@walkhi/code-relax 0.1.0-beta.8 → 0.1.0-beta.81

package/dist/src/self-relay/admin-auth.mjs

@@ -0,0 +1,59 @@
+import fs from 'node:fs';
+import { randomBytes, scrypt, timingSafeEqual } from 'node:crypto';
+import { promisify } from 'node:util';
+
+const derive = promisify(scrypt);
+const COOKIE = '__Host-code-relax-admin';
+const SESSION_MS = 12 * 60 * 60 * 1000;
+const cookie = (value, seconds) => `${COOKIE}=${value}; Path=/; Secure; HttpOnly; SameSite=Strict; Max-Age=${seconds}`;
+
+export async function passwordRecord(password) {
+  if (typeof password !== 'string' || password.length < 10 || Buffer.byteLength(password) > 256) {
+    throw new Error('Admin password must have at least 10 characters and at most 256 bytes');
+  }
+  const salt = randomBytes(16).toString('hex');
+  return { salt, hash: (await derive(password, salt, 64)).toString('hex') };
+}
+
+export function createAdminAuth(passwordFile) {
+  const { salt, hash } = JSON.parse(fs.readFileSync(passwordFile, 'utf8'));
+  if (!/^[a-f0-9]{32}$/.test(salt) || !/^[a-f0-9]{128}$/.test(hash)) throw new Error('Invalid admin password record');
+  const expected = Buffer.from(hash, 'hex');
+  const sessions = new Map();
+  let windowStart = 0, attempts = 0, verifying = false;
+  const token = request => (request.headers.cookie || '').split(';').map(value => value.trim())
+    .find(value => value.startsWith(`${COOKIE}=`))?.slice(COOKIE.length + 1);
+  function purge() {
+    for (const [id, expires] of sessions) if (expires <= Date.now()) sessions.delete(id);
+  }
+  return {
+    authenticated(request) { purge(); return sessions.has(token(request)); },
+    async login(password, request, response) {
+      const now = Date.now();
+      if (now - windowStart >= 60000) { windowStart = now; attempts = 0; }
+      // This is a single-owner console: bound both guessing and concurrent scrypt memory.
+      if (attempts >= 10 || verifying) {
+        response.setHeader('Retry-After', '60');
+        return { status: 429, error: '尝试过于频繁，请一分钟后重试' };
+      }
+      attempts++;
+      if (typeof password !== 'string' || Buffer.byteLength(password) > 256) return { status: 400, error: '请输入有效密码' };
+      verifying = true;
+      try {
+        const actual = await derive(password, salt, 64);
+        if (!timingSafeEqual(actual, expected)) return { status: 401, error: '密码不正确' };
+        purge();
+        sessions.delete(token(request));
+        if (sessions.size >= 32) sessions.delete(sessions.keys().next().value);
+        const id = randomBytes(32).toString('base64url');
+        sessions.set(id, Date.now() + SESSION_MS);
+        response.setHeader('Set-Cookie', cookie(id, SESSION_MS / 1000));
+        return { status: 200 };
+      } finally { verifying = false; }
+    },
+    logout(request, response) {
+      sessions.delete(token(request));
+      response.setHeader('Set-Cookie', cookie('', 0));
+    },
+  };
+}

package/dist/src/self-relay/admin-cloud.mjs

@@ -0,0 +1,101 @@
+import fs from 'node:fs';
+import tencentcloud from 'tencentcloud-sdk-nodejs-common';
+
+const INSTANCE_ID = 'lhins-byrs7n8o';
+const REGION = 'ap-beijing';
+const { CommonClient } = tencentcloud;
+const METRICS = [
+  ['LighthouseOutratio', 'outRatioPercent', 10],
+  ['LighthouseOuttraffic', 'outMbps', 10],
+  ['LighthouseIntraffic', 'inMbps', 10],
+  ['CpuUsage', 'cpuPercent', 10],
+  ['MemUsage', 'memoryPercent', 10],
+  ['DiskUsage', 'diskPercent', 60],
+  ['CpuLoad1', 'cpuLoad1', 10],
+];
+
+function latestPoint(result) {
+  const point = result?.DataPoints?.[0];
+  if (!point?.Values?.length || !point?.Timestamps?.length) return null;
+  const index = point.Values.length - 1;
+  const value = Number(point.Values[index]);
+  const timestamp = Number(point.Timestamps[index]);
+  return Number.isFinite(value) && Number.isFinite(timestamp)
+    ? { value, sampledAt: new Date(timestamp * 1000).toISOString() } : null;
+}
+
+export function startAdminCloud({ credentialFile = process.env.CREDENTIALS_DIRECTORY
+  ? `${process.env.CREDENTIALS_DIRECTORY}/tencent-monitor.json` : null,
+  metricIntervalMs = 60000, trafficIntervalMs = 300000 } = {}) {
+  if (!credentialFile) return { read: () => ({ configured: false }), close() {} };
+  const { secretId, secretKey } = JSON.parse(fs.readFileSync(credentialFile, 'utf8'));
+  if (!secretId || !secretKey) throw new Error('Tencent monitor credentials are incomplete');
+  const credential = { secretId, secretKey };
+  const profile = { httpProfile: { reqTimeout: 8 } };
+  const monitor = new CommonClient('monitor.tencentcloudapi.com', '2018-07-24',
+    { credential, region: REGION, profile });
+  const lighthouse = new CommonClient('lighthouse.tencentcloudapi.com', '2020-03-24',
+    { credential, region: REGION, profile });
+  let closed = false;
+  let metricBusy = false;
+  let trafficBusy = false;
+  const current = { configured: true, metricAvailable: false, trafficAvailable: false,
+    outRatioPercent: null, outMbps: null, inMbps: null, metricSampledAt: null,
+    cpuPercent: null, memoryPercent: null, diskPercent: null, cpuLoad1: null,
+    trafficUsedBytes: null, trafficTotalBytes: null, trafficRemainingBytes: null,
+    trafficStartAt: null, trafficEndAt: null, trafficSampledAt: null };
+
+  async function sampleMetrics() {
+    if (metricBusy || closed) return;
+    metricBusy = true;
+    const end = new Date();
+    const base = { Namespace: 'QCE/LIGHTHOUSE',
+      StartTime: new Date(end.getTime() - 180000).toISOString(), EndTime: end.toISOString(),
+      Instances: [{ Dimensions: [{ Name: 'InstanceId', Value: INSTANCE_ID }] }] };
+    try {
+      const values = await Promise.allSettled(METRICS.map(([MetricName, , Period]) =>
+        monitor.request('GetMonitorData', { ...base, MetricName, Period })));
+      if (closed) return;
+      const samples = values.map(result => result.status === 'fulfilled' ? latestPoint(result.value) : null);
+      for (let index = 0; index < METRICS.length; index++) {
+        const [, field] = METRICS[index];
+        const value = samples[index]?.value ?? null;
+        current[field] = value !== null && (field === 'outMbps' || field === 'inMbps') ? value * 8 : value;
+      }
+      current.metricSampledAt = samples.reduce((latest, sample) => sample?.sampledAt > latest
+        ? sample.sampledAt : latest, '') || null;
+      current.metricAvailable = Boolean(current.metricSampledAt);
+    } catch {
+      current.metricAvailable = false;
+    } finally { metricBusy = false; }
+  }
+
+  async function sampleTraffic() {
+    if (trafficBusy || closed) return;
+    trafficBusy = true;
+    try {
+      const data = await lighthouse.request('DescribeInstancesTrafficPackages', { InstanceIds: [INSTANCE_ID] });
+      if (closed) return;
+      const packages = data?.InstanceTrafficPackageSet?.find(item => item.InstanceId === INSTANCE_ID)?.TrafficPackageSet || [];
+      const active = packages.find(item => Date.parse(item.StartTime) <= Date.now()
+        && Date.parse(item.EndTime) >= Date.now()) || packages[0];
+      current.trafficUsedBytes = active?.TrafficUsed ?? null;
+      current.trafficTotalBytes = active?.TrafficPackageTotal ?? null;
+      current.trafficRemainingBytes = active?.TrafficPackageRemaining ?? null;
+      current.trafficStartAt = active?.StartTime ?? null;
+      current.trafficEndAt = active?.EndTime ?? null;
+      current.trafficSampledAt = active ? new Date().toISOString() : null;
+      current.trafficAvailable = Boolean(active);
+    } catch {
+      current.trafficAvailable = false;
+    } finally { trafficBusy = false; }
+  }
+
+  void sampleMetrics();
+  void sampleTraffic();
+  const metricTimer = setInterval(sampleMetrics, metricIntervalMs);
+  const trafficTimer = setInterval(sampleTraffic, trafficIntervalMs);
+  metricTimer.unref();
+  trafficTimer.unref();
+  return { read: () => ({ ...current }), close() { closed = true; clearInterval(metricTimer); clearInterval(trafficTimer); } };
+}

