herdr-remote-relay 0.2.1 → 0.2.3

package/README.md

@@ -1,27 +1,21 @@
 # herdr-remote-relay
 
-Standalone relay server for [Herdr Remote](https://www.npmjs.com/package/herdr-remote):
-it serves the mobile web terminal and brokers browser ↔ workstation sessions.
+*[English](README.md) · [简体中文](README.zh-CN.md)*
 
-Its only runtime dependency is `ws`, so the machine running it needs no
-compiler, no Herdr and no plugin. It never runs a shell and never touches your
-Herdr socket — only the host connector on your own workstation does that.
+Standalone relay server and WebUI for [Herdr Remote](https://www.npmjs.com/package/herdr-remote).
 
-**You usually do not need to install this yourself.** `herdr-remote` starts a
-relay locally unless you point it at one you host. Install this package only
-when you want to reach your workstation from outside your own network.
+Brokers WebSocket connections between browsers and workstation host connectors. Runtime dependency is `ws` only; requires no compilers or Herdr binaries.
+
+> **Note**: `herdr-remote` runs a local relay automatically. Install this package only when deploying a dedicated relay server.
+
+## Installation
 
 ```bash
 npm install -g herdr-remote-relay
-herdr-remote-relay --public-url https://herdr.example.com \
-  --password your-password --admin-token your-long-random-admin-token \
-  --trust-proxy
+herdr-remote-relay --public-url https://herdr.example.com --password <password>
 ```
 
-Requirements: Node.js 22+, a domain name, and TLS. Terminate TLS in a reverse
-proxy in front of the relay — nginx, Caddy, Traefik and Cloudflare Tunnel all
-work. Example configs for nginx, Cloudflare Tunnel, systemd and Docker Compose
-ship in `deploy/` inside this package.
+Requirements: Node.js 22+, TLS reverse proxy (nginx, Caddy, Cloudflare Tunnel).
 
 ## Docker
 
@@ -32,7 +26,7 @@ docker run -d --name herdr-relay --restart unless-stopped \
   -e RELAY_BIND=0.0.0.0 \
   -e RELAY_PUBLIC_URL=https://herdr.example.com \
   -e RELAY_PASSWORD=your-password \
-  -e RELAY_ADMIN_TOKEN=your-long-random-admin-token \
+  -e RELAY_ADMIN_TOKEN=your-admin-token \
   -e RELAY_TRUST_PROXY=1 \
   -e RELAY_AUTH_STATE_FILE=/data/relay-auth.json \
   node:22-alpine npx -y herdr-remote-relay
@@ -40,63 +34,41 @@ docker run -d --name herdr-relay --restart unless-stopped \
 
