herdr-remote 0.2.38 → 0.3.31

package/dist/updater.js

@@ -1,401 +0,0 @@
-// Self-update for the installed CLI.
-//
-// Releases come from GitHub first and npm second: a GitHub Release installs the
-// moment it exists, while npm can take many minutes after publishing before a
-// version resolves. Both carry the same self-contained tarball, which bundles
-// the relay, so one install updates both.
-//
-// The update path is only meaningful for a package installed with npm. A
-// source checkout is managed by git and a linked development copy by the
-// developer, so this refuses to touch either: silently running `npm install -g`
-// over a checkout would replace the tree someone is working in.
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { spawn } from 'node:child_process';
-import { createRequire } from 'node:module';
-import { cliTarballUrl, GITHUB_RELEASES_URL, LATEST_CLI_TARBALL_URL, LATEST_RELEASE_MANIFEST_URL, } from 'herdr-remote-relay/protocol';
-import { PACKAGE_ROOT } from './paths.js';
-import { heldByAnotherProcess, installInPlace } from './updater/in-place.js';
-import { runNpm } from './updater/npm.js';
-const PACKAGE_NAME = 'herdr-remote';
-const RELAY_PACKAGE = 'herdr-remote-relay';
-const DEFAULT_REGISTRY = 'https://registry.npmjs.org';
-/**
- * A public mirror, tried last.
- *
- * `registry.npmjs.org` is not reachable from every network this runs on — in
- * mainland China it usually is not — and "could not reach npm registry" on a
- * machine that installs packages perfectly well is a bug report, not a
- * diagnosis. The mirror is read-only and only ever asked for a version number.
- */
-const MIRROR_REGISTRY = 'https://registry.npmmirror.com';
-function currentVersion() {
-    try {
-        return JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, 'package.json'), 'utf8')).version;
-    }
-    catch {
-        return '0.0.0';
-    }
-}
-/** The relay bundled with this herdr-remote, read from disk: an update replaces it. */
-function installedRelayVersion() {
-    try {
-        const manifest = createRequire(import.meta.url).resolve(`${RELAY_PACKAGE}/package.json`);
-        return JSON.parse(fs.readFileSync(manifest, 'utf8')).version;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * How this copy got here.
- *
- * - `npm`      installed with npm, from a release tarball or a registry; updating is `npm install -g`.
- * - `linked`   `npm link`ed into a global tree from a working copy.
- * - `source`   run straight out of a checkout.
- *
- * The distinction is drawn from the path rather than from npm, which would
- * mean shelling out on every render.
- */
-function installKind() {
-    const root = PACKAGE_ROOT;
-    // A real install always lives inside a node_modules tree.
-    if (!root.split(path.sep).includes('node_modules'))
-        return 'source';
-    try {
-        // `npm link` leaves a symlink where a published install has a directory.
-        if (fs.lstatSync(root).isSymbolicLink())
-            return 'linked';
-    }
-    catch {
-        // Unreadable: treat as a normal install and let npm report the problem.
-    }
-    return 'npm';
-}
-/** `HERDR_REMOTE_UPDATE_CHECK=0` turns the automatic checks off (offline machines, tests). */
-function updateChecksEnabled(env = process.env) {
-    return env.HERDR_REMOTE_UPDATE_CHECK !== '0';
-}
-function canSelfUpdate() {
-    return installKind() === 'npm';
-}
-function normalizeRegistry(value) {
-    if (typeof value !== 'string')
-        return null;
-    const trimmed = value.trim().replace(/\/+$/, '');
-    if (!/^https?:\/\//i.test(trimmed))
-        return null;
-    return trimmed;
-}
-/** The `registry=` line from an npmrc file, if it has one. */
-function registryFromNpmrc(filePath) {
-    let contents;
-    try {
-        contents = fs.readFileSync(filePath, 'utf8');
-    }
-    catch {
-        return null;
-    }
-    let found = null;
-    for (const rawLine of contents.split(/\r?\n/)) {
-        const line = rawLine.trim();
-        if (!line || line.startsWith('#') || line.startsWith(';'))
-            continue;
-        const match = /^registry\s*=\s*(.+)$/i.exec(line);
-        // The last assignment wins, as it does for npm itself.
