agent-loft 0.2.33 → 0.2.35

package/src/core/pricing.ts

@@ -0,0 +1,93 @@
+// 按单价估算没报费用的 agent（Codex）的金额：Token × 单价。
+//
+// 单价来自 LiteLLM 公开维护的价格表（model_prices_and_context_window.json），只取 OpenAI 的对话模型。
+// 内置一份快照（model-prices.json，[输入, 缓存读取, 输出]，美元 / 百万 token），连得上 GitHub 时
+// 每天更新一次存到 data/model-prices.json，连不上就一直用快照。
+// 只按基础单价算：长上下文加价、priority / flex 档位都不管，所以是估算。
+import fs from "node:fs";
+import path from "node:path";
+import { dataDir, readJson, writeJsonAtomic } from "../home.js";
+import type { TokenUsage } from "./types.js";
+
+/** [输入, 缓存读取（null 表示按输入算）, 输出]，美元 / 百万 token */
+type Price = [number, number | null, number];
+type Table = Record<string, Price>;
+type Cache = { at: number; prices: Table };
+
+const SOURCE = "https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json";
+const CACHE_FILE = () => path.join(dataDir, "model-prices.json");
+const MAX_AGE = 24 * 3600_000;
+/** 拉失败了隔多久再试 */
+const RETRY = 3600_000;
+
+const snapshot: Table = JSON.parse(fs.readFileSync(new URL("./model-prices.json", import.meta.url), "utf8"));
+let cache: Cache | null = null;
+let fetching = false;
+let lastTry = 0;
+
+function loadCache(): Cache {
+  return (cache ??= readJson<Cache>(CACHE_FILE(), { at: 0, prices: {} }));
+}
+
+/** 从 LiteLLM 的整张表里挑出 OpenAI 对话模型，换成每百万 token 的价格 */
+export function pickOpenAiPrices(raw: Record<string, unknown>): Table {
+  const perM = (v: unknown): number | null =>
+    typeof v === "number" && Number.isFinite(v) && v >= 0 ? Math.round(v * 1e12) / 1e6 : null;
+  const out: Table = {};
+  for (const [name, entry] of Object.entries(raw)) {
+    if (!entry || typeof entry !== "object") continue;
+    const e = entry as Record<string, unknown>;
+    if (e.litellm_provider !== "openai" || (e.mode !== "chat" && e.mode !== "responses")) continue;
+    const input = perM(e.input_cost_per_token);
+    const output = perM(e.output_cost_per_token);
+    if (input === null || output === null) continue;
+    out[name] = [input, perM(e.cache_read_input_token_cost), output];
+  }
+  return out;
+}
+
+async function refresh(): Promise<void> {
+  fetching = true;
+  lastTry = Date.now();
+  try {
+    const res = await fetch(SOURCE, { signal: AbortSignal.timeout(30_000) });
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    const prices = pickOpenAiPrices((await res.json()) as Record<string, unknown>);
+    if (Object.keys(prices).length === 0) throw new Error("价格表里没有 OpenAI 模型");
+    cache = { at: Date.now(), prices };
+    writeJsonAtomic(CACHE_FILE(), cache);
+  } catch (err) {
+    console.warn("[pricing] 更新模型单价失败，先用内置的:", err instanceof Error ? err.message : err);
+  } finally {
+    fetching = false;
+  }
+}
+
+/** 过期了就在后台更新一次（不等它，这次先用手上的） */
+function refreshIfStale(): void {
+  // 跑测试时不联网
+  if (process.env.NODE_TEST_CONTEXT) return;
+  if (fetching || Date.now() - loadCache().at < MAX_AGE || Date.now() - lastTry < RETRY) return;
+  void refresh();
+}
+
+/** 模型的单价。认不出来返回 undefined。名字带 openai/ 前缀、日期后缀（-2026-03-05）的也认 */
+export function priceOf(model: string | undefined): Price | undefined {
+  if (!model) return undefined;
+  refreshIfStale();
+  const table = loadCache().prices;
+  const base = model.replace(/^openai\//, "");
+  for (const name of [base, base.replace(/-\d{4}-\d{2}-\d{2}$/, "")]) {
+    const p = table[name] ?? snapshot[name];
+    if (p) return p;
+  }
+  return undefined;
+}
+
+/** 按单价估算的金额（美元）。output 已经含推理，不再单算 reasoning；认不出模型返回 undefined */
+export function estimateCost(model: string | undefined, usage: TokenUsage): number | undefined {
+  const p = priceOf(model);
+  if (!p) return undefined;
+  const [input, cacheRead, output] = p;
+  return (usage.input * input + usage.cacheRead * (cacheRead ?? input) + usage.cacheWrite * input + usage.output * output) / 1e6;
+}