 ## Options
 
-Every setting has a flag, an environment variable and a JSON config file key
-(`--config`, or `HERDR_RELAY_CONFIG`). Precedence runs defaults → file →
-environment → flags.
-
-| Variable | Default | |
-|---|---|---|
-| `RELAY_PUBLIC_URL` | `http://127.0.0.1:8787` | URL browsers open |
-| `RELAY_PASSWORD` | *(none)* | Password a workstation must present. **Empty = public relay** |
-| `RELAY_ADMIN_TOKEN` | *(none)* | Operator token for the relay dashboard at `/admin` |
-| `RELAY_BIND` | `127.0.0.1` | Listen address (`0.0.0.0` in Docker) |
-| `RELAY_PORT` | `8787` | Listen port |
-| `RELAY_TRUST_PROXY` | `0` | Set to `1` behind a reverse proxy |
-| `RELAY_AUTH_STATE_FILE` | `~/.local/state/herdr-remote-relay/relay-auth.json` | Device records |
-| `RELAY_ALLOWED_ORIGINS` | *(same-origin)* | Extra browser origins, comma separated |
-| `RELAY_MAX_CLIENTS_PER_HOST` | `16` | Browsers per workstation |
-| `RELAY_DEPLOYMENT_MODE` | `remote` | `local` is reserved for the workstation-managed relay |
-
-Whatever proxy you put in front must forward WebSocket upgrades and must not
-time out idle connections — a terminal is idle between keystrokes.
-
-## Public relays
-
-Leaving `RELAY_PASSWORD` empty makes the relay public: anyone may connect a
-workstation to it. That is safe to share, because each workstation is reachable
-only through its own host token — generated on that machine, never handed out
-by the relay. Nobody else can pair a device to your terminal.
-
-What a public relay does give away is bandwidth and the fact that your
-workstation is online. Set a password if that matters.
-
-## Connect a workstation
-
-On the workstation, run `herdr-remote`, open the **Relay** tab and set the
-access mode to **Self-hosted relay**, the relay URL to
-`wss://herdr.example.com`, and the relay password to the same `RELAY_PASSWORD`.
-Then check:
-
+| Option | Env Var | Default | Description |
+|---|---|---|---|
+| `--public-url` | `RELAY_PUBLIC_URL` | `http://127.0.0.1:8787` | Public URL for browsers |
+| `--password` | `RELAY_PASSWORD` | *(empty)* | Workstation join password (empty = public) |
+| `--admin-token` | `RELAY_ADMIN_TOKEN` | *(empty)* | Operator token for `/admin` |
+| `--bind` | `RELAY_BIND` | `127.0.0.1` | Listen address |
+| `--port` | `RELAY_PORT` | `8787` | Listen port |
+| `--trust-proxy` | `RELAY_TRUST_PROXY` | `0` | Trust `X-Forwarded-For` header (`1` behind proxy) |
+| `--state-file` | `RELAY_AUTH_STATE_FILE` | `~/.local/state/herdr-remote-relay/relay-auth.json` | Auth state file path |
+| `--allowed-origins` | `RELAY_ALLOWED_ORIGINS` | *(same-origin)* | Allowed CORS origins, comma-separated |
+| `--max-clients` | `RELAY_MAX_CLIENTS_PER_HOST` | `16` | Maximum browser clients per host |
+| `--max-hosts` | `RELAY_MAX_HOSTS` | `1024` | Maximum workstations on this relay |
+| `--max-pending-handshakes` | `RELAY_MAX_PENDING_HANDSHAKES` | `1024` | Maximum unauthenticated WebSockets |
+| `--max-buffered-bytes` | `RELAY_MAX_BUFFERED_BYTES_PER_CLIENT` | `4194304` | Maximum queued bytes per browser |
+| `--host-reconnect-grace-ms` | `RELAY_HOST_RECONNECT_GRACE_MS` | `30000` | Host reconnect grace period |
+| `--config` | `HERDR_RELAY_CONFIG` | *(none)* | JSON configuration file path |
+
+Reverse proxies must pass WebSocket `Upgrade` headers and maintain long idle timeouts. The relay disables WebSocket compression and enables TCP NoDelay for terminal frames. When no browser is attached, business heartbeats stop and only WebSocket liveness probes remain. Deployment examples for nginx, systemd, and Docker Compose are in `deploy/`.
+
+## Multiple workstations and isolation
+
+A browser can save multiple workstation pairings. The switcher in the lower-left WebUI only shows profiles saved by that browser; it never enumerates other relay hosts. `/api/status` is scoped to the workstation bound to the presented credentials, while only `RELAY_ADMIN_TOKEN` can inspect relay-wide state. `/healthz` does not disclose host or client counts.
+
+## Connecting a Workstation
+
+In `herdr-remote` TUI under **Relay** tab:
+- Set mode to **Self-hosted relay**
+- Set Relay URL to `wss://herdr.example.com`
+- Set Relay Password to matching `RELAY_PASSWORD`
+
+Check connection status:
 ```bash
-curl https://herdr.example.com/healthz    # hosts should be 1
+curl https://herdr.example.com/healthz
 ```
 
