ai_co_discuss 0.3.46 → 0.3.49

package/web/app.js

@@ -66,7 +66,7 @@ const MANUAL_TRIGGER_INSTRUCTION = "首次复制后，可由人工或软件原
 const MANAGEMENT_LOGIN_HINT = "需要登录管理员账号或使用创建该房间的浏览器";
 const THEMES = ["channel", "channel-light"];
 // proxy and host_proxy label answers relayed for the retired web chatbot members.
-const SOURCE_LABELS = { demo: "示例", user: "本人发言", proxy: "用户代发", cli: "CLI 发言", api: "API 发言", url: "历史 URL 发言", host_proxy: "主持人代发" };
+const SOURCE_LABELS = { demo: "示例", user: "本人发言", proxy: "用户代发", cli: "CLI 发言", api: "API 发言", url: "历史 URL 发言", host_proxy: "主持人代发", goal: "Goal" };
 const TURN_LABELS = { pending: "待处理", notified: "已通知，待回答", answered: "已回答", cancelled: "已取消" };
 const PLATFORM_IDENTITIES = {
   "用户": { label: "User", initials: "U", style: "user", icon: "/icons/user.svg", description: "发起与协助" },
@@ -81,7 +81,7 @@ const PLATFORM_IDENTITIES = {
 // An instance shows its platform's nickname with its own suffix: Antigravity-2 → Gemini-2.
 const IDENTITIES = by_platform(PLATFORM_IDENTITIES, (identity, name) => ({ ...identity, label: identity.label ? identity.label + name.slice(platform_of(name).length) : name, description: "AI 实例" }));
 const state = { rooms: [], folders: [], room: null, page: 1, pages: 1, query: "", mention_only: false, host_only: false,
-  named_followup: false, create_discussion: false,
+  named_followup: false, create_discussion: false, create_goal: null,
   archive_view: false, directory_sort: "manual", management: null, dragged_room: null, folder_moves: new Map(), folder_version: 0,
   reply_to: null, tab: "discussion", refresh_version: 0, context_dirty: false, topic_dirty: false,
   snapshot_id: 0, pending_submission: null, pending_room: null, toast_timer: null, editing_queued: null };
@@ -124,6 +124,8 @@ state.directory_pending = new Map();
 state.directory_version = 0;
 state.navigation_version = 0;
 state.admin = { loaded: false, local: false, registered: false, setup_available: false, logged_in: false, profile: null, identity_version: 0 };
+// needs: "" | "pairing" | "renew"; pairing_code arrives from a scanned link (#pair=CODE); prompt waits for the user's tap.
+state.device = { id: "", needs: "", pairing_code: "", prompt: null };
 state.launch = { available: false, remote: false, relay: null, connect_command: "", profiles: {}, projects: [], presets: [], builtin_presets: [], hidden_builtins: [], workflows: [], description_templates: {}, workspace: {}, scheduler: {}, error: "", recoveries: [] };
 // The workflow chosen in the new-room form: { id, label, members: { card: instance } }; cards removed from the form drop out at submission.
 state.create_workflow = null;
@@ -204,22 +206,9 @@ function notify_failure(error, message) {
   error.notified = true;
 }
 
-/** The administrator session token kept by this browser, or an empty string. */
-function admin_token() {
-  if (state.admin.local) return "";
-  try { return localStorage.getItem(ADMIN_SESSION_KEY) || ""; } catch { return ""; }
-}
-
-/** Store or clear the administrator session token; storage failures only lose persistence. */
-function store_admin_token(token) {
-  try { token ? localStorage.setItem(ADMIN_SESSION_KEY, token) : localStorage.removeItem(ADMIN_SESSION_KEY); } catch { /* Keep the session in memory only. */ }
-}
-
-/** The administrator header for writes that bypass request_json, or no header without a session. */
-function admin_headers() {
-  const session = admin_token();
-  return session ? { "X-Discussion-Admin": session } : {};
-}
+// The administrator login is an HttpOnly cookie the website sets; this page never sees or stores the token. An older
+// version kept it in localStorage, where any script could read it, so that copy is deleted.
+try { localStorage.removeItem(ADMIN_SESSION_KEY); } catch { /* Nothing stored. */ }
 
 /** Request JSON from the local or remotely hosted discussion service. */
 async function request_json(path, payload, access_token) {
@@ -230,9 +219,7 @@ async function request_json(path, payload, access_token) {
   const options = { cache: "no-store" };
   const target_room = path.match(/^\/api\/rooms\/([^/?]+)/)?.[1];
   const token = access_token || (target_room ? localStorage.getItem(`discuss-access:${target_room}`) : null);
-  const session = admin_token();
   options.headers = token ? { "X-Discussion-Token": token } : {};
-  if (session) options.headers["X-Discussion-Admin"] = session;
   if (payload !== undefined) {
     options.method = "POST";
     options.headers["Content-Type"] = "application/json";
@@ -259,7 +246,6 @@ function apply_admin_identity(profile) {
 /** Record the server's administrator state and refresh every identity-dependent view without a reload. */
 function apply_admin_state(info) {
   const local = info.local === true;
-  if (local || !info.logged_in) store_admin_token("");
   Object.assign(state.admin, { loaded: true, local, computer_rooms: info.computer_rooms === true, registered: Boolean(info.registered), setup_available: Boolean(info.setup_available),
     logged_in: Boolean(info.logged_in), profile: info.profile ? { username: info.profile.username, avatar: info.profile.avatar || "" } : null });
   apply_admin_identity(state.admin.profile);
@@ -289,9 +275,8 @@ function admin_error(error) {
   return error;
 }
 
