@walkhi/code-relax 0.1.0-beta.51 → 0.1.0-beta.59

package/dist/bin/set-relay-admin-password.mjs

@@ -0,0 +1,11 @@
+import fs from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { passwordRecord } from '../src/self-relay/admin-auth.mjs';
+
+// Run as the management service user (or root and then chown root:codexrelay).
+// The plaintext is printed once for handoff; only its salted scrypt hash is saved.
+const file = process.argv[2] || '/etc/codex-relay/admin-password.json';
+const password = randomBytes(18).toString('base64url');
+const record = await passwordRecord(password);
+fs.writeFileSync(file, JSON.stringify(record) + '\n', { mode: 0o640, flag: 'wx' });
+console.log(password);

package/dist/build-platform.json

@@ -1 +1 @@
-{"layout":"npm-platform-packages","version":"0.1.0-beta.51"}
+{"layout":"npm-platform-packages","version":"0.1.0-beta.59"}

package/dist/shared/release-version.cjs

@@ -0,0 +1,31 @@
+(function (root, factory) {
+  const api = factory();
+  if (typeof module === 'object' && module.exports) module.exports = api;
+  else root.CodeRelaxReleaseVersion = api;
+})(typeof globalThis !== 'undefined' ? globalThis : this, function () {
+  function parse(value) {
+    if (typeof value !== 'string') return null;
+    const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.exec(value);
+    if (!match) return null;
+    const core = match.slice(1, 4).map(Number), pre = match[4]?.split('.') || [];
+    if (core.some(part => !Number.isSafeInteger(part)) || pre.some(part => /^\d+$/.test(part) && (part.length > 1 && part[0] === '0' || !Number.isSafeInteger(Number(part))))) return null;
+    return { core, pre };
+  }
+  function compare(a, b) {
+    const left = parse(a), right = parse(b);
+    if (!left || !right) return null;
+    for (let i = 0; i < 3; i++) if (left.core[i] !== right.core[i]) return left.core[i] > right.core[i] ? 1 : -1;
+    if (!left.pre.length || !right.pre.length) return left.pre.length === right.pre.length ? 0 : left.pre.length ? -1 : 1;
+    for (let i = 0; i < Math.max(left.pre.length, right.pre.length); i++) {
+      const x = left.pre[i], y = right.pre[i];
+      if (x === y) continue;
+      if (x === undefined || y === undefined) return x === undefined ? -1 : 1;
+      const nx = /^\d+$/.test(x), ny = /^\d+$/.test(y);
+      if (nx && ny) return Number(x) > Number(y) ? 1 : -1;
+      if (nx !== ny) return nx ? -1 : 1;
+      return x > y ? 1 : -1;
+    }
+    return 0;
+  }
+  return { compare };
+});

package/dist/src/dots-room-client.mjs

@@ -77,6 +77,8 @@ export class DotsRoomClient extends CelsiusClient {
             while ((end = text.indexOf('\n\n')) >= 0) {
               const frame = text.slice(0, end); text = text.slice(end + 2);
               const data = frame.split('\n').filter(line => line.startsWith('data:')).map(line => line.slice(5).trimStart()).join('\n');
+              // Desktop's ChatGPT SSE treats [DONE] as completion, not JSON.
+              if (data.trim() === '[DONE]') { finish(null, null); return; }
               if (data) try { onEvent(JSON.parse(data)); clearTimeout(timer); } catch (error) { finish(error); return; }
             }
             bytes = Buffer.byteLength(text);

package/dist/src/file-upload-session.mjs

@@ -34,6 +34,8 @@ async function uniqueDestination(directory, name, partial) {
 
 export function createFileUploadSession(root) {
   let upload;
+  let committed = false;
+  const files = new Map();
   const completed = new Map();
   let completedBytes = 0;
   const directory = path.join(root, 'incoming');
@@ -46,11 +48,12 @@ export function createFileUploadSession(root) {
   };
   const clear = async () => {
     await clearActive();
+    if (committed) return;
     for (const file of completed.values()) {
       await fs.unlink(file.path).catch(() => {});
       if (file.preview) await fs.unlink(file.preview.path).catch(() => {});
     }
-    completed.clear(); completedBytes = 0;
+    completed.clear(); files.clear(); completedBytes = 0;
   };
   return {
     async receive(message) {
@@ -58,19 +61,29 @@ export function createFileUploadSession(root) {
       if (message.type === 'cancel') { await clear(); return { type: 'cancelled' }; }
       if (message.type === 'commit') {
         if (upload) throw new Error('文件尚未上传完成');
-        completed.clear(); completedBytes = 0;
+        committed = true;
         return { type: 'committed' };
       }
       if (message.type === 'remove') {
+        if (committed) throw new Error('文件批次已提交');
         if (upload) throw new Error('请等待当前文件上传完成');
         const file = completed.get(message.id);
         if (!file) throw new Error('文件上传会话已失效');
         await fs.unlink(file.path);
         if (file.preview) await fs.unlink(file.preview.path);
         completed.delete(message.id); completedBytes -= file.size;
+        for (const [key, value] of files) if (value.id === message.id || value.previewOf === message.id) files.delete(key);
         return { type: 'removed', id: message.id };
       }
       if (message.type === 'start') {
+        if (typeof message.fileKey !== 'string' || !/^[0-9]+(?:-preview)?$/.test(message.fileKey)) throw new Error('文件批次编号无效');
+        const previous = files.get(message.fileKey);
+        if (previous) {
+          if (previous.originalName !== message.name || previous.size !== message.size ||
+              previous.expected !== message.sha256?.toLowerCase() || previous.previewOf !== message.previewOf) throw new Error('续传文件身份不一致');
+          return previous.result || { type: 'started', id: previous.id, offset: previous.offset, chunkBytes: FILE_CHUNK_BYTES };
+        }
+        if (committed) throw new Error('文件批次已提交');
         if (upload) throw new Error('已有文件正在上传');
         if (!validName(message.name)) throw new Error('文件名无效');
         if (!Number.isSafeInteger(message.size) || message.size < 1 || message.size > MAX_FILE_BYTES) {
@@ -87,7 +100,9 @@ export function createFileUploadSession(root) {
         const partial = path.join(directory, `.upload-${id}`);
         const handle = await fs.open(partial, 'wx');
         upload = { id, partial, handle, name: parent ? `${id}.preview.jpg` : message.name, size: message.size, parent,
+          originalName: message.name, previewOf: message.previewOf,
           expected: message.sha256.toLowerCase(), hash: crypto.createHash('sha256'), offset: 0 };
+        files.set(message.fileKey, upload);
         return { type: 'started', id, offset: 0, chunkBytes: FILE_CHUNK_BYTES };
       }
       const current = upload;
@@ -119,6 +134,7 @@ export function createFileUploadSession(root) {
         try { saved = await uniqueDestination(directory, current.name, current.partial); }
         catch (error) { await fs.unlink(current.partial).catch(() => {}); throw error; }
         const result = { type: 'completed', id: current.id, ...saved, size: current.size, sha256: current.expected };
+        current.result = result;
         if (current.parent) current.parent.preview = result;
         else { completed.set(current.id, result); completedBytes += current.size; }
         return result;

