ec-web 0.0.21 → 0.0.23

package/dist/index.js

@@ -5,7 +5,7 @@
  * 用法:
  *   ec-web [--port 42705] [--home <EVOLCORE_HOME>]
  *
- * 通过 EVOLCORE_HOME 定位 evolcore 数据目录，启动 HTTP+WS 服务，浏览器配对码登录。
+ * 通过 EVOLCORE_HOME 定位 evolcore 数据目录，启动 HTTP+WS 服务；配对码和访问 token 由 daemon 管理。
  * 与 evolcore daemon 通过 IPC socket（live 状态）+ 文件系统（历史数据）旁路通信。
  */
 import fs from 'fs';
@@ -106,7 +106,9 @@ for (const list of Object.values(ifaces)) {
     }
 }
 process.stdout.write(`\n${BOLD}${CYAN}EC Web — EvolCore${RST}  ${DIM}(home: ${p.root})${RST}\n\n`);
-process.stdout.write(`  ${BOLD}配对码:${RST}  ${GREEN}${BOLD}${handle.pairingCode}${RST}  ${DIM}(5 分钟内有效，配对后 token 缓存 30 天，有访问自动续期)${RST}\n\n`);
+process.stdout.write(handle.pairingCode
+    ? `  ${BOLD}配对码:${RST}  ${GREEN}${BOLD}${handle.pairingCode}${RST}  ${DIM}(daemon 提供，5 分钟内有效，配对后 token 缓存 30 天，有访问自动续期)${RST}\n\n`
+    : `  ${BOLD}配对码:${RST}  ${YELLOW}daemon 暂不可用，请先启动 EvolCore${RST}\n\n`);
 process.stdout.write(`  ${BOLD}本机:${RST}    http://localhost:${handle.port}\n`);
 for (const ip of lanIps)
     process.stdout.write(`  ${BOLD}局域网:${RST}  http://${ip}:${handle.port}\n`);

package/dist/ipc-client.js

@@ -12,7 +12,18 @@ import path from 'path';
 // Keep this list aligned with evolcore's local-control IPC gate.  `evolagent.list`
 // is used by the Agents view and is read-only from EC Web's perspective, but the
 // daemon still requires the local control token before returning its registry.
-const LOCAL_CONTROL_COMMANDS = new Set(['evolagent.list', 'menu.exec', 'monitor-snapshot']);
+const LOCAL_CONTROL_COMMANDS = new Set([
+    'evolagent.list',
+    'menu.exec',
+    'model.catalog',
+    'monitor-snapshot',
+    'monitor-subscribe',
+    'monitor-unsubscribe',
+    'remote-auth.pair-code',
+    'remote-auth.issue-local',
+    'remote-auth.redeem',
+    'remote-auth.validate',
+]);
 export function ipcQuery(socketPath, cmd, timeoutMs = 3000) {
     let request = cmd;
     if (LOCAL_CONTROL_COMMANDS.has(cmd.type) && typeof cmd.controlToken !== 'string') {

package/dist/paths.js

@@ -25,10 +25,27 @@ export function resolveRoot() {
     }
     return _root;
 }
+function stripTrailingWindowsSeparators(value) {
+    const stripped = value.replace(/[\\/]+$/g, '');
+    // Keep a drive-root separator. `C:` is a drive-relative path on Windows.
+    if (/^[a-zA-Z]:$/.test(stripped) && /^[a-zA-Z]:[\\/]+$/.test(value)) {
+        return `${stripped}\\`;
+    }
+    return stripped;
+}
+/**
+ * Canonicalize EVOLCORE_HOME exactly like the main EvolCore package does.
+ * The CLI and EC Web may receive the same Windows directory with different
+ * casing, slash styles, or a trailing separator; all must select one pipe.