-/** Store the new session and show the owner's identity. */
-function accept_admin_session({ token, profile }) {
-  store_admin_token(token);
+/** Show the owner's identity once signed in; the website keeps the login in its cookie. */
+function accept_admin_session({ profile }) {
   apply_admin_state({ registered: true, setup_available: false, logged_in: true, profile, computer_rooms: state.admin.computer_rooms });
   // Pairing and the paired computer both need the session, so read them again now.
   computer_rooms_only() ? connect_computer_rooms() : load_launch_settings();
@@ -303,11 +288,6 @@ async function register_admin({ username, password, confirm, setup_key }) {
   if (problem) throw new Error(problem);
   try { accept_admin_session(await request_json("/api/admin/register", { username: username.trim(), password, setup_key: setup_key.trim() })); }
   catch (error) { throw admin_error(error); }
-  // Registered from the computer running the local service: keep the account in its private directory.
-  if (local_connection) {
-    try { show_toast(`账号与密码已保存到本机 ${(await local_launch_request("admin-account", { username: username.trim(), password })).saved}`); }
-    catch (error) { show_toast(`注册成功，但账号未能保存到本机：${error.message}`, true); }
-  }
 }
 
 /** Sign in and keep the session in this browser. */
@@ -317,11 +297,10 @@ async function login_admin({ username, password }) {
   catch (error) { throw admin_error(error); }
 }
 
-/** Leave this browser; the local session is dropped even if the server cannot be reached. */
+/** Leave this browser: the website ends the login and clears its cookie. */
 async function logout_admin() {
   try { await request_json("/api/admin/logout", {}); }
-  catch { /* The token is removed below either way. */ }
-  store_admin_token("");
+  catch { /* Shown as signed out either way; the login also expires on its own. */ }
   state.admin.logged_in = false;
   state.launch.relay = null;
   if (state.remote_rooms) await show_computer_rooms(false).catch(() => {});
@@ -330,6 +309,32 @@ async function logout_admin() {
   publish_view();
 }
 
+/** List this account's live logins, each with the browser that signed in and whether it is this one. */
+async function admin_sessions() {
+  return (await request_json("/api/admin/sessions")).sessions;
+}
+
+/** The passkeys that can sign in to this website, and removing one (a lost device's). */
+async function admin_passkeys() {
+  return (await request_json("/api/admin/passkeys")).passkeys;
+}
+async function delete_admin_passkey(id) {
+  await request_json("/api/admin/passkey-delete", { id });
+}
+
+/** End one other login by id, or every login but this one with { others: true }. */
+async function revoke_admin_sessions(target) {
+  await request_json("/api/admin/revoke", target);
+}
+
+/** Change the password after proving the current one; the website ends every other login. */
+async function change_admin_password({ current_password, password, confirm }) {
+  const problem = validate_admin_form({ username: "x", password, confirm });
+  if (problem) throw new Error(problem);
+  try { await request_json("/api/admin/password", { current_password, password }); }
+  catch (error) { throw admin_error(error); }
+}
+
 /** Save the display name and/or avatar; an empty avatar restores the default. */
 async function update_admin_profile(patch) {
   if (patch.username !== undefined) {
@@ -369,7 +374,7 @@ async function admin_avatar_from_file(file) {
 /** Whether this browser may write as the room owner: its own control credential, a logged-in administrator session, or the
  *  loopback-only local site, whose server writes as the owner for every visitor (`admin_as_owner`). */
 function has_room_control(room_id) {
-  return Boolean(localStorage.getItem(`discuss-access:${room_id}`) || state.admin.local || (state.admin.logged_in && admin_token()));
+  return Boolean(localStorage.getItem(`discuss-access:${room_id}`) || state.admin.local || state.admin.logged_in);
 }
 