package/dist/src/lan-socket-server.mjs

@@ -7,12 +7,21 @@ import { FILE_READ_LIMIT } from './file-transfer-range.mjs';
 
 // One authenticated connection carries requests and explicitly owned subscriptions.
 // The dispatcher is shared business routing, not an HTTP loopback proxy.
-export function attachLanSocket(server, { token, dispatch, authorizeDevice = () => false, onDeviceAuthorizationsChanged, onDeviceConnected, uploadsRoot }) {
+export function attachLanSocket(server, { token, dispatch, authorizeDevice = () => false, onDeviceAuthorizationsChanged, onDeviceConnected,
+  onPhoneConnected, onPhoneDisconnected, uploadsRoot }) {
   // Allow four individually valid images to reach the aggregate-size validator,
   // so an oversized composition returns an error instead of dropping the connection.
   const wss = new WebSocketServer({ noServer: true, maxPayload: 48 * 1024 * 1024, perMessageDeflate: false });
   const uploadWss = new WebSocketServer({ noServer: true, maxPayload: 512 * 1024, perMessageDeflate: false });
   const activeUploads = new Map();
+  const uploadSessions = new Map();
+  let closing = false;
+  const expireUpload = async (id, entry) => {
+    if (uploadSessions.get(id) !== entry) return;
+    uploadSessions.delete(id);
+    clearTimeout(entry.timer);
+    await entry.session.close();
+  };
   const deviceConnections = new Map();
   const stopWatching = onDeviceAuthorizationsChanged?.(() => {
     for (const connection of deviceConnections.values()) {
@@ -39,7 +48,9 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
     target.handleUpgrade(request, socket, head, ws => target.emit('connection', ws));
   });
   uploadWss.on('connection', ws => {
-    let authenticated = false, stopped = false, identity = '', upload, purpose, chunk;
+    let authenticated = false, stopped = false, identity = '', upload, purpose, chunk, uploadEntry, uploadId;
+    let release, discardUpload = false;
+    const released = new Promise(resolve => { release = resolve; });
     let queued = 0;
     let pending = Promise.resolve();
     const authTimer = setTimeout(() => ws.close(1008, 'Authentication required'), 5000);
@@ -51,8 +62,16 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
       deviceConnections.delete(ws);
       clearTimeout(authTimer);
       void pending.finally(async () => {
-        await upload?.close();
         activeUploads.delete(ws);
+        if (uploadEntry) {
+          uploadEntry.ws = null;
+          if (discardUpload || closing) await expireUpload(uploadId, uploadEntry);
+          else {
+            uploadEntry.timer = setTimeout(() => { void expireUpload(uploadId, uploadEntry); }, 5 * 60 * 1000);
+            uploadEntry.timer.unref();
+          }
+        }
+        release();
       });
     };
     ws.on('close', stop);
@@ -76,21 +95,54 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
               authorizeDevice(message.clientId, message.credential) === true) identity = `device:${message.clientId}`;
           else if (token && message?.type === 'auth' && typeof message.token === 'string') {
             const supplied = Buffer.from(message.token), expected = Buffer.from(token || '');
-            if (supplied.length === expected.length && crypto.timingSafeEqual(supplied, expected)) identity = 'local-token';
+            if (supplied.length === expected.length && crypto.timingSafeEqual(supplied, expected)) {
+              identity = typeof message.relayClientId === 'string' && message.relayClientId.length <= 200
+                ? `relay:${message.relayClientId}` : 'local-token';
+            }
           }
+          if (identity && purpose === 'upload') {
+            uploadId = message.uploadSessionId;
+            if (typeof uploadId !== 'string' || !/^[a-f0-9-]{36}$/.test(uploadId)) throw new Error('上传批次编号无效');
+            const entry = uploadSessions.get(uploadId);
+            if (entry) {
+              if (entry.identity !== identity) throw new Error('上传批次身份不一致');
+              if (entry.ws) { entry.ws.terminate(); await entry.released; }
+              if (uploadSessions.get(uploadId) !== entry) throw new Error('上传批次已失效，无法确认原批次状态');
+            } else if (message.resumeUpload) throw new Error('上传断点已过期或工作站已重启，请重新发送');
+          }
+          // Taking over a connection can await an in-flight disk write. The new
+          // socket and its authorization must still be live when that finishes.
+          if (stopped || closing || ws.readyState !== WebSocket.OPEN) return;
+          if (message.type === 'device-auth' && !authorizeDevice(message.clientId, message.credential)) throw new Error('设备授权已失效');
           const same = [...activeUploads.values()].filter(item => item.identity === identity && item.purpose === purpose);
           const uploads = [...activeUploads.values()].filter(item => item.purpose === 'upload').length;
           if (!identity || same.length >= (purpose === 'upload' ? 1 : 3) || activeUploads.size >= 8 ||
               (purpose === 'upload' && uploads >= 2)) throw new Error('文件身份无效或文件任务过多');
           if (message.type === 'device-auth') deviceConnections.set(ws, {
             clientId: message.clientId, credential: message.credential,
