@walkhi/code-relax 0.1.0-beta.68 → 0.1.0-beta.69

package/dist/bin/manage-relay-admin.mjs

@@ -1,20 +1,20 @@
-#!/usr/bin/env node
-import fs from 'node:fs';
-import mysql from 'mysql2/promise';
-
-const path = process.env.RELAY_MYSQL_CONFIG_FILE;
-const action = process.argv[2];
-const email = (process.argv[3] || '').trim().toLowerCase();
-if (!path || !['--grant', '--revoke', '--list'].includes(action) ||
-    (action !== '--list' && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email))) {
-  throw new Error('Use --grant EMAIL, --revoke EMAIL or --list with RELAY_MYSQL_CONFIG_FILE');
-}
-const db = await mysql.createConnection({ ...JSON.parse(fs.readFileSync(path, 'utf8')),
-  dateStrings: true, timezone: 'Z', multipleStatements: false });
-try {
-  if (action === '--grant') await db.execute(`INSERT INTO relay_admin_emails (email,granted_at)
-    VALUES (?,UTC_TIMESTAMP(3)) ON DUPLICATE KEY UPDATE email=VALUES(email)`, [email]);
-  else if (action === '--revoke') await db.execute('DELETE FROM relay_admin_emails WHERE email=?', [email]);
-  const [rows] = await db.query('SELECT email FROM relay_admin_emails ORDER BY email');
-  console.log(JSON.stringify({ admins: rows.map(row => row.email) }));
-} finally { await db.end(); }
+#!/usr/bin/env node
+import fs from 'node:fs';
+import mysql from 'mysql2/promise';
+
+const path = process.env.RELAY_MYSQL_CONFIG_FILE;
+const action = process.argv[2];
+const email = (process.argv[3] || '').trim().toLowerCase();
+if (!path || !['--grant', '--revoke', '--list'].includes(action) ||
+    (action !== '--list' && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email))) {
+  throw new Error('Use --grant EMAIL, --revoke EMAIL or --list with RELAY_MYSQL_CONFIG_FILE');
+}
+const db = await mysql.createConnection({ ...JSON.parse(fs.readFileSync(path, 'utf8')),
+  dateStrings: true, timezone: 'Z', multipleStatements: false });
+try {
+  if (action === '--grant') await db.execute(`INSERT INTO relay_admin_emails (email,granted_at)
+    VALUES (?,UTC_TIMESTAMP(3)) ON DUPLICATE KEY UPDATE email=VALUES(email)`, [email]);
+  else if (action === '--revoke') await db.execute('DELETE FROM relay_admin_emails WHERE email=?', [email]);
+  const [rows] = await db.query('SELECT email FROM relay_admin_emails ORDER BY email');
+  console.log(JSON.stringify({ admins: rows.map(row => row.email) }));
+} finally { await db.end(); }