-        if (match)
-            found = normalizeRegistry(match[1].replace(/^["']|["']$/g, ''));
-    }
-    return found;
-}
-/**
- * Where to ask, in the order to ask.
- *
- * Whatever npm itself is configured to use comes first: a machine behind a
- * corporate proxy or on a mirror has already answered this question, and
- * ignoring that answer is what made the check fail on a machine where
- * `npm install` works. The public registry and then a public mirror follow, so
- * a private registry that does not carry this package is not the end of it.
- */
-function registryCandidates({ env = process.env, home = os.homedir(), cwd = process.cwd(), } = {}) {
-    const candidates = [];
-    const add = (value) => {
-        const normalized = normalizeRegistry(value);
-        if (normalized && !candidates.includes(normalized))
-            candidates.push(normalized);
-    };
-    // npm exports its whole config into the environment of anything it runs.
-    add(env.npm_config_registry);
-    add(env.NPM_CONFIG_REGISTRY);
-    add(env.HERDR_REMOTE_REGISTRY);
-    add(registryFromNpmrc(path.join(cwd, '.npmrc')));
-    add(registryFromNpmrc(path.join(home, '.npmrc')));
-    add(DEFAULT_REGISTRY);
-    add(MIRROR_REGISTRY);
-    return candidates;
-}
-/** Compare two `MAJOR.MINOR.PATCH` strings. Returns 1, -1 or 0. */
-function compareVersions(a, b) {
-    const parse = (value) => String(value)
-        .split('-')[0]
-        .split('.')
-        .map((part) => Number.parseInt(part, 10) || 0);
-    const left = parse(a);
-    const right = parse(b);
-    for (let index = 0; index < Math.max(left.length, right.length); index += 1) {
-        const diff = (left[index] || 0) - (right[index] || 0);
-        if (diff > 0)
-            return 1;
-        if (diff < 0)
-            return -1;
-    }
-    return 0;
-}
-/** One JSON request with a deadline. Never throws. */
-async function fetchJson(url, { timeoutMs, fetchImpl }) {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
-    try {
-        const response = await fetchImpl(url, {
-            signal: controller.signal,
-            headers: { Accept: 'application/json', 'Cache-Control': 'no-cache' },
-        });
-        if (!response.ok)
-            return { ok: false, message: `HTTP ${response.status ?? '?'}` };
-        return { ok: true, body: await response.json() };
-    }
-    catch (error) {
-        const failure = error;
-        return {
-            ok: false,
-            message: failure?.name === 'AbortError' ? 'timed out' : String(failure?.message || error),
-        };
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
-/**
- * One registry, one question: what is the latest published version?
- *
- * The dist-tags endpoint first: a few bytes, answered fresh by npmjs and
- * npmmirror alike. `/<package>/latest` is the fallback for registries without
- * it, asked for plain JSON. It used to be asked for npm's abbreviated install
- * format, which npmjs refuses on that path with a 406, so every check quietly
- * fell through to a mirror that had not synced the release yet.