-            revoke() { stop(); ws.close(4401, 'Device authorization revoked'); },
+            revoke() { discardUpload = true; stop(); ws.close(4401, 'Device authorization revoked'); },
           });
           activeUploads.set(ws, { identity, purpose }); authenticated = true; clearTimeout(authTimer);
           if (message.type === 'device-auth') onDeviceConnected?.(message.clientId, message);
-          if (purpose === 'upload') upload = createFileUploadSession(uploadsRoot);
-          reply({ type: 'ready', version: 2, purpose, maxDownloadBytes: FILE_READ_LIMIT, maxFileBytes: MAX_FILE_BYTES, maxFileCount: MAX_FILE_COUNT,
-            maxTotalBytes: MAX_TOTAL_BYTES, chunkBytes: FILE_CHUNK_BYTES });
+          if (purpose === 'upload') {
+            uploadEntry = uploadSessions.get(uploadId);
+            if (!uploadEntry) {
+              if ([...uploadSessions.values()].filter(entry => !entry.committed).length >= 2) throw new Error('待完成上传批次过多，请稍后再试');
+              if (uploadSessions.size >= 32) {
+                const oldest = [...uploadSessions].find(([, entry]) => entry.committed && !entry.ws);
+                if (!oldest) throw new Error('上传批次过多，请稍后再试');
+                await expireUpload(...oldest);
+              }
+              if (stopped || closing || ws.readyState !== WebSocket.OPEN) return;
+              uploadEntry = { identity, session: createFileUploadSession(uploadsRoot) };
+              uploadSessions.set(uploadId, uploadEntry);
+            }
+            clearTimeout(uploadEntry.timer);
+            Object.assign(uploadEntry, { ws, released });
+            upload = uploadEntry.session;
+          }
+          reply({ type: 'ready', version: 3, purpose, maxDownloadBytes: FILE_READ_LIMIT, maxFileBytes: MAX_FILE_BYTES, maxFileCount: MAX_FILE_COUNT,
+            maxTotalBytes: MAX_TOTAL_BYTES, chunkBytes: FILE_CHUNK_BYTES, uploadSessionId: uploadId });
           return;
         }
         if (purpose === 'download') {
@@ -112,12 +164,19 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
           chunk = message; return;
         }
         reply(await upload.receive(message));
-      }).catch(error => { reply({ type: 'error', error: error.message }); stop(); ws.close(1008, 'File request rejected'); })
+        if (message.type === 'commit') uploadEntry.committed = true;
+        if (message.type === 'cancel') {
+          await expireUpload(uploadId, uploadEntry);
+          uploadEntry = null;
+        }
+      }).catch(error => { reply({ type: 'error', error: error.message }); discardUpload = true; stop(); ws.close(1008, 'File request rejected'); })
         .finally(() => { queued--; });
     });
   });
   wss.on('connection', ws => {
     let authenticated = false, alive = true, stopped = false;
+    let phone, reported = false;
+    const connectionId = crypto.randomUUID();
     const active = new Map();
     const send = value => {
       if (stopped || ws.readyState !== WebSocket.OPEN) return;
@@ -136,6 +195,7 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
       stopped = true;
       deviceConnections.delete(ws);
       clearTimeout(authTimer); clearInterval(heartbeat);
+      if (reported) onPhoneDisconnected?.(connectionId);
       for (const reply of active.values()) reply.end();
       active.clear();
     };
@@ -158,6 +218,10 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
         if (!accepted) {
           ws.close(1008, 'Authentication failed'); return;
         }
+        if (message.type === 'device-auth') phone = { clientId: message.clientId, mode: 'lan' };
+        else if (typeof message.relayClientId === 'string' && /^[\w-]{16,128}$/.test(message.relayClientId)) {
+          phone = { clientId: message.relayClientId, mode: 'self-relay' };
+        }
         if (message.type === 'device-auth') onDeviceConnected?.(message.clientId, message);
         if (message.type === 'device-auth') deviceConnections.set(ws, {
           clientId: message.clientId, credential: message.credential,
@@ -186,6 +250,12 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
           (message.body !== undefined && (!message.body || typeof message.body !== 'object' || Array.isArray(message.body)))) {
         send({ type: 'response', id, status: 400, body: { error: '无效的连接请求' } }); return;
       }
+      // Health probes, management and file sockets are not chat connections.
+      // Three message sources share this catalog/events entry point.
+      if (phone && !reported && /^\/api\/(?:threads(?:\?|$)|thread-events(?:\?|$)|threads\/[^/?]+\/(?:events|dots-activity-events)(?:\?|$))/.test(path)) {
+        reported = true;
+        onPhoneConnected?.(connectionId, phone.clientId, phone.mode);
+      }
       const reply = new EventEmitter();
       let waiting, batch = 0;
       const sendPart = (pieces, pageEnd = false) => new Promise((resolve, reject) => {
@@ -259,8 +329,10 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
     });
   });
   return { close() {
+    closing = true;
     stopWatching?.();
     for (const ws of wss.clients) ws.terminate(); wss.close();
     for (const ws of uploadWss.clients) ws.terminate(); uploadWss.close();
+    for (const [id, entry] of uploadSessions) if (!entry.ws) void expireUpload(id, entry);
   } };
 }