 /** Explain why a management write failed when this browser has neither credential. */
@@ -1141,6 +1146,7 @@ function reset_create_form() {
   state.launch.scheduler = default_scheduler();
   state.named_followup = false;
   state.create_discussion = false;
+  state.create_goal = null;
   state.create_chain_rounds = DEFAULT_CHAIN_ROUNDS;
   state.create_workflow = null;
   state.create_host_workflows = false;
@@ -1948,8 +1954,12 @@ async function submit_room(event, folder_id = null) {
   const discussion = state.create_discussion ? { goal: payload.goal.trim(), named_followup: state.named_followup,
     limits: read_limits("new-room") } : null;
   if (discussion && !(launching && payload.host && payload.experts[payload.host] === "cli")) throw new Error("开启讨论需要一位由本机唤醒的 AI 主持人；请先添加并设为主持人");
-  // The key joins the signature only when a discussion is requested, so recovered requests keep matching their stored signature.
-  const signed = (current_payload, current_draft) => JSON.stringify(discussion ? { payload: current_payload, launch_draft: current_draft, discussion } : { payload: current_payload, launch_draft: current_draft });
+  const goal = state.create_goal ? { ...state.create_goal, objective: state.create_goal.objective.trim() } : null;
+  if (goal && !goal.objective) throw new Error("请填写 Goal 目标");
+  if (goal && !(launching && payload.host && payload.experts[payload.host] === "cli")) throw new Error("开启 Goal 需要一位由本机唤醒的 AI 主持人；请先添加并设为主持人");
+  // The key joins the signature only when a discussion or goal is requested, so recovered requests keep matching their stored signature.
+  const signed = (current_payload, current_draft) => JSON.stringify(discussion ? { payload: current_payload, launch_draft: current_draft, discussion }
+    : goal ? { payload: current_payload, launch_draft: current_draft, goal } : { payload: current_payload, launch_draft: current_draft });
   const signature = signed(payload, launch_draft);
   const navigation = state.navigation_version;
   if (!launching) element("room-dialog").close();
@@ -1969,6 +1979,7 @@ async function submit_room(event, folder_id = null) {
     } });
   state.pending_room = null;
   if (discussion) await open_discussion_after_creation(room.id, discussion);
+  if (goal) await open_goal_after_creation(room.id, goal);
   if (signed(room_creation_payload(folder_id), launching ? creation_launch_options() : null) === signature) {
     element("room-form").reset();
     render_expert_inputs("new-expert-modes", default_experts());
@@ -1990,6 +2001,27 @@ async function open_discussion_after_creation(room_id, { goal, named_followup, l
   }
 }
 
+/** Open the goal of a room just created; a failure leaves the room as an ordinary free room. */
+async function open_goal_after_creation(room_id, { objective, max_continues, max_minutes }) {
+  const path = `/api/rooms/${room_id}/goal`;
+  try {
+    const current = await request_json(path);
+    await request_json(path, { action: "start", revision: current.revision, objective, max_continues, max_minutes });
+    state.create_goal = null;
+  } catch (error) {
+    notify("warning", `房间已创建，但开启 Goal 失败：${error.message}；可在右侧成员栏重试`);
+  }
+}
+
+/** Keep a pairing code from a scanned link (#pair=CODE) for the settings form, and take it out of the address bar. */
+function take_pairing_code() {
+  const match = (location.hash || "").match(/(?:^#|&)pair=([0-9A-Za-z-]{12,16})/);
+  if (!match) return;
+  state.device.pairing_code = match[1].toUpperCase();
+  history.replaceState(null, "", `${location.pathname}${location.search}`);
+  notify("info", "已读取配对码：登录后在 设置 → 账号 中完成配对");
+}
+
 /** Read a site-bound connection without exposing its credential to the shared view snapshot. */
 function restore_local_connection() {
   const fragment = new URLSearchParams(location.hash?.slice(1) || "");
@@ -2052,13 +2084,208 @@ async function relay_cipher(private_key, public_jwk) {
     material, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
 }
 