+ */
+export function normalizeWindowsSocketRoot(root) {
+    return stripTrailingWindowsSeparators(path.win32.resolve(root)).toLowerCase();
+}
 /** socket 路径派生：与 evolcore resolveInstanceSocketPath 完全一致 */
 function resolveInstanceSocketPath(root) {
     if (isWindows) {
-        const hash = crypto.createHash('sha1').update(root).digest('hex').slice(0, 12);
+        const canonicalRoot = normalizeWindowsSocketRoot(root);
+        const hash = crypto.createHash('sha1').update(canonicalRoot).digest('hex').slice(0, 12);
         return `\\\\.\\pipe\\daemon-${hash}`;
     }
     return path.join(root, 'data', 'instance', 'daemon.sock');

package/dist/server.js

@@ -3,10 +3,10 @@
  *
  * - HTTP: 静态资源 + 配对 API
  * - WebSocket: 订阅式实时推送（aid / msg / session）
- * - 鉴权: 6 位配对码（5 分钟有效）→ token（30 天，有访问自动续期），持久化到磁盘
+ * - 鉴权: daemon 通过本地 IPC 提供 6 位配对码（5 分钟有效）和远程访问 token（30 天滑动续期）
  * - 安全: 绑定 0.0.0.0（支持远程访问），token 校验；远程连接可执行受控管理操作，不能修改 daemon 配置或读取 secret
  *
- * 与 evolcore 的唯一通信：启动时发 ping 检查 protocolVersion（soft 校验）。
+ * 与 evolcore daemon 通过 IPC socket（状态、Menu 和远程访问凭据）+ 文件系统（历史数据）旁路通信。
  */
 import http from 'http';
 import fs from 'fs';
@@ -33,13 +33,11 @@ import { ccProjectsDir } from './paths.js';
 import { relationRolesSource, handleRelationRolesApi, handlePeerRoleApi } from './sources/relation-roles.js';
 import { roleDefinitionsSource, handleRoleDefinitionsApi } from './sources/role-definitions.js';
 import { handleModelsApi } from './sources/models.js';
-import { detectBaseAgents } from './sources/baseagent-detector.js';
+import { detectBaseAgentsAsync } from './sources/baseagent-detector.js';
 import { readCodexSessionResult } from './sources/session-codex.js';
 import { handleBasicSettingsApi } from './sources/basic-settings.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const STATIC_DIR = path.join(__dirname, 'static');
-const TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1000; // 30天（滑动窗口：每次有效访问刷新 lastActive 自动续期）
-const PAIRING_TTL_MS = 5 * 60 * 1000; // 5min
 const DEFAULT_PORT = 42705;
 const PROTOCOL_VERSION = 1; // 与 evolcore ping response 对齐的软校验版本
 function daemonOwnerMenuAuth(localDirect, actorAid) {
@@ -61,14 +59,6 @@ function daemonTriggerControlToken() {
         return undefined;
     }
 }
-function matchesDaemonControlToken(value) {
-    const expected = daemonTriggerControlToken();
-    if (typeof value !== 'string' || !expected)
-        return false;
-    const provided = Buffer.from(value);
-    const target = Buffer.from(expected);
-    return provided.length === target.length && crypto.timingSafeEqual(provided, target);
-}
 const SOURCES = { agents: aidSource, msg: msgSource, session: sessionSource, cache: cacheSource, system: systemSource, triggers: triggersSource, monitor: monitorSource, logs: logsSource, gateway: gatewaySource, roles: relationRolesSource, roleDefinitions: roleDefinitionsSource };
 // ECWeb 自身版本：渲染 System 页时随快照下发（不走 daemon IPC，ECWeb 就是这个进程）。
 function readEcwebVersion() {
@@ -104,66 +94,21 @@ const MIME = {
 };
 const HTML_CACHE_CONTROL = 'no-cache';
 const STATIC_CACHE_CONTROL = 'public, max-age=0, must-revalidate';
-function tokenStorePath() {
-    const dir = resolvePaths().instanceDir;
-    const current = path.join(dir, 'ecweb-tokens.json');
-    const legacy = path.join(dir, 'watch-web-tokens.json');
-    if (!fs.existsSync(current) && fs.existsSync(legacy)) {
-        try {
-            fs.renameSync(legacy, current);
-        }
-        catch { }
-    }
-    return current;
-}
-function loadTokens() {
-    try {
-        const store = JSON.parse(fs.readFileSync(tokenStorePath(), 'utf-8'));
-        if (Array.isArray(store.tokens))
-            return store;
-    }
-    catch { }
-    return { tokens: [] };
-}
-function saveTokens(store) {
-    try {
-        fs.mkdirSync(resolvePaths().instanceDir, { recursive: true });
-        const tmp = tokenStorePath() + '.tmp';
-        fs.writeFileSync(tmp, JSON.stringify(store, null, 2));
-        fs.renameSync(tmp, tokenStorePath());
-    }
-    catch { }
-}
-function pruneExpired(store, now) {
-    const before = store.tokens.length;
-    store.tokens = store.tokens.filter(t => now - t.lastActive < TOKEN_TTL_MS);
-    return store.tokens.length !== before;
+async function remoteAuth(type, payload = {}) {
+    const response = await ipcQuery(resolvePaths().socket, { type, ...payload }, 2_000);
+    return response && typeof response === 'object' ? response : null;