-| Symptom | Cause |
-|---|---|
-| `hosts: 0` | Workstation not connected — check `herdr-remote status` |
-| `relay_password_required` | Password differs between the two sides |
-| Page loads, terminal never opens | Proxy is not forwarding `Upgrade` headers |
-| Drops after ~60s idle | Proxy read timeout too short |
-
-## Security
-
-- Tokens are stored as SHA-256 hashes, never in clear text. Terminal content is
-  never written to disk.
-- Pairing codes are single-use, expire in ten minutes, and are rate limited.
-- The `/admin` operator credential is separate from the workstation join
-  password and from paired device tokens.
-- Losing the state file just means re-pairing your devices.
-
 ## License
 
 MIT

package/README.zh-CN.md

@@ -0,0 +1,74 @@
+# herdr-remote-relay
+
+*[English](README.md) · [简体中文](README.zh-CN.md)*
+
+[Herdr Remote](https://www.npmjs.com/package/herdr-remote) 的独立 Relay 服务端与 WebUI。
+
+负责在浏览器与工作站主机连接器之间转发 WebSocket 连接。运行时仅依赖 `ws`，无需编译环境或 Herdr 二进制文件。
+
+> **提示**：`herdr-remote` 默认在本地自动运行 relay。仅在需要部署独立中继服务器时安装本包。
+
+## 安装
+
+```bash
+npm install -g herdr-remote-relay
+herdr-remote-relay --public-url https://herdr.example.com --password <密码>
+```
+
+前置要求：Node.js 22+、TLS 反向代理（nginx、Caddy、Cloudflare Tunnel 等）。
+
+## Docker 运行
+
+```bash
+docker run -d --name herdr-relay --restart unless-stopped \
+  -p 127.0.0.1:8787:8787 \
+  -v herdr-relay:/data \
+  -e RELAY_BIND=0.0.0.0 \
+  -e RELAY_PUBLIC_URL=https://herdr.example.com \
+  -e RELAY_PASSWORD=你的密码 \
+  -e RELAY_ADMIN_TOKEN=你的管理令牌 \
+  -e RELAY_TRUST_PROXY=1 \
+  -e RELAY_AUTH_STATE_FILE=/data/relay-auth.json \
+  node:22-alpine npx -y herdr-remote-relay
+```
+
+## 配置参数
+
+| 参数 | 环境变量 | 默认值 | 说明 |
+|---|---|---|---|
+| `--public-url` | `RELAY_PUBLIC_URL` | `http://127.0.0.1:8787` | 浏览器访问的公开地址 |
+| `--password` | `RELAY_PASSWORD` | *(空)* | 工作站接入密码（留空为公用 Relay） |
+| `--admin-token` | `RELAY_ADMIN_TOKEN` | *(空)* | `/admin` 管理后台操作员令牌 |
+| `--bind` | `RELAY_BIND` | `127.0.0.1` | 监听地址 |
+| `--port` | `RELAY_PORT` | `8787` | 监听端口 |
+| `--trust-proxy` | `RELAY_TRUST_PROXY` | `0` | 信任 `X-Forwarded-For` 头（反代后设为 `1`） |
+| `--state-file` | `RELAY_AUTH_STATE_FILE` | `~/.local/state/herdr-remote-relay/relay-auth.json` | 认证状态文件路径 |
+| `--allowed-origins` | `RELAY_ALLOWED_ORIGINS` | *(同源)* | 允许的跨域源，逗号分隔 |
+| `--max-clients` | `RELAY_MAX_CLIENTS_PER_HOST` | `16` | 每台工作站最大客户端连接数 |
+| `--max-hosts` | `RELAY_MAX_HOSTS` | `1024` | relay 最大工作站数 |
+| `--max-pending-handshakes` | `RELAY_MAX_PENDING_HANDSHAKES` | `1024` | 最大未认证 WebSocket 握手数 |
+| `--max-buffered-bytes` | `RELAY_MAX_BUFFERED_BYTES_PER_CLIENT` | `4194304` | 单个慢浏览器最大待发送缓冲 |
+| `--host-reconnect-grace-ms` | `RELAY_HOST_RECONNECT_GRACE_MS` | `30000` | 工作站断线恢复宽限时间 |
+| `--config` | `HERDR_RELAY_CONFIG` | *(无)* | JSON 配置文件路径 |
+
+反向代理必须转发 WebSocket `Upgrade` 头，并设置较长空闲超时时间。relay 会关闭 WebSocket 压缩并启用 TCP NoDelay；没有浏览器连接时，工作站会停止业务 heartbeat，仅保留 WebSocket 存活探测以节省流量。`deploy/` 目录下提供 nginx、systemd 与 Docker Compose 示例。
+
+## 多工作站与隔离
+
+同一个浏览器可以保存多个工作站配对，WebUI 左下角的实例切换器只显示本地已保存的实例，不会枚举 relay 上的其他工作站。`/api/status` 按设备令牌绑定的工作站隔离，只有 `RELAY_ADMIN_TOKEN` 才能查看 relay 全局状态；`/healthz` 不公开工作站和客户端数量。
+
+## 工作站连接
+
+在工作站的 `herdr-remote` TUI 中进入 **Relay** 页面：
+- 访问方式选择 **自建 relay**
+- Relay 地址填写 `wss://herdr.example.com`
+- Relay 密码填写对应的 `RELAY_PASSWORD`
+
+验证连接状态：
+```bash
+curl https://herdr.example.com/healthz
+```
+
+## 开源协议
+
+MIT