package/dist/src/platform/desktop-project-store.mjs

@@ -140,6 +140,11 @@ export async function withDesktopProjectRegistration(options, action) {
     const mutate = async (project, operation, saveOperation, removeNative) => {
         const transform = updating ? (state, value, root) => updateProjectInState(state, value, root, operation.previousProject)
           : removing ? removeProjectFromState : registerProjectInState;
+        const verify = async () => {
+          const finalState = parseState(await fs.readFile(stateFile));
+          const verified = transform(finalState, project, codexDataRoot);
+          if (JSON.stringify(verified) !== JSON.stringify(finalState)) throw new Error('Desktop 项目状态未能在最终文件中核对，请检查后继续完成操作。');
+        };
         let restartNeeded = operation.desktopWasRunning === true;
         let registrationError;
         const current = await host.inspect();
@@ -181,27 +186,33 @@ export async function withDesktopProjectRegistration(options, action) {
           if (removing) await removeNative();
           operation[removing ? 'desktopRemoved' : 'desktopRegistered'] = true;
           await saveOperation();
+          // Verify the committed registry while Desktop is still closed. New
+          // projects are usable in the kernel without waiting for its UI.
+          if (!removing && !updating) await verify();
         } catch (error) { registrationError = error; }
         // Restore the UI even if the registry write failed. This never starts or
         // restarts a kernel and never changes the service's active connections.
         if (restartNeeded) {
           try {
             if (!(await host.inspect()).running) await host.startDesktop(info.desktop, { CODEX_APP_SERVER_WS_URL: serverUrl, CODEX_HOME: codexDataRoot });
-            const deadline = Date.now() + readyTimeoutMs;
-            while (!await host.desktopReady()) {
-              if (Date.now() >= deadline) throw new Error('Codex Desktop 尚未重新就绪。');
-              await wait(500);
+            // Creation completes once registration is verified and the OS has
+            // accepted launch. Keep update/removal's existing readiness contract.
+            if (removing || updating) {
+              const deadline = Date.now() + readyTimeoutMs;
+              while (!await host.desktopReady()) {
+                if (Date.now() >= deadline) throw new Error('Codex Desktop 尚未重新就绪。');
+                await wait(500);
+              }
+              if (await host.sharedServiceUrl() !== serverUrl) throw new Error('Desktop 未接入原工作站内核。');
             }
-            if (await host.sharedServiceUrl() !== serverUrl) throw new Error('Desktop 未接入原工作站内核。');
           } catch (error) {
             throw new Error([registrationError?.message, `${removing ? '项目移除状态已记录' : '项目已保留'}，重新打开 Codex Desktop 未完成：${error.message}`].filter(Boolean).join(' '));
           }
         }
         if (registrationError) throw registrationError;
-        const finalState = parseState(await fs.readFile(stateFile));
-        const verified = transform(finalState, project, codexDataRoot);
-        if (JSON.stringify(verified) !== JSON.stringify(finalState)) throw new Error('Desktop 项目状态未能在最终文件中核对，请检查后继续完成操作。');
-        return { status: removing ? 'removed' : updating ? 'updated' : 'registered', restarted: restartNeeded };
+        if (removing || updating) await verify();
+        return { status: removing ? 'removed' : updating ? 'updated' : 'registered',
+          ...(removing || updating ? { restarted: restartNeeded } : { restartRequested: restartNeeded }) };
     };
     return await action({ register: mutate, remove: mutate });
   } finally { await release(); }

package/dist/src/self-relay/admin-auth.mjs

@@ -0,0 +1,59 @@
+import fs from 'node:fs';
+import { randomBytes, scrypt, timingSafeEqual } from 'node:crypto';
+import { promisify } from 'node:util';
+
+const derive = promisify(scrypt);
+const COOKIE = '__Host-code-relax-admin';
+const SESSION_MS = 12 * 60 * 60 * 1000;
+const cookie = (value, seconds) => `${COOKIE}=${value}; Path=/; Secure; HttpOnly; SameSite=Strict; Max-Age=${seconds}`;
+
+export async function passwordRecord(password) {
+  if (typeof password !== 'string' || password.length < 10 || Buffer.byteLength(password) > 256) {
+    throw new Error('Admin password must have at least 10 characters and at most 256 bytes');
+  }
+  const salt = randomBytes(16).toString('hex');
+  return { salt, hash: (await derive(password, salt, 64)).toString('hex') };
+}
+
+export function createAdminAuth(passwordFile) {
+  const { salt, hash } = JSON.parse(fs.readFileSync(passwordFile, 'utf8'));
+  if (!/^[a-f0-9]{32}$/.test(salt) || !/^[a-f0-9]{128}$/.test(hash)) throw new Error('Invalid admin password record');
+  const expected = Buffer.from(hash, 'hex');
+  const sessions = new Map();
+  let windowStart = 0, attempts = 0, verifying = false;
+  const token = request => (request.headers.cookie || '').split(';').map(value => value.trim())
+    .find(value => value.startsWith(`${COOKIE}=`))?.slice(COOKIE.length + 1);
+  function purge() {
+    for (const [id, expires] of sessions) if (expires <= Date.now()) sessions.delete(id);
+  }
+  return {
+    authenticated(request) { purge(); return sessions.has(token(request)); },
+    async login(password, request, response) {
+      const now = Date.now();
+      if (now - windowStart >= 60000) { windowStart = now; attempts = 0; }
+      // This is a single-owner console: bound both guessing and concurrent scrypt memory.
+      if (attempts >= 10 || verifying) {
+        response.setHeader('Retry-After', '60');
+        return { status: 429, error: '尝试过于频繁，请一分钟后重试' };
+      }
+      attempts++;
+      if (typeof password !== 'string' || Buffer.byteLength(password) > 256) return { status: 400, error: '请输入有效密码' };
+      verifying = true;
+      try {
+        const actual = await derive(password, salt, 64);
+        if (!timingSafeEqual(actual, expected)) return { status: 401, error: '密码不正确' };
+        purge();
+        sessions.delete(token(request));
+        if (sessions.size >= 32) sessions.delete(sessions.keys().next().value);
+        const id = randomBytes(32).toString('base64url');
+        sessions.set(id, Date.now() + SESSION_MS);
+        response.setHeader('Set-Cookie', cookie(id, SESSION_MS / 1000));
+        return { status: 200 };
+      } finally { verifying = false; }
+    },
+    logout(request, response) {
+      sessions.delete(token(request));
+      response.setHeader('Set-Cookie', cookie('', 0));
+    },
+  };
+}