- */
-async function askRegistry(registry, { timeoutMs, fetchImpl }) {
-    const endpoints = [
-        {
-            url: `${registry}/-/package/${PACKAGE_NAME}/dist-tags`,
-            read: (body) => body?.latest,
-        },
-        { url: `${registry}/${PACKAGE_NAME}/latest`, read: (body) => body?.version },
-    ];
-    let message = null;
-    for (const endpoint of endpoints) {
-        const attempt = await fetchJson(endpoint.url, { timeoutMs, fetchImpl });
-        if (!attempt.ok) {
-            message = attempt.message;
-            continue;
-        }
-        const latest = endpoint.read(attempt.body);
-        if (typeof latest === 'string' && latest)
-            return { ok: true, latest };
-        message = 'registry answered without a version';
-    }
-    return { ok: false, message };
-}
-const VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
-/** The newest GitHub Release, from the manifest every release carries. */
-async function askGithubReleases(manifestUrl, { timeoutMs, fetchImpl }) {
-    const attempt = await fetchJson(manifestUrl, { timeoutMs, fetchImpl });
-    if (!attempt.ok)
-        return attempt;
-    const version = attempt.body?.version;
-    if (typeof version === 'string' && VERSION_PATTERN.test(version)) {
-        return { ok: true, latest: version };
-    }
-    return { ok: false, message: 'release manifest has no version' };
-}
-/**
- * Ask what the current release is.
- *
- * Never throws: an update check is a convenience, and a machine that is offline
- * or behind a proxy should still get a working settings screen.
- *
- * GitHub Releases and every registry are asked at once and the newest answer
- * wins. Taking the first answer let a mirror a few minutes (or hours) behind
- * report the release before last as current. `sources` lists the ones that
- * already carry the newest version, GitHub first, which is where an install
- * should come from; `behind` lists the ones that do not, so the screen can say
- * why. GitHub is not reachable from every network, which is what the
- * registries are still asked for.
- */
-async function checkForUpdate({ timeoutMs = 6000, fetchImpl = globalThis.fetch, registries = registryCandidates(), releaseManifest = LATEST_RELEASE_MANIFEST_URL, current = currentVersion(), } = {}) {
-    const attempts = await Promise.all([
-        ...(releaseManifest
-            ? [
-                askGithubReleases(releaseManifest, { timeoutMs, fetchImpl }).then((answer) => ({
-                    source: GITHUB_RELEASES_URL,
-                    ...answer,
-                })),
-            ]
-            : []),
-        ...registries.map(async (registry) => ({
-            source: registry,
-            ...(await askRegistry(registry, { timeoutMs, fetchImpl })),
-        })),
-    ]);
-    const answers = attempts.filter((attempt) => attempt.ok);
-    if (answers.length === 0) {
-        // The reason is carried out with the failure. "Could not reach npm
-        // registry" with nothing after it leaves the user guessing between DNS, a
-        // proxy, a firewall and a mirror that does not carry the package.
-        return {
-            ok: false,
-            current,
-            errorKey: 'update.errorNetwork',
-            message: attempts
-                .map((attempt) => `${attempt.source}: ${'message' in attempt ? attempt.message : ''}`)
-                .join('; '),
-        };
-    }
-    const latest = answers
-        .map((answer) => answer.latest)
-        .reduce((best, version) => (compareVersions(version, best) > 0 ? version : best));
-    const sources = answers
-        .filter((answer) => compareVersions(answer.latest, latest) === 0)
-        .map((answer) => answer.source);
-    const behind = answers
-        .filter((answer) => compareVersions(answer.latest, latest) < 0)
-        .map((answer) => ({ source: answer.source, version: answer.latest }));
-    return {
-        ok: true,
-        current,
-        latest,
-        source: sources[0],
-        sources,
-        behind,
-        updateAvailable: compareVersions(latest, current) > 0,
-    };
-}
-/** Just the lines npm meant for a person: its `npm error` / `npm ERR!` summary. */
-function npmErrorSummary(output) {
-    const lines = String(output || '')
-        .split(/\r?\n/)
-        .map((line) => line.trim())
-        .filter((line) => /^npm (error|ERR!)/.test(line) && !/complete log of this run/i.test(line))
-        .map((line) => line.replace(/^npm (error|ERR!)\s*/, ''))
-        .filter(Boolean);
-    return (lines.length > 0
-        ? lines.slice(0, 3)
-        : String(output || '')
-            .trim()
-            .split(/\r?\n/)
-            .slice(-3)).join(' ');
-}
-/** "No matching version": the registry has not caught up with its own dist-tag. */
-function isNotYetPublished(output) {
-    return /\bETARGET\b|notarget|No matching version found/i.test(String(output || ''));
-}
-/** What is actually installed now, read from disk rather than the require cache. */
-function installedVersionOnDisk() {
-    try {
-        return JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, 'package.json'), 'utf8')).version;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Install a release over this one.