-/** Seal one request so that only the paired computer can read it and seal the answer. */
+
+// ---- Device trust (.dev/plans/远程访问安全加固/PROTOCOL.md): this browser's own signing key, pairing by a code shown on a
+// trusted screen, and passkey confirmations. The paired computer decides; the website only forwards. ----
+const DEVICE_DB = "codiscuss-device";
+const PASSKEY_TIMEOUT_MS = 60000;
+let device_identity_promise = null;
+
+function bytes_to_b64url(bytes) {
+  return bytes_to_base64(new Uint8Array(bytes)).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+
+function b64url_to_bytes(text) {
+  const base = String(text || "").replaceAll("-", "+").replaceAll("_", "/");
+  return base64_to_bytes(base + "=".repeat((4 - base.length % 4) % 4));
+}
+
+/** Open the browser's store for the device key; a browser without one keeps the key for this page only. */
+function device_store(mode, use) {
+  return new Promise((resolve, reject) => {
+    const opening = indexedDB.open(DEVICE_DB, 1);
+    opening.onupgradeneeded = () => opening.result.createObjectStore("keys");
+    opening.onerror = () => reject(opening.error);
+    opening.onsuccess = () => {
+      const transaction = opening.result.transaction("keys", mode), request = use(transaction.objectStore("keys"));
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error);
+    };
+  });
+}
+
+/** This browser's signing key, created once and never exportable; its id is the first 32 hex digits of SHA-256 of the public key. */
+function device_identity() {
+  device_identity_promise ||= (async () => {
+    let saved = await device_store("readonly", store => store.get("device")).catch(() => null);
+    if (!saved) {
+      const pair = await crypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, false, ["sign", "verify"]);
+      const raw = new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey));
+      const { kty, crv, x, y } = await crypto.subtle.exportKey("jwk", pair.publicKey);
+      const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", raw));
+      saved = { private_key: pair.privateKey, public_jwk: { kty, crv, x, y }, raw: bytes_to_b64url(raw),
+        id: Array.from(digest.slice(0, 16), byte => byte.toString(16).padStart(2, "0")).join("") };
+      await device_store("readwrite", store => store.put(saved, "device")).catch(() => {});
+    }
+    state.device.id = saved.id;
+    return saved;
+  })();
+  return device_identity_promise;
+}
+
+/** A short device name from the browser's own description, e.g. "iPhone · Safari". */
+function device_label(agent = navigator.userAgent) {
+  const text = String(agent || "");
+  const system = /iPhone/.test(text) ? "iPhone" : /iPad/.test(text) ? "iPad" : /Android/.test(text) ? "Android" : /Windows/.test(text) ? "Windows"
+    : /Mac OS X|Macintosh/.test(text) ? "Mac" : /Linux/.test(text) ? "Linux" : "";
+  const browser = /Edg\//.test(text) ? "Edge" : /Chrome\//.test(text) ? "Chrome" : /Firefox\//.test(text) ? "Firefox" : /Safari\//.test(text) ? "Safari" : "";
+  return [system, browser].filter(Boolean).join(" · ") || "未知设备";
+}
+
+/** Run a device action on the paired computer, or on this computer's own service from its local page. */
+async function device_request(action, payload = {}) {
+  if (relay_machine) return relay_command(action, payload);
+  if (action === "device-pairing") return local_launch_request("device-pairing", payload);
+  if (action === "device-list") return local_launch_request("devices", {});
+  if (action === "device-revoke") return local_launch_request("devices", { revoke: payload.device_id });
+  if (action === "write-revoke") return local_launch_request("devices", { revoke_write: payload });
+  throw new Error("请在已配对的设备上操作");
+}
+
+/** Pair this browser with the code shown on a trusted screen: the code authenticates this browser's public key. */
+async function pair_this_device(code) {
+  const machine = relay_machine;
+  if (!machine) throw new Error("请先登录并确认电脑在线，再输入配对码");
+  const normal = String(code || "").toUpperCase().replace(/[^0-9A-Z]/g, "");
+  if (normal.length !== 12) throw new Error("配对码是 12 位字母和数字");
+  const device = await device_identity();
+  const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(normal), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const proof = bytes_to_b64url(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`codiscuss-pair-v1\n${machine.id}\n${device.raw}`)));
+  const result = await relay_command("device-pair", { public_key: device.public_jwk, label: device_label(), proof });
+  Object.assign(state.device, { needs: "", pairing_code: "" });
+  publish_view();
+  // Settings and the computer's rooms load now that the computer accepts this device.
+  load_launch_settings();
+  if (computer_rooms_only()) connect_computer_rooms();
+  return result;
+}
+
+/** The page's own passkey confirmation: WebAuthn needs the user's tap, so options are fetched first and the call runs on the tap. */
+function passkey_prompt({ title, description, confirm_label, run }) {
+  return new Promise((resolve, reject) => {
+    state.device.prompt = { title, description, confirm_label, run: async () => {
+      state.device.prompt = null;
+      publish_view();
+      try { resolve(await run()); } catch (error) { reject(error); }
+    }, cancel: () => { state.device.prompt = null; publish_view(); reject(Object.assign(new Error("已取消"), { cancelled: true })); } };
+    publish_view();
+  });
+}
+
+/** Ask this device's passkey to sign a challenge; returns the assertion fields the computer or website checks. */
+async function passkey_assertion(options) {
+  const credential = await navigator.credentials.get({ publicKey: { challenge: b64url_to_bytes(options.challenge), rpId: options.rp_id,
+    allowCredentials: (options.allow || []).map(id => ({ type: "public-key", id: b64url_to_bytes(id) })), userVerification: "required", timeout: PASSKEY_TIMEOUT_MS } });
+  return { id: bytes_to_b64url(credential.rawId), client_data_json: bytes_to_b64url(credential.response.clientDataJSON),
+    authenticator_data: bytes_to_b64url(credential.response.authenticatorData), signature: bytes_to_b64url(credential.response.signature) };
+}
+
+/** Create one passkey for this paired device, registered with both the computer and the website in a single step. */
+async function create_device_passkey() {
+  const computer = await relay_command("passkey-options", {});
+  const website = await request_json("/api/admin/passkey-challenge", { purpose: "register" });
+  const challenge = new Uint8Array(await crypto.subtle.digest("SHA-256", new Uint8Array([...b64url_to_bytes(computer.challenge), ...b64url_to_bytes(website.challenge)])));
+  return passkey_prompt({ title: "为这台设备创建通行密钥", description: "之后用指纹、面容或设备密码登录、续期和开启远程可写，不用再输密码。", confirm_label: "创建通行密钥",
+    run: async () => {
+      const created = await navigator.credentials.create({ publicKey: { challenge, rp: computer.rp,
+        user: { id: b64url_to_bytes(computer.user_id), name: computer.user_name || "codiscuss", displayName: computer.user_name || "AI CoDiscuss" },
+        pubKeyCredParams: [{ type: "public-key", alg: -7 }, { type: "public-key", alg: -257 }],
+        authenticatorSelection: { userVerification: "required", residentKey: "preferred" }, attestation: "none", timeout: PASSKEY_TIMEOUT_MS,
+        excludeCredentials: (computer.exclude || []).map(id => ({ type: "public-key", id: b64url_to_bytes(id) })) } });
+      const credential = { id: bytes_to_b64url(created.rawId), client_data_json: bytes_to_b64url(created.response.clientDataJSON),
+        attestation_object: bytes_to_b64url(created.response.attestationObject) };
+      await relay_command("passkey-register", { challenge_id: computer.challenge_id, website_challenge: website.challenge, credential });
+      await request_json("/api/admin/passkey-register", { challenge_id: website.challenge_id, computer_challenge: computer.challenge, credential, label: device_label() });
+      notify("info", "已创建通行密钥");
+    } });
+}
+
+/** Show a pairing code for another device: from the computer's own page directly, from a paired device after its passkey. */
+async function invite_device(temporary) {
+  if (!relay_machine) return local_launch_request("device-pairing", { temporary });
+  const options = await relay_command("passkey-challenge", { purpose: "pair" });
+  return passkey_prompt({ title: "添加新设备", description: "新设备将获得与这台设备相同的远程权限，请用通行密钥确认是你本人在操作。", confirm_label: "用通行密钥确认",
+    run: async () => relay_command("device-pairing", { temporary, challenge_id: options.challenge_id, assertion: await passkey_assertion(options) }) });
+}
+
+/** Confirm remote writing in one room with this device's passkey; the computer grants twelve hours. */
+async function confirm_write_grant(room_id) {
+  const options = await relay_command("passkey-challenge", { purpose: "write", room_id });
+  return passkey_prompt({ title: "确认远程可写", description: "这个房间的成员可以改动电脑上的文件或运行命令。确认后，这台设备 12 小时内可以在本房间远程操作；可随时在 设置 → 账号 中撤销。",
+    confirm_label: "用通行密钥确认",
+    run: async () => {
+      const result = await relay_command("write-grant", { challenge_id: options.challenge_id, assertion: await passkey_assertion(options), room_id });
+      notify("info", "已开启远程可写，12 小时内有效");
+      return result;
+    } });
+}
+
+/** Extend this device's trust by thirty days with its passkey. */
+async function renew_this_device() {
+  const options = await relay_command("passkey-challenge", { purpose: "renew" });
+  return passkey_prompt({ title: "续期这台设备", description: "用通行密钥确认后，这台设备再获得 30 天授权。", confirm_label: "用通行密钥确认",
+    run: async () => {
+      await relay_command("device-renew", { challenge_id: options.challenge_id, assertion: await passkey_assertion(options) });
+      state.device.needs = "";
+      notify("info", "已续期 30 天");
+    } });
+}
+
+/** Sign in to the website with a passkey instead of the password. */
+async function login_with_passkey() {
+  const options = await request_json("/api/admin/passkey-challenge", { purpose: "login" });
+  return passkey_prompt({ title: "用通行密钥登录", description: "用这台设备的指纹、面容或设备密码登录。", confirm_label: "继续",
+    run: async () => {
+      try { accept_admin_session(await request_json("/api/admin/passkey-login", { challenge_id: options.challenge_id, assertion: await passkey_assertion(options) })); }
+      catch (error) { throw admin_error(error); }
+    } });
+}
+
+/**
+ * React to what the computer asked for: pair or renew this device (shown in settings), or confirm writing in a room
+ * and run the request once more. Returns true when the request should be retried.
+ */
+async function meet_device_need(error) {
+  if (error.need === "write-grant" && error.room_id) {
+    await confirm_write_grant(error.room_id);
+    return true;
+  }
+  if (error.need === "pairing" || error.need === "renew") {
+    if (state.device.needs !== error.need) notify("warning", error.need === "pairing" ? "这台设备还没有与电脑配对：打开 设置 → 账号，扫描或输入配对码" : "这台设备的授权已到期：打开 设置 → 账号 用通行密钥续期");
+    state.device.needs = error.need;
+    publish_view();
+  }
+  return false;
+}
+
+/**
+ * Seal one request so that only the paired computer can read it and seal the answer. This browser signs it with its
+ * device key; only a pairing request goes unsigned. The send time lets the computer refuse a replay.
+ */
 async function seal_relay_request(machine, id, request) {
   const encoder = new TextEncoder();
+  // The computer it is meant for is signed too, so the request cannot be passed on to another paired computer.
+  const body = JSON.stringify({ ...request, machine: machine.id, sent_at: Date.now() });
+  let plain = { body };
+  if (request.action !== "device-pair") {
+    const device = await device_identity();
+    const signature = await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, device.private_key, encoder.encode(`${id}\n${body}`));
+    plain = { body, device_id: device.id, signature: bytes_to_b64url(signature) };
+  }
   const ephemeral = await crypto.subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, false, ["deriveBits"]);
   const key = await relay_cipher(ephemeral.privateKey, machine.public_key);
   const iv = crypto.getRandomValues(new Uint8Array(12));
-  const data = await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData: encoder.encode(id) }, key, encoder.encode(JSON.stringify(request)));
+  const data = await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData: encoder.encode(id) }, key, encoder.encode(JSON.stringify(plain)));
   const { kty, crv, x, y } = await crypto.subtle.exportKey("jwk", ephemeral.publicKey);
   return { key, envelope: { key: { kty, crv, x, y }, iv: bytes_to_base64(iv), data: bytes_to_base64(data) } };
 }
@@ -2102,8 +2329,17 @@ async function queued_relay_command(action, payload, limit) {
   throw Object.assign(new Error(`电脑「${machine.name}」未在限时内答复，请确认它开机并运行 codiscuss 后重试`), { launch: { stage: "unconfirmed" } });
 }
 
