row);
-      const grant = target === 'hap' ? { uploads: await Promise.all(metadata.files.map(async (f, i) => ({ name: f.name,
-        ...await signUpload(keys[i], f, i === 1 ? 'application/json' : i === 2 ? 'image/png' : 'application/octet-stream') }))) }
-        : await signUpload(key, metadata);
-      reply(200, { ...publicState(row), ...grant }); return;
-    }
-    const match = new RegExp(`^${prefix}/([a-f0-9]{64})(/complete)?$`).exec(req.url || '');
-    if (!match || !((!match[2] && req.method === 'GET') || (match[2] && req.method === 'POST'))) {
-      reply(404, { ok: false, error: 'NOT_FOUND' }); return;
-    }
-    const row = read(match[1]);
-    if (!row || row.identity !== identityKey(claims) || (row.metadata.target || 'android') !== target) { reply(404, { ok: false, error: 'INTENT_NOT_FOUND' }); return; }
-    if (match[2] && row.status === 'prepared') {
-      if (busy) { reply(409, { ok: false, error: 'PUBLICATION_BUSY' }); return; }
-      busy = true; row.status = 'validating'; save(row);
-      void complete(row).finally(() => { busy = false; });
-    }
-    reply(row.status === 'validating' ? 202 : 200, publicState(row));
-  } catch (error) {
-    console.error(JSON.stringify({ event: 'release-api-failed', code: /^[A-Za-z.]+$/.test(error.code || '') ? error.code : 'io-or-provider' }));
-    reply(503, { ok: false, error: 'RELEASE_UNAVAILABLE' });
-  }
-});
-async function complete(row) {
-  const { metadata, key } = row;
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'code-relax-release-'));
-  const apk = path.join(dir, 'release.apk'), json = path.join(dir, 'release.json');
-  const hap = metadata.target === 'hap';
-  const files = hap ? metadata.files : [{ ...metadata, name: 'release.apk' }];
-  let stage = 'download';
-  try {
-    for (const [i, file] of files.entries()) {
-      const ticket = await cosCall('getObjectUrl', { ...object(row.keys?.[i] || key), Sign: true, Method: 'GET', Protocol: 'https:', Expires: 300 });
-      const response = await fetch(ticket.Url, { signal: AbortSignal.timeout(120000) });
-      if (!response.ok || Number(response.headers.get('content-length')) !== file.size) throw Error();
-      let size = 0; const hash = createHash('sha256'), md5 = createHash('md5');
-      await pipeline(Readable.fromWeb(response.body), new Transform({ transform(chunk, encoding, next) {
-        size += chunk.length; if (size > file.size) return next(Error('Oversize'));
-        hash.update(chunk); md5.update(chunk); next(null, chunk);
-      } }), fs.createWriteStream(path.join(dir, file.name), { flags: 'wx', mode: 0o600 }));
-      if (size !== file.size || hash.digest('hex') !== file.sha256 || md5.digest('base64') !== file.contentMd5) throw Error();
-      const unsigned = new URL(ticket.Url); unsigned.search = '';
-      if (!hap && (await fetch(unsigned, { method: 'HEAD', signal: AbortSignal.timeout(15000) })).status !== 403) throw Error();
-    }
-    if (hap) {
-      stage = 'harmony-signature';
-      await verifyHarmony(dir, metadata, readHarmonyConfig());
-      row.result = { sha256: metadata.sha256, versionCode: metadata.versionCode, size: metadata.size };
-      if (metadata.verifyOnly) row.status = 'verified';
-      else { stage = 'harmony-publish'; row.result = await activateHarmony(metadata, storage, row.keys); row.status = 'published'; }
-      save(row); return;
-    }
-    stage = 'signature';
-    const { stdout: signature } = await execute('/usr/bin/apksigner', ['verify', '--print-certs', apk], {
-      timeout: 30000, env: { ...process.env, JAVA_TOOL_OPTIONS: '-Xmx256m' } });