- *
- * Resolves with `{ ok, output }` rather than rejecting, so the caller can show
- * npm's own message; npm's diagnostics are more useful than anything that could
- * be invented here.
- *
- * - The exact version the check found is installed, not `@latest`, from the
- *   sources that reported it: GitHub's release tarball first, then registries,
- *   asked with `--prefer-online` so npm revalidates the package metadata it
- *   cached before the release existed.
- * - Right after a release, npm's view of the package can still lack the new
- *   version although its dist-tag already points at it: npm answers ETARGET.
- *   That is a wait, not a failure, so it is retried a few times, then the next
- *   source that carries the version is tried.
- * - On Windows, when something holds the package directory so npm cannot
- *   rename it, the release is copied over it instead.
- * - Success is what is on disk afterwards, not npm's exit code.
- */
-async function performUpdate({ spawnImpl = spawn, timeoutMs = 180_000, 
-// Seam for tests: the suite runs from a checkout, where the guard below is
-// correctly the only reachable outcome.
-installKindImpl = installKind, 
-// The sources that reported `version`, preferred first. Empty means GitHub,
-// then whatever registry npm is configured with, which is right when no
-// check has run.
-source = '', sources = [], version = null, attempts = 3, retryDelayMs = 15_000, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), readInstalledVersion = installedVersionOnDisk, onAttempt = () => { }, platform = process.platform, inPlace = installInPlace, } = {}) {
-    const kind = installKindImpl();
-    if (kind !== 'npm')
-        return { ok: false, errorKey: `update.cannot.${kind}` };
-    const target = typeof version === 'string' && VERSION_PATTERN.test(version) ? version : null;
-    const candidates = [];
-    for (const candidate of [source, ...sources]) {
-        const normalized = normalizeRegistry(candidate);
-        if (normalized && !candidates.includes(normalized))
-            candidates.push(normalized);
-    }
-    // '' is npm's own configured registry.
-    if (candidates.length === 0)
-        candidates.push(GITHUB_RELEASES_URL, '');
-    let last = { ok: false, output: '' };
-    let notYetPublished = false;
-    for (const candidate of candidates) {
-        const github = candidate === GITHUB_RELEASES_URL;
-        const args = github
-            ? ['install', '-g', target ? cliTarballUrl(target) : LATEST_CLI_TARBALL_URL]
-            : ['install', '-g', `${PACKAGE_NAME}@${target || 'latest'}`, '--prefer-online'];
-        if (candidate && !github)
-            args.push('--registry', candidate);
-        for (let attempt = 1; attempt <= attempts; attempt += 1) {
-            onAttempt({ source: candidate, attempt });
-            let result = await runNpm(spawnImpl, args, timeoutMs);
-            if (!result.ok && platform === 'win32' && heldByAnotherProcess(result.output))
-                result = await inPlace(args, (stagedArgs) => runNpm(spawnImpl, stagedArgs, timeoutMs));
-            if (result.ok) {
-                const installed = readInstalledVersion();
-                if (target && installed && compareVersions(installed, target) < 0) {
-                    return {
-                        ok: false,
-                        errorKey: 'update.errorNotApplied',
-                        installed,
-                        output: result.output.slice(-2000),
-                    };
-                }
-                return { ok: true, installed, output: result.output.slice(-2000) };
-            }
-            last = result;
-            if (result.spawnFailed) {
-                return {
-                    ok: false,
-                    errorKey: 'update.errorFailed',
-                    output: result.output,
-                    summary: result.output,
-                };
-            }
-            notYetPublished = isNotYetPublished(result.output);
-            if (!notYetPublished)
-                break; // Not a wait: this source will not do better.