 }
-function validAuthorizedBy(value) {
-    if (typeof value !== 'string')
-        return undefined;
-    const normalized = value.trim();
-    if (!normalized || normalized.length > 512 || /[\r\n]/.test(normalized))
-        return undefined;
-    return normalized;
-}
-function getValidTokenRecord(token, now) {
+async function validateRemoteToken(token) {
     if (!token)
         return null;
-    const store = loadTokens();
-    const changed = pruneExpired(store, now);
-    const rec = store.tokens.find(t => t.token === token);
-    if (rec) {
-        rec.lastActive = now;
-        saveTokens(store);
-        return rec;
-    }
-    if (changed)
-        saveTokens(store);
-    return null;
+    const result = await remoteAuth('remote-auth.validate', { token });
+    if (!result?.ok || result.valid !== true)
+        return null;
+    return result.authorizedBy ? { authorizedBy: result.authorizedBy } : {};
 }
-function validateAndRenew(token, now) {
-    return getValidTokenRecord(token, now) !== null;
+async function issueLocalRemoteToken(label) {
+    const result = await remoteAuth('remote-auth.issue-local', { label });
+    return result?.ok && typeof result.token === 'string' ? result.token : null;
 }
 // ── Static ──
 // 经 AUN Service Proxy 转发时，proxy-server 注入 x-forwarded-prefix 头，
@@ -469,11 +414,8 @@ function isLocalDirect(req) {
     const providerAid = req.headers['x-aun-provider-aid'];
     return !providerAid || (Array.isArray(providerAid) ? providerAid.length === 0 : !providerAid.trim());
 }
-function genPairingCode() {
-    return String(crypto.randomInt(0, 1000000)).padStart(6, '0');
-}
 // ── Pair handler ──
-function handlePair(req, res, pairingCode, pairingExpiry, authorizedBy, log) {
+function handlePair(req, res, log) {
     let body = '';
     req.on('data', (chunk) => { body += chunk; if (body.length > 4096)
         req.destroy(); });
@@ -484,47 +426,34 @@ function handlePair(req, res, pairingCode, pairingExpiry, authorizedBy, log) {
             code = String(JSON.parse(body).code || '');
         }
         catch { }
-        if (Date.now() > pairingExpiry) {
-            res.writeHead(403, { 'Content-Type': 'application/json' }).end(JSON.stringify({ ok: false, reason: '配对码已过期，请重启 watch' }));
-            log(`✗ 配对失败（码已过期） from ${ip}`);
-            return;
-        }
-        if (code !== pairingCode) {
-            res.writeHead(403, { 'Content-Type': 'application/json' }).end(JSON.stringify({ ok: false, reason: '配对码错误' }));
-            log(`✗ 配对失败（码错误: ${code}） from ${ip}`);
-            return;
-        }
-        const now = Date.now();
-        const token = crypto.randomBytes(32).toString('hex');
-        const store = loadTokens();
-        pruneExpired(store, now);
-        store.tokens.push({
-            token,
-            createdAt: now,
-            lastActive: now,
+        void remoteAuth('remote-auth.redeem', {
+            code,
             label: ip,
-            ...(authorizedBy ? { authorizedBy } : {}),
+        }).then(result => {
+            if (!result?.ok || typeof result.token !== 'string') {
+                const status = result?.code === 'PAIRING_EXPIRED' ? 403 : 403;
+                res.writeHead(status, { 'Content-Type': 'application/json' }).end(JSON.stringify({ ok: false, reason: result?.error ?? '配对失败' }));
+                log(`✗ 配对失败（${result?.code ?? 'daemon-unavailable'}） from ${ip}`);
+                return;
+            }
+            res.writeHead(200, { 'Content-Type': 'application/json' }).end(JSON.stringify({ ok: true, token: result.token }));
+            log(`✓ 配对成功 from ${ip}（daemon token 缓存 30 天，有访问自动续期）`);
+        }).catch(error => {
+            res.writeHead(503, { 'Content-Type': 'application/json' }).end(JSON.stringify({ ok: false, reason: 'daemon unavailable' }));
+            log(`✗ 配对失败（daemon unavailable: ${error instanceof Error ? error.message : String(error)}） from ${ip}`);
         });
-        saveTokens(store);
-        res.writeHead(200, { 'Content-Type': 'application/json' }).end(JSON.stringify({ ok: true, token }));
-        log(`✓ 配对成功 from ${ip}（token 缓存 30 天，有访问自动续期${authorizedBy ? `，批准者 ${authorizedBy}` : ''}）`);
     });
 }
 /**
  * 本地直连免配对：自动发 token。远程（隧道或真远程）需配对码。
  * 本地直连判定：socket 来源是回环 AND 无 x-aun-provider-aid 头（非隧道）。
  */
-function issueLocalDirectToken(req, log) {
+async function issueLocalDirectToken(req, log) {
     if (!isLocalDirect(req))