package/dist/src/self-relay/admin-login-page.mjs

@@ -0,0 +1,7 @@
+import { adminUiTokens, adminFooterStyles, adminAuthStyles } from './admin-style.mjs';
+
+export function adminLoginPage() {
+  return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>登录 · Code Relax 管理</title><style>${adminUiTokens}${adminFooterStyles}${adminAuthStyles}</style></head>
+<body class="admin-login"><main><form id="login" class="login-card"><h1>Code Relax 管理</h1><p>输入管理密码，进入后台。</p><label for="password">管理密码</label><input id="password" name="password" type="password" autocomplete="current-password" required maxlength="256" autofocus><button id="submit" type="submit">登录</button><p id="result" role="alert" aria-live="polite"></p></form></main><footer class="admin-footer">京ICP备2026027643号-2</footer>
+<script>const form=document.getElementById('login'),button=document.getElementById('submit'),result=document.getElementById('result');form.addEventListener('submit',async event=>{event.preventDefault();if(button.disabled)return;button.disabled=true;result.textContent='正在登录…';try{const response=await fetch('/admin/login',{method:'POST',headers:{'Content-Type':'application/json','X-Code-Relax-Admin':'1'},body:JSON.stringify({password:form.password.value})});const body=await response.json();if(!response.ok)throw new Error(body.error||'登录失败');form.reset();location.replace('/')}catch(error){result.textContent=error.message}finally{button.disabled=false}});</script></body></html>`;
+}