-            if (attempt < attempts)
-                await sleep(retryDelayMs);
-        }
-    }
-    return {
-        ok: false,
-        errorKey: notYetPublished ? 'update.errorNotYetPublished' : 'update.errorFailed',
-        output: String(last.output || '').slice(-2000),
-        summary: npmErrorSummary(last.output),
-    };
-}
-export { DEFAULT_REGISTRY, MIRROR_REGISTRY, canSelfUpdate, checkForUpdate, compareVersions, currentVersion, installKind, installedVersionOnDisk, installedRelayVersion, performUpdate, registryCandidates, updateChecksEnabled, };

package/node_modules/herdr-remote-relay/README.md

@@ -1,76 +0,0 @@
-# herdr-remote-relay
-
-*[English](README.md) · [简体中文](README.zh-CN.md)*
-
-Standalone relay server and WebUI for [Herdr Remote](https://www.npmjs.com/package/herdr-remote).
-
-Brokers WebSocket connections between browsers and workstation host connectors. Runtime dependency is `ws` only; requires no compilers or Herdr binaries.
-
-> **Note**: `herdr-remote` runs a local relay automatically. Install this package only when deploying a dedicated relay server.
-
-## Installation
-
-```bash
-npm install -g https://github.com/dibin666/herdr-remote/releases/latest/download/herdr-remote-relay.tgz
-herdr-remote-relay --public-url https://herdr.example.com --password <password>
-```
-
-From npm instead: `npm install -g herdr-remote-relay` (it can lag a new release by a while).
-
-Requirements: Node.js 22+, TLS reverse proxy (nginx, Caddy, Cloudflare Tunnel).
-
-## Docker
-
-```bash
-docker run -d --name herdr-relay --restart unless-stopped \
-  -p 127.0.0.1:8787:8787 \
-  -v herdr-relay:/data \
-  -e RELAY_BIND=0.0.0.0 \
-  -e RELAY_PUBLIC_URL=https://herdr.example.com \
-  -e RELAY_PASSWORD=your-password \
-  -e RELAY_ADMIN_TOKEN=your-admin-token \
-  -e RELAY_TRUST_PROXY=1 \
-  -e RELAY_AUTH_STATE_FILE=/data/relay-auth.json \
-  node:22-alpine npx -y herdr-remote-relay
-```
-
-## Options
-
-| Option | Env Var | Default | Description |
-|---|---|---|---|
-| `--public-url` | `RELAY_PUBLIC_URL` | `http://127.0.0.1:8787` | Public URL for browsers |
-| `--password` | `RELAY_PASSWORD` | *(empty)* | Workstation join password (empty = public) |
-| `--admin-token` | `RELAY_ADMIN_TOKEN` | *(empty)* | Operator token for `/admin` |
-| `--bind` | `RELAY_BIND` | `127.0.0.1` | Listen address |
-| `--port` | `RELAY_PORT` | `8787` | Listen port |
-| `--trust-proxy` | `RELAY_TRUST_PROXY` | `0` | Trust `X-Forwarded-For` header (`1` behind proxy) |
-| `--state-file` | `RELAY_AUTH_STATE_FILE` | `~/.local/state/herdr-remote-relay/relay-auth.json` | Auth state file path |
-| `--allowed-origins` | `RELAY_ALLOWED_ORIGINS` | *(same-origin)* | Allowed CORS origins, comma-separated |
-| `--max-clients` | `RELAY_MAX_CLIENTS_PER_HOST` | `16` | Maximum browser clients per host |
-| `--max-hosts` | `RELAY_MAX_HOSTS` | `1024` | Maximum workstations on this relay |
-| `--max-pending-handshakes` | `RELAY_MAX_PENDING_HANDSHAKES` | `1024` | Maximum unauthenticated WebSockets |
-| `--max-buffered-bytes` | `RELAY_MAX_BUFFERED_BYTES_PER_CLIENT` | `4194304` | Maximum queued bytes per browser |
-| `--host-reconnect-grace-ms` | `RELAY_HOST_RECONNECT_GRACE_MS` | `30000` | Host reconnect grace period |
-| `--config` | `HERDR_RELAY_CONFIG` | *(none)* | JSON configuration file path |
-
-Reverse proxies must pass WebSocket `Upgrade` headers and maintain reasonable idle timeouts. The relay disables WebSocket compression and enables TCP NoDelay for terminal frames. When no browser is attached, business heartbeats stop while low-frequency transport keepalive (minimal idle heartbeat and WebSocket ping/pong watchdog) remains active to prevent proxies from dropping idle connections. Deployment examples for nginx, systemd, and Docker Compose are in `deploy/`.