-/** Run one local-service operation on the paired computer and answer as the local bridge would. */
+/** Run one local-service operation on the paired computer; a write confirmation the computer asks for runs it once more. */
 async function relay_command(action, payload) {
+  try { return await relay_command_once(action, payload); }
+  catch (error) {
+    if (await meet_device_need(error)) return relay_command_once(action, payload);
+    throw error;
+  }
+}
+
+/** Run one local-service operation on the paired computer and answer as the local bridge would. */
+async function relay_command_once(action, payload) {
   // The folder dialog would open on the computer where nobody sees it.
   if (action === "pick-directory") throw new Error("请直接输入电脑上的完整路径");
   const limit = payload === undefined ? RELAY_SETTINGS_WAIT_MS : ["room-models", "models", "api-check", "scheduler-check"].includes(action)
@@ -2113,12 +2349,21 @@ async function relay_command(action, payload) {
   try { answer = await relay_exchange(action, payload, limit); }
   catch (error) { if (computer_rooms_only() || (error.status !== 404 && !error.offline)) throw error; }
   const { status, body } = answer ?? await queued_relay_command(action, payload, limit);
-  if (status >= 400) throw Object.assign(new Error(body.error || "本机操作失败"), { launch: body.launch });
+  if (status >= 400) throw Object.assign(new Error(body.error || "本机操作失败"), { launch: body.launch, need: body.need, room_id: body.room_id });
   return body;
 }
 