package/dist/src/self-relay/admin-page.mjs

@@ -0,0 +1,87 @@
+import { adminUiTokens, adminFooterStyles, adminAuthStyles, adminWorkstationStyles } from './admin-style.mjs';
+import { adminWorkstationsMarkup, adminWorkstationsScript } from './admin-workstations-page.mjs';
+
+export function adminPage() {
+  return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="color-scheme" content="only light"><meta name="theme-color" content="#f5f7fa"><title>Code Relax 管理</title><style>${adminUiTokens}${adminFooterStyles}</style>
+<style>@media(max-width:600px){body main{padding:12px 12px 40px}header.page-head{align-items:center;gap:8px;margin-bottom:8px}header.page-head h1{font-size:20px;line-height:1.2;margin:0}main .nav{gap:0;margin-bottom:12px}main .nav button{padding:8px 11px}main .stack,main .grid{gap:10px}main .card{padding:12px}main .hero strong{font-size:20px}main .throughput{grid-template-columns:repeat(2,minmax(0,1fr));gap:6px;margin-top:10px}main .metrics{gap:6px}main .metric{display:flex;flex-direction:row-reverse;align-items:center;justify-content:space-between;gap:6px;min-width:0;padding:9px 10px}main .metric strong{font-size:17px;margin:0;white-space:nowrap}main .metric span{font-size:11px}main .card-head{margin-bottom:10px}}</style>
+<style>@media(max-width:600px){main .throughput .metric strong{font-size:17px}}</style>
+<style>.metric.warn{border-color:#946d38;background:#352a1b}.metric.warn strong{color:#ffd192}.metric.critical{border-color:#a65b58;background:#38211f}.metric.critical strong{color:#ffb1a9}.state.critical{background:#72342e;color:#ffe1dc}#trafficTimeline.critical .quota-fill{background:#d46a60}</style>
+<style>.quota-timeline{display:grid;gap:9px;margin-top:18px}.quota-timeline[hidden]{display:none}.quota-heading{display:flex;align-items:center;justify-content:space-between;gap:12px;color:#b7c8ba;font-size:12px;font-variant-numeric:tabular-nums}.quota-heading strong{font-size:13px}.quota-pace{font-weight:700;color:#7bc993}.quota-pace.ahead{color:#e9b46f}.quota-track{position:relative;height:13px;border:1px solid #526154;border-radius:7px;background:#5c6e6030}.quota-fill{position:absolute;inset:0 auto 0 0;border-radius:6px;background:#48ae78}.quota-timeline.ahead .quota-fill{background:#d39b4c}.quota-now{position:absolute;top:-5px;bottom:-5px;width:2px;background:#d8e3db;box-shadow:0 0 0 1px #162019;transform:translateX(-1px)}.quota-now:before{position:absolute;top:-1px;left:50%;width:7px;height:7px;background:#d8e3db;transform:translate(-50%,-50%) rotate(45deg);content:""}.quota-period{display:flex;justify-content:space-between;gap:12px;color:#91a394;font-size:11px}.quota-period span:last-child{text-align:right}</style>
+<style>
+:root{color-scheme:only light;font:14px/1.5 system-ui,"Microsoft YaHei",sans-serif;background:#f5f7fa;color:#17212b}*{box-sizing:border-box}body{margin:0}button,input,textarea{font:inherit}button{cursor:pointer;border:1px solid transparent;border-radius:9px;padding:9px 14px;background:#397e58;color:white;font-weight:600}button:hover{background:#46966b}button:disabled{opacity:.45;cursor:default}button.secondary{background:#26352c;color:#c8d7cd;border-color:#405548}button.danger{background:transparent;color:#eaa29c;border-color:#734947}button:focus-visible,input:focus-visible,textarea:focus-visible{outline:2px solid #8ad2a0;outline-offset:2px}
+main{max-width:1180px;margin:auto;padding:28px 24px 70px}h1{font-size:29px;line-height:1.2;margin:6px 0 8px}h2{font-size:18px;margin:0}h3{font-size:15px;margin:0}p{margin:0}.eyebrow{color:#83b598;letter-spacing:.12em;font-size:11px;font-weight:700}.subtle,.hint,.note{color:#a3b4a8}.hint,.note{font-size:12px}.note{margin-top:15px}.page-head{display:flex;align-items:end;justify-content:space-between;gap:16px;margin-bottom:22px}.page-head .subtle{margin-top:6px}.nav{display:flex;gap:7px;border-bottom:1px solid #34463a;margin-bottom:22px;overflow:auto}.nav button{border:0;border-bottom:2px solid transparent;border-radius:0;background:transparent;color:#b6c9bb;padding:12px 17px;white-space:nowrap}.nav button[aria-current=page]{color:#b9efca;border-bottom-color:#8ad2a0;background:#1a2b20}.page[hidden]{display:none}.stack{display:grid;gap:18px}.grid{display:grid;grid-template-columns:minmax(0,1.25fr) minmax(290px,.75fr);gap:18px;align-items:start}.card{background:#19241d;border:1px solid #34463a;border-radius:16px;padding:22px;box-shadow:0 12px 30px #080e0a24}.card-head{margin-bottom:18px}.hero{display:flex;align-items:start;justify-content:space-between;gap:18px;flex-wrap:wrap}.hero strong{font-size:26px}.state{border-radius:100px;padding:5px 10px;font-size:12px;font-weight:700;color:#c9f2d5;background:#28583b}.state.warn{background:#62491c;color:#ffe4a8}.state.down{background:#63302c;color:#ffd1c8}.throughput,.metrics{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:10px}.throughput{margin-top:20px}.metrics{grid-template-columns:repeat(3,minmax(0,1fr))}.metric{background:#111b15;border:1px solid #2b3c30;border-radius:11px;padding:14px;color:#9eafa3;font-size:12px}.metric strong{display:block;color:#f0f6f0;font-size:25px;line-height:1.2;margin-bottom:5px;font-variant-numeric:tabular-nums}.metric small{display:block;color:#80b893}.throughput .metric strong{font-size:32px}.detail{display:grid;gap:10px}.detail div{display:flex;justify-content:space-between;gap:12px;border-bottom:1px solid #2b3c30;padding-bottom:10px}.detail div:last-child{border:0;padding:0}.field{display:grid;gap:7px;margin:15px 0}.field label{font-size:13px;font-weight:600;color:#c5d7c9}input,textarea{width:100%;background:#101913;border:1px solid #45614d;border-radius:9px;color:#f1f7f1;padding:10px 12px}textarea{min-height:145px;resize:vertical}.actions{display:flex;flex-wrap:wrap;gap:9px;align-items:center}.current{border:1px solid #385841;background:#112017;border-radius:11px;padding:15px;margin-bottom:18px}.current.empty{border-color:#34463a;background:#111b15}.badge{display:inline-block;background:#28583b;color:#c9f2d5;border-radius:100px;padding:2px 8px;font-size:11px;font-weight:700}.current h3,.history h3{margin:8px 0 4px;overflow-wrap:anywhere}.current p,.history p{white-space:pre-wrap;overflow-wrap:anywhere;color:#c1d1c5}.date{font-size:12px;color:#94a99a}.history{display:grid;gap:10px}.history-item{border:1px solid #34463a;background:#141e17;border-radius:11px;padding:15px}.history-item.active{border-color:#4d865e}.history-item p{margin:8px 0 12px;max-height:4.5em;overflow:hidden}.history-item .actions button{padding:6px 10px;font-size:12px}.empty-note{padding:24px;border:1px dashed #415748;border-radius:10px;color:#a3b4a8;text-align:center}.status{min-height:24px;margin-top:16px;color:#96d4a9}.status.error{color:#f0aaa2}@media(max-width:800px){main{padding:24px 16px 50px}.grid{grid-template-columns:1fr}.metrics{grid-template-columns:repeat(2,minmax(0,1fr))}}@media(max-width:500px){.page-head{align-items:start}.card{padding:17px}.throughput{grid-template-columns:1fr}.metric{padding:10px}.metric strong{font-size:21px}}
+</style><style>
+.announcement-toolbar{display:flex;align-items:center;justify-content:space-between;gap:12px;flex-wrap:wrap;margin-bottom:18px}.announcement-toolbar h2{font-size:20px}.announcement-controls{display:flex;align-items:center;gap:9px;flex-wrap:wrap}.announcement-controls input{width:min(230px,100%)}.announcement-controls select{width:auto;min-width:108px}select{font:inherit;background:#101913;border:1px solid #45614d;border-radius:9px;color:#f1f7f1;padding:10px 12px}.announcement-list{display:grid;gap:9px}.announcement-row{display:grid;grid-template-columns:minmax(0,1fr) 90px 145px minmax(220px,auto);align-items:center;gap:14px;border:1px solid #34463a;border-radius:11px;padding:14px;background:#141e17}.announcement-row.active{border-color:#4d865e}.announcement-row h3{overflow-wrap:anywhere}.announcement-row p{color:#a3b4a8;font-size:12px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.announcement-row .actions{justify-content:flex-end;gap:6px}.announcement-row .actions button{padding:6px 9px;font-size:12px}.announcement-row .date{font-variant-numeric:tabular-nums}.announcement-status{display:inline-block;width:max-content;padding:3px 8px;border-radius:100px;font-size:11px;font-weight:700;color:#cad7ce;background:#334038}.announcement-status.active{background:#28583b;color:#c9f2d5}.announcement-status.draft{background:#4d462c;color:#ffe4a8}.announcement-empty{padding:32px;text-align:center;color:#a3b4a8}dialog{width:min(570px,calc(100% - 28px));max-height:calc(100vh - 36px);overflow:auto;background:#19241d;color:#edf4ee;border:1px solid #45614d;border-radius:16px;padding:22px;box-shadow:0 24px 70px #050905bb}dialog::backdrop{background:#050905bb}.editor-head{display:flex;align-items:center;justify-content:space-between;gap:10px}.editor-head button{padding:4px 10px}.editor-actions{display:flex;justify-content:flex-end;gap:8px;flex-wrap:wrap;margin-top:18px}.editor-actions[hidden]{display:none}dialog textarea{min-height:200px}dialog input:disabled,dialog textarea:disabled{opacity:.8}.hero-meta{display:flex;align-items:center;gap:10px}.hero-meta .hint{white-space:nowrap}.quota-card .card-head{display:flex;align-items:center;justify-content:space-between;gap:10px}.quota-card .card-head .hint{white-space:nowrap}@media(max-width:800px){.announcement-row{grid-template-columns:minmax(0,1fr) auto;gap:8px}.announcement-row .date{grid-column:1}.announcement-row .actions{grid-column:2;grid-row:2;align-self:end}.announcement-row .announcement-status{grid-column:2;grid-row:1}.announcement-toolbar{align-items:stretch}.announcement-controls{width:100%}.announcement-controls input{flex:1;min-width:110px}}@media(max-width:500px){.announcement-row{padding:11px}.announcement-row .actions button{padding:5px 7px;font-size:11px}.announcement-controls select{min-width:96px}.hero{align-items:center;flex-wrap:nowrap}.hero strong{font-size:20px}.hero-meta{gap:6px}.hero-meta .hint{font-size:11px}.hero-meta .state{padding:3px 7px}}