         return null;
-    const now = Date.now();
-    const token = crypto.randomBytes(32).toString('hex');
-    const store = loadTokens();
-    pruneExpired(store, now);
-    const ip = clientIp(req);
-    store.tokens.push({ token, createdAt: now, lastActive: now, label: `local-direct:${ip}` });
-    saveTokens(store);
-    log(`✓ 本地直连自动授权 from ${ip}`);
+    const token = await issueLocalRemoteToken(`local-direct:${clientIp(req)}`);
+    if (token)
+        log(`✓ 本地直连自动授权 from ${clientIp(req)}`);
     return token;
 }
 // ── WebSocket connection ──
@@ -555,7 +484,30 @@ function handleConnection(ws, req, log, tokenRecord) {
             send({ type: 'error', message: `unknown view: ${view}` });
             return;
         }
-        const sourceParams = { ...params, __menuAuth: daemonOwnerMenuAuth(localDirect, actorAid) };
+        const sourceParams = {
+            ...params,
+            __menuAuth: daemonOwnerMenuAuth(localDirect, actorAid),
+            __ecwebRequestId: crypto.randomUUID(),
+            __ecwebEndpoint: `WS snapshot:${view}`,
+        };
+        let deactivate = null;
+        if (source.activate) {
+            try {
+                deactivate = await source.activate(sourceParams);
+            }
+            catch (e) {
+                if (generation === subscriptionGeneration)
+                    send({ type: 'error', message: `subscription failed: ${e?.message || e}` });
+                return;
+            }
+            if (generation !== subscriptionGeneration) {
+                deactivate();
+                return;
+            }
+            // Install cleanup before awaiting the initial snapshot, so a view switch
+            // or socket close releases the monitor lease immediately.
+            unsubscribe = deactivate;
+        }
         // System 视图：把 ECWeb 自身版本合并进快照（前端版本卡用）
         const decorate = (data) => (view === 'system' && data ? { ...data, ecwebVersion: ECWEB_VERSION } : data);
         let initialSnapshot;
@@ -570,16 +522,30 @@ function handleConnection(ws, req, log, tokenRecord) {
                 return;
             send({ type: 'error', message: `snapshot failed: ${e?.message || e}` });
         }
-        const nextUnsubscribe = source.subscribe(sourceParams, (data) => {
-            if (generation === subscriptionGeneration && currentView === view) {
-                send({ type: 'delta', view, data: decorate(data) });
+        let nextUnsubscribe;
+        try {
+            nextUnsubscribe = source.subscribe(sourceParams, (data) => {
+                if (generation === subscriptionGeneration && currentView === view) {
+                    send({ type: 'delta', view, data: decorate(data) });
+                }
+            });
+        }
+        catch (e) {
+            deactivate?.();
+            if (generation === subscriptionGeneration) {
+                unsubscribe = null;
+                send({ type: 'error', message: `subscription failed: ${e?.message || e}` });
             }
-        });
+            return;
+        }
         if (generation !== subscriptionGeneration) {
             nextUnsubscribe();
             return;
         }
-        unsubscribe = nextUnsubscribe;
+        unsubscribe = () => {
+            nextUnsubscribe();
+            deactivate?.();
+        };
     };
     ws.on('message', async (raw) => {
         let msg;
@@ -771,26 +737,20 @@ export async function startWatchWebServer(opts = {}) {
     if (pingResp && pingResp.protocolVersion !== undefined && pingResp.protocolVersion < PROTOCOL_VERSION) {
         log(`⚠️  evolcore protocolVersion=${pingResp.protocolVersion}，watch 期望 >=${PROTOCOL_VERSION}，部分功能可能异常`);
     }
-    let pairingCode = genPairingCode();
-    let pairingExpiry = Date.now() + PAIRING_TTL_MS;
-    let pairingAuthorizedBy;
-    function freshPairing() {
-        if (Date.now() > pairingExpiry) {
-            pairingCode = genPairingCode();
-            pairingExpiry = Date.now() + PAIRING_TTL_MS;
-            pairingAuthorizedBy = undefined;
-            log(`↺ 配对码已刷新：${pairingCode}（5 分钟有效）`);
-        }
-        return { code: pairingCode, expiresAt: pairingExpiry };
-    }
-    const server = http.createServer((req, res) => {
+    const server = http.createServer(async (req, res) => {
         const pathname = requestPath(req.url || '');
         const localDirect = isLocalDirect(req);
         if (req.method === 'GET' && (req.url || '') === '/api/available-baseagents') {