-    const certificates = [...signature.matchAll(/^Signer #\d+ certificate SHA-256 digest: ([a-f0-9]{64})$/gm)];
-    if (certificates.length !== 1 || certificates[0][1] !== metadata.certificateSha256) throw Error();
-    stage = 'identity';
-    const { stdout: badging } = await execute('/usr/bin/aapt', ['dump', 'badging', apk], { timeout: 30000 });
-    const identity = /^package: name='([^']+)' versionCode='(\d+)' versionName='([^']+)'/m.exec(badging);
-    if (!identity || identity[1] !== metadata.packageName || Number(identity[2]) !== metadata.versionCode
-      || identity[3] !== metadata.versionName || /^application-debuggable/m.test(badging)) throw Error();
-    row.result = { sha256: metadata.sha256, versionCode: metadata.versionCode, size: metadata.size };
-    if (metadata.verifyOnly) row.status = 'verified';
-    else {
-      stage = 'publish';
-      fs.writeFileSync(json, JSON.stringify(metadata), { mode: 0o600 });
-      const { stdout } = await execute(process.execPath, [fileURLToPath(new URL('./publish-android-release.mjs', import.meta.url)), apk, json, '--existing-object'], { timeout: 240000 });
-      row.result = JSON.parse(stdout.trim()); row.status = 'published';
-    }
-    save(row);
-  } catch (error) {
-    row.status = 'failed'; row.error = `RELEASE_${stage.toUpperCase()}_FAILED`; save(row);
-    console.error(JSON.stringify({ event: 'release-validation-failed', intentId: row.intentId, stage, code: /^[A-Za-z0-9_.-]+$/.test(error.code || '') ? error.code : 'validation' }));
-  } finally {
-    for (const file of [...files.map(f => path.join(dir, f.name)), json]) fs.rmSync(file, { force: true }); fs.rmdirSync(dir);
-    // Verification objects remain private evidence; the deployment identity has no DeleteObject grant.
-  }
-}
-// A restart never blindly launches an interrupted publisher a second time.
-for (const name of fs.readdirSync(stateDir).filter(x => /^[a-f0-9]{64}\.json$/.test(x))) {
-  const row = read(name.slice(0, -5));
-  if (row.status === 'validating') { row.status = 'failed'; row.error = 'INTERRUPTED_CHECK_LATEST'; save(row); }
-}
-server.requestTimeout = 15000;
-server.listen(45852, '127.0.0.1');
-process.on('SIGTERM', () => { server.close(); const timer = setInterval(() => { if (!busy) { clearInterval(timer); process.exit(0); } }, 250); });
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import http from 'node:http';
+import { createHash, randomUUID } from 'node:crypto';
+import { pipeline } from 'node:stream/promises';
+import { Transform, Readable } from 'node:stream';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { fileURLToPath } from 'node:url';
+import { verifyReleaseIdentity, createUploadSigner } from '../relay-admin/release-oidc.mjs';
+import { androidReleaseStorage } from '../relay-admin/android-release-storage.mjs';
+import { readAndroidCatalog } from '../src/self-relay/android-releases.mjs';
+import { updatePublicWorkstations } from '../src/self-relay/public-releases.mjs';
+
+import { readHarmonyConfig, validateHarmonyMetadata, checkHarmonyVersion, verifyHarmony, activateHarmony } from '../relay-admin/harmony-release.mjs';
+
+const execute = promisify(execFile);
+const config = JSON.parse(fs.readFileSync('/etc/codex-relay/android-releases.json', 'utf8'));
+const credential = JSON.parse(fs.readFileSync('/etc/codex-relay/tencent-monitor.json', 'utf8'));
+const storage = androidReleaseStorage('/etc/codex-relay/android-releases.json', '/etc/codex-relay/tencent-monitor.json');
+const signUpload = createUploadSigner(config, { secretId: credential.secretId, secretKey: credential.secretKey });
+const stateDir = '/var/lib/codex-relay/release-publisher';
+fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+const cosCall = (method, args) => new Promise((resolve, reject) => storage.cos[method](args, (e, r) => e ? reject(e) : resolve(r)));
+const object = key => ({ Bucket: config.bucket, Region: config.region, Key: key });
+const identityKey = p => `${p.repository_id}/${p.run_id}/${p.run_attempt}/${p.sha}`;
+const filename = id => path.join(stateDir, id + '.json');
+function save(row) {
+  const temp = filename(row.intentId) + '.' + randomUUID();
+  fs.writeFileSync(temp, JSON.stringify(row), { mode: 0o600 }); fs.renameSync(temp, filename(row.intentId));
+}
+const read = id => fs.existsSync(filename(id)) ? JSON.parse(fs.readFileSync(filename(id))) : null;
+const publicState = row => ({ ok: true, intentId: row.intentId, status: row.status, result: row.result, error: row.error });
+async function readJson(req) {
+  const chunks = []; let size = 0;
+  for await (const chunk of req) { size += chunk.length; if (size > 16384) throw Error('Request too large'); chunks.push(chunk); }
+  return JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}');
+}
+function metadataFrom(data, claims, target) {
+  const { packageName, versionCode, versionName, size, sha256, contentMd5, certificateSha256, notes,
+    buildCommit, artifactId, runId, sourceCommit, verifyOnly } = data;
+  if (!Number.isSafeInteger(versionCode) || versionCode < 1 || versionCode > 2100000000
+    || !/^[a-f0-9]{64}$/.test(sha256)
+    || !Number.isSafeInteger(size) || size < 1 || size > 200 * 1024 * 1024
+    || typeof notes !== 'string' || notes.length > 2000 || !/^[A-Za-z0-9+/]{22}==$/.test(contentMd5)
+    || !/^\d+$/.test(artifactId) || runId !== claims.run_id || sourceCommit !== claims.sha
+    || typeof verifyOnly !== 'boolean' || !/^[a-f0-9]{40}$/.test(buildCommit)) throw Error('Invalid metadata');
+  if (target === 'hap') validateHarmonyMetadata(data, readHarmonyConfig());
+  else if (packageName !== 'com.walkhi.codexremote' || !/^\d+\.\d+\.\d+\.\d+$/.test(versionName)
+    || !versionName.endsWith('.' + versionCode) || certificateSha256 !== config.certificateSha256) throw Error('Invalid Android identity');
+  return { target, ...(target === 'hap' ? { files: data.files } : {}), packageName, versionCode, versionName, size, sha256, contentMd5, certificateSha256, notes,
+    buildCommit, artifactId, runId, sourceCommit, verifyOnly };
+}
+let busy = false;
+const server = http.createServer(async (req, res) => {
+  const reply = (code, data) => { if (!res.destroyed) { res.writeHead(code, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }); res.end(JSON.stringify(data)); } };
+  let claims;
+  const npmStatus = req.url === '/code-relax/publish/npm/status';
+  try { claims = await verifyReleaseIdentity((req.headers.authorization || '').replace(/^Bearer /, ''), npmStatus ? 'npm' : 'mobile'); }
+  catch { reply(401, { ok: false, error: 'OIDC_REJECTED' }); return; }
+  if (npmStatus) {
+    try {
+      if (req.method !== 'POST') { reply(405, { ok: false, error: 'METHOD_NOT_ALLOWED' }); return; }
+      const { version } = await readJson(req);
+      const response = await fetch('https://registry.npmjs.org/@walkhi%2fcode-relax', { signal: AbortSignal.timeout(15000) });
+      if (!response.ok) throw Error('Registry unavailable');
+      const metadata = await response.json();
+      if (metadata['dist-tags']?.latest !== version || metadata['dist-tags']?.beta !== version
+        || !metadata.versions?.[version]) { reply(409, { ok: false, error: 'NPM_VERSION_MISMATCH' }); return; }
+      updatePublicWorkstations(version);
+      reply(200, { ok: true, version });
+    } catch { reply(500, { ok: false, error: 'NPM_STATUS_SYNC_FAILED' }); }