+</style><style>
+:root{color-scheme:only light;background:#f5f7fa;color:#17212b}body{min-height:100vh;background:radial-gradient(circle at 16% 15%,#cfe6d7aa 0,transparent 28%),radial-gradient(circle at 86% 76%,#dbece0aa 0,transparent 26%),linear-gradient(#1f4a2d0b 1px,transparent 1px),linear-gradient(90deg,#1f4a2d0b 1px,transparent 1px),#f5f7fa;background-size:auto,auto,32px 32px,32px 32px,auto}
+button{background:#e0f0e5;color:#235d3a;border-color:#a9cbb4}button:hover{background:#cce5d4;color:#194d31;border-color:#84b995}button.secondary{background:#f4f8f5;color:#315f42;border-color:#c8daca}button.secondary:hover{background:#e8f2eb;color:#235d3a;border-color:#a9cbb4}button.danger{background:#fff8f6;color:#a34c43;border-color:#e6c5c0}button.danger:hover{background:#fdece8;color:#993b32;border-color:#dba7a0}button:focus-visible,input:focus-visible,textarea:focus-visible,select:focus-visible{outline-color:#4b9b66}
+.subtle,.hint,.note{color:#607168}.page-head{justify-content:flex-start;align-items:center;gap:26px;margin-bottom:18px}.page-head h1{flex:none;color:#26332b}.page-head .nav{min-width:0;gap:4px;margin:0;border:0}.page-head .nav button{flex:none}.nav button{color:#607168}.nav button:hover{background:#eef5f0;color:#286e43}.nav button[aria-current=page]{color:#286e43;border-bottom-color:#68b582;background:#e4f1e8}.nav button[aria-current=page]:hover{background:#d8ebdd;color:#235d3a}.card{background:#ffffffee;border-color:#d5ddd8;box-shadow:0 10px 24px #263a2d0a}.metric{background:#f8faf8;border-color:#dce5df;color:#607168}.metric strong{color:#26332b}.metric small{color:#43865b}.metric.warn{background:#fff6e7;border-color:#e8c890}.metric.warn strong{color:#985d16}.metric.critical{background:#fff0ec;border-color:#dfaaa1}.metric.critical strong{color:#a5443b}
+.state,.badge,.announcement-status.active{background:#e4f1e8;color:#286e43}.state.warn,.announcement-status.draft{background:#fff1d8;color:#895711}.state.down,.state.critical{background:#fbe6e2;color:#a13e35}.traffic-usage{color:#52645a;font-size:13px;font-variant-numeric:tabular-nums}.quota-card .quota-timeline{margin-top:12px}.quota-heading{color:#52645a}.quota-heading .warn{color:#985d16}.quota-heading .critical{color:#a5443b}.quota-pace{color:#28764a}.quota-pace.ahead{color:#a87326}.quota-track{border-color:#cfdbd2;background:#e9f0eb}.quota-fill{background:#68b582}.quota-timeline.ahead .quota-fill,.quota-timeline.warn .quota-fill{background:#d39b4c}.quota-now{background:#52645a;box-shadow:0 0 0 1px #fff}.quota-now:before{background:#52645a}.quota-period{color:#77857d}
+.field label{color:#3b5142}input,textarea,select,.announcement-controls select{background:#fff;border-color:#c6d4cb;color:#26332b}input::placeholder,textarea::placeholder{color:#89988d}.date{color:#77857d}.announcement-row{background:#fff;border-color:#d5ddd8}.announcement-row.active{border-color:#a9c6b3;box-shadow:inset 3px 0 #68b582}.announcement-row p{color:#607168}.announcement-status{background:#edf1ee;color:#52645a}.announcement-empty{color:#607168}dialog{background:#fff;color:#26332b;border-color:#c6d4cb;box-shadow:0 24px 70px #263a2d33}dialog::backdrop{background:#172c20a8}.status{color:#28764a}.status.error{color:#a5443b}.relay-heading{display:flex;align-items:center;justify-content:space-between;gap:10px;margin-bottom:10px}.overview-sample{display:flex;justify-content:flex-end}.throughput{margin-top:12px}.throughput .metric{padding:10px 12px}.throughput .metric strong{font-size:20px}@media(max-width:600px){header.page-head{gap:8px}header.page-head h1{font-size:18px}.page-head .nav{gap:2px}.page-head .nav button{padding:7px 6px;font-size:12px}main .throughput{margin-top:8px}main .throughput .metric{padding:7px 8px}main .throughput .metric strong{font-size:14px}}
+</style><style>
+#metrics{grid-template-columns:repeat(5,minmax(0,1fr))}.relay-heading{margin-bottom:14px}.resource-head{display:flex;align-items:center;justify-content:space-between;gap:10px}.resource-head .hint{white-space:nowrap}.resource-card .throughput{border-top:1px solid #dce5df;padding-top:10px;margin-top:12px}.resource-card .throughput .metric{display:flex;flex-direction:row-reverse;align-items:center;justify-content:space-between;gap:8px;padding:8px 10px}.resource-card .throughput .metric strong{font-size:16px;margin:0;white-space:nowrap}
+@media(max-width:800px){#metrics{grid-template-columns:repeat(2,minmax(0,1fr))}}
+@media(max-width:600px){.resource-card .throughput .metric strong{font-size:14px}}
+</style><style>main:not(.authenticated)>:not(#adminLogin){display:none!important}#adminLogin{max-width:430px;margin:10vh auto}#adminLogin[hidden]{display:none}.usage-toolbar{display:flex;align-items:center;justify-content:space-between;gap:12px;flex-wrap:wrap;margin-bottom:16px}.usage-views,.usage-pages{display:flex;align-items:center;gap:8px}.usage-views button[aria-pressed=true]{background:#286e43;color:#fff}.usage-rows{display:grid;gap:8px}.usage-row{display:grid;gap:8px;padding:12px 14px;border:1px solid var(--admin-row-border);border-radius:var(--admin-control-radius);background:var(--admin-row)}.usage-row-head{display:flex;align-items:baseline;justify-content:space-between;gap:12px;min-width:0}.usage-row-head span{min-width:0;overflow-wrap:anywhere}.usage-row-head small{flex-shrink:0;white-space:nowrap}.usage-row strong{font-variant-numeric:tabular-nums}.usage-row small{text-align:right}.usage-pages{margin-top:16px}</style></head><body><main class="authenticated">
+<style>${adminAuthStyles}${adminWorkstationStyles}</style><header class="page-head"><h1>中继管理</h1><nav class="nav" aria-label="管理页面"><button type="button" data-page="overview" aria-current="page">运行概览</button><button type="button" data-page="workstations">工作站</button><button type="button" data-page="announcements">系统公告</button><button type="button" data-page="settings">容量设置</button><button type="button" data-page="usage">使用统计</button></nav><button id="logout" class="secondary admin-logout" type="button">退出登录</button></header>
+${adminWorkstationsMarkup}
+<section id="overview" class="page stack"><section class="card" aria-label="中继连接与转发"><div class="relay-heading"><h2>中继连接与转发</h2><span id="healthText" class="state">读取中</span></div><div id="metrics" class="metrics"></div></section><div class="grid"><section class="card resource-card" aria-label="服务器资源"><div class="card-head resource-head"><h2>服务器资源</h2><span id="sampleTime" class="hint">等待采样</span></div><div id="serverMetrics" class="metrics"></div><div class="throughput" id="throughput"></div></section><section class="card quota-card"><div class="card-head"><h2>流量包</h2><span id="trafficNote" class="hint">等待更新</span></div><p id="trafficUsage" class="traffic-usage">—</p><div id="trafficTimeline" class="quota-timeline" hidden><div class="quota-heading"><strong id="trafficRemaining">流量剩余 —</strong><span id="trafficPace" class="quota-pace">—×</span><span id="timeRemaining">时间剩余 —</span></div><div id="quotaTrack" class="quota-track" role="img"><span id="quotaFill" class="quota-fill"></span><span id="quotaNow" class="quota-now"></span></div><div class="quota-period"><span id="trafficEnd">到期 —</span><span id="trafficStart">本期开始 —</span></div></div></section></div></section>
+<section id="announcements" class="page" hidden><section class="card"><div class="announcement-toolbar"><div><h2>公告管理</h2><p id="announcementCount" class="hint">正在读取</p></div><button id="newAnnouncement" type="button">新建公告</button></div><div class="announcement-controls"><input id="announcementSearch" type="search" aria-label="搜索公告" placeholder="搜索标题或正文"><select id="announcementFilter" aria-label="筛选状态"><option value="all">全部状态</option><option value="active">发布中</option><option value="draft">草稿</option><option value="withdrawn">已撤下</option></select></div><div id="announcementList" class="announcement-list" style="margin-top:14px"></div></section></section>