package/bin/herdr-remote-relay.js

@@ -17,22 +17,25 @@ const USAGE = `herdr-remote-relay ${VERSION} — standalone relay for Herdr Remo
 Usage: herdr-remote-relay [options]
 
 Options:
-  --password <password>      Password a workstation must present (RELAY_PASSWORD).
-                             Leave unset for a public relay.
-  --admin-token <token>      Operator token for the relay dashboard (RELAY_ADMIN_TOKEN).
-  --deployment-mode <mode>   WebUI deployment mode: local or remote (default remote).
-  --public-url <url>         Public URL browsers use (RELAY_PUBLIC_URL)
+  --password <password>      Workstation password (RELAY_PASSWORD, empty for public)
+  --admin-token <token>      Admin dashboard token (RELAY_ADMIN_TOKEN)
+  --deployment-mode <mode>   Deployment mode: local or remote (default remote)
+  --public-url <url>         Public URL for browsers (RELAY_PUBLIC_URL)
   --bind <address>           Listen address (default 127.0.0.1, RELAY_BIND)
   --port <number>            Listen port (default 8787, RELAY_PORT)
-  --trust-proxy              Read X-Forwarded-For for rate limiting (RELAY_TRUST_PROXY)
-  --state-file <file>        Where device/host records are stored (RELAY_AUTH_STATE_FILE)
-  --allowed-origins <list>   Extra comma-separated browser origins (RELAY_ALLOWED_ORIGINS)
-  --max-clients <number>     Max browsers per workstation (RELAY_MAX_CLIENTS_PER_HOST)
-  --config <file>            JSON config file (also HERDR_RELAY_CONFIG)
-  -h, --help                 Show this help
-  -v, --version              Show the version
+  --trust-proxy              Trust X-Forwarded-For headers (RELAY_TRUST_PROXY)
+  --state-file <file>        Auth state file path (RELAY_AUTH_STATE_FILE)
+  --allowed-origins <list>   Allowed browser origins, comma-separated
+  --max-clients <number>     Max clients per workstation (default 16)
+  --max-hosts <number>       Max workstations on this relay (default 1024)
+  --max-pending-handshakes <n> Max unauthenticated WebSockets (default 1024)
+  --max-buffered-bytes <n>   Max queued bytes per browser (default 4194304)
+  --host-reconnect-grace-ms <n> Grace period for host handoff (default 30000)
+  --config <file>            JSON config file (HERDR_RELAY_CONFIG)
+  -h, --help                 Show help
+  -v, --version              Show version
 