package/src/core/terminals.ts

@@ -0,0 +1,308 @@
+// 网页终端：服务端起 shell（node-pty），页面用 WebSocket 连上来收发。
+//
+// shell 属于人，不属于页面：关掉页面、手机切到后台、断线都不结束它，重连后按 since 补上错过的输出；
+// 没有页面连着超过 terminal.keepAliveMin 分钟才结束。同一个终端可以同时开在几个页面上。
+//
+// 谁能用：管理员；成员要管理员在 设置 → 用户 里单独开「远程控制」（users.json 的 remote）。
+// 和 agent 不同，这里没有授权卡 —— 拿到终端就是拿到这台机器上 agent-loft 这个系统用户的 shell。
+// 权限收回、用户被停用或删除、设置里关掉终端时，他开着的 shell 立刻结束。
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { createRequire } from "node:module";
+import { EventEmitter } from "node:events";
+import type { IPty } from "node-pty";
+import { agentEnvironment } from "./agent-env.js";
+import { config, onConfigChange } from "./config.js";
+import { canUseRemote, getUser, userEvents, type User } from "./users.js";
+
+// ---------- node-pty ----------
+
+type PtyModule = typeof import("node-pty");
+
+/** node-pty 是原生模块、可选依赖：装不上（没有编译工具）时终端整个不可用，其他功能照常 */
+let ptyModule: PtyModule | null | undefined;
+let ptyError = "";
+
+function loadPty(): PtyModule | null {
+  if (ptyModule !== undefined) return ptyModule;
+  try {
+    ptyModule = createRequire(import.meta.url)("node-pty") as PtyModule;
+  } catch (err) {
+    ptyModule = null;
+    ptyError = err instanceof Error ? err.message.split("\n")[0]! : String(err);
+  }
+  return ptyModule;
+}
+
+/** 终端能不能用；不能用时 reason 写给管理员看 */
+export function terminalAvailability(): { available: boolean; reason?: string } {
+  if (loadPty()) return { available: true };
+  return { available: false, reason: `没装好 node-pty（${ptyError}）。在 agent-loft 的安装目录里运行 npm install node-pty 后重启` };
+}
+
+/** 这个人现在能不能用终端 */
+export function canUseTerminal(user: Pick<User, "role" | "disabled" | "remote"> | undefined): boolean {
+  return config().remote.terminal && canUseRemote(user);
+}
+
+// ---------- 输出记录 ----------
+
+/** 每个终端留多少输出（字符），断线重连、换个页面打开时补发 */
+const LOG_LIMIT = 512 * 1024;
+
+/**
+ * 最近的输出，加上从开始到现在一共输出了多少（total）。
+ * 页面记着自己收到第几个字符了（since），重连时只补后面的；早于记录开头的补不了，整屏重画。
+ */
+export class OutputLog {
+  private buf = "";
+  total = 0;
+
+  constructor(private readonly limit = LOG_LIMIT) {}
+
+  append(data: string): void {
+    this.buf += data;
+    this.total += data.length;
+    if (this.buf.length > this.limit * 1.25) {
+      // 从换行处截：别从一个转义序列中间开始重放
+      const cut = this.buf.length - this.limit;
+      const nl = this.buf.indexOf("\n", cut);
+      this.buf = this.buf.slice(nl >= 0 && nl - cut < 4096 ? nl + 1 : cut);
+    }
+  }
+
+  /** since 之后的输出；reset：页面得先清屏，data 是能补的全部 */
+  since(since: number): { reset: boolean; data: string } {
+    const start = this.total - this.buf.length;
+    if (Number.isInteger(since) && since >= start && since <= this.total) return { reset: false, data: this.buf.slice(since - start) };
+    return { reset: true, data: this.buf };
+  }
+}
+
+// ---------- 终端 ----------
+
+/** 连着这个终端的一个页面。由 Web 渠道实现（见 channels/web/terminal.ts） */
+export type TermPeer = {
+  send(msg: unknown): void;
+  close(code: number, reason: string): void;
+};
+
+type Term = {
+  id: string;
+  owner: string;
+  cwd: string;
+  shell: string;
+  createdAt: number;
+  pty: IPty;
+  log: OutputLog;
+  peers: Set<TermPeer>;
+  cols: number;
+  rows: number;
+  /** 没有页面连着时开始计时，到点结束 shell */
+  idleTimer: NodeJS.Timeout | null;
+  /** 还没发出去的输出：pty 一次只吐几十个字节，攒一下再发 */