+<dialog id="announcementEditor" aria-labelledby="editorHeading"><div class="editor-head"><h2 id="editorHeading">新建公告</h2><button id="closeEditor" class="secondary" type="button" aria-label="关闭">关闭</button></div><div class="field"><label for="title">标题</label><input id="title" maxlength="80" placeholder="输入公告标题"></div><div class="field"><label for="message">正文</label><textarea id="message" maxlength="2000" placeholder="输入公告内容"></textarea></div><p id="editorNote" class="hint"></p><p id="editorError" class="status error" role="alert" hidden></p><div id="editorActions" class="editor-actions"><button id="saveDraft" class="secondary" type="button">保存草稿</button><button id="publish" type="button">发布公告</button></div></dialog>
+<section id="settings" class="page stack" hidden><section class="card"><div class="card-head"><h2>服务器转发容量</h2><p class="hint">只限制经 WSS 转发的普通会话，WebRTC 直连与白名单转发不占用此额度</p></div><div class="field"><label for="limit">最大并发会话</label><input id="limit" type="number" min="1" max="256"></div><button id="saveLimit" type="button">保存设置</button><p class="note">当前上限是人工配置值，不随 CPU 或带宽自动改变。</p></section></section>
+<section id="usage" class="page" hidden><section class="card"><div class="usage-toolbar"><div><h2>今日使用统计</h2><p id="usageCount" class="hint">正在读取</p></div><div class="usage-views"><button id="usageUsers" type="button" class="secondary" aria-pressed="true">用户</button><button id="usageComputers" type="button" class="secondary" aria-pressed="false">工作站</button><button id="usageRefresh" type="button" class="secondary">刷新</button></div></div><div id="usageRows" class="usage-rows"></div><div class="usage-pages"><button id="usagePrev" type="button" class="secondary">上一页</button><span id="usagePageText" class="hint"></span><button id="usageNext" type="button" class="secondary">下一页</button></div><p id="usageError" class="status error" role="alert"></p></section></section><p id="result" class="status" role="status" aria-live="polite"></p>
+</main><footer class="admin-footer">网站备案号：京ICP备2026027643号-2</footer><script>
+const el=id=>document.getElementById(id);let snapshot=null;
+const request=async(path,options={})=>{const response=await fetch(path,{...options,referrerPolicy:'no-referrer'});if(response.status===401){location.replace('/');throw new Error('登录已过期，请重新登录')}const body=await response.json();if(!response.ok)throw new Error(body.error||('HTTP '+response.status));return body};
+el('logout').addEventListener('click',async()=>{el('logout').disabled=true;try{await request('/admin/logout',{method:'POST',headers:{'X-Code-Relax-Admin':'1'}});location.replace('/')}catch(error){setResult(error.message,true)}finally{el('logout').disabled=false}});
+function setResult(message,error=false){el('result').textContent=message;el('result').classList.toggle('error',error)}
+function node(tag,className,value){const item=document.createElement(tag);if(className)item.className=className;if(value!==undefined)item.textContent=value;return item}
+function metric(value,label,extra,tone){const item=node('div','metric'+(tone?' '+tone:''));item.append(node('strong','',value),node('span','',label));if(extra)item.append(node('small','',extra));return item}
+function toneAbove(value,warn,critical){return typeof value==='number'&&Number.isFinite(value)?value>=critical?'critical':value>=warn?'warn':'':''}
+function toneBelow(value,warn,critical){return typeof value==='number'&&Number.isFinite(value)?value<=critical?'critical':value<=warn?'warn':'':''}
+function number(value,digits=0){return typeof value==='number'&&Number.isFinite(value)?value.toFixed(digits):'—'}
+function date(value){return new Date(value).toLocaleString('zh-CN')}
+function renderTrafficTimeline(cloud,available){const start=Date.parse(cloud.trafficStartAt);const end=Date.parse(cloud.trafficEndAt);const total=Number(cloud.trafficTotalBytes);const remaining=Number(cloud.trafficRemainingBytes);const valid=available&&Number.isFinite(start)&&Number.isFinite(end)&&end>start&&cloud.trafficTotalBytes!=null&&cloud.trafficRemainingBytes!=null&&total>0&&Number.isFinite(remaining);const timeline=el('trafficTimeline');timeline.hidden=!valid;if(!valid)return;
+const clamp=value=>Math.max(0,Math.min(100,value));const quotaLeft=clamp(remaining/total*100);const timeLeft=clamp((end-Date.now())/(end-start)*100);const used=100-quotaLeft;const elapsed=100-timeLeft;const pace=elapsed>0?used/elapsed:null;
+timeline.classList.toggle('ahead',pace!==null&&pace>1);timeline.classList.toggle('warn',quotaLeft<=20);timeline.classList.toggle('critical',quotaLeft<=10);el('trafficRemaining').textContent='流量剩余 '+number(quotaLeft,1)+'%';el('trafficRemaining').className=toneBelow(quotaLeft,20,10);el('timeRemaining').textContent='时间剩余 '+number(timeLeft,1)+'%';el('trafficPace').textContent=pace===null?'—×':number(pace,2)+'×';el('trafficPace').classList.toggle('ahead',pace!==null&&pace>1);
+el('quotaFill').style.width=quotaLeft+'%';el('quotaNow').style.left=timeLeft+'%';el('quotaTrack').setAttribute('aria-label','流量剩余 '+number(quotaLeft,1)+'%，时间剩余 '+number(timeLeft,1)+'%');el('trafficStart').textContent='本期开始 '+date(cloud.trafficStartAt);el('trafficEnd').textContent='到期 '+date(cloud.trafficEndAt)}
+function renderOverview(state){const cloud=state.cloud||{};const relay=state.relayAvailable!==false;const cloudFresh=cloud.metricAvailable&&Date.now()-Date.parse(cloud.metricSampledAt)<180000;const trafficFresh=cloud.trafficAvailable&&Date.now()-Date.parse(cloud.trafficSampledAt)<900000;const occupancy=state.maxRelaySessions?state.activeRelaySessions/state.maxRelaySessions:0;const high=occupancy>=.9||(cloudFresh&&(cloud.cpuPercent>=85||cloud.memoryPercent>=90||cloud.diskPercent>=90||cloud.outRatioPercent>=90));const caution=occupancy>=.75||(cloudFresh&&(cloud.cpuPercent>=65||cloud.memoryPercent>=80||cloud.diskPercent>=80||cloud.outRatioPercent>=70));const label=!relay?'中继不可用':high?'压力较高':!cloudFresh?'云监控数据过期':caution?'需要关注':'压力正常';
+el('healthText').textContent=label;el('healthText').className='state'+(!relay||!cloudFresh&&!high?' down':high?' critical':caution?' warn':'');el('sampleTime').textContent=cloudFresh?'采样时间 '+new Date(cloud.metricSampledAt).toLocaleTimeString('zh-CN',{hour:'2-digit',minute:'2-digit'}):'等待采样';
+el('throughput').replaceChildren(metric(cloudFresh?number(cloud.outMbps,2)+' Mbps':'—','公网发送'),metric(cloudFresh?number(cloud.inMbps,2)+' Mbps':'—','公网接收'));
+el('serverMetrics').replaceChildren(metric(cloudFresh?number(cloud.cpuPercent,1)+'%':'—','CPU 使用率',null,cloudFresh?toneAbove(cloud.cpuPercent,65,85):''),metric(cloudFresh?number(cloud.memoryPercent,1)+'%':'—','内存使用率',null,cloudFresh?toneAbove(cloud.memoryPercent,80,90):''),metric(cloudFresh?number(cloud.diskPercent,1)+'%':'—','系统盘使用率',null,cloudFresh?toneAbove(cloud.diskPercent,80,90):''),metric(cloudFresh?number(cloud.cpuLoad1,2):'—','1 分钟负载'),metric(cloudFresh?number(cloud.outRatioPercent,1)+'%':'—','出口带宽使用率',null,cloudFresh?toneAbove(cloud.outRatioPercent,70,90):''));
+const gb=value=>value==null?'—':number(Number(value)/1073741824,2)+' GB';
+el('trafficUsage').textContent=trafficFresh?'已用 '+gb(cloud.trafficUsedBytes)+' / '+gb(cloud.trafficTotalBytes):'流量暂不可用';
+el('trafficNote').textContent=trafficFresh?'更新时间 '+new Date(cloud.trafficSampledAt).toLocaleTimeString('zh-CN',{hour:'2-digit',minute:'2-digit'}):'暂不可用';
+renderTrafficTimeline(cloud,trafficFresh);
+el('metrics').replaceChildren(metric(number(state.activeRelaySessions)+' / '+number(state.maxRelaySessions),'受限转发',null,state.maxRelaySessions?toneAbove(state.activeRelaySessions/state.maxRelaySessions,.75,.9):''),metric(number(state.activeExemptRelaySessions),'白名单转发'),metric(number(state.websocketConnections),'WebSocket 连接'),metric(number(state.onlineComputers),'在线工作站'),metric(number(state.activePhones),'活动移动端'))}
+let editorItem=null,editorMode='new',writing=false;
+function openEditor(item=null,duplicate=false){editorItem=duplicate?null:item;editorMode=duplicate?'new':item?.status==='draft'?'draft':item?'view':'new';el('editorHeading').textContent=duplicate?'复制为新公告':editorMode==='draft'?'编辑草稿':editorMode==='view'?'查看公告':'新建公告';el('title').value=item?.title||'';el('message').value=item?.message||'';el('title').disabled=editorMode==='view';el('message').disabled=editorMode==='view';el('editorActions').hidden=editorMode==='view';el('editorNote').textContent=editorMode==='view'?'已发布内容只读；可复制为新公告再修改。':'发布后会立即替换当前公告并通知在线设备。';el('editorError').hidden=true;el('announcementEditor').showModal();if(editorMode!=='view')el('title').focus()}
+function action(label,className,handler,disabled=false){const button=node('button',className,label);button.type='button';button.disabled=disabled;button.addEventListener('click',handler);return button}