package/dist/bin/migrate-relay-db.mjs

@@ -1,109 +1,109 @@
-#!/usr/bin/env node
-import fs from 'node:fs';
-import { createHash } from 'node:crypto';
-import { fileURLToPath } from 'node:url';
-import mysql from 'mysql2/promise';
-import { relaySchemaVersions } from '../database/versions.mjs';
-import { deviceStore } from '../src/self-relay/device-store.mjs';
-import { relayAdminState } from '../src/self-relay/admin-state.mjs';
-
-const command = process.argv[2];
-if (!['--schema', '--import', '--check'].includes(command) || !process.env.RELAY_MYSQL_CONFIG_FILE) {
-  throw new Error('Use --schema, --import or --check with RELAY_MYSQL_CONFIG_FILE');
-}
-const config = JSON.parse(fs.readFileSync(process.env.RELAY_MYSQL_CONFIG_FILE, 'utf8'));
-const db = await mysql.createConnection({ ...config, dateStrings: true, timezone: 'Z', multipleStatements: false });
-const sqlTime = value => value.replace('T', ' ').replace(/Z$/, '');
-const migrations = relaySchemaVersions;
-try {
-  if (command === '--schema') {
-    const [existing] = await db.query("SHOW TABLES LIKE 'schema_migrations'");
-    const [applied] = existing.length ? await db.query('SELECT version, sha256 FROM schema_migrations') : [[]];
-    const known = new Map(applied.map(row => [row.version, row.sha256]));
-    if (known.size !== applied.length || [...known.keys()].some(version => !migrations.includes(version))) throw new Error('Unexpected schema version');
-    for (const version of migrations) {
-      const source = fs.readFileSync(fileURLToPath(new URL(`../database/${version}.sql`, import.meta.url)), 'utf8');
-      const sha256 = createHash('sha256').update(source).digest('hex');
-      if (known.has(version)) {
-        if (known.get(version) !== sha256) throw new Error(`Migration changed: ${version}`);
-        continue;
-      }
-      if (version !== migrations[0] && !known.has(migrations[migrations.indexOf(version) - 1])) throw new Error('Previous migration missing');
-      const statements = source.split('\n').filter(line => !line.trimStart().startsWith('--')).join('\n');
-      for (const statement of statements.split(';').map(item => item.trim()).filter(Boolean)) await db.query(statement);
-      await db.execute('INSERT INTO schema_migrations (version, sha256) VALUES (?,?)', [version, sha256]);
-      known.set(version, sha256);
-      console.log(JSON.stringify({ schema: version, sha256 }));
-    }
-  } else {
-    const [versions] = await db.query('SELECT version FROM schema_migrations');
-    if (!versions.some(row => row.version === '001_relay_core') || versions.some(row => !migrations.includes(row.version))) throw new Error('Unexpected schema version');
-    if (command === '--check') {
-      const names = ['computers', 'mobile_authorizations', 'official_computers', 'announcements', 'relay_settings', 'users', 'user_login_identities'];
-      if (versions.some(row => row.version === '002_email_accounts')) names.push('email_login_challenges', 'user_sessions', 'email_send_limits');
-      if (versions.some(row => row.version === '003_relay_usage')) names.push('relay_admin_emails', 'relay_usage_settings', 'relay_usage_totals', 'relay_usage_computer_totals', 'relay_usage_entitlements', 'relay_usage_budgets', 'relay_usage_computer_budgets', 'relay_usage_sessions');
-      if (versions.some(row => row.version === '004_relay_usage_actions')) names.push('relay_usage_actions');
-      if (versions.some(row => row.version === '006_relay_diagnostics')) names.push('relay_diagnostics');
-      if (versions.some(row => row.version === '007_relay_usage_daily')) names.push('relay_usage_user_days', 'relay_usage_computer_days');
-      const counts = {};
-      for (const name of names) { const [rows] = await db.query(`SELECT COUNT(*) AS count FROM ${name}`); counts[name] = rows[0].count; }
-      if (process.env.RELAY_STATE_FILE && process.env.RELAY_ADMIN_STATE_FILE) {
-        const devices = deviceStore(process.env.RELAY_STATE_FILE).entries();
-        const admin = relayAdminState(process.env.RELAY_ADMIN_STATE_FILE, 8).read();
-        const expected = { computers: devices.length,
-          mobile_authorizations: devices.reduce((sum, item) => sum + item.clients.length, 0),
-          official_computers: devices.filter(item => item.officialComputer).length,
-          announcements: admin.announcements.length, relay_settings: 1 };
-        if (Object.keys(expected).some(name => counts[name] !== expected[name])) throw new Error('Imported row counts differ from JSON');
-        const [saved] = await db.query('SELECT id,host_hash,status,revision FROM computers');
-        const original = new Map(devices.map(item => [item.id, item]));
-        for (const row of saved) {
-          const item = original.get(row.id);
-          if (!item || item.hostHash !== row.host_hash || item.status !== row.status || item.revision !== Number(row.revision)) {
-            throw new Error('Imported computer identity differs from JSON');
-          }
-        }
-        const [authorized] = await db.query('SELECT computer_id,client_id,credential_hash FROM mobile_authorizations');
-        for (const row of authorized) {
-          const item = original.get(row.computer_id)?.clients.find(client => client.id === row.client_id);
-          if (!item || item.hash !== row.credential_hash) throw new Error('Imported mobile authorization differs from JSON');
-        }
-        const [settings] = await db.query('SELECT max_relay_sessions FROM relay_settings WHERE id=1');
-        if (settings[0]?.max_relay_sessions !== admin.maxRelaySessions) throw new Error('Imported relay setting differs from JSON');
-        console.log(JSON.stringify({ verified: true, counts }));
-      } else console.log(JSON.stringify(counts));
-    } else {
-      const stateFile = process.env.RELAY_STATE_FILE, adminFile = process.env.RELAY_ADMIN_STATE_FILE;
-      if (!stateFile || !adminFile) throw new Error('RELAY_STATE_FILE and RELAY_ADMIN_STATE_FILE required for import');
-      const devices = deviceStore(stateFile).entries();
-      const admin = relayAdminState(adminFile, 8).read();
-      const [existing] = await db.query('SELECT (SELECT COUNT(*) FROM computers) AS computers, (SELECT COUNT(*) FROM relay_settings) AS settings');
-      if (existing[0].computers || existing[0].settings) throw new Error('Import target is not empty');
-      await db.beginTransaction();
-      try {
-        for (const item of devices) {
-          await db.execute('INSERT INTO computers (id,host_hash,status,revision,created_at,updated_at) VALUES (?,?,?,?,?,?)',
-            [item.id, item.hostHash, item.status, item.revision, sqlTime(item.createdAt), sqlTime(item.updatedAt)]);
-          for (const client of item.clients) await db.execute(
-            'INSERT INTO mobile_authorizations (computer_id,client_id,credential_hash,created_at,updated_at) VALUES (?,?,?,?,?)',
-            [item.id, client.id, client.hash, sqlTime(client.createdAt), sqlTime(client.updatedAt)]);
-          if (item.officialComputer) {
-            const official = item.officialComputer;
-            await db.execute('INSERT INTO official_computers (computer_id,environment_id,name,hostname,updated_at) VALUES (?,?,?,?,?)',
-              [item.id, official.environmentId, official.name, official.hostname, sqlTime(official.updatedAt)]);
-          }
-        }
-        await db.execute('INSERT INTO relay_settings (id,max_relay_sessions,updated_at) VALUES (1,?,UTC_TIMESTAMP(3))', [admin.maxRelaySessions]);
-        for (const item of admin.announcements) await db.execute(
-          'INSERT INTO announcements (id,title,message,status,created_at,updated_at,published_at) VALUES (?,?,?,?,?,?,?)',
-          [item.id, item.title, item.message, item.status, sqlTime(item.createdAt), sqlTime(item.updatedAt),
-            item.publishedAt ? sqlTime(item.publishedAt) : null]);
-        await db.commit();
-      } catch (error) { await db.rollback(); throw error; }
-      console.log(JSON.stringify({ imported: true, computers: devices.length,
-        mobileAuthorizations: devices.reduce((sum, item) => sum + item.clients.length, 0),
-        officialComputers: devices.filter(item => item.officialComputer).length,
-        announcements: admin.announcements.length }));
-    }