+  pending: string;
+  flushTimer: NodeJS.Timeout | null;
+};
+
+export type TermInfo = { id: string; cwd: string; shell: string; createdAt: number; attached: number };
+
+const PER_USER = 10;
+const TOTAL = 50;
+
+const terms = new Map<string, Term>();
+/** 某人的终端开了 / 结束了：他开着的页面重新拉列表 */
+export const terminalEvents = new EventEmitter<{ changed: [owner: string] }>();
+
+function info(t: Term): TermInfo {
+  return { id: t.id, cwd: t.cwd, shell: path.basename(t.shell), createdAt: t.createdAt, attached: t.peers.size };
+}
+
+export function listTerminals(owner: string): TermInfo[] {
+  return [...terms.values()].filter((t) => t.owner === owner).sort((a, b) => a.createdAt - b.createdAt).map(info);
+}
+
+/** 只给主人：别人的终端 id 拿到了也当不存在 */
+export function getTerminal(id: string, owner: string): TermInfo | undefined {
+  const t = terms.get(id);
+  return t && t.owner === owner ? info(t) : undefined;
+}
+
+function defaultShell(): { file: string; args: string[] } {
+  if (process.platform === "win32") return { file: process.env.COMSPEC || "powershell.exe", args: [] };
+  const candidates = [process.env.SHELL, "/bin/bash", "/bin/zsh", "/bin/sh"].filter((s): s is string => !!s);
+  const file = candidates.find((s) => path.isAbsolute(s) && fs.existsSync(s)) ?? "/bin/sh";
+  // 登录 shell：systemd / launchd 下 PATH 很短，读一遍 profile 才像平时开的终端
+  return { file, args: ["-l"] };
+}
+
+function usableDir(dir: unknown): string | undefined {
+  if (typeof dir !== "string" || !path.isAbsolute(dir)) return undefined;
+  try {
+    return fs.statSync(dir).isDirectory() ? path.resolve(dir) : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function clampSize(n: unknown, fallback: number, max: number): number {
+  const v = Math.round(Number(n));
+  return Number.isFinite(v) && v >= 2 ? Math.min(v, max) : fallback;
+}
+
+export function createTerminal(user: User, opts: { cwd?: unknown; cols?: unknown; rows?: unknown }): TermInfo {
+  if (!canUseTerminal(user)) throw new Error("你没有使用终端的权限");
+  const pty = loadPty();
+  if (!pty) throw new Error(terminalAvailability().reason);
+  if (listTerminals(user.id).length >= PER_USER) throw new Error(`最多同时开 ${PER_USER} 个终端，先关掉几个`);
+  if (terms.size >= TOTAL) throw new Error("服务器上开着的终端太多了");
+  const cwd = usableDir(opts.cwd) ?? usableDir(config().workspaceRoot) ?? os.homedir();
+  const cols = clampSize(opts.cols, 80, 500);
+  const rows = clampSize(opts.rows, 24, 200);
+  const shell = defaultShell();
+  const env: Record<string, string> = {};
+  for (const [k, v] of Object.entries(agentEnvironment())) if (typeof v === "string") env[k] = v;
+  env.TERM = "xterm-256color";
+  env.COLORTERM = "truecolor";
+  if (!env.LANG && !env.LC_ALL) env.LANG = "C.UTF-8";
+  const proc = pty.spawn(shell.file, shell.args, { name: "xterm-256color", cols, rows, cwd, env });
+  const t: Term = {
+    id: `t_${crypto.randomBytes(6).toString("hex")}`,
+    owner: user.id,
+    cwd,
+    shell: shell.file,
+    createdAt: Date.now(),
+    pty: proc,
+    log: new OutputLog(),
+    peers: new Set(),
+    cols,
+    rows,
+    idleTimer: null,
+    pending: "",
+    flushTimer: null,
+  };
+  terms.set(t.id, t);
+  proc.onData((data) => {
+    t.log.append(data);
+    t.pending += data;
+    t.flushTimer ??= setTimeout(() => flush(t), 8);
+  });