+    return;
+  }
+  const target = /^\/code-relax\/publish\/(android|hap)\/intents(?:\/|$)/.exec(req.url || '')?.[1];
+  if (!target) { reply(404, { ok: false, error: 'NOT_FOUND' }); return; }
+  const prefix = `/code-relax/publish/${target}/intents`;
+  try {
+    if (req.method === 'POST' && req.url === prefix) {
+      let metadata;
+      try { metadata = metadataFrom(await readJson(req), claims, target); } catch { reply(400, { ok: false, error: 'INVALID_RELEASE' }); return; }
+      if (!metadata.verifyOnly && target === 'hap') {
+        try { checkHarmonyVersion(metadata); } catch { reply(409, { ok: false, error: 'VERSION_CONFLICT' }); return; }
+      }
+      if (!metadata.verifyOnly && target === 'android') {
+        const catalog = readAndroidCatalog(config.catalogFile);
+        const previous = catalog.releases.find(x => x.versionCode === metadata.versionCode);
+        if (catalog.latestVersionCode > metadata.versionCode || (previous && previous.sha256 !== metadata.sha256)) {
+          reply(409, { ok: false, error: 'VERSION_CONFLICT' }); return;
+        }
+      }
+      const identity = identityKey(claims);
+      const intentId = createHash('sha256').update(JSON.stringify({ identity, metadata })).digest('hex');
+      let row = read(intentId);
+      if (row && row.status !== 'prepared') { reply(200, publicState(row)); return; }
+      const key = metadata.verifyOnly ? `code-relax/android/ci-verification/${claims.run_id}/${intentId}.apk`
+        : `code-relax/android/${metadata.versionCode}/Code-Relax-${metadata.sha256.slice(0, 16)}.apk`;
+      const keys = target === 'hap' ? metadata.files.map(f => metadata.verifyOnly
+        ? `code-relax/harmony/ci-verification/${claims.run_id}/${intentId}/${f.name}`
+        : `code-relax/harmony/${metadata.versionCode}/${f.name}`) : [key];
+      row ??= { intentId, identity, metadata, key, keys, status: 'prepared' };
+      save(row);
+      const grant = target === 'hap' ? { uploads: await Promise.all(metadata.files.map(async (f, i) => ({ name: f.name,
+        ...await signUpload(keys[i], f, i === 1 ? 'application/json' : i === 2 ? 'image/png' : 'application/octet-stream') }))) }
+        : await signUpload(key, metadata);
+      reply(200, { ...publicState(row), ...grant }); return;
+    }
+    const match = new RegExp(`^${prefix}/([a-f0-9]{64})(/complete)?$`).exec(req.url || '');
+    if (!match || !((!match[2] && req.method === 'GET') || (match[2] && req.method === 'POST'))) {
+      reply(404, { ok: false, error: 'NOT_FOUND' }); return;
+    }
+    const row = read(match[1]);
+    if (!row || row.identity !== identityKey(claims) || (row.metadata.target || 'android') !== target) { reply(404, { ok: false, error: 'INTENT_NOT_FOUND' }); return; }
+    if (match[2] && row.status === 'prepared') {
+      if (busy) { reply(409, { ok: false, error: 'PUBLICATION_BUSY' }); return; }
+      busy = true; row.status = 'validating'; save(row);
+      void complete(row).finally(() => { busy = false; });
+    }
+    reply(row.status === 'validating' ? 202 : 200, publicState(row));
+  } catch (error) {
+    console.error(JSON.stringify({ event: 'release-api-failed', code: /^[A-Za-z.]+$/.test(error.code || '') ? error.code : 'io-or-provider' }));
+    reply(503, { ok: false, error: 'RELEASE_UNAVAILABLE' });
+  }
+});
+async function complete(row) {
+  const { metadata, key } = row;
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'code-relax-release-'));
+  const apk = path.join(dir, 'release.apk'), json = path.join(dir, 'release.json');
+  const hap = metadata.target === 'hap';
+  const files = hap ? metadata.files : [{ ...metadata, name: 'release.apk' }];