             // Base agent 可用性检测 API
-            const available = detectBaseAgents();
-            res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify(available));
+            try {
+                const available = await detectBaseAgentsAsync();
+                res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+                res.end(JSON.stringify(available));
+            }
+            catch (error) {
+                res.writeHead(500, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+                res.end(JSON.stringify({ success: false, error: error?.message || String(error) }));
+            }
         }
         else if (req.method === 'GET' && (req.url || '') === '/api/pair-code') {
             // 取码 API：仅真本地直连可用（socket 回环 + 无 x-aun-provider-aid）。
@@ -801,28 +761,24 @@ export async function startWatchWebServer(opts = {}) {
                 res.end(JSON.stringify({ error: 'forbidden' }));
                 return;
             }
-            const { code, expiresAt } = freshPairing();
-            // daemon 通过 localhost 取码时带上 AUN 已认证的 owner AID。只接受
-            // 第一次绑定，避免同一配对码在不同 owner 间被重新归属。
-            const ownerHeader = req.headers['x-evolcore-pair-authorized-by'];
-            const controlHeader = req.headers['x-evolcore-control-token'];
-            const requestedOwner = validAuthorizedBy(Array.isArray(ownerHeader) ? ownerHeader[0] : ownerHeader);
-            const suppliedControlToken = Array.isArray(controlHeader) ? controlHeader[0] : controlHeader;
-            if (!pairingAuthorizedBy && requestedOwner && matchesDaemonControlToken(suppliedControlToken)) {
-                pairingAuthorizedBy = requestedOwner;
+            const pair = await remoteAuth('remote-auth.pair-code');
+            if (!pair?.ok || typeof pair.code !== 'string' || typeof pair.expiresAt !== 'number') {
+                res.writeHead(503, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'daemon unavailable' }));
+                return;
             }
             res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ code, expiresAt }));
+            res.end(JSON.stringify({ code: pair.code, expiresAt: pair.expiresAt }));
         }
         else if (req.method === 'POST' && (req.url || '').startsWith('/api/pair')) {
-            // 配对 API：远程（隧道/真远程）需要配对码；本地直连自动发 token 跳过配对。
-            const autoToken = issueLocalDirectToken(req, log);
+            // 配对 API：远程（隧道/真远程）需要 daemon 配对码；本地直连自动发 daemon token。
+            const autoToken = await issueLocalDirectToken(req, log);
             if (autoToken) {
                 res.writeHead(200, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ ok: true, token: autoToken }));
                 return;
             }
-            handlePair(req, res, pairingCode, pairingExpiry, pairingAuthorizedBy, log);
+            handlePair(req, res, log);
         }
         else if (pathname === '/api/basic-settings' || pathname === '/api/basic-settings/secret') {
             const authHeader = req.headers.authorization || '';
@@ -830,11 +786,11 @@ export async function startWatchWebServer(opts = {}) {
             const { query } = parseUrl(req.url || '');
             let token = bearerToken || query.token || '';
             if (!token) {
-                const autoToken = issueLocalDirectToken(req, log);
+                const autoToken = await issueLocalDirectToken(req, log);
                 if (autoToken)
                     token = autoToken;
             }
-            if (!token || !validateAndRenew(token, Date.now())) {
+            if (!token || !(await validateRemoteToken(token))) {
                 res.writeHead(401, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ success: false, error: 'unauthorized' }));
                 return;
@@ -858,11 +814,11 @@ export async function startWatchWebServer(opts = {}) {
             const { query } = parseUrl(req.url || '');
             let token = bearerToken || query.token || '';
             if (!token) {
-                const autoToken = issueLocalDirectToken(req, log);
+                const autoToken = await issueLocalDirectToken(req, log);
                 if (autoToken)
                     token = autoToken;
             }
-            if (!token || !validateAndRenew(token, Date.now())) {
+            if (!token || !(await validateRemoteToken(token))) {