+function renderAnnouncements(state){const available=state.relayAvailable!==false;const items=state.announcements||[];const filter=el('announcementFilter').value;const query=el('announcementSearch').value.trim().toLocaleLowerCase();const visible=items.filter(item=>(filter==='all'||item.status===filter)&&(!query||(item.title+' '+item.message).toLocaleLowerCase().includes(query)));el('newAnnouncement').disabled=!available;el('announcementCount').textContent=available?'共 '+items.length+' 条 · 发布中 '+items.filter(item=>item.status==='active').length+' 条':'中继暂不可用';const list=el('announcementList');list.replaceChildren();if(!visible.length){list.append(node('div','announcement-empty',available?items.length?'没有符合条件的公告':'暂无公告，点击“新建公告”开始':'暂时无法读取公告'));return}
+for(const item of visible){const row=node('article','announcement-row'+(item.status==='active'?' active':''));const summary=node('div');summary.append(node('h3','',item.title),node('p','',item.message));const status=node('span','announcement-status '+item.status,{active:'发布中',draft:'草稿',withdrawn:'已撤下'}[item.status]||'未知');const when=node('span','date',(item.status==='draft'?'修改 ':'发布 ')+date(item.status==='draft'?item.updatedAt:item.publishedAt));const actions=node('div','actions');const path='/admin/api/announcements/'+encodeURIComponent(item.id);
+if(item.status==='draft'){actions.append(action('编辑','secondary',()=>openEditor(item)),action('发布','',()=>{if(!snapshot.announcement||confirm('发布后将替换当前公告，确定发布？'))write('PUT',path+'/publish',{},'公告已发布')},!available),action('删除','danger',()=>{if(confirm('确定删除这条草稿？'))write('DELETE',path,{},'草稿已删除')},!available))}
+else if(item.status==='active'){actions.append(action('查看','secondary',()=>openEditor(item)),action('撤下','danger',()=>{if(confirm('确定撤下当前公告？'))write('PUT',path+'/withdraw',{},'公告已撤下')},!available))}
+else{actions.append(action('查看','secondary',()=>openEditor(item)),action('复制','secondary',()=>openEditor(item,true),!available),action('删除','danger',()=>{if(confirm('确定删除这条已撤下的公告？'))write('DELETE',path,{},'公告记录已删除')},!available))}
+row.append(summary,status,when,actions);list.append(row)}}
+function render(state){snapshot=state;renderOverview(state);renderAnnouncements(state);el('saveLimit').disabled=state.relayAvailable===false;if(document.activeElement!==el('limit'))el('limit').value=state.maxRelaySessions??''}
+async function load(){try{render(await request('/admin/api/status'));setResult('')}catch(error){snapshot=null;el('healthText').textContent='状态暂不可用';el('healthText').className='state down';for(const id of ['metrics','serverMetrics','throughput','announcementList'])el(id).replaceChildren();el('trafficTimeline').hidden=true;el('trafficUsage').textContent='—';el('announcementCount').textContent='暂时无法读取';el('saveLimit').disabled=true;setResult(error.message,true)}}
+async function write(method,path,body,message){if(writing)return false;writing=true;try{await request(path,{method,headers:{'Content-Type':'application/json','X-Code-Relax-Admin':'1'},body:JSON.stringify(body)});await load();setResult(message);return true}catch(error){setResult(error.message,true);if(el('announcementEditor').open){el('editorError').textContent=error.message;el('editorError').hidden=false}return false}finally{writing=false}}
+let usageView='user',usagePage=1,usageTotal=0;
+function usageDuration(value){const seconds=Math.floor(Number(value)||0),hours=Math.floor(seconds/3600),minutes=Math.floor(seconds%3600/60),rest=seconds%60;return hours?hours+' 小时 '+minutes+' 分钟':minutes?minutes+' 分钟 '+rest+' 秒':rest+' 秒'}
+function usageTime(value){return value?new Date(value.replace(' ','T')+'Z').toLocaleTimeString('zh-CN',{timeZone:'Asia/Shanghai',hour:'2-digit',minute:'2-digit',second:'2-digit',hour12:false}):'—'}
+async function loadUsage(){const view=usageView,page=usagePage;el('usageError').textContent='';el('usageCount').textContent='正在读取';try{const result=await request('/admin/api/usage?view='+view+'&page='+page);if(view!==usageView||page!==usagePage||el('usage').hidden)return;usageTotal=result.total;el('usageCount').textContent='今日有记录：'+usageTotal+(view==='user'?' 个用户':' 台工作站')+' · 北京时间';el('usagePageText').textContent='第 '+page+' / '+Math.max(1,Math.ceil(usageTotal/30))+' 页';el('usagePrev').disabled=page<=1;el('usageNext').disabled=page*30>=usageTotal;const rows=el('usageRows');rows.replaceChildren();if(!result.rows.length){rows.append(node('div','empty-note','今日暂无计时记录'));return}for(const item of result.rows){const row=node('div','usage-row');const counts=' · 消息 '+Number(item.message_count||0)+' · 轮次 '+Number(item.turn_count||0);const heading=node('div','usage-row-head');const title=node('span','',view==='user'?item.email:'工作站 …'+item.id.slice(-8));title.title=view==='user'?item.email:item.id;heading.append(title,node('small','hint','最后使用 '+usageTime(item.last_used_at)));row.append(heading,node('strong','',view==='user'?'任务 '+usageDuration(item.today_task_seconds)+counts:'任务 '+usageDuration(item.today_task_seconds)+' · 免费账号 '+usageDuration(item.today_free_task_seconds)+counts));rows.append(row)}}catch(error){if(view===usageView&&page===usagePage){usageTotal=0;el('usageCount').textContent='统计暂不可用';el('usageRows').replaceChildren();el('usagePageText').textContent='';el('usagePrev').disabled=true;el('usageNext').disabled=true;el('usageError').textContent=error.message}}}
+function setUsageView(view){if(usageView===view)return;usageView=view;usagePage=1;el('usageUsers').setAttribute('aria-pressed',String(view==='user'));el('usageComputers').setAttribute('aria-pressed',String(view==='computer'));void loadUsage()}
+el('usageUsers').onclick=()=>setUsageView('user');el('usageComputers').onclick=()=>setUsageView('computer');el('usageRefresh').onclick=()=>loadUsage();el('usagePrev').onclick=()=>{if(usagePage>1){usagePage--;void loadUsage()}};el('usageNext').onclick=()=>{if(usagePage*30<usageTotal){usagePage++;void loadUsage()}};
+function showPage(route){cancelWorkstations();const detail=route.startsWith('workstations/')&&/^[a-zA-Z0-9_-]{16,128}$/.test(route.slice(13))?[route,route.slice(13)]:null;const page=detail?'workstations':['overview','announcements','settings','usage','workstations'].includes(route)?route:'overview';workstationId=detail?detail[1]:null;for(const button of document.querySelectorAll('[data-page]'))button.setAttribute('aria-current',button.dataset.page===page?'page':'false');for(const section of document.querySelectorAll('.page'))section.hidden=section.id!==page;if(page==='workstations'){el('workstationBack').hidden=!workstationId;el('workstationHeading').textContent=workstationId?'工作站详情':'工作站';el('workstationCount').textContent='正在读取';el('workstationContent').replaceChildren();el('workstationError').textContent='';void loadWorkstations()}else if(page==='usage')void loadUsage();else void load()}
+function navigatePage(page){history.pushState(null,'','#'+page);showPage(page)}
+for(const button of document.querySelectorAll('[data-page]'))button.addEventListener('click',()=>navigatePage(button.dataset.page));
+window.addEventListener('popstate',()=>showPage(location.hash.slice(1)));
+el('saveLimit').addEventListener('click',()=>write('PUT','/admin/api/settings',{maxRelaySessions:Number(el('limit').value)},'转发容量已保存'));
+el('newAnnouncement').addEventListener('click',()=>openEditor());el('closeEditor').addEventListener('click',()=>el('announcementEditor').close());el('announcementSearch').addEventListener('input',()=>{if(snapshot)renderAnnouncements(snapshot)});el('announcementFilter').addEventListener('change',()=>{if(snapshot)renderAnnouncements(snapshot)});
+async function saveAnnouncement(publish){const title=el('title').value.trim(),message=el('message').value.trim();if(!title||!message){el('editorError').textContent='请填写标题和正文';el('editorError').hidden=false;return}if(publish&&snapshot?.announcement&&snapshot.announcement.id!==editorItem?.id&&!confirm('发布后将替换当前公告，确定发布？'))return;const path=editorMode==='draft'?'/admin/api/announcements/'+encodeURIComponent(editorItem.id):'/admin/api/announcements';const target=publish&&editorMode==='draft'?path+'/publish':path;const body={title,message};if(publish&&editorMode==='new')body.publish=true;const ok=await write('PUT',target,body,publish?'公告已发布':'草稿已保存');if(ok)el('announcementEditor').close()}
+el('saveDraft').addEventListener('click',()=>saveAnnouncement(false));el('publish').addEventListener('click',()=>saveAnnouncement(true));
+${adminWorkstationsScript}
+showPage(location.hash.slice(1));setInterval(()=>{if(document.hidden)return;if(!el('overview').hidden)void load();else if(!el('workstations').hidden)void loadWorkstations()},5000);
+document.addEventListener('visibilitychange',()=>{if(document.hidden)cancelWorkstations();else if(!el('workstations').hidden)void loadWorkstations()});
+</script></body></html>`;
+}