+  let stage = 'download';
+  try {
+    for (const [i, file] of files.entries()) {
+      const ticket = await cosCall('getObjectUrl', { ...object(row.keys?.[i] || key), Sign: true, Method: 'GET', Protocol: 'https:', Expires: 300 });
+      const response = await fetch(ticket.Url, { signal: AbortSignal.timeout(120000) });
+      if (!response.ok || Number(response.headers.get('content-length')) !== file.size) throw Error();
+      let size = 0; const hash = createHash('sha256'), md5 = createHash('md5');
+      await pipeline(Readable.fromWeb(response.body), new Transform({ transform(chunk, encoding, next) {
+        size += chunk.length; if (size > file.size) return next(Error('Oversize'));
+        hash.update(chunk); md5.update(chunk); next(null, chunk);
+      } }), fs.createWriteStream(path.join(dir, file.name), { flags: 'wx', mode: 0o600 }));
+      if (size !== file.size || hash.digest('hex') !== file.sha256 || md5.digest('base64') !== file.contentMd5) throw Error();
+      const unsigned = new URL(ticket.Url); unsigned.search = '';
+      if (!hap && (await fetch(unsigned, { method: 'HEAD', signal: AbortSignal.timeout(15000) })).status !== 403) throw Error();
+    }
+    if (hap) {
+      stage = 'harmony-signature';
+      await verifyHarmony(dir, metadata, readHarmonyConfig());
+      row.result = { sha256: metadata.sha256, versionCode: metadata.versionCode, size: metadata.size };
+      if (metadata.verifyOnly) row.status = 'verified';
+      else { stage = 'harmony-publish'; row.result = await activateHarmony(metadata, storage, row.keys); row.status = 'published'; }
+      save(row); return;
+    }
+    stage = 'signature';
+    const { stdout: signature } = await execute('/usr/bin/apksigner', ['verify', '--print-certs', apk], {
+      timeout: 30000, env: { ...process.env, JAVA_TOOL_OPTIONS: '-Xmx256m' } });
+    const certificates = [...signature.matchAll(/^Signer #\d+ certificate SHA-256 digest: ([a-f0-9]{64})$/gm)];
+    if (certificates.length !== 1 || certificates[0][1] !== metadata.certificateSha256) throw Error();
+    stage = 'identity';
+    const { stdout: badging } = await execute('/usr/bin/aapt', ['dump', 'badging', apk], { timeout: 30000 });
+    const identity = /^package: name='([^']+)' versionCode='(\d+)' versionName='([^']+)'/m.exec(badging);
+    if (!identity || identity[1] !== metadata.packageName || Number(identity[2]) !== metadata.versionCode
+      || identity[3] !== metadata.versionName || /^application-debuggable/m.test(badging)) throw Error();
+    row.result = { sha256: metadata.sha256, versionCode: metadata.versionCode, size: metadata.size };
+    if (metadata.verifyOnly) row.status = 'verified';
+    else {
+      stage = 'publish';
+      fs.writeFileSync(json, JSON.stringify(metadata), { mode: 0o600 });
+      const { stdout } = await execute(process.execPath, [fileURLToPath(new URL('./publish-android-release.mjs', import.meta.url)), apk, json, '--existing-object'], { timeout: 240000 });
+      row.result = JSON.parse(stdout.trim()); row.status = 'published';
+    }
+    save(row);
+  } catch (error) {
+    row.status = 'failed'; row.error = `RELEASE_${stage.toUpperCase()}_FAILED`; save(row);
+    console.error(JSON.stringify({ event: 'release-validation-failed', intentId: row.intentId, stage, code: /^[A-Za-z0-9_.-]+$/.test(error.code || '') ? error.code : 'validation' }));
+  } finally {
+    for (const file of [...files.map(f => path.join(dir, f.name)), json]) fs.rmSync(file, { force: true }); fs.rmdirSync(dir);
+    // Verification objects remain private evidence; the deployment identity has no DeleteObject grant.