-  }
-} finally { await db.end(); }
+#!/usr/bin/env node
+import fs from 'node:fs';
+import { createHash } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import mysql from 'mysql2/promise';
+import { relaySchemaVersions } from '../database/versions.mjs';
+import { deviceStore } from '../src/self-relay/device-store.mjs';
+import { relayAdminState } from '../src/self-relay/admin-state.mjs';
+
+const command = process.argv[2];
+if (!['--schema', '--import', '--check'].includes(command) || !process.env.RELAY_MYSQL_CONFIG_FILE) {
+  throw new Error('Use --schema, --import or --check with RELAY_MYSQL_CONFIG_FILE');
+}
+const config = JSON.parse(fs.readFileSync(process.env.RELAY_MYSQL_CONFIG_FILE, 'utf8'));
+const db = await mysql.createConnection({ ...config, dateStrings: true, timezone: 'Z', multipleStatements: false });
+const sqlTime = value => value.replace('T', ' ').replace(/Z$/, '');
+const migrations = relaySchemaVersions;
+try {
+  if (command === '--schema') {
+    const [existing] = await db.query("SHOW TABLES LIKE 'schema_migrations'");
+    const [applied] = existing.length ? await db.query('SELECT version, sha256 FROM schema_migrations') : [[]];
+    const known = new Map(applied.map(row => [row.version, row.sha256]));
+    if (known.size !== applied.length || [...known.keys()].some(version => !migrations.includes(version))) throw new Error('Unexpected schema version');
+    for (const version of migrations) {
+      const source = fs.readFileSync(fileURLToPath(new URL(`../database/${version}.sql`, import.meta.url)), 'utf8');
+      const sha256 = createHash('sha256').update(source).digest('hex');
+      if (known.has(version)) {
+        if (known.get(version) !== sha256) throw new Error(`Migration changed: ${version}`);
+        continue;
+      }
+      if (version !== migrations[0] && !known.has(migrations[migrations.indexOf(version) - 1])) throw new Error('Previous migration missing');
+      const statements = source.split('\n').filter(line => !line.trimStart().startsWith('--')).join('\n');
+      for (const statement of statements.split(';').map(item => item.trim()).filter(Boolean)) await db.query(statement);
+      await db.execute('INSERT INTO schema_migrations (version, sha256) VALUES (?,?)', [version, sha256]);
+      known.set(version, sha256);
+      console.log(JSON.stringify({ schema: version, sha256 }));
+    }
+  } else {
+    const [versions] = await db.query('SELECT version FROM schema_migrations');
+    if (!versions.some(row => row.version === '001_relay_core') || versions.some(row => !migrations.includes(row.version))) throw new Error('Unexpected schema version');
+    if (command === '--check') {
+      const names = ['computers', 'mobile_authorizations', 'official_computers', 'announcements', 'relay_settings', 'users', 'user_login_identities'];
+      if (versions.some(row => row.version === '002_email_accounts')) names.push('email_login_challenges', 'user_sessions', 'email_send_limits');
+      if (versions.some(row => row.version === '003_relay_usage')) names.push('relay_admin_emails', 'relay_usage_settings', 'relay_usage_totals', 'relay_usage_computer_totals', 'relay_usage_entitlements', 'relay_usage_budgets', 'relay_usage_computer_budgets', 'relay_usage_sessions');
+      if (versions.some(row => row.version === '004_relay_usage_actions')) names.push('relay_usage_actions');
+      if (versions.some(row => row.version === '006_relay_diagnostics')) names.push('relay_diagnostics');
+      if (versions.some(row => row.version === '007_relay_usage_daily')) names.push('relay_usage_user_days', 'relay_usage_computer_days');
+      const counts = {};
+      for (const name of names) { const [rows] = await db.query(`SELECT COUNT(*) AS count FROM ${name}`); counts[name] = rows[0].count; }
+      if (process.env.RELAY_STATE_FILE && process.env.RELAY_ADMIN_STATE_FILE) {
+        const devices = deviceStore(process.env.RELAY_STATE_FILE).entries();
+        const admin = relayAdminState(process.env.RELAY_ADMIN_STATE_FILE, 8).read();
+        const expected = { computers: devices.length,
+          mobile_authorizations: devices.reduce((sum, item) => sum + item.clients.length, 0),
+          official_computers: devices.filter(item => item.officialComputer).length,
+          announcements: admin.announcements.length, relay_settings: 1 };
+        if (Object.keys(expected).some(name => counts[name] !== expected[name])) throw new Error('Imported row counts differ from JSON');
+        const [saved] = await db.query('SELECT id,host_hash,status,revision FROM computers');
+        const original = new Map(devices.map(item => [item.id, item]));
+        for (const row of saved) {
+          const item = original.get(row.id);
+          if (!item || item.hostHash !== row.host_hash || item.status !== row.status || item.revision !== Number(row.revision)) {
+            throw new Error('Imported computer identity differs from JSON');
+          }
+        }
+        const [authorized] = await db.query('SELECT computer_id,client_id,credential_hash FROM mobile_authorizations');
+        for (const row of authorized) {
+          const item = original.get(row.computer_id)?.clients.find(client => client.id === row.client_id);
+          if (!item || item.hash !== row.credential_hash) throw new Error('Imported mobile authorization differs from JSON');
+        }
+        const [settings] = await db.query('SELECT max_relay_sessions FROM relay_settings WHERE id=1');
+        if (settings[0]?.max_relay_sessions !== admin.maxRelaySessions) throw new Error('Imported relay setting differs from JSON');
+        console.log(JSON.stringify({ verified: true, counts }));
+      } else console.log(JSON.stringify(counts));
+    } else {
+      const stateFile = process.env.RELAY_STATE_FILE, adminFile = process.env.RELAY_ADMIN_STATE_FILE;
+      if (!stateFile || !adminFile) throw new Error('RELAY_STATE_FILE and RELAY_ADMIN_STATE_FILE required for import');
+      const devices = deviceStore(stateFile).entries();
+      const admin = relayAdminState(adminFile, 8).read();
+      const [existing] = await db.query('SELECT (SELECT COUNT(*) FROM computers) AS computers, (SELECT COUNT(*) FROM relay_settings) AS settings');
+      if (existing[0].computers || existing[0].settings) throw new Error('Import target is not empty');
+      await db.beginTransaction();
+      try {
+        for (const item of devices) {
+          await db.execute('INSERT INTO computers (id,host_hash,status,revision,created_at,updated_at) VALUES (?,?,?,?,?,?)',
+            [item.id, item.hostHash, item.status, item.revision, sqlTime(item.createdAt), sqlTime(item.updatedAt)]);
+          for (const client of item.clients) await db.execute(
+            'INSERT INTO mobile_authorizations (computer_id,client_id,credential_hash,created_at,updated_at) VALUES (?,?,?,?,?)',
+            [item.id, client.id, client.hash, sqlTime(client.createdAt), sqlTime(client.updatedAt)]);
+          if (item.officialComputer) {
+            const official = item.officialComputer;
+            await db.execute('INSERT INTO official_computers (computer_id,environment_id,name,hostname,updated_at) VALUES (?,?,?,?,?)',
+              [item.id, official.environmentId, official.name, official.hostname, sqlTime(official.updatedAt)]);
+          }
+        }
+        await db.execute('INSERT INTO relay_settings (id,max_relay_sessions,updated_at) VALUES (1,?,UTC_TIMESTAMP(3))', [admin.maxRelaySessions]);
+        for (const item of admin.announcements) await db.execute(
+          'INSERT INTO announcements (id,title,message,status,created_at,updated_at,published_at) VALUES (?,?,?,?,?,?,?)',
+          [item.id, item.title, item.message, item.status, sqlTime(item.createdAt), sqlTime(item.updatedAt),
+            item.publishedAt ? sqlTime(item.publishedAt) : null]);
+        await db.commit();
+      } catch (error) { await db.rollback(); throw error; }
+      console.log(JSON.stringify({ imported: true, computers: devices.length,
+        mobileAuthorizations: devices.reduce((sum, item) => sum + item.clients.length, 0),
+        officialComputers: devices.filter(item => item.officialComputer).length,
+        announcements: admin.announcements.length }));
+    }
+  }
+} finally { await db.end(); }