package/dist/src/self-relay/admin-server.mjs

@@ -0,0 +1,105 @@
+import http from 'node:http';
+import fs from 'node:fs';
+import { adminPage } from './admin-page.mjs';
+import { startAdminCloud } from './admin-cloud.mjs';
+import { MAX_ADMIN_REQUEST_BYTES } from './admin-state.mjs';
+import { createAdminAuth } from './admin-auth.mjs';
+import { adminLoginPage } from './admin-login-page.mjs';
+import endpoints from '../../shared/service-endpoints.cjs';
+
+function reply(response, status, body, type = 'application/json; charset=utf-8') {
+  const bytes = typeof body === 'string' ? body : JSON.stringify(body);
+  response.writeHead(status, { 'Content-Type': type, 'Content-Length': Buffer.byteLength(bytes),
+    'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff',
+    'Referrer-Policy': 'no-referrer', 'X-Robots-Tag': 'noindex, nofollow', 'X-Frame-Options': 'DENY' });
+  response.end(bytes);
+}
+
+async function readBody(request) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of request) {
+    size += chunk.length;
+    if (size > MAX_ADMIN_REQUEST_BYTES) throw Object.assign(new Error('Admin request too large'), { status: 413 });
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks);
+}
+
+export async function startAdminServer({ port = 45851, relayUrl = 'http://127.0.0.1:45850', accessFile = '/etc/codex-relay/admin-access.json',
+  passwordFile = '/etc/codex-relay/admin-password.json', publicOrigin = endpoints.adminOrigin } = {}) {
+  const { key } = JSON.parse(fs.readFileSync(accessFile, 'utf8'));
+  if (!/^[A-Za-z0-9_-]{43}$/.test(key)) throw new Error('Invalid admin access key');
+  const auth = createAdminAuth(passwordFile);
+  const cloud = startAdminCloud();
+  const relayOrigin = new URL(relayUrl);
+  if (relayOrigin.hostname !== '127.0.0.1' || relayOrigin.protocol !== 'http:' || relayOrigin.pathname !== '/') {
+    cloud.close(); throw new Error('Admin relay endpoint must be loopback HTTP');
+  }
+  const server = http.createServer(async (request, response) => {
+    const target = new URL(request.url || '/', 'http://localhost');
+    if (request.method === 'GET' && target.pathname === '/admin/health') { reply(response, 200, { ok: true }); return; }
+    if (!['GET', 'HEAD'].includes(request.method) && (request.headers.origin !== publicOrigin
+      || request.headers['sec-fetch-site'] === 'cross-site' || request.headers['x-code-relax-admin'] !== '1')) {
+      reply(response, 403, { error: 'Cross-site request rejected' }); return;
+    }
+    if (request.method === 'GET' && target.pathname === '/') {
+      reply(response, 200, auth.authenticated(request) ? adminPage() : adminLoginPage(), 'text/html; charset=utf-8'); return;
+    }
+    if (request.method === 'GET' && ['/admin', '/admin/'].includes(target.pathname)) {
+      response.writeHead(303, { Location: '/', 'Cache-Control': 'no-store' }); response.end(); return;
+    }
+    if (request.method === 'POST' && target.pathname === '/admin/login') {
+      try {
+        if (request.headers['content-type']?.split(';')[0] !== 'application/json') {
+          reply(response, 415, { error: 'Expected application/json' }); return;
+        }
+        const { password } = JSON.parse((await readBody(request)).toString('utf8'));
+        const result = await auth.login(password, request, response);
+        reply(response, result.status, result.error ? { error: result.error } : { ok: true });
+      } catch (error) {
+        const status = error.status || (error instanceof SyntaxError || error instanceof TypeError ? 400 : 500);
+        if (status === 500) console.error('Admin login failed:', error.message);
+        reply(response, status, { error: status === 500 ? '登录服务暂不可用' : '登录请求无效' });
+      }
+      return;
+    }
+    if (request.method === 'POST' && target.pathname === '/admin/logout') {
+      auth.logout(request, response); reply(response, 200, { ok: true }); return;
+    }
+    if (!target.pathname.startsWith('/admin/api/')) { reply(response, 404, { error: 'Not found' }); return; }
+    if (!auth.authenticated(request)) { reply(response, 401, { error: '登录已过期，请重新登录' }); return; }
+    if (request.method === 'GET' && (['/admin/api/status', '/admin/api/usage', '/admin/api/usage-diagnostics',
+      '/admin/api/workstations'].includes(target.pathname) || /^\/admin\/api\/workstations\/[\w-]{16,128}$/.test(target.pathname))) {
+      try {
+        const upstream = await fetch(new URL(target.pathname + target.search, relayOrigin), {
+          signal: AbortSignal.timeout(3000), headers: { 'X-Code-Relax-Admin-Key': key } });
+        const state = await upstream.json();
+        if (!upstream.ok) { reply(response, upstream.status, state); return; }
+        reply(response, 200, target.pathname === '/admin/api/status'
+          ? { ...state, relayAvailable: true, cloud: cloud.read() } : state);
+      } catch {
+        reply(response, 503, { error: '中继服务暂不可用' });
+      }
+      return;
+    }
+    if (!target.pathname.startsWith('/admin/api/') || !['PUT', 'DELETE', 'POST'].includes(request.method || '')) {
+      reply(response, 404, { error: 'Not found' }); return;
+    }
+    try {
+      const body = await readBody(request);
+      const upstream = await fetch(new URL(target.pathname + target.search, relayOrigin), {
+        method: request.method, signal: AbortSignal.timeout(3000),
+        headers: { 'Content-Type': request.headers['content-type'] || '',
+          'X-Code-Relax-Admin': request.headers['x-code-relax-admin'] || '',
+          'X-Code-Relax-Admin-Key': key },
+        body,
+      });
+      reply(response, upstream.status, await upstream.text());
+    } catch (error) { reply(response, error.status || 503, { error: error.status === 413 ? error.message : '中继服务暂不可用' }); }
+  });
+  try {
+    await new Promise((resolve, reject) => { server.once('error', reject); server.listen(port, '127.0.0.1', resolve); });
+  } catch (error) { cloud.close(); throw error; }
+  return { port: server.address().port, async close() { cloud.close(); await new Promise(resolve => server.close(resolve)); } };
+}

package/dist/src/self-relay/admin-state.mjs

@@ -2,19 +2,23 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 
-export function relayAdminState(file, initialMaxRelaySessions) {
-  let value = { version: 1, maxRelaySessions: initialMaxRelaySessions, announcement: null };
+// 80 title + 2000 body UTF-16 units fit even when every unit uses a six-byte JSON escape.
+export const MAX_ADMIN_REQUEST_BYTES = 16 * 1024;
+
+export function relayAdminState(file, initialMaxRelaySessions, { initial, persist } = {}) {
+  let value = initial ? validate(initial) : { version: 3, maxRelaySessions: initialMaxRelaySessions, announcement: null, announcements: [] };
   if (file && fs.existsSync(file)) value = validate(JSON.parse(fs.readFileSync(file, 'utf8')));
 