+  }
+}
+// A restart never blindly launches an interrupted publisher a second time.
+for (const name of fs.readdirSync(stateDir).filter(x => /^[a-f0-9]{64}\.json$/.test(x))) {
+  const row = read(name.slice(0, -5));
+  if (row.status === 'validating') { row.status = 'failed'; row.error = 'INTERRUPTED_CHECK_LATEST'; save(row); }
+}
+server.requestTimeout = 15000;
+server.listen(45852, '127.0.0.1');
+process.on('SIGTERM', () => { server.close(); const timer = setInterval(() => { if (!busy) { clearInterval(timer); process.exit(0); } }, 250); });

package/dist/bin/set-relay-admin-password.mjs

@@ -0,0 +1,11 @@
+import fs from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { passwordRecord } from '../src/self-relay/admin-auth.mjs';
+
+// Run as the management service user (or root and then chown root:codexrelay).
+// The plaintext is printed once for handoff; only its salted scrypt hash is saved.
+const file = process.argv[2] || '/etc/codex-relay/admin-password.json';
+const password = randomBytes(18).toString('base64url');
+const record = await passwordRecord(password);
+fs.writeFileSync(file, JSON.stringify(record) + '\n', { mode: 0o640, flag: 'wx' });
+console.log(password);

package/dist/build-platform.json

@@ -1 +1 @@
-{"layout":"npm-platform-packages","version":"0.1.0-beta.50"}
+{"layout":"npm-platform-packages","version":"0.1.0-beta.59"}

package/dist/get-shared-service-url.ps1

@@ -1,14 +1,14 @@
-param([Parameter(Mandatory=$true)][string]$AppServerUrl)
-$ErrorActionPreference = 'Stop'
-[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
-if ($AppServerUrl -cnotmatch '^ws://127\.0\.0\.1:([1-9][0-9]{0,4})\z' -or [int]$Matches[1] -gt 65535) { throw 'Invalid managed app-server URL.' }
-$port = [int]$Matches[1]
-$package = Get-AppxPackage OpenAI.Codex | Select-Object -First 1
-if (-not $package) { exit }
-$desktop = Join-Path $package.InstallLocation 'app/ChatGPT.exe'
-# Match an installed Desktop process connected to the selected loopback port.
-$connections = @(Get-NetTCPConnection -RemotePort $port -State Established -ErrorAction SilentlyContinue | Where-Object {
-    $_.RemoteAddress -eq '127.0.0.1' -and
-    (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Path -eq $desktop
-})
-if ($connections.Count) { $AppServerUrl }
+param([Parameter(Mandatory=$true)][string]$AppServerUrl)
+$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+if ($AppServerUrl -cnotmatch '^ws://127\.0\.0\.1:([1-9][0-9]{0,4})\z' -or [int]$Matches[1] -gt 65535) { throw 'Invalid managed app-server URL.' }
+$port = [int]$Matches[1]
+$package = Get-AppxPackage OpenAI.Codex | Select-Object -First 1
+if (-not $package) { exit }
+$desktop = Join-Path $package.InstallLocation 'app/ChatGPT.exe'
+# Match an installed Desktop process connected to the selected loopback port.
+$connections = @(Get-NetTCPConnection -RemotePort $port -State Established -ErrorAction SilentlyContinue | Where-Object {
+    $_.RemoteAddress -eq '127.0.0.1' -and
+    (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Path -eq $desktop
+})
+if ($connections.Count) { $AppServerUrl }