+  proc.onExit(({ exitCode }) => {
+    flush(t);
+    finish(t, `shell 已退出（${exitCode}）`, exitCode);
+  });
+  armIdle(t);
+  console.log(`[终端] ${user.name} 开了终端 ${t.id}（${cwd}）`);
+  terminalEvents.emit("changed", t.owner);
+  return info(t);
+}
+
+function flush(t: Term): void {
+  if (t.flushTimer) clearTimeout(t.flushTimer);
+  t.flushTimer = null;
+  if (!t.pending) return;
+  const msg = { t: "o", d: t.pending };
+  t.pending = "";
+  for (const peer of t.peers) peer.send(msg);
+}
+
+/** 没有页面连着了：keepAliveMin 分钟后结束 */
+function armIdle(t: Term): void {
+  if (t.idleTimer) clearTimeout(t.idleTimer);
+  t.idleTimer = null;
+  if (t.peers.size > 0) return;
+  const ms = Math.max(1, config().remote.keepAliveMin) * 60_000;
+  t.idleTimer = setTimeout(() => killTerminal(t.id, "没有页面连着，已超时结束"), ms);
+  t.idleTimer.unref();
+}
+
+/** 从表里拿掉、告诉连着的页面。shell 自己退出和被结束都走这里 */
+function finish(t: Term, reason: string, code: number | null): void {
+  if (terms.get(t.id) !== t) return;
+  terms.delete(t.id);
+  if (t.idleTimer) clearTimeout(t.idleTimer);
+  if (t.flushTimer) clearTimeout(t.flushTimer);
+  for (const peer of t.peers) {
+    peer.send({ t: "x", code, reason });
+    peer.close(4000, "终端已结束");
+  }
+  t.peers.clear();
+  terminalEvents.emit("changed", t.owner);
+}
+
+export function killTerminal(id: string, reason = "已关闭"): boolean {
+  const t = terms.get(id);
+  if (!t) return false;
+  finish(t, reason, null);
+  try {
+    t.pty.kill();
+  } catch {
+    // 已经退出了
+  }
+  return true;
+}
+
+/** 页面连上来：先补上 since 之后的输出 */
+export function attachTerminal(id: string, owner: string, peer: TermPeer, since: number): boolean {
+  const t = terms.get(id);
+  if (!t || t.owner !== owner) return false;
+  flush(t);
+  const { reset, data } = t.log.since(since);
+  peer.send({ t: "a", reset, d: data, total: t.log.total, cwd: t.cwd });
+  t.peers.add(peer);
+  armIdle(t);
+  return true;
+}
+
+export function detachTerminal(id: string, peer: TermPeer): void {
+  const t = terms.get(id);
+  if (!t || !t.peers.delete(peer)) return;
+  armIdle(t);
+}
+
+export function writeTerminal(id: string, data: string): void {
+  const t = terms.get(id);
+  if (t && data) t.pty.write(data);
+}
+
+/** 几个页面开着同一个终端、窗口大小不一样：以最后调整的那个为准 */
+export function resizeTerminal(id: string, cols: unknown, rows: unknown): void {
+  const t = terms.get(id);
+  if (!t) return;
+  const c = clampSize(cols, t.cols, 500);
+  const r = clampSize(rows, t.rows, 200);
+  if (c === t.cols && r === t.rows) return;
+  t.cols = c;
+  t.rows = r;
+  try {
+    t.pty.resize(c, r);
+  } catch {
+    // 正在退出
+  }
+}
+
+/**
+ * 权限变了（用户改了、设置里关了）：现在不能用终端的人，shell 立刻结束。
+ * 用户改动由 userEvents 通知；终端里 agent-loft user … 直接改文件的没有事件，Web 的心跳会再调一次
+ */
+export function enforceTerminalAccess(): void {
+  for (const t of [...terms.values()]) {
+    if (!canUseTerminal(getUser(t.owner))) killTerminal(t.id, "终端权限已被收回");
+  }
+}
+
+let watching = false;
+/** 启动 Web 渠道时调用一次 */
+export function watchTerminalAccess(): void {
+  if (watching) return;
+  watching = true;
+  userEvents.on("changed", enforceTerminalAccess);
+  onConfigChange(() => enforceTerminalAccess());
+}
+
+/** 服务停止：结束所有 shell */
+export function killAllTerminals(): void {
+  for (const id of [...terms.keys()]) killTerminal(id, "服务已停止");
+}