                 res.writeHead(401, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'unauthorized' }));
                 return;
@@ -875,11 +831,11 @@ export async function startWatchWebServer(opts = {}) {
             const { query } = parseUrl(req.url || '');
             let token = bearerToken || query.token || '';
             if (!token) {
-                const autoToken = issueLocalDirectToken(req, log);
+                const autoToken = await issueLocalDirectToken(req, log);
                 if (autoToken)
                     token = autoToken;
             }
-            if (!token || !validateAndRenew(token, Date.now())) {
+            if (!token || !(await validateRemoteToken(token))) {
                 res.writeHead(401, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'unauthorized' }));
                 return;
@@ -893,11 +849,11 @@ export async function startWatchWebServer(opts = {}) {
             const { query } = parseUrl(req.url || '');
             let token = bearerToken || query.token || '';
             if (!token) {
-                const autoToken = issueLocalDirectToken(req, log);
+                const autoToken = await issueLocalDirectToken(req, log);
                 if (autoToken)
                     token = autoToken;
             }
-            const tokenRecord = token ? getValidTokenRecord(token, Date.now()) : null;
+            const tokenRecord = token ? await validateRemoteToken(token) : null;
             if (!token || !tokenRecord) {
                 res.writeHead(401, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'unauthorized' }));
@@ -912,11 +868,11 @@ export async function startWatchWebServer(opts = {}) {
             const { query } = parseUrl(req.url || '');
             let token = bearerToken || query.token || '';
             if (!token) {
-                const autoToken = issueLocalDirectToken(req, log);
+                const autoToken = await issueLocalDirectToken(req, log);
                 if (autoToken)
                     token = autoToken;
             }
-            const tokenRecord = token ? getValidTokenRecord(token, Date.now()) : null;
+            const tokenRecord = token ? await validateRemoteToken(token) : null;
             if (!token || !tokenRecord) {
                 res.writeHead(401, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'unauthorized' }));
@@ -930,11 +886,11 @@ export async function startWatchWebServer(opts = {}) {
             const { query } = parseUrl(req.url || '');
             let token = bearerToken || query.token || '';
             if (!token) {
-                const autoToken = issueLocalDirectToken(req, log);
+                const autoToken = await issueLocalDirectToken(req, log);
                 if (autoToken)
                     token = autoToken;
             }
-            const tokenRecord = token ? getValidTokenRecord(token, Date.now()) : null;
+            const tokenRecord = token ? await validateRemoteToken(token) : null;
             if (!token || !tokenRecord) {
                 res.writeHead(401, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'unauthorized' }));
@@ -947,11 +903,11 @@ export async function startWatchWebServer(opts = {}) {
         }
     });
     const wss = new WebSocketServer({ noServer: true });
-    server.on('upgrade', (req, socket, head) => {
+    server.on('upgrade', async (req, socket, head) => {
         const { query } = parseUrl(req.url || '');
         // 本地直连免 token；远程需 token。
         const localDirect = isLocalDirect(req);
-        const tokenRecord = localDirect ? null : getValidTokenRecord(query.token || '', Date.now());
+        const tokenRecord = localDirect ? null : await validateRemoteToken(query.token || '');
         const authed = localDirect || tokenRecord !== null;
         wss.handleUpgrade(req, socket, head, (ws) => {
             if (!authed) {
@@ -963,11 +919,12 @@ export async function startWatchWebServer(opts = {}) {
         });
     });
     const { port, displaced } = await bindPort(server, opts.port ?? DEFAULT_PORT, log);
+    const initialPair = await remoteAuth('remote-auth.pair-code');
     return {
         url: `http://0.0.0.0:${port}`,
         port,
         displaced,
-        pairingCode,
+        pairingCode: initialPair?.ok && typeof initialPair.code === 'string' ? initialPair.code : '',
         close() {
             return new Promise((resolve) => {
                 // 强制断开所有 WS 客户端（graceful close 握手可能永不完成）