package/dist/bin/publish-harmony-release.mjs

@@ -1,46 +1,46 @@
-#!/usr/bin/env node
-import fs from 'node:fs';
-import path from 'node:path';
-import { createHash } from 'node:crypto';
-import { androidReleaseStorage } from '../relay-admin/android-release-storage.mjs';
-import { readHarmonyConfig, hapName, validateHarmonyMetadata, checkHarmonyVersion,
-  verifyHarmony, activateHarmony } from '../relay-admin/harmony-release.mjs';
-
-// Local PowerShell releases use the same verifier, COS objects and activation as GitHub CD.
-const directory = path.resolve(process.argv[2] || '');
-if (!process.argv[2]) throw Error('Usage: publish-harmony-release.mjs DIRECTORY');
-let stage = 'metadata';
-try {
-  const manifest = JSON.parse(fs.readFileSync(path.join(directory, 'manifest.json5'), 'utf8')).app;
-  const config = readHarmonyConfig();
-  const metadata = { packageName: manifest.bundleName, versionCode: manifest.versionCode,
-    versionName: manifest.versionName, certificateSha256: config.certificateSha256 };
-  if (!Number.isSafeInteger(metadata.versionCode) || metadata.versionCode <= 0
-    || !/^\d+\.\d+\.\d+$/.test(metadata.versionName)) throw Error();
-  metadata.files = [hapName(metadata), 'manifest.json5', 'icon.png'].map(name => {
-    const bytes = fs.readFileSync(path.join(directory, name));
-    return { name, size: bytes.length, sha256: createHash('sha256').update(bytes).digest('hex'),
-      contentMd5: createHash('md5').update(bytes).digest('base64') };
-  });
-  Object.assign(metadata, { size: metadata.files[0].size, sha256: metadata.files[0].sha256,
-    contentMd5: metadata.files[0].contentMd5 });
-  validateHarmonyMetadata(metadata, config);
-  checkHarmonyVersion(metadata);
-  stage = 'signature';
-  await verifyHarmony(directory, metadata, config);
-  const storage = androidReleaseStorage('/etc/codex-relay/android-releases.json', '/etc/codex-relay/tencent-monitor.json');
-  const keys = metadata.files.map(f => `code-relax/harmony/${metadata.versionCode}/${f.name}`);
-  stage = 'upload';
-  for (const [i, file] of metadata.files.entries()) {
-    await new Promise((resolve, reject) => storage.cos.putObject({ ...storage.object({ objectKey: keys[i] }),
-      Body: fs.createReadStream(path.join(directory, file.name)), ContentLength: file.size,
-      ContentMD5: file.contentMd5, ContentType: i === 1 ? 'application/json' : i === 2 ? 'image/png' : 'application/octet-stream',
-      Headers: { 'x-cos-forbid-overwrite': 'true' }
-    }, (error, result) => error ? reject(error) : resolve(result)));
-  }
-  stage = 'publication';
-  console.log(JSON.stringify(await activateHarmony(metadata, storage, keys)));
-} catch {
-  console.error(`Harmony publication failed at ${stage}; inspect objects and current version before retrying.`);
-  process.exitCode = 1;
-}
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { androidReleaseStorage } from '../relay-admin/android-release-storage.mjs';
+import { readHarmonyConfig, hapName, validateHarmonyMetadata, checkHarmonyVersion,
+  verifyHarmony, activateHarmony } from '../relay-admin/harmony-release.mjs';
+
+// Local PowerShell releases use the same verifier, COS objects and activation as GitHub CD.
+const directory = path.resolve(process.argv[2] || '');
+if (!process.argv[2]) throw Error('Usage: publish-harmony-release.mjs DIRECTORY');
+let stage = 'metadata';
+try {
+  const manifest = JSON.parse(fs.readFileSync(path.join(directory, 'manifest.json5'), 'utf8')).app;
+  const config = readHarmonyConfig();
+  const metadata = { packageName: manifest.bundleName, versionCode: manifest.versionCode,
+    versionName: manifest.versionName, certificateSha256: config.certificateSha256 };
+  if (!Number.isSafeInteger(metadata.versionCode) || metadata.versionCode <= 0
+    || !/^\d+\.\d+\.\d+$/.test(metadata.versionName)) throw Error();
+  metadata.files = [hapName(metadata), 'manifest.json5', 'icon.png'].map(name => {
+    const bytes = fs.readFileSync(path.join(directory, name));
+    return { name, size: bytes.length, sha256: createHash('sha256').update(bytes).digest('hex'),
+      contentMd5: createHash('md5').update(bytes).digest('base64') };
+  });
+  Object.assign(metadata, { size: metadata.files[0].size, sha256: metadata.files[0].sha256,
+    contentMd5: metadata.files[0].contentMd5 });
+  validateHarmonyMetadata(metadata, config);
+  checkHarmonyVersion(metadata);
+  stage = 'signature';
+  await verifyHarmony(directory, metadata, config);
+  const storage = androidReleaseStorage('/etc/codex-relay/android-releases.json', '/etc/codex-relay/tencent-monitor.json');
+  const keys = metadata.files.map(f => `code-relax/harmony/${metadata.versionCode}/${f.name}`);
+  stage = 'upload';
+  for (const [i, file] of metadata.files.entries()) {
+    await new Promise((resolve, reject) => storage.cos.putObject({ ...storage.object({ objectKey: keys[i] }),
+      Body: fs.createReadStream(path.join(directory, file.name)), ContentLength: file.size,
+      ContentMD5: file.contentMd5, ContentType: i === 1 ? 'application/json' : i === 2 ? 'image/png' : 'application/octet-stream',
+      Headers: { 'x-cos-forbid-overwrite': 'true' }
+    }, (error, result) => error ? reject(error) : resolve(result)));
+  }
+  stage = 'publication';
+  console.log(JSON.stringify(await activateHarmony(metadata, storage, keys)));
+} catch {
+  console.error(`Harmony publication failed at ${stage}; inspect objects and current version before retrying.`);
+  process.exitCode = 1;
+}

package/dist/bin/self-relay-admin.mjs

@@ -1,8 +1,8 @@
-import { startAdminServer } from '../src/self-relay/admin-server.mjs';
-
-const port = Number(process.env.RELAY_ADMIN_PORT || 45851);
-if (!Number.isSafeInteger(port) || port < 1 || port > 65535) throw new Error('Invalid RELAY_ADMIN_PORT');
-const server = await startAdminServer({ port });
-console.log(JSON.stringify({ service: 'codex-relay-admin', port: server.port }));
-await new Promise(resolve => { process.once('SIGTERM', resolve); process.once('SIGINT', resolve); });
-await server.close();
+import { startAdminServer } from '../src/self-relay/admin-server.mjs';
+
+const port = Number(process.env.RELAY_ADMIN_PORT || 45851);
+if (!Number.isSafeInteger(port) || port < 1 || port > 65535) throw new Error('Invalid RELAY_ADMIN_PORT');
+const server = await startAdminServer({ port });
+console.log(JSON.stringify({ service: 'codex-relay-admin', port: server.port }));
+await new Promise(resolve => { process.once('SIGTERM', resolve); process.once('SIGINT', resolve); });
+await server.close();