-See docs/self-hosted-relay.md.
+Guide: docs/self-hosted-relay.md
 `;
 
 function webUiBuilt() {

package/config.example.json

@@ -4,7 +4,11 @@
     "host": "127.0.0.1",
     "port": 8787,
     "publicUrl": "https://herdr.example.com",
-    "trustProxy": true
+    "trustProxy": true,
+    "maxHosts": 1024,
+    "maxPendingHandshakes": 1024,
+    "maxBufferedBytesPerClient": 4194304,
+    "hostReconnectGraceMs": 30000
   },
   "auth": {
     "password": "change-me",

package/deploy/systemd/relay.env.example

@@ -5,6 +5,11 @@ RELAY_PUBLIC_URL=https://herdr.example.com
 RELAY_DEPLOYMENT_MODE=remote
 RELAY_BIND=127.0.0.1
 RELAY_PORT=8787
+RELAY_MAX_HOSTS=1024
+RELAY_MAX_PENDING_HANDSHAKES=1024
+RELAY_MAX_CLIENTS_PER_HOST=16
+RELAY_MAX_BUFFERED_BYTES_PER_CLIENT=4194304
+RELAY_HOST_RECONNECT_GRACE_MS=30000
 
 # Password a workstation must present. Leave empty for a public relay.
 RELAY_PASSWORD=change-me

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "herdr-remote-relay",
-  "version": "0.2.1",
-  "description": "Standalone relay server for Herdr Remote: serves the mobile web terminal and brokers browser <-> workstation sessions",
+  "version": "0.2.3",
+  "description": "Standalone relay server and web terminal for Herdr Remote",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -37,7 +37,8 @@
     "src",
     "web/dist",
     "deploy",
-    "config.example.json"
+    "config.example.json",
+    "README.zh-CN.md"
   ],
   "scripts": {
     "build": "npm --prefix web run build",

package/src/auth-store.js

@@ -18,6 +18,11 @@ function nowIso(now = Date.now()) {
   return new Date(now).toISOString();
 }
 
+function validHostId(value) {
+  return typeof value === 'string'
+    && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(value);
+}
+
 class AuthStore {
   constructor({ stateFile, pairingTtlMs = 10 * 60 * 1000, deviceTtlMs = 30 * 24 * 60 * 60 * 1000, maxDevices = 32, password = null } = {}) {
     if (!stateFile) throw new TypeError('stateFile is required');
@@ -57,7 +62,7 @@ class AuthStore {
    * relay nobody else can impersonate an enrolled host or pair a device to it.
    */
   registerHost(hostId, token, password = null, now = Date.now()) {
-    if (typeof hostId !== 'string' || hostId.length < 1 || hostId.length > 128 || typeof token !== 'string' || token.length < 16) {
+    if (!validHostId(hostId) || typeof token !== 'string' || token.length < 16 || token.length > 4096) {
       return { ok: false, code: 'invalid_host_credentials', message: 'hostId and token are required' };
     }
     if (!this.checkPassword(password)) {
@@ -84,7 +89,7 @@ class AuthStore {
 