package/src/core/usage.ts

@@ -4,29 +4,59 @@
 // 都按会话 id 记在这里：页面重新加载、服务重启后还在。
 // 按 agent 会话算，不按对话：/new、恢复旧会话、切 agent 之后显示的都是现在这个会话的。
 // Codex 升级前跑过的轮次没有记录，从升级后开始算。
+//
+// 另外按天记一本账（usage-daily.json，设置 →「用量」按日 / 月 / 年统计）：每次报上来的增量记到当天、
+// 按「谁的对话 + 哪个 agent + 什么模型」分开。只从有这本账开始算，之前的用量没有日期，不补。
+// 没报费用的（Codex）查的时候按模型单价估一个（见 pricing.ts）。
 import path from "node:path";
 import { dataDir, readJson, writeJsonAtomic } from "../home.js";
+import { estimateCost } from "./pricing.js";
 import type { TokenUsage } from "./types.js";
 
 export type UsageTotals = Required<Omit<TokenUsage, "costUsd">> & { costUsd?: number; at: number };
 type Store = Record<string, UsageTotals>;
 
+/** 一天里某个人用某个 agent 的合计 */
+export type DailyTotals = Required<Omit<TokenUsage, "costUsd">> & { costUsd?: number };
+/** 按天的账：日期（服务器本地时间 YYYY-MM-DD）→「owner\tagent\tmodel」→ 合计。没有主人、不知道模型的是空串 */
+type Ledger = Record<string, Record<string, DailyTotals>>;
+/** 查询结果的一行。estimated：costUsd 是按单价估的，不是 agent 报的 */
+export type DailyRow = DailyTotals & { day: string; owner?: string; agent: string; model?: string; estimated?: true };
+
 const FILE = () => path.join(dataDir, "usage.json");
+const DAILY_FILE = () => path.join(dataDir, "usage-daily.json");
 const MAX_SESSIONS = 1000;
+/** 按天的账留多久（天） */
+const MAX_DAYS = 3 * 366;
 
 let store: Store | null = null;
+let ledger: Ledger | null = null;
 let timer: NodeJS.Timeout | null = null;
 
 function load(): Store {
   return (store ??= readJson<Store>(FILE(), {}));
 }
 
+function loadLedger(): Ledger {
+  return (ledger ??= readJson<Ledger>(DAILY_FILE(), {}));
+}
+
 function write(): void {
   const s = load();
   // 只留最近用过的会话
   const keys = Object.keys(s).sort((a, b) => s[b]!.at - s[a]!.at);
   for (const k of keys.slice(MAX_SESSIONS)) delete s[k];
   writeJsonAtomic(FILE(), s);
+  const l = loadLedger();
+  const days = Object.keys(l).sort();
+  for (const d of days.slice(0, Math.max(0, days.length - MAX_DAYS))) delete l[d];
+  writeJsonAtomic(DAILY_FILE(), l);
+}
+
+/** 本地时间的 YYYY-MM-DD */
+export function dayOf(ms: number): string {
+  const d = new Date(ms);
+  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}-${String(d.getDate()).padStart(2, "0")}`;
 }
 
 function persistSoon(): void {
@@ -52,19 +82,63 @@ const FIELDS = ["input", "cacheRead", "cacheWrite", "output", "reasoning"] as co
 
 /**
  * cumulative：报的是累计值，每项取较大的（累计值只增不减；恢复的会话万一没从原来的总数接着算，
- * 宁可先少算，也不把之前的再加一遍）。否则是增量，加上去
+ * 宁可先少算，也不把之前的再加一遍）。否则是增量，加上去。
+ * by：这次用量算谁的、哪个 agent 的（记进按天的账；不给就只记会话的）
  */
-export function recordUsage(sessionId: string | undefined, usage: TokenUsage, cumulative = false): void {
+export function recordUsage(
+  sessionId: string | undefined,
+  usage: TokenUsage,
+  cumulative = false,
+  by?: { owner?: string; agent: string; model?: string },
+): void {
   if (!sessionId) return;
   const s = load();
   const t = (s[sessionId] ??= { input: 0, cacheRead: 0, cacheWrite: 0, output: 0, reasoning: 0, at: 0 });
-  for (const f of FIELDS) t[f] = cumulative ? Math.max(t[f], num(usage[f])) : t[f] + num(usage[f]);
+  const delta: DailyTotals = { input: 0, cacheRead: 0, cacheWrite: 0, output: 0, reasoning: 0 };
+  for (const f of FIELDS) {
+    const next = cumulative ? Math.max(t[f], num(usage[f])) : t[f] + num(usage[f]);
+    delta[f] = next - t[f];
+    t[f] = next;
+  }
   const cost = num(usage.costUsd);
-  if (cost) t.costUsd = cumulative ? Math.max(t.costUsd ?? 0, cost) : (t.costUsd ?? 0) + cost;
+  if (cost) {
+    const next = cumulative ? Math.max(t.costUsd ?? 0, cost) : (t.costUsd ?? 0) + cost;
+    if (next > (t.costUsd ?? 0)) delta.costUsd = next - (t.costUsd ?? 0);
+    t.costUsd = next;
+  }
   t.at = Date.now();
+  if (by) addDaily(t.at, by, delta);
   persistSoon();
 }
 