package/dist/bin/self-relay-demo.mjs

@@ -1,33 +1,33 @@
-#!/usr/bin/env node
-import { startRelayDemo } from '../src/self-relay/demo.mjs';
-import fs from 'node:fs';
-import { spawnSync } from 'node:child_process';
-
-const mode = 'lan-shared';
-let remoteRelay;
-if (process.env.RELAY_URL) {
-  let hostKey;
-  const sshIndex = process.argv.indexOf('--ssh-host');
-  if (sshIndex !== -1) {
-    const host = process.argv[sshIndex + 1];
-    if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(host || '')) throw new Error('Invalid SSH alias');
-    const result = spawnSync('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10', host,
-      'sudo -n cat /etc/codex-relay/host.key'], { encoding: 'utf8', timeout: 15000, windowsHide: true });
-    if (result.error || result.status !== 0) throw new Error('Cannot read relay credential through SSH');
-    hostKey = result.stdout.trim();
-  } else hostKey = fs.readFileSync(process.env.RELAY_HOST_KEY_FILE, 'utf8').trim();
-  remoteRelay = { url: process.env.RELAY_URL, hostKey };
-}
-const demo = await startRelayDemo({ mode, remoteRelay });
-let client;
-try {
-  client = demo.connect(); await client.ready;
-  const health = await client.request('/api/health');
-  if (health.status !== 200 || health.body.transportMode !== mode) throw new Error('Relay validation failed');
-  console.log(JSON.stringify({ ok: true, simulated: true, mode, relay: demo.relay.url,
-    bridge: demo.bridgeUrl, message: '中继 → 连接器 → 模拟桌面服务已连通；未连接 Codex，未执行任务。' }, null, 2));
-  if (!process.argv.includes('--check')) {
-    console.log('验证连接保持运行。Ctrl+C 停止全部模拟进程内服务。');
-    await new Promise(resolve => { process.once('SIGINT', resolve); process.once('SIGTERM', resolve); });
-  }
-} finally { client?.close(); await demo.close(); }
+#!/usr/bin/env node
+import { startRelayDemo } from '../src/self-relay/demo.mjs';
+import fs from 'node:fs';
+import { spawnSync } from 'node:child_process';
+
+const mode = 'lan-shared';
+let remoteRelay;
+if (process.env.RELAY_URL) {
+  let hostKey;
+  const sshIndex = process.argv.indexOf('--ssh-host');
+  if (sshIndex !== -1) {
+    const host = process.argv[sshIndex + 1];
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(host || '')) throw new Error('Invalid SSH alias');
+    const result = spawnSync('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10', host,
+      'sudo -n cat /etc/codex-relay/host.key'], { encoding: 'utf8', timeout: 15000, windowsHide: true });
+    if (result.error || result.status !== 0) throw new Error('Cannot read relay credential through SSH');
+    hostKey = result.stdout.trim();
+  } else hostKey = fs.readFileSync(process.env.RELAY_HOST_KEY_FILE, 'utf8').trim();
+  remoteRelay = { url: process.env.RELAY_URL, hostKey };
+}
+const demo = await startRelayDemo({ mode, remoteRelay });
+let client;
+try {
+  client = demo.connect(); await client.ready;
+  const health = await client.request('/api/health');
+  if (health.status !== 200 || health.body.transportMode !== mode) throw new Error('Relay validation failed');
+  console.log(JSON.stringify({ ok: true, simulated: true, mode, relay: demo.relay.url,
+    bridge: demo.bridgeUrl, message: '中继 → 连接器 → 模拟桌面服务已连通；未连接 Codex，未执行任务。' }, null, 2));
+  if (!process.argv.includes('--check')) {
+    console.log('验证连接保持运行。Ctrl+C 停止全部模拟进程内服务。');
+    await new Promise(resolve => { process.once('SIGINT', resolve); process.once('SIGTERM', resolve); });
+  }
+} finally { client?.close(); await demo.close(); }