-
-## Multiple workstations and isolation
-
-A browser can save multiple workstation pairings. The switcher in the lower-left WebUI only shows profiles saved by that browser; it never enumerates other relay hosts. `/api/status` is scoped to the workstation bound to the presented credentials, while only `RELAY_ADMIN_TOKEN` can inspect relay-wide state. `/healthz` does not disclose host or client counts.
-
-## Connecting a Workstation
-
-In `herdr-remote` TUI under **Relay** tab:
-- Set mode to **Self-hosted relay**
-- Set Relay URL to `wss://herdr.example.com`
-- Set Relay Password to matching `RELAY_PASSWORD`
-
-Check connection status:
-```bash
-curl https://herdr.example.com/healthz
-```
-
-## License
-
-MIT

package/node_modules/herdr-remote-relay/README.zh-CN.md

@@ -1,76 +0,0 @@
-# herdr-remote-relay
-
-*[English](README.md) · [简体中文](README.zh-CN.md)*
-
-[Herdr Remote](https://www.npmjs.com/package/herdr-remote) 的独立 Relay 服务端与 WebUI。
-
-负责在浏览器与工作站主机连接器之间转发 WebSocket 连接。运行时仅依赖 `ws`，无需编译环境或 Herdr 二进制文件。
-
-> **提示**：`herdr-remote` 默认在本地自动运行 relay。仅在需要部署独立中继服务器时安装本包。
-
-## 安装
-
-```bash
-npm install -g https://github.com/dibin666/herdr-remote/releases/latest/download/herdr-remote-relay.tgz
-herdr-remote-relay --public-url https://herdr.example.com --password <密码>
-```
-
-也可从 npm 安装：`npm install -g herdr-remote-relay`（新版本上线后 npm 可能要过一段时间才同步）。
-
-前置要求：Node.js 22+、TLS 反向代理（nginx、Caddy、Cloudflare Tunnel 等）。
-
-## Docker 运行
-
-```bash
-docker run -d --name herdr-relay --restart unless-stopped \
-  -p 127.0.0.1:8787:8787 \
-  -v herdr-relay:/data \
-  -e RELAY_BIND=0.0.0.0 \
-  -e RELAY_PUBLIC_URL=https://herdr.example.com \
-  -e RELAY_PASSWORD=你的密码 \
-  -e RELAY_ADMIN_TOKEN=你的管理令牌 \
-  -e RELAY_TRUST_PROXY=1 \
-  -e RELAY_AUTH_STATE_FILE=/data/relay-auth.json \
-  node:22-alpine npx -y herdr-remote-relay
-```
-
-## 配置参数
-
-| 参数 | 环境变量 | 默认值 | 说明 |
-|---|---|---|---|
-| `--public-url` | `RELAY_PUBLIC_URL` | `http://127.0.0.1:8787` | 浏览器访问的公开地址 |
-| `--password` | `RELAY_PASSWORD` | *(空)* | 工作站接入密码（留空为公用 Relay） |
-| `--admin-token` | `RELAY_ADMIN_TOKEN` | *(空)