-  function save(next) {
-    value = validate(next);
-    if (!file) return value;
+  async function save(next) {
+    const validated = validate(next);
+    if (persist) await persist(validated);
+    if (!file) { value = validated; return value; }
     fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
     const temporary = `${file}.${randomUUID()}.tmp`;
     let descriptor;
     try {
       descriptor = fs.openSync(temporary, 'wx', 0o600);
-      fs.writeFileSync(descriptor, JSON.stringify(value));
+      fs.writeFileSync(descriptor, JSON.stringify(validated));
       fs.fsyncSync(descriptor); fs.closeSync(descriptor); descriptor = undefined;
       fs.renameSync(temporary, file);
       if (process.platform !== 'win32') {
@@ -25,32 +29,94 @@ export function relayAdminState(file, initialMaxRelaySessions) {
       if (descriptor !== undefined) fs.closeSync(descriptor);
       fs.rmSync(temporary, { force: true });
     }
+    value = validated;
     return value;
   }
 
   return {
     read: () => structuredClone(value),
     setMaxRelaySessions(maxRelaySessions) { return save({ ...value, maxRelaySessions }); },
-    publish(title, message) {
-      return save({ ...value, announcement: { id: randomUUID(), title: clean(title, 80), message: clean(message, 2000),
-        publishedAt: new Date().toISOString() } });
+    createAnnouncement(title, message, publish = false) {
+      const now = new Date().toISOString();
+      const record = { id: randomUUID(), title: clean(title, 80), message: clean(message, 2000),
+        createdAt: now, updatedAt: now, publishedAt: publish ? now : null, status: publish ? 'active' : 'draft' };
+      const announcements = value.announcements.map(item => publish && item.status === 'active'
+        ? { ...item, status: 'withdrawn', updatedAt: now } : item);
+      return save({ ...value, announcement: publish ? publicAnnouncement(record) : value.announcement,
+        announcements: [record, ...announcements] });
+    },
+    updateDraft(id, title, message) {
+      const existing = value.announcements.find(item => item.id === id);
+      if (!existing || existing.status !== 'draft') throw new Error('Only drafts can be edited');
+      return save({ ...value, announcements: value.announcements.map(item => item.id === id
+        ? { ...item, title: clean(title, 80), message: clean(message, 2000), updatedAt: new Date().toISOString() } : item) });
+    },
+    publishDraft(id, title, message) {
+      const existing = value.announcements.find(item => item.id === id);
+      if (!existing || existing.status !== 'draft') throw new Error('Only drafts can be published');
+      const now = new Date().toISOString();
+      const published = { ...existing, title: title === undefined ? existing.title : clean(title, 80),
+        message: message === undefined ? existing.message : clean(message, 2000),
+        publishedAt: now, updatedAt: now, status: 'active' };
+      return save({ ...value, announcement: publicAnnouncement(published),
+        announcements: value.announcements.map(item => item.id === id ? published : item.status === 'active'
+          ? { ...item, status: 'withdrawn', updatedAt: now } : item) });
+    },
+    withdraw(id) {
+      if (!value.announcement || value.announcement.id !== id) throw new Error('Announcement is no longer active');
+      const now = new Date().toISOString();
+      return save({ ...value, announcement: null, announcements: value.announcements.map(item => item.status === 'active'
+        ? { ...item, status: 'withdrawn', updatedAt: now } : item) });
+    },
+    deleteAnnouncement(id) {
+      if (typeof id !== 'string' || !value.announcements.some(item => item.id === id)) throw new Error('Announcement not found');
+      if (value.announcement?.id === id) throw new Error('Withdraw the current announcement before deleting it');
+      return save({ ...value, announcements: value.announcements.filter(item => item.id !== id) });
     },
-    withdraw() { return save({ ...value, announcement: null }); },
   };
 }
 
 function validate(source) {
-  if (!source || source.version !== 1 || !Number.isSafeInteger(source.maxRelaySessions) ||
+  if (!source || ![1, 2, 3].includes(source.version) || !Number.isSafeInteger(source.maxRelaySessions) ||
       source.maxRelaySessions < 1 || source.maxRelaySessions > 256) throw new Error('Invalid relay admin state');
-  let announcement = null;
-  if (source.announcement !== null && source.announcement !== undefined) {
-    const item = source.announcement;
-    if (!item || !/^[\w-]{16,128}$/.test(item.id) || !Number.isFinite(Date.parse(item.publishedAt))) {
-      throw new Error('Invalid relay announcement');
-    }
-    announcement = { id: item.id, title: clean(item.title, 80), message: clean(item.message, 2000), publishedAt: item.publishedAt };
+  const announcement = source.announcement == null ? null : validateAnnouncement(source.announcement);
+  const announcements = source.version === 1 ? (announcement ? [announcement] : []) : source.announcements;
+  if (!Array.isArray(announcements)) throw new Error('Invalid relay announcement history');
+  const validated = source.version === 3 ? announcements.map(validateRecord) : announcements.map(item => {
+    const old = validateAnnouncement(item);
+    return { ...old, createdAt: old.publishedAt, updatedAt: old.publishedAt,
+      status: old.id === announcement?.id ? 'active' : 'withdrawn' };
+  });
+  const active = validated.filter(item => item.status === 'active');
+  if (new Set(validated.map(item => item.id)).size !== validated.length || active.length > 1 ||
+      (active.length === 0) !== (announcement === null) ||
+      (announcement && !active.some(item => item.id === announcement.id &&
+        item.title === announcement.title && item.message === announcement.message && item.publishedAt === announcement.publishedAt))) {
+    throw new Error('Invalid relay announcement history');
   }
-  return { version: 1, maxRelaySessions: source.maxRelaySessions, announcement };
+  return { version: 3, maxRelaySessions: source.maxRelaySessions, announcement, announcements: validated };
+}
+
+function validateAnnouncement(item) {
+  if (!item || !/^[\w-]{16,128}$/.test(item.id) || typeof item.publishedAt !== 'string' ||
+      !Number.isFinite(Date.parse(item.publishedAt))) throw new Error('Invalid relay announcement');
+  return { id: item.id, title: clean(item.title, 80), message: clean(item.message, 2000), publishedAt: item.publishedAt };
+}
+
+function validateRecord(item) {
+  if (!item || !/^[\w-]{16,128}$/.test(item.id) || !['draft', 'active', 'withdrawn'].includes(item.status) ||
+      typeof item.createdAt !== 'string' || !Number.isFinite(Date.parse(item.createdAt)) ||
+      typeof item.updatedAt !== 'string' || !Number.isFinite(Date.parse(item.updatedAt)) ||
+      (item.status === 'draft' ? item.publishedAt !== null :
+        typeof item.publishedAt !== 'string' || !Number.isFinite(Date.parse(item.publishedAt)))) {
+    throw new Error('Invalid relay announcement record');
+  }
+  return { id: item.id, title: clean(item.title, 80), message: clean(item.message, 2000),
+    createdAt: item.createdAt, updatedAt: item.updatedAt, publishedAt: item.publishedAt, status: item.status };
+}
+
+function publicAnnouncement(record) {
+  return { id: record.id, title: record.title, message: record.message, publishedAt: record.publishedAt };
 }
 
 function clean(value, limit) {