   /** Verify a host token without enrolling anything. */
   authenticateHost(hostId, token) {
-    if (typeof hostId !== 'string' || typeof token !== 'string' || token.length < 16) return false;
+    if (!validHostId(hostId) || typeof token !== 'string' || token.length < 16 || token.length > 4096) return false;
     const existing = this.state.hosts[hostId];
     return Boolean(existing) && equalHash(existing.tokenHash, hash(token));
   }
@@ -94,7 +99,7 @@ class AuthStore {
   }
 
   startPairing(hostId, publicUrl, now = Date.now()) {
-    if (!this.state.hosts[hostId]) {
+    if (!validHostId(hostId) || !this.state.hosts[hostId]) {
       const error = new Error('host is not connected or enrolled');
       error.code = 'host_not_found';
       throw error;
@@ -103,7 +108,7 @@ class AuthStore {
     let code;
     do {
       code = randomToken(4).toUpperCase().replace(/[-_]/g, '').slice(0, 6);
-    } while ([...this.pairings.values()].some((pairing) => pairing.codeHash === hash(code)));
+    } while ([...this.pairings.values()].some((pairing) => equalHash(pairing.codeHash, hash(code))));
     const expiresAt = now + this.pairingTtlMs;
     this.pairings.set(code, {
       codeHash: hash(code),
@@ -119,7 +124,7 @@ class AuthStore {
     this.cleanup(now);
     const normalized = code.trim().toUpperCase();
     const pairing = this.pairings.get(normalized);
-    if (!pairing || pairing.expiresAt <= now || pairing.codeHash !== hash(normalized)) return null;
+    if (!pairing || pairing.expiresAt <= now || !equalHash(pairing.codeHash, hash(normalized))) return null;
     this.pairings.delete(normalized);
 
     const devices = Object.values(this.state.devices);

package/src/metrics.js

@@ -26,23 +26,92 @@ class RelayMetrics {
       closedPtysCleaned: 0,
       deadConnectionsClosed: 0,
       idleHostsTerminated: 0,
+      slowClientsDropped: 0,
       lastCleanupAt: null,
     };
     this.lastSample = { at: this.startedAt, bytesIn: 0, bytesOut: 0, framesIn: 0, framesOut: 0 };
+    this.hostTraffic = new Map();
     this.cpuSampleAt = process.hrtime.bigint();
     this.cpuSample = process.cpuUsage();
     this.eventLoop = monitorEventLoopDelay({ resolution: 20 });
     this.eventLoop.enable();
   }
 
-  recordIn(bytes) {
-    this.bytesIn += bytes;
+  hostCounter(hostId) {
+    if (typeof hostId !== 'string' || hostId.length === 0) return null;
+    let counter = this.hostTraffic.get(hostId);
+    if (!counter) {
+      counter = {
+        bytesIn: 0,
+        bytesOut: 0,
+        framesIn: 0,
+        framesOut: 0,
+        sampleAt: Date.now(),
+        sampleBytesIn: 0,
+        sampleBytesOut: 0,
+        sampleFramesIn: 0,
+        sampleFramesOut: 0,
+      };
+      this.hostTraffic.set(hostId, counter);
+    }
+    return counter;
+  }
+
+  recordIn(bytes, hostId = null) {
+    const amount = Math.max(0, Number(bytes) || 0);
+    this.bytesIn += amount;
     this.framesIn += 1;
+    const counter = this.hostCounter(hostId);
+    if (counter) {
+      counter.bytesIn += amount;
+      counter.framesIn += 1;
+    }
   }
 