 /** Read or write one room route on the paired computer's local website, as its owner, and answer as request_json would. */
 async function relay_room_request(path, payload) {
+  try { return await relay_room_request_once(path, payload); }
+  catch (error) {
+    if (await meet_device_need(error)) return relay_room_request_once(path, payload);
+    throw error;
+  }
+}
+
+/** Read or write one room route on the paired computer once. */
+async function relay_room_request_once(path, payload) {
   let answer;
   for (let attempt = 0; ; attempt += 1) {
     try { answer = await relay_exchange("room-api", { method: payload === undefined ? "GET" : "POST", path, body: payload }); break; }
@@ -2129,7 +2374,8 @@ async function relay_room_request(path, payload) {
       await new Promise((resolve) => setTimeout(resolve, RELAY_READ_RETRY_MS[attempt]));
     }
   }
-  if (answer.status >= 400) throw Object.assign(new Error(answer.body?.error || "请求失败，请重试"), { preflight: answer.status < 500, status: answer.status });
+  if (answer.status >= 400) throw Object.assign(new Error(answer.body?.error || "请求失败，请重试"),
+    { preflight: answer.status < 500, status: answer.status, need: answer.body?.need, room_id: answer.body?.room_id });
   return answer;
 }
 
@@ -2167,7 +2413,7 @@ async function relay_upload(path, data) {
 async function post_room_file(path, body, token) {
   if (state.remote_rooms) return relay_upload(path, body);
   const response = await fetch(path, { method: "POST",
-    headers: { "Content-Type": "application/octet-stream", ...(token ? { "X-Discussion-Token": token } : {}), ...admin_headers() }, body });
+    headers: { "Content-Type": "application/octet-stream", ...(token ? { "X-Discussion-Token": token } : {}) }, body });
   const result = await response.json();
   if (!response.ok) throw new Error(result.error || "附件上传失败");
   return result;
@@ -2262,7 +2508,8 @@ function relay_event_source() {
   const target = new EventTarget();
   const emit = (type, data) => target.dispatchEvent(Object.assign(new Event(type), { data }));
   const url = `${location.origin.replace(/^http/, "ws")}/api/machines/${encodeURIComponent(relay_machine.id)}/relay`;
-  const socket = new WebSocket(url, [RELAY_PROTOCOL, `a.${admin_token()}`]);
+  // The login cookie goes with the upgrade, so no credential travels in the subprotocol.
+  const socket = new WebSocket(url, [RELAY_PROTOCOL]);
   let ping;
   target.readyState = 0;
   socket.addEventListener("open", () => {
@@ -2403,6 +2650,7 @@ async function load_launch_settings() {
   try {
     local_connection = null;
     relay_machine = null;
+    take_pairing_code();
     local_connection = restore_local_connection();
     state.launch.remote = Boolean(local_connection);
     if (local_connection) state.launch.connect_command = `codiscuss local connect "${location.origin}"`;
@@ -2429,7 +2677,8 @@ async function load_launch_settings() {
     if (!Object.keys(state.launch.scheduler).length) state.launch.scheduler = default_scheduler();
     load_room_models();
   } catch (error) {
-    relay_machine = null;
+    // An unpaired or expired device keeps its way to the computer: pairing and renewal go through it.
+    relay_machine = error.need === "pairing" || error.need === "renew" ? relay_machine : null;
     state.launch.remote = Boolean(local_connection);
     Object.assign(state.launch, { available: false, room_models: null, error: error.message });
     // Without a reachable local service, launches can still go through the paired computer.
@@ -2441,13 +2690,14 @@ async function load_launch_settings() {
 
 /** The computer paired with this site, most recently seen first; only the administrator can read or use it. */
 async function load_relay_machine() {
-  if (!admin_token()) return null;
+  // The admin state is read before launch settings at start-up, so this knows whether a login cookie exists.
+  if (state.admin.local || !state.admin.logged_in) return null;
   try { return (await request_json("/api/machines")).machines[0] || null; } catch { return null; }
 }
 