package/dist/src/self-relay/admin-login-page.mjs

@@ -0,0 +1,7 @@
+import { adminUiTokens, adminFooterStyles, adminAuthStyles } from './admin-style.mjs';
+
+export function adminLoginPage() {
+  return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>登录 · Code Relax 管理</title><style>${adminUiTokens}${adminFooterStyles}${adminAuthStyles}</style></head>
+<body class="admin-login"><main><form id="login" class="login-card"><h1>Code Relax 管理</h1><p>输入管理密码，进入后台。</p><label for="password">管理密码</label><input id="password" name="password" type="password" autocomplete="current-password" required maxlength="256" autofocus><button id="submit" type="submit">登录</button><p id="result" role="alert" aria-live="polite"></p></form></main><footer class="admin-footer">京ICP备2026027643号-2</footer>
+<script>const form=document.getElementById('login'),button=document.getElementById('submit'),result=document.getElementById('result');form.addEventListener('submit',async event=>{event.preventDefault();if(button.disabled)return;button.disabled=true;result.textContent='正在登录…';try{const response=await fetch('/admin/login',{method:'POST',headers:{'Content-Type':'application/json','X-Code-Relax-Admin':'1'},body:JSON.stringify({password:form.password.value})});const body=await response.json();if(!response.ok)throw new Error(body.error||'登录失败');form.reset();location.replace('/')}catch(error){result.textContent=error.message}finally{button.disabled=false}});</script></body></html>`;
+}

package/dist/src/self-relay/admin-page.mjs

@@ -1,6 +1,7 @@
-import { adminUiTokens, adminFooterStyles } from './admin-style.mjs';
+import { adminUiTokens, adminFooterStyles, adminAuthStyles, adminWorkstationStyles } from './admin-style.mjs';
+import { adminWorkstationsMarkup, adminWorkstationsScript } from './admin-workstations-page.mjs';
 