package/dist/bin/self-relay-server.mjs

@@ -1,66 +1,66 @@
-#!/usr/bin/env node
-import fs from 'node:fs';
-import serviceEndpoints from '../shared/service-endpoints.cjs';
-import { deviceStore, validId } from '../src/self-relay/device-store.mjs';
-import { openRelayMysql } from '../src/self-relay/mysql-state.mjs';
-import { startSelfRelay } from '../src/self-relay/server.mjs';
-import { updateDebugAllowlist } from '../src/self-relay/debug-allowlist.mjs';
-
-const keyFile = process.env.RELAY_HOST_KEY_FILE;
-if (!keyFile) throw new Error('RELAY_HOST_KEY_FILE is required');
-const hostKey = fs.readFileSync(keyFile, 'utf8').trim();
-const port = Number(process.env.RELAY_PORT || 45850);
-if (!Number.isInteger(port) || port < 1024 || port > 65535) throw new Error('Invalid RELAY_PORT');
-const stateFile = process.env.RELAY_STATE_FILE;
-const mysqlConfigFile = process.env.RELAY_MYSQL_CONFIG_FILE;
-const accountConfigFile = process.env.RELAY_ACCOUNT_CONFIG_FILE;
-const longPairingFile = process.env.RELAY_LONG_PAIRING_FILE || '/var/lib/codex-relay/long-pairing.json';
-if (!stateFile && !mysqlConfigFile) throw new Error('RELAY_STATE_FILE or RELAY_MYSQL_CONFIG_FILE is required');
-const debugAllowlistFile = process.env.RELAY_DEBUG_ALLOWLIST_FILE || '/etc/codex-relay/debug-allowlist.json';
-const adminStateFile = process.env.RELAY_ADMIN_STATE_FILE || '/var/lib/codex-relay/admin.json';
-const maxRelaySessions = Number(process.env.RELAY_MAX_RELAY_SESSIONS || 8);
-if (!Number.isSafeInteger(maxRelaySessions) || maxRelaySessions < 1 || maxRelaySessions > 256) throw new Error('Invalid RELAY_MAX_RELAY_SESSIONS');
-const debugCommand = process.argv.find(value => ['--debug-list', '--debug-allow', '--debug-deny'].includes(value));
-if (debugCommand) {
-  const database = mysqlConfigFile ? await openRelayMysql(mysqlConfigFile, maxRelaySessions) : null;
-  const records = (database?.devices || deviceStore(stateFile)).entries();
-  if (debugCommand === '--debug-list') {
-    console.log(JSON.stringify(records.map(record => ({
-      deviceId: record.id, status: record.status, clientCount: record.clients.length,
-    })), null, 2));
-  } else {
-    const index = process.argv.indexOf(debugCommand), deviceId = process.argv[index + 1];
-    if (!validId(deviceId)) throw new Error('Invalid device ID');
-    const record = records.find(record => record.id === deviceId && record.status === 'active');
-    if (!record && debugCommand === '--debug-allow') throw new Error('Active paired device not found');
-    updateDebugAllowlist(debugAllowlistFile, deviceId, debugCommand === '--debug-allow');
-    console.log('Debug allowlist updated; restart relay to apply.');
-  }
-  if (database) await database.close();
-  process.exit(0);
-}
-if (process.argv.includes('--init-state')) { if (mysqlConfigFile) throw new Error('Use migrations for MySQL mode'); deviceStore(stateFile, { initialize: true }); console.log('Device store initialized'); process.exit(0); }
-const revokeIndex = process.argv.indexOf('--revoke-host');
-if (revokeIndex >= 0) {
-  // Run only with the service stopped: this is an offline administrator operation.
-  if (!process.argv.includes('--offline')) throw new Error('Stop the relay service and supply --offline');
-  const id = process.argv[revokeIndex + 1];
-  if (!validId(id)) throw new Error('Invalid device ID');
-  const database = mysqlConfigFile ? await openRelayMysql(mysqlConfigFile, maxRelaySessions) : null;
-  const store = database?.devices || deviceStore(stateFile), record = store.entries().find(item => item.id === id);
-  if (!record) throw new Error('Device not found');
-  await store.save({ ...record, status: 'revoked', clients: [], revision: record.revision + 1, updatedAt: new Date().toISOString() });
-  if (database) await database.close();
-  console.log('Computer and phone authorization revoked'); process.exit(0);
-}
-const relay = await startSelfRelay({ port, hostKey, stateFile, mysqlConfigFile, accountConfigFile, debugAllowlistFile, adminStateFile, maxRelaySessions,
-  longPairingFile,
-  androidReleaseConfigFile: process.env.RELAY_ANDROID_RELEASE_CONFIG_FILE,
-  androidReleaseCredentialFile: process.env.CREDENTIALS_DIRECTORY ? `${process.env.CREDENTIALS_DIRECTORY}/tencent-monitor.json` : undefined,
-  usageDiagnosticKeyFile: process.env.RELAY_USAGE_DIAGNOSTIC_KEY_FILE,
-  publicRelayUrl: process.env.RELAY_PUBLIC_URL || serviceEndpoints.relayUrl, appDownloadUrl: process.env.RELAY_APP_DOWNLOAD_URL || serviceEndpoints.installUrl,
-  log: entry => console.log(JSON.stringify({ time: new Date().toISOString(), ...entry })) });
-console.log(JSON.stringify({ service: 'codex-self-relay', listen: relay.url, maxConnections: 128, maxRelaySessions,
-  maxFrameMiB: 8, encryption: 'TLS must be supplied by reverse proxy; no end-to-end encryption' }));
-await new Promise(resolve => { process.once('SIGTERM', resolve); process.once('SIGINT', resolve); });