 /** Pair the connected computer so devices without the local service can launch on it; needs the administrator session. */
 async function pair_local_machine() {
-  if (!admin_token()) return;
+  if (state.admin.local || !state.admin.logged_in) return;
   try { await request_json("/api/machines", await local_launch_request("machine-link", {})); }
   catch (error) { console.warn("Pairing this computer failed:", error.message); }
 }
@@ -2768,11 +3018,14 @@ function workflow_preset({ card, requested_access, needs_platform, ...preset })
   return preset;
 }
 
-/** Fill the new-room form with a workflow's cards, each a preset-made instance, and remember which card each plays. */
+/**
+ * Fill the new-room form with a workflow's cards, each a preset-made instance, and remember which card each plays.
+ * Choosing another (or the same one again after editing) replaces the previous cards; clearing the choice keeps them as ordinary members.
+ */
 async function choose_create_workflow(id) {
   const workflow = id ? await local_launch_request("workflows", { action: "get", id }) : null;
-  for (const name of Object.values(state.create_workflow?.members || {})) write_view_expert("new-expert-modes", name, "");
   if (!workflow) { state.create_workflow = null; return publish_view(); }
+  for (const name of Object.values(state.create_workflow?.members || {})) write_view_expert("new-expert-modes", name, "");
   const members = {};
   for (const agent of workflow.agents) members[agent.card] = add_preset_instance("new-expert-modes", workflow_preset(agent), "cli");
   state.create_workflow = { id, label: workflow.label || id, members };
@@ -2825,6 +3078,14 @@ function write_create_chain_rounds(value) {
 /** Choose whether a new room opens a discussion right away; the room itself is always the same collaboration room. */
 function write_create_discussion(value) {
   state.create_discussion = Boolean(value);
+  if (state.create_discussion) state.create_goal = null;
+  publish_view();
+}
+
+/** Turn the new room's goal on (with a patch of its fields) or off; a goal and a discussion exclude each other. */
+function write_create_goal(patch) {
+  state.create_goal = patch === null ? null : { objective: "", max_continues: 0, max_minutes: 0, ...(state.create_goal || {}), ...patch };
+  if (state.create_goal) state.create_discussion = false;
   publish_view();
 }
 
@@ -2948,6 +3209,11 @@ async function browse_local_directory() {
   return (await local_launch_request("pick-directory", {})).path || "";
 }
 
+/** List one page of folders another device may choose on the paired computer: the saved projects, or folders inside them. */
+async function list_remote_directories(path = "", offset = 0) {
+  return local_launch_request("browse-directory", { path, offset });
+}
+
 /** Let the user browse for the project folder on the computer running the local service. */
 async function pick_launch_directory() {
   try {
@@ -3151,6 +3417,38 @@ async function start_room_discussion({ goal, max_rounds, max_minutes, named_foll
   show_toast("讨论已开启，由主持人推进；需本机接入程序保持运行");
 }
 
+/** Open a goal from the page with the revision just read; the host is woken right away to start on it. */
+async function start_room_goal({ objective, max_continues = 0, max_minutes = 0 }) {
+  const room_id = state.room.id, path = `/api/rooms/${room_id}/goal`;
+  if (!has_room_control(room_id)) throw new Error(MANAGEMENT_LOGIN_HINT);
+  const current = await request_json(path);
+  if (state.room?.id !== room_id) return;
+  await request_json(path, { action: "start", revision: current.revision, objective, max_continues, max_minutes });
+  if (state.room?.id !== room_id) return;
+  await refresh_room();
+  show_toast("Goal 已开启，主持人会持续推进；需本机接入程序保持运行");
+}
+
+/** Change the open goal's objective or budgets. */
+async function update_room_goal({ objective, max_continues = 0, max_minutes = 0 }) {
+  const room_id = state.room.id;
+  if (!has_room_control(room_id)) throw new Error(MANAGEMENT_LOGIN_HINT);
+  await request_json(`/api/rooms/${room_id}/goal`, { action: "update", objective, max_continues, max_minutes });
+  if (state.room?.id !== room_id) return;
+  await refresh_room();
+  show_toast("Goal 已更新");
+}
+
+/** Pause, resume or end the open goal; only the owner controls it. */
+async function goal_control(action) {
+  const room_id = state.room.id;
+  if (!has_room_control(room_id)) throw new Error(MANAGEMENT_LOGIN_HINT);
+  await request_json(`/api/rooms/${room_id}/goal`, { action });
+  if (state.room?.id !== room_id) return;
+  await refresh_room();
+  show_toast({ pause: "Goal 已暂停，房间空闲时不再唤醒主持人", resume: "Goal 已继续", clear: "Goal 已结束，房间回到自由协作" }[action]);
+}
+
 /** Conclude the discussion and go on as a free room; every message and the conclusion stay. */
 async function end_room_discussion() {
   const room_id = state.room.id, session_id = state.room.session?.id;
@@ -4032,8 +4330,10 @@ function view_snapshot() {
     upload_status: state.upload_status, sending_message: state.sending_message, sending_preview: state.sending_preview,
     mention_only: state.mention_only, host_only: state.host_only, reply_to: state.reply_to, editing_queued: state.editing_queued?.id ?? null,
     access: access_snapshot(), admin: admin_snapshot(),
+    device: { id: state.device.id, needs: state.device.needs, pairing_code: state.device.pairing_code,
+      prompt: state.device.prompt ? { title: state.device.prompt.title, description: state.device.prompt.description, confirm_label: state.device.prompt.confirm_label } : null },
     tab: state.tab, snapshot_id: state.snapshot_id, context_dirty: state.context_dirty,
-    theme: document.documentElement.dataset.theme, fields, experts, launch: structuredClone(state.launch), named_followup: state.named_followup, create_discussion: state.create_discussion, create_chain_rounds: state.create_chain_rounds, create_workflow: state.create_workflow, create_host_workflows: state.create_host_workflows };
+    theme: document.documentElement.dataset.theme, fields, experts, launch: structuredClone(state.launch), named_followup: state.named_followup, create_discussion: state.create_discussion, create_goal: state.create_goal, create_chain_rounds: state.create_chain_rounds, create_workflow: state.create_workflow, create_host_workflows: state.create_host_workflows };
 }
 