-export function adminPage(basePath = '/admin') {
+export function adminPage() {
   return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="color-scheme" content="only light"><meta name="theme-color" content="#f5f7fa"><title>Code Relax 管理</title><style>${adminUiTokens}${adminFooterStyles}</style>
 <style>@media(max-width:600px){body main{padding:12px 12px 40px}header.page-head{align-items:center;gap:8px;margin-bottom:8px}header.page-head h1{font-size:20px;line-height:1.2;margin:0}main .nav{gap:0;margin-bottom:12px}main .nav button{padding:8px 11px}main .stack,main .grid{gap:10px}main .card{padding:12px}main .hero strong{font-size:20px}main .throughput{grid-template-columns:repeat(2,minmax(0,1fr));gap:6px;margin-top:10px}main .metrics{gap:6px}main .metric{display:flex;flex-direction:row-reverse;align-items:center;justify-content:space-between;gap:6px;min-width:0;padding:9px 10px}main .metric strong{font-size:17px;margin:0;white-space:nowrap}main .metric span{font-size:11px}main .card-head{margin-bottom:10px}}</style>
 <style>@media(max-width:600px){main .throughput .metric strong{font-size:17px}}</style>
@@ -22,7 +23,8 @@ button{background:#e0f0e5;color:#235d3a;border-color:#a9cbb4}button:hover{backgr
 @media(max-width:800px){#metrics{grid-template-columns:repeat(2,minmax(0,1fr))}}
 @media(max-width:600px){.resource-card .throughput .metric strong{font-size:14px}}
 </style><style>main:not(.authenticated)>:not(#adminLogin){display:none!important}#adminLogin{max-width:430px;margin:10vh auto}#adminLogin[hidden]{display:none}.usage-toolbar{display:flex;align-items:center;justify-content:space-between;gap:12px;flex-wrap:wrap;margin-bottom:16px}.usage-views,.usage-pages{display:flex;align-items:center;gap:8px}.usage-views button[aria-pressed=true]{background:#286e43;color:#fff}.usage-rows{display:grid;gap:8px}.usage-row{display:grid;gap:8px;padding:12px 14px;border:1px solid var(--admin-row-border);border-radius:var(--admin-control-radius);background:var(--admin-row)}.usage-row-head{display:flex;align-items:baseline;justify-content:space-between;gap:12px;min-width:0}.usage-row-head span{min-width:0;overflow-wrap:anywhere}.usage-row-head small{flex-shrink:0;white-space:nowrap}.usage-row strong{font-variant-numeric:tabular-nums}.usage-row small{text-align:right}.usage-pages{margin-top:16px}</style></head><body><main class="authenticated">
-<header class="page-head"><h1>中继管理</h1><nav class="nav" aria-label="管理页面"><button type="button" data-page="overview" aria-current="page">运行概览</button><button type="button" data-page="announcements">系统公告</button><button type="button" data-page="settings">容量设置</button><button type="button" data-page="usage">使用统计</button></nav></header>
+<style>${adminAuthStyles}${adminWorkstationStyles}</style><header class="page-head"><h1>中继管理</h1><nav class="nav" aria-label="管理页面"><button type="button" data-page="overview" aria-current="page">运行概览</button><button type="button" data-page="workstations">工作站</button><button type="button" data-page="announcements">系统公告</button><button type="button" data-page="settings">容量设置</button><button type="button" data-page="usage">使用统计</button></nav><button id="logout" class="secondary admin-logout" type="button">退出登录</button></header>
+${adminWorkstationsMarkup}
 <section id="overview" class="page stack"><section class="card" aria-label="中继连接与转发"><div class="relay-heading"><h2>中继连接与转发</h2><span id="healthText" class="state">读取中</span></div><div id="metrics" class="metrics"></div></section><div class="grid"><section class="card resource-card" aria-label="服务器资源"><div class="card-head resource-head"><h2>服务器资源</h2><span id="sampleTime" class="hint">等待采样</span></div><div id="serverMetrics" class="metrics"></div><div class="throughput" id="throughput"></div></section><section class="card quota-card"><div class="card-head"><h2>流量包</h2><span id="trafficNote" class="hint">等待更新</span></div><p id="trafficUsage" class="traffic-usage">—</p><div id="trafficTimeline" class="quota-timeline" hidden><div class="quota-heading"><strong id="trafficRemaining">流量剩余 —</strong><span id="trafficPace" class="quota-pace">—×</span><span id="timeRemaining">时间剩余 —</span></div><div id="quotaTrack" class="quota-track" role="img"><span id="quotaFill" class="quota-fill"></span><span id="quotaNow" class="quota-now"></span></div><div class="quota-period"><span id="trafficEnd">到期 —</span><span id="trafficStart">本期开始 —</span></div></div></section></div></section>
 <section id="announcements" class="page" hidden><section class="card"><div class="announcement-toolbar"><div><h2>公告管理</h2><p id="announcementCount" class="hint">正在读取</p></div><button id="newAnnouncement" type="button">新建公告</button></div><div class="announcement-controls"><input id="announcementSearch" type="search" aria-label="搜索公告" placeholder="搜索标题或正文"><select id="announcementFilter" aria-label="筛选状态"><option value="all">全部状态</option><option value="active">发布中</option><option value="draft">草稿</option><option value="withdrawn">已撤下</option></select></div><div id="announcementList" class="announcement-list" style="margin-top:14px"></div></section></section>
 <dialog id="announcementEditor" aria-labelledby="editorHeading"><div class="editor-head"><h2 id="editorHeading">新建公告</h2><button id="closeEditor" class="secondary" type="button" aria-label="关闭">关闭</button></div><div class="field"><label for="title">标题</label><input id="title" maxlength="80" placeholder="输入公告标题"></div><div class="field"><label for="message">正文</label><textarea id="message" maxlength="2000" placeholder="输入公告内容"></textarea></div><p id="editorNote" class="hint"></p><p id="editorError" class="status error" role="alert" hidden></p><div id="editorActions" class="editor-actions"><button id="saveDraft" class="secondary" type="button">保存草稿</button><button id="publish" type="button">发布公告</button></div></dialog>
@@ -30,7 +32,8 @@ button{background:#e0f0e5;color:#235d3a;border-color:#a9cbb4}button:hover{backgr
 <section id="usage" class="page" hidden><section class="card"><div class="usage-toolbar"><div><h2>今日使用统计</h2><p id="usageCount" class="hint">正在读取</p></div><div class="usage-views"><button id="usageUsers" type="button" class="secondary" aria-pressed="true">用户</button><button id="usageComputers" type="button" class="secondary" aria-pressed="false">工作站</button><button id="usageRefresh" type="button" class="secondary">刷新</button></div></div><div id="usageRows" class="usage-rows"></div><div class="usage-pages"><button id="usagePrev" type="button" class="secondary">上一页</button><span id="usagePageText" class="hint"></span><button id="usageNext" type="button" class="secondary">下一页</button></div><p id="usageError" class="status error" role="alert"></p></section></section><p id="result" class="status" role="status" aria-live="polite"></p>
 </main><footer class="admin-footer">网站备案号：京ICP备2026027643号-2</footer><script>
 const el=id=>document.getElementById(id);let snapshot=null;
-const request=async(path,options={})=>{const response=await fetch(path,{...options,referrerPolicy:'no-referrer'});const body=await response.json();if(!response.ok)throw new Error(body.error||('HTTP '+response.status));return body};