-  recordOut(bytes) {
-    this.bytesOut += bytes;
+  recordOut(bytes, hostId = null) {
+    const amount = Math.max(0, Number(bytes) || 0);
+    this.bytesOut += amount;
     this.framesOut += 1;
+    const counter = this.hostCounter(hostId);
+    if (counter) {
+      counter.bytesOut += amount;
+      counter.framesOut += 1;
+    }
+  }
+
+  forgetHost(hostId) {
+    if (typeof hostId === 'string') this.hostTraffic.delete(hostId);
+  }
+
+  hostThroughput(hostId, now = Date.now()) {
+    const counter = this.hostCounter(hostId);
+    if (!counter) return {
+      bytesIn: 0,
+      bytesOut: 0,
+      bytesInPerSec: 0,
+      bytesOutPerSec: 0,
+      framesIn: 0,
+      framesOut: 0,
+      framesInPerSec: 0,
+      framesOutPerSec: 0,
+    };
+    const elapsedMs = now - counter.sampleAt;
+    const throughput = {
+      bytesIn: counter.bytesIn,
+      bytesOut: counter.bytesOut,
+      bytesInPerSec: bytesPerSecond(counter.bytesIn, counter.sampleBytesIn, elapsedMs),
+      bytesOutPerSec: bytesPerSecond(counter.bytesOut, counter.sampleBytesOut, elapsedMs),
+      framesIn: counter.framesIn,
+      framesOut: counter.framesOut,
+      framesInPerSec: bytesPerSecond(counter.framesIn, counter.sampleFramesIn, elapsedMs),
+      framesOutPerSec: bytesPerSecond(counter.framesOut, counter.sampleFramesOut, elapsedMs),
+    };
+    counter.sampleAt = now;
+    counter.sampleBytesIn = counter.bytesIn;
+    counter.sampleBytesOut = counter.bytesOut;
+    counter.sampleFramesIn = counter.framesIn;
+    counter.sampleFramesOut = counter.framesOut;
+    return throughput;
   }
 
   recordCleanup(name, amount = 1) {
@@ -74,7 +143,7 @@ class RelayMetrics {
     };
   }
 
-  snapshot({ clients = [], hosts = [], ptys = [], sample = true } = {}) {
+  snapshot({ clients = [], hosts = [], ptys = [], sample = true, scopeHostId = null } = {}) {
     const now = Date.now();
     const elapsedMs = now - this.lastSample.at;
     const throughput = {
@@ -92,22 +161,27 @@ class RelayMetrics {
     }
     const memory = process.memoryUsage();
     const load = os.loadavg();
-    const controller = clients.find((client) => client.role === 'controller');
+    // Every attached window has full input, so there is no "active controller"
+    // to name: reporting the first of them as one had an operator reading a
+    // distinction that does not exist. The host is still worth naming, and any
+    // client knows which workstation it is on.
+    const anyClient = clients[0];
+    const scopedThroughput = scopeHostId ? this.hostThroughput(scopeHostId, now) : throughput;
     return {
       version: this.version,
       protocolVersion: this.protocolVersion,
       uptimeSeconds: Math.floor((now - this.startedAt) / 1000),
       startTime: new Date(this.startedAt).toISOString(),
       serverTime: new Date(now).toISOString(),
-      activeControllerId: controller?.id || null,
-      activeHostId: controller?.hostId || hosts[0]?.id || null,
+      activeControllerId: null,
+      activeHostId: anyClient?.hostId || hosts[0]?.id || null,
       clients,
       hosts,
       ptys,
       clientCount: clients.length,
       hostCount: hosts.length,
       ptyCount: ptys.length,
-      throughput,
+      throughput: scopedThroughput,
       cpu: {
         load1m: finite(load[0]),
         load5m: finite(load[1]),
@@ -130,6 +204,7 @@ class RelayMetrics {
 