 /** Update a shared draft using the same input events as the original controls. */
@@ -4243,7 +4543,7 @@ async function execute_view_action(name, value) {
     save_context: () => save_context(event), save_topic: () => save_topic(event),
     filter: filter_view, reply: set_view_reply, cancel_reply, skip_turn,
     copy_cli: () => copy_context(), copy_background,
-    download_member_access, copy_member_access_text, copy_member_join, copy_member_launch: name => copy_member_join(name, true), pause_discussion, restart_discussion, start_room_discussion, end_room_discussion,
+    download_member_access, copy_member_access_text, copy_member_join, copy_member_launch: name => copy_member_join(name, true), pause_discussion, restart_discussion, start_room_discussion, end_room_discussion, start_room_goal, update_room_goal, goal_control,
     save_launch_defaults, resume_launch, discard_launch, retry_launch_connection, check_launch_connection: load_launch_settings,
     load_room_configuration, save_room_configuration, interrupt_member, retry_delivery, retract_message, retract_latest, stop_room, rewind_and_send, fork_room, change_member, reorder_speakers, invite_member,
     choose_create_workflow, enable_room_workflow, move_workflow_members, set_room_host_workflows,
@@ -4270,13 +4570,17 @@ function change_view_theme(theme) {
 
 window.discuss_view = { snapshot: view_snapshot, write_field: write_view_field, notify, load_decision_input,
   write_launch: write_launch_field, default_launch_entry, description_template, save_description_template, description_draft, write_description_draft, describe_member, set_chain_rounds, continue_chain, expert_presets, apply_expert_preset, unique_instance, member_label, default_name, label_draft, write_label_draft, preset_identity, save_expert_preset, delete_expert_preset, write_room_connection, write_room_adapter, launch_clients: LAUNCH_CLIENTS,
-  launch_model_state, load_launch_models, write_launch_model, save_launch_api_key, write_scheduler, save_scheduler_api_key, check_scheduler, write_named_followup, write_create_discussion, write_create_chain_rounds, check_launch_api, launch_summary, launch_can_set_access, pick_launch_directory, browse_local_directory, save_launch_projects, restore_launch_profile, reset_create_form, empty_discussion_message,
+  launch_model_state, load_launch_models, write_launch_model, save_launch_api_key, write_scheduler, save_scheduler_api_key, check_scheduler, write_named_followup, write_create_discussion, write_create_goal, write_create_chain_rounds, check_launch_api, launch_summary, launch_can_set_access, pick_launch_directory, browse_local_directory, list_remote_directories, save_launch_projects, restore_launch_profile, reset_create_form, empty_discussion_message,
   start_drag: start_directory_drag, reconnect: reconnect_live_updates, stop_label, local_request: local_launch_request,
   attachment_markup, attachment_size, attachment_file_icon, drop_attachments, paste_attachments,
   write_expert: write_view_expert, add_instance: add_view_instance, add_preset: add_preset_instance, platform_of, execute: execute_view_action, theme: change_view_theme,
   reload_workflows, workflow_preset, create_workflow_label, write_create_host_workflows,
   admin: { register: register_admin, login: login_admin, logout: logout_admin,
-    update_profile: update_admin_profile, avatar_from_file: admin_avatar_from_file, validate: validate_admin_form },
+    update_profile: update_admin_profile, avatar_from_file: admin_avatar_from_file, validate: validate_admin_form,
+    sessions: admin_sessions, revoke: revoke_admin_sessions, change_password: change_admin_password, login_with_passkey,
+    passkeys: admin_passkeys, delete_passkey: delete_admin_passkey },
+  device: { request: device_request, pair: pair_this_device, invite: invite_device, create_passkey: create_device_passkey, renew: renew_this_device, confirm_write: confirm_write_grant,
+    label: device_label, prompt_confirm: () => state.device.prompt?.run(), prompt_cancel: () => state.device.prompt?.cancel() },
   request: request_json, rewind_plan, identities: IDENTITIES, display_name, mention_handles, mentioned_members, render_room_markdown, sources: SOURCE_LABELS,
   set_member_access, set_member_model, allow_denials, set_member_adapter, reload_room_models, read_room_files, limits_label, stop_reason_label, participant_model, participant_files, participant_session_hint, participant_access,
   turn_label, turn_guidance, round_groups, limit_rounds, progress_speaker, brief_meta, max_message_length: MAX_MESSAGE_LENGTH, provenance: message_provenance, format_time };