+function addDaily(at: number, by: { owner?: string; agent: string; model?: string }, delta: DailyTotals): void {
+  if (!FIELDS.some((f) => delta[f] > 0) && !delta.costUsd) return;
+  const day = (loadLedger()[dayOf(at)] ??= {});
+  const d = (day[`${by.owner ?? ""}\t${by.agent}\t${by.model ?? ""}`] ??= { input: 0, cacheRead: 0, cacheWrite: 0, output: 0, reasoning: 0 });
+  for (const f of FIELDS) d[f] += delta[f];
+  if (delta.costUsd) d.costUsd = (d.costUsd ?? 0) + delta.costUsd;
+}
+
+/** 按天的账里 from ~ to（含两头，YYYY-MM-DD）的行；visible 按主人过滤 */
+export function dailyUsage(from: string, to: string, visible?: (owner: string | undefined) => boolean): DailyRow[] {
+  const rows: DailyRow[] = [];
+  for (const [day, buckets] of Object.entries(loadLedger())) {
+    if (day < from || day > to) continue;
+    for (const [k, v] of Object.entries(buckets)) {
+      const [o = "", agent = "", model = ""] = k.split("\t");
+      const owner = o || undefined;
+      if (visible && !visible(owner)) continue;
+      const row: DailyRow = { day, ...(owner ? { owner } : {}), agent, ...(model ? { model } : {}), ...v };
+      if (!row.costUsd) {
+        const est = estimateCost(model, row);
+        if (est) Object.assign(row, { costUsd: est, estimated: true });
+      }
+      rows.push(row);
+    }
+  }
+  return rows.sort((a, b) => a.day.localeCompare(b.day));
+}
+
 export function usageOf(sessionId: string | undefined): UsageTotals | undefined {
   return sessionId ? load()[sessionId] : undefined;
 }

package/src/core/users.ts

@@ -25,6 +25,8 @@ export type User = {
   passwordHash: string;
   createdAt: number;
   disabled?: boolean;
+  /** 成员能不能用远程控制（终端、桌面）。管理员一直能用，不看这个 */
+  remote?: boolean;
 };
 
 export type PublicUser = Omit<User, "passwordHash">;
@@ -165,6 +167,12 @@ export function isAdmin(user: Pick<User, "role"> | undefined): boolean {
   return user?.role === "admin";
 }
 
+/** 能不能用远程控制（终端、桌面）：管理员能用，成员要单独开。设置里各自还有总开关 */
+export function canUseRemote(user: Pick<User, "role" | "disabled" | "remote"> | undefined): boolean {
+  if (!user || user.disabled) return false;
+  return user.role === "admin" || user.remote === true;
+}
+
 /**
  * 升级前的登录态、推送订阅没有记是谁的：都算最早的那个管理员的（就是迁移出来的 admin）。
  */
@@ -220,7 +228,10 @@ export function createUser(params: { name: string; password: string; role?: Role
   return publicUser(user);
 }
 
-export function updateUser(id: string, patch: { name?: string; role?: Role; disabled?: boolean; password?: string }): PublicUser {
+export function updateUser(
+  id: string,
+  patch: { name?: string; role?: Role; disabled?: boolean; password?: string; remote?: boolean },
+): PublicUser {
   const list = load().map((u) => ({ ...u }));
   const user = list.find((u) => u.id === id);
   if (!user) throw new Error("用户不存在");
@@ -234,6 +245,10 @@ export function updateUser(id: string, patch: { name?: string; role?: Role; disa
     if (patch.disabled) user.disabled = true;
     else delete user.disabled;
   }
+  if (patch.remote !== undefined) {
+    if (patch.remote) user.remote = true;
+    else delete user.remote;
+  }
   if (patch.password !== undefined) {
     checkPassword(patch.password);
     user.passwordHash = hashPassword(patch.password);