   close() {
     this.eventLoop.disable();
+    this.hostTraffic.clear();
   }
 }
 

package/src/relay-config.js

@@ -33,8 +33,12 @@ const DEFAULTS = {
     publicUrl: 'http://127.0.0.1:8787',
     maxPayloadBytes: 1024 * 1024,
     maxClientsPerHost: 16,
+    maxHosts: 1024,
+    maxPendingHandshakes: 1024,
+    maxBufferedBytesPerClient: 4 * 1024 * 1024,
     allowedOrigins: [],
     trustProxy: false,
+    hostReconnectGraceMs: 30 * 1000,
   },
   auth: {
     pairingTtlMs: 10 * 60 * 1000,
@@ -147,6 +151,10 @@ function applyEnvironment(config, env) {
   if (env.RELAY_PUBLIC_URL) config.relay.publicUrl = env.RELAY_PUBLIC_URL;
   if (env.RELAY_MAX_PAYLOAD_BYTES) config.relay.maxPayloadBytes = env.RELAY_MAX_PAYLOAD_BYTES;
   if (env.RELAY_MAX_CLIENTS_PER_HOST) config.relay.maxClientsPerHost = env.RELAY_MAX_CLIENTS_PER_HOST;
+  if (env.RELAY_MAX_HOSTS) config.relay.maxHosts = env.RELAY_MAX_HOSTS;
+  if (env.RELAY_MAX_PENDING_HANDSHAKES) config.relay.maxPendingHandshakes = env.RELAY_MAX_PENDING_HANDSHAKES;
+  if (env.RELAY_MAX_BUFFERED_BYTES_PER_CLIENT) config.relay.maxBufferedBytesPerClient = env.RELAY_MAX_BUFFERED_BYTES_PER_CLIENT;
+  if (env.RELAY_HOST_RECONNECT_GRACE_MS) config.relay.hostReconnectGraceMs = env.RELAY_HOST_RECONNECT_GRACE_MS;
   if (env.RELAY_ALLOWED_ORIGINS !== undefined) {
     const origins = parseOriginList(env.RELAY_ALLOWED_ORIGINS);
     if (origins) config.relay.allowedOrigins = origins;
@@ -180,6 +188,10 @@ function applyOptions(config, options) {
   if (options['admin-token']) config.auth.adminToken = options['admin-token'];
   if (options['state-file']) config.auth.stateFile = options['state-file'];
   if (options['max-clients']) config.relay.maxClientsPerHost = options['max-clients'];
+  if (options['max-hosts']) config.relay.maxHosts = options['max-hosts'];
+  if (options['max-pending-handshakes']) config.relay.maxPendingHandshakes = options['max-pending-handshakes'];
+  if (options['max-buffered-bytes']) config.relay.maxBufferedBytesPerClient = options['max-buffered-bytes'];
+  if (options['host-reconnect-grace-ms']) config.relay.hostReconnectGraceMs = options['host-reconnect-grace-ms'];
 }
 
 function validate(config) {
@@ -192,6 +204,25 @@ function validate(config) {
     16 * 1024 * 1024,
   );
   config.relay.maxClientsPerHost = parseInteger(config.relay.maxClientsPerHost, DEFAULTS.relay.maxClientsPerHost, 1, 256);
+  config.relay.maxHosts = parseInteger(config.relay.maxHosts, DEFAULTS.relay.maxHosts, 1, 100000);
+  config.relay.maxPendingHandshakes = parseInteger(
+    config.relay.maxPendingHandshakes,
+    DEFAULTS.relay.maxPendingHandshakes,
+    16,
+    100000,
+  );
+  config.relay.maxBufferedBytesPerClient = parseInteger(
+    config.relay.maxBufferedBytesPerClient,
+    DEFAULTS.relay.maxBufferedBytesPerClient,
+    64 * 1024,
+    256 * 1024 * 1024,
+  );
+  config.relay.hostReconnectGraceMs = parseInteger(
+    config.relay.hostReconnectGraceMs,
+    DEFAULTS.relay.hostReconnectGraceMs,
+    1000,
+    24 * 60 * 60 * 1000,
+  );
   config.auth.pairingTtlMs = parseInteger(config.auth.pairingTtlMs, DEFAULTS.auth.pairingTtlMs, 30 * 1000, 24 * 60 * 60 * 1000);
   config.auth.deviceTtlMs = parseInteger(config.auth.deviceTtlMs, DEFAULTS.auth.deviceTtlMs, 60 * 1000, 365 * 24 * 60 * 60 * 1000);
   config.auth.maxDevices = parseInteger(config.auth.maxDevices, DEFAULTS.auth.maxDevices, 1, 10000);