-await relay.close();
+#!/usr/bin/env node
+import fs from 'node:fs';
+import serviceEndpoints from '../shared/service-endpoints.cjs';
+import { deviceStore, validId } from '../src/self-relay/device-store.mjs';
+import { openRelayMysql } from '../src/self-relay/mysql-state.mjs';
+import { startSelfRelay } from '../src/self-relay/server.mjs';
+import { updateDebugAllowlist } from '../src/self-relay/debug-allowlist.mjs';
+
+const keyFile = process.env.RELAY_HOST_KEY_FILE;
+if (!keyFile) throw new Error('RELAY_HOST_KEY_FILE is required');
+const hostKey = fs.readFileSync(keyFile, 'utf8').trim();
+const port = Number(process.env.RELAY_PORT || 45850);
+if (!Number.isInteger(port) || port < 1024 || port > 65535) throw new Error('Invalid RELAY_PORT');
+const stateFile = process.env.RELAY_STATE_FILE;
+const mysqlConfigFile = process.env.RELAY_MYSQL_CONFIG_FILE;
+const accountConfigFile = process.env.RELAY_ACCOUNT_CONFIG_FILE;
+const longPairingFile = process.env.RELAY_LONG_PAIRING_FILE || '/var/lib/codex-relay/long-pairing.json';
+if (!stateFile && !mysqlConfigFile) throw new Error('RELAY_STATE_FILE or RELAY_MYSQL_CONFIG_FILE is required');
+const debugAllowlistFile = process.env.RELAY_DEBUG_ALLOWLIST_FILE || '/etc/codex-relay/debug-allowlist.json';
+const adminStateFile = process.env.RELAY_ADMIN_STATE_FILE || '/var/lib/codex-relay/admin.json';
+const maxRelaySessions = Number(process.env.RELAY_MAX_RELAY_SESSIONS || 8);
+if (!Number.isSafeInteger(maxRelaySessions) || maxRelaySessions < 1 || maxRelaySessions > 256) throw new Error('Invalid RELAY_MAX_RELAY_SESSIONS');
+const debugCommand = process.argv.find(value => ['--debug-list', '--debug-allow', '--debug-deny'].includes(value));
+if (debugCommand) {
+  const database = mysqlConfigFile ? await openRelayMysql(mysqlConfigFile, maxRelaySessions) : null;
+  const records = (database?.devices || deviceStore(stateFile)).entries();
+  if (debugCommand === '--debug-list') {
+    console.log(JSON.stringify(records.map(record => ({
+      deviceId: record.id, status: record.status, clientCount: record.clients.length,
+    })), null, 2));
+  } else {
+    const index = process.argv.indexOf(debugCommand), deviceId = process.argv[index + 1];
+    if (!validId(deviceId)) throw new Error('Invalid device ID');
+    const record = records.find(record => record.id === deviceId && record.status === 'active');
+    if (!record && debugCommand === '--debug-allow') throw new Error('Active paired device not found');
+    updateDebugAllowlist(debugAllowlistFile, deviceId, debugCommand === '--debug-allow');
+    console.log('Debug allowlist updated; restart relay to apply.');
+  }
+  if (database) await database.close();
+  process.exit(0);
+}
+if (process.argv.includes('--init-state')) { if (mysqlConfigFile) throw new Error('Use migrations for MySQL mode'); deviceStore(stateFile, { initialize: true }); console.log('Device store initialized'); process.exit(0); }
+const revokeIndex = process.argv.indexOf('--revoke-host');
+if (revokeIndex >= 0) {
+  // Run only with the service stopped: this is an offline administrator operation.
+  if (!process.argv.includes('--offline')) throw new Error('Stop the relay service and supply --offline');
+  const id = process.argv[revokeIndex + 1];
+  if (!validId(id)) throw new Error('Invalid device ID');
+  const database = mysqlConfigFile ? await openRelayMysql(mysqlConfigFile, maxRelaySessions) : null;
+  const store = database?.devices || deviceStore(stateFile), record = store.entries().find(item => item.id === id);
+  if (!record) throw new Error('Device not found');
+  await store.save({ ...record, status: 'revoked', clients: [], revision: record.revision + 1, updatedAt: new Date().toISOString() });
+  if (database) await database.close();
+  console.log('Computer and phone authorization revoked'); process.exit(0);
+}
+const relay = await startSelfRelay({ port, hostKey, stateFile, mysqlConfigFile, accountConfigFile, debugAllowlistFile, adminStateFile, maxRelaySessions,
+  longPairingFile,
+  androidReleaseConfigFile: process.env.RELAY_ANDROID_RELEASE_CONFIG_FILE,
+  androidReleaseCredentialFile: process.env.CREDENTIALS_DIRECTORY ? `${process.env.CREDENTIALS_DIRECTORY}/tencent-monitor.json` : undefined,
+  usageDiagnosticKeyFile: process.env.RELAY_USAGE_DIAGNOSTIC_KEY_FILE,
+  publicRelayUrl: process.env.RELAY_PUBLIC_URL || serviceEndpoints.relayUrl, appDownloadUrl: process.env.RELAY_APP_DOWNLOAD_URL || serviceEndpoints.installUrl,
+  log: entry => console.log(JSON.stringify({ time: new Date().toISOString(), ...entry })) });
+console.log(JSON.stringify({ service: 'codex-self-relay', listen: relay.url, maxConnections: 128, maxRelaySessions,
+  maxFrameMiB: 8, encryption: 'TLS must be supplied by reverse proxy; no end-to-end encryption' }));
+await new Promise(resolve => { process.once('SIGTERM', resolve); process.once('SIGINT', resolve); });
+await relay.close();