+const request=async(path,options={})=>{const response=await fetch(path,{...options,referrerPolicy:'no-referrer'});if(response.status===401){location.replace('/');throw new Error('登录已过期，请重新登录')}const body=await response.json();if(!response.ok)throw new Error(body.error||('HTTP '+response.status));return body};
+el('logout').addEventListener('click',async()=>{el('logout').disabled=true;try{await request('/admin/logout',{method:'POST',headers:{'X-Code-Relax-Admin':'1'}});location.replace('/')}catch(error){setResult(error.message,true)}finally{el('logout').disabled=false}});
 function setResult(message,error=false){el('result').textContent=message;el('result').classList.toggle('error',error)}
 function node(tag,className,value){const item=document.createElement(tag);if(className)item.className=className;if(value!==undefined)item.textContent=value;return item}
 function metric(value,label,extra,tone){const item=node('div','metric'+(tone?' '+tone:''));item.append(node('strong','',value),node('span','',label));if(extra)item.append(node('small','',extra));return item}
@@ -69,12 +72,16 @@ function usageTime(value){return value?new Date(value.replace(' ','T')+'Z').toLo
 async function loadUsage(){const view=usageView,page=usagePage;el('usageError').textContent='';el('usageCount').textContent='正在读取';try{const result=await request('/admin/api/usage?view='+view+'&page='+page);if(view!==usageView||page!==usagePage||el('usage').hidden)return;usageTotal=result.total;el('usageCount').textContent='今日有记录：'+usageTotal+(view==='user'?' 个用户':' 台工作站')+' · 北京时间';el('usagePageText').textContent='第 '+page+' / '+Math.max(1,Math.ceil(usageTotal/30))+' 页';el('usagePrev').disabled=page<=1;el('usageNext').disabled=page*30>=usageTotal;const rows=el('usageRows');rows.replaceChildren();if(!result.rows.length){rows.append(node('div','empty-note','今日暂无计时记录'));return}for(const item of result.rows){const row=node('div','usage-row');const counts=' · 消息 '+Number(item.message_count||0)+' · 轮次 '+Number(item.turn_count||0);const heading=node('div','usage-row-head');const title=node('span','',view==='user'?item.email:'工作站 …'+item.id.slice(-8));title.title=view==='user'?item.email:item.id;heading.append(title,node('small','hint','最后使用 '+usageTime(item.last_used_at)));row.append(heading,node('strong','',view==='user'?'任务 '+usageDuration(item.today_task_seconds)+counts:'任务 '+usageDuration(item.today_task_seconds)+' · 免费账号 '+usageDuration(item.today_free_task_seconds)+counts));rows.append(row)}}catch(error){if(view===usageView&&page===usagePage){usageTotal=0;el('usageCount').textContent='统计暂不可用';el('usageRows').replaceChildren();el('usagePageText').textContent='';el('usagePrev').disabled=true;el('usageNext').disabled=true;el('usageError').textContent=error.message}}}
 function setUsageView(view){if(usageView===view)return;usageView=view;usagePage=1;el('usageUsers').setAttribute('aria-pressed',String(view==='user'));el('usageComputers').setAttribute('aria-pressed',String(view==='computer'));void loadUsage()}
 el('usageUsers').onclick=()=>setUsageView('user');el('usageComputers').onclick=()=>setUsageView('computer');el('usageRefresh').onclick=()=>loadUsage();el('usagePrev').onclick=()=>{if(usagePage>1){usagePage--;void loadUsage()}};el('usageNext').onclick=()=>{if(usagePage*30<usageTotal){usagePage++;void loadUsage()}};
-function showPage(page){for(const button of document.querySelectorAll('[data-page]'))button.setAttribute('aria-current',button.dataset.page===page?'page':'false');for(const section of document.querySelectorAll('.page'))section.hidden=section.id!==page;history.replaceState(null,'','#'+page);if(page==='usage')void loadUsage();else void load()}
-for(const button of document.querySelectorAll('[data-page]'))button.addEventListener('click',()=>showPage(button.dataset.page));
+function showPage(route){cancelWorkstations();const detail=route.startsWith('workstations/')&&/^[a-zA-Z0-9_-]{16,128}$/.test(route.slice(13))?[route,route.slice(13)]:null;const page=detail?'workstations':['overview','announcements','settings','usage','workstations'].includes(route)?route:'overview';workstationId=detail?detail[1]:null;for(const button of document.querySelectorAll('[data-page]'))button.setAttribute('aria-current',button.dataset.page===page?'page':'false');for(const section of document.querySelectorAll('.page'))section.hidden=section.id!==page;if(page==='workstations'){el('workstationBack').hidden=!workstationId;el('workstationHeading').textContent=workstationId?'工作站详情':'工作站';el('workstationCount').textContent='正在读取';el('workstationContent').replaceChildren();el('workstationError').textContent='';void loadWorkstations()}else if(page==='usage')void loadUsage();else void load()}
+function navigatePage(page){history.pushState(null,'','#'+page);showPage(page)}
+for(const button of document.querySelectorAll('[data-page]'))button.addEventListener('click',()=>navigatePage(button.dataset.page));
+window.addEventListener('popstate',()=>showPage(location.hash.slice(1)));
 el('saveLimit').addEventListener('click',()=>write('PUT','/admin/api/settings',{maxRelaySessions:Number(el('limit').value)},'转发容量已保存'));
 el('newAnnouncement').addEventListener('click',()=>openEditor());el('closeEditor').addEventListener('click',()=>el('announcementEditor').close());el('announcementSearch').addEventListener('input',()=>{if(snapshot)renderAnnouncements(snapshot)});el('announcementFilter').addEventListener('change',()=>{if(snapshot)renderAnnouncements(snapshot)});
 async function saveAnnouncement(publish){const title=el('title').value.trim(),message=el('message').value.trim();if(!title||!message){el('editorError').textContent='请填写标题和正文';el('editorError').hidden=false;return}if(publish&&snapshot?.announcement&&snapshot.announcement.id!==editorItem?.id&&!confirm('发布后将替换当前公告，确定发布？'))return;const path=editorMode==='draft'?'/admin/api/announcements/'+encodeURIComponent(editorItem.id):'/admin/api/announcements';const target=publish&&editorMode==='draft'?path+'/publish':path;const body={title,message};if(publish&&editorMode==='new')body.publish=true;const ok=await write('PUT',target,body,publish?'公告已发布':'草稿已保存');if(ok)el('announcementEditor').close()}
 el('saveDraft').addEventListener('click',()=>saveAnnouncement(false));el('publish').addEventListener('click',()=>saveAnnouncement(true));
-showPage(['overview','announcements','settings','usage'].includes(location.hash.slice(1))?location.hash.slice(1):'overview');setInterval(()=>{if(!document.hidden&&!el('overview').hidden)load()},5000);
-</script></body></html>`.replaceAll('/admin/api/', basePath + '/api/');
+${adminWorkstationsScript}
+showPage(location.hash.slice(1));setInterval(()=>{if(document.hidden)return;if(!el('overview').hidden)void load();else if(!el('workstations').hidden)void loadWorkstations()},5000);
+document.addEventListener('visibilitychange',()=>{if(document.hidden)cancelWorkstations();else if(!el('workstations').hidden)void loadWorkstations()});
+</script></body></html>`;
 }