package/dist/bin/set-relay-admin-password.mjs

@@ -1,11 +1,11 @@
-import fs from 'node:fs';
-import { randomBytes } from 'node:crypto';
-import { passwordRecord } from '../src/self-relay/admin-auth.mjs';
-
-// Run as the management service user (or root and then chown root:codexrelay).
-// The plaintext is printed once for handoff; only its salted scrypt hash is saved.
-const file = process.argv[2] || '/etc/codex-relay/admin-password.json';
-const password = randomBytes(18).toString('base64url');
-const record = await passwordRecord(password);
-fs.writeFileSync(file, JSON.stringify(record) + '\n', { mode: 0o640, flag: 'wx' });
-console.log(password);
+import fs from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { passwordRecord } from '../src/self-relay/admin-auth.mjs';
+
+// Run as the management service user (or root and then chown root:codexrelay).
+// The plaintext is printed once for handoff; only its salted scrypt hash is saved.
+const file = process.argv[2] || '/etc/codex-relay/admin-password.json';
+const password = randomBytes(18).toString('base64url');
+const record = await passwordRecord(password);
+fs.writeFileSync(file, JSON.stringify(record) + '\n', { mode: 0o640, flag: 'wx' });
+console.log(password);

package/dist/build-platform.json

@@ -1 +1 @@
-{"layout":"npm-platform-packages","version":"0.1.0-beta.68"}
+{"layout":"npm-platform-packages","version":"0.1.0-beta.69"}