package/dist/src/self-relay/admin-server.mjs

@@ -3,6 +3,9 @@ import fs from 'node:fs';
 import { adminPage } from './admin-page.mjs';
 import { startAdminCloud } from './admin-cloud.mjs';
 import { MAX_ADMIN_REQUEST_BYTES } from './admin-state.mjs';
+import { createAdminAuth } from './admin-auth.mjs';
+import { adminLoginPage } from './admin-login-page.mjs';
+import endpoints from '../../shared/service-endpoints.cjs';
 
 function reply(response, status, body, type = 'application/json; charset=utf-8') {
   const bytes = typeof body === 'string' ? body : JSON.stringify(body);
@@ -12,10 +15,22 @@ function reply(response, status, body, type = 'application/json; charset=utf-8')
   response.end(bytes);
 }
 
-export async function startAdminServer({ port = 45851, relayUrl = 'http://127.0.0.1:45850', accessFile = '/etc/codex-relay/admin-access.json' } = {}) {
+async function readBody(request) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of request) {
+    size += chunk.length;
+    if (size > MAX_ADMIN_REQUEST_BYTES) throw Object.assign(new Error('Admin request too large'), { status: 413 });
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks);
+}
+
+export async function startAdminServer({ port = 45851, relayUrl = 'http://127.0.0.1:45850', accessFile = '/etc/codex-relay/admin-access.json',
+  passwordFile = '/etc/codex-relay/admin-password.json', publicOrigin = endpoints.adminOrigin } = {}) {
   const { key } = JSON.parse(fs.readFileSync(accessFile, 'utf8'));
   if (!/^[A-Za-z0-9_-]{43}$/.test(key)) throw new Error('Invalid admin access key');
-  const basePath = '/admin/' + key;
+  const auth = createAdminAuth(passwordFile);
   const cloud = startAdminCloud();
   const relayOrigin = new URL(relayUrl);
   if (relayOrigin.hostname !== '127.0.0.1' || relayOrigin.protocol !== 'http:' || relayOrigin.pathname !== '/') {
@@ -24,16 +39,38 @@ export async function startAdminServer({ port = 45851, relayUrl = 'http://127.0.
   const server = http.createServer(async (request, response) => {
     const target = new URL(request.url || '/', 'http://localhost');
     if (request.method === 'GET' && target.pathname === '/admin/health') { reply(response, 200, { ok: true }); return; }
-    if (request.headers['sec-fetch-site'] === 'cross-site' && request.method !== 'GET') { reply(response, 403, { error: 'Cross-site request rejected' }); return; }
-    if (target.pathname !== basePath && !target.pathname.startsWith(basePath + '/')) { reply(response, 404, { error: 'Not found' }); return; }
-    target.pathname = '/admin' + target.pathname.slice(basePath.length);
+    if (!['GET', 'HEAD'].includes(request.method) && (request.headers.origin !== publicOrigin
+      || request.headers['sec-fetch-site'] === 'cross-site' || request.headers['x-code-relax-admin'] !== '1')) {
+      reply(response, 403, { error: 'Cross-site request rejected' }); return;
+    }
+    if (request.method === 'GET' && target.pathname === '/') {
+      reply(response, 200, auth.authenticated(request) ? adminPage() : adminLoginPage(), 'text/html; charset=utf-8'); return;
+    }
     if (request.method === 'GET' && ['/admin', '/admin/'].includes(target.pathname)) {
-      reply(response, 200, adminPage(basePath), 'text/html; charset=utf-8'); return;
+      response.writeHead(303, { Location: '/', 'Cache-Control': 'no-store' }); response.end(); return;
     }
-    if (request.method === 'GET' && target.pathname === '/admin/usage') {
-      response.writeHead(302, { Location: basePath + '#usage', 'Cache-Control': 'no-store' }); response.end(); return;
+    if (request.method === 'POST' && target.pathname === '/admin/login') {
+      try {
+        if (request.headers['content-type']?.split(';')[0] !== 'application/json') {
+          reply(response, 415, { error: 'Expected application/json' }); return;
+        }
+        const { password } = JSON.parse((await readBody(request)).toString('utf8'));
+        const result = await auth.login(password, request, response);
+        reply(response, result.status, result.error ? { error: result.error } : { ok: true });
+      } catch (error) {
+        const status = error.status || (error instanceof SyntaxError || error instanceof TypeError ? 400 : 500);
+        if (status === 500) console.error('Admin login failed:', error.message);
+        reply(response, status, { error: status === 500 ? '登录服务暂不可用' : '登录请求无效' });
+      }
+      return;
     }
-    if (request.method === 'GET' && ['/admin/api/status', '/admin/api/session', '/admin/api/usage', '/admin/api/usage-diagnostics'].includes(target.pathname)) {
+    if (request.method === 'POST' && target.pathname === '/admin/logout') {
+      auth.logout(request, response); reply(response, 200, { ok: true }); return;
+    }
+    if (!target.pathname.startsWith('/admin/api/')) { reply(response, 404, { error: 'Not found' }); return; }
+    if (!auth.authenticated(request)) { reply(response, 401, { error: '登录已过期，请重新登录' }); return; }
+    if (request.method === 'GET' && (['/admin/api/status', '/admin/api/usage', '/admin/api/usage-diagnostics',
+      '/admin/api/workstations'].includes(target.pathname) || /^\/admin\/api\/workstations\/[\w-]{16,128}$/.test(target.pathname))) {
       try {
         const upstream = await fetch(new URL(target.pathname + target.search, relayOrigin), {
           signal: AbortSignal.timeout(3000), headers: { 'X-Code-Relax-Admin-Key': key } });
@@ -50,22 +87,16 @@ export async function startAdminServer({ port = 45851, relayUrl = 'http://127.0.
       reply(response, 404, { error: 'Not found' }); return;
     }
     try {
-      const chunks = [];
-      let size = 0;
-      for await (const chunk of request) {
-        size += chunk.length;
-        if (size > MAX_ADMIN_REQUEST_BYTES) { reply(response, 413, { error: 'Admin request too large' }); return; }
-        chunks.push(chunk);
-      }
+      const body = await readBody(request);
       const upstream = await fetch(new URL(target.pathname + target.search, relayOrigin), {
         method: request.method, signal: AbortSignal.timeout(3000),
         headers: { 'Content-Type': request.headers['content-type'] || '',
           'X-Code-Relax-Admin': request.headers['x-code-relax-admin'] || '',
           'X-Code-Relax-Admin-Key': key },
-        body: Buffer.concat(chunks),
+        body,
       });
       reply(response, upstream.status, await upstream.text());
-    } catch { reply(response, 503, { error: '中继服务暂不可用' }); }
+    } catch (error) { reply(response, error.status || 503, { error: error.status === 413 ? error.message : '中继服务暂不可用' }); }
   });
   try {
     await new Promise((resolve, reject) => { server.once('error', reject); server.listen(port, '127.0.0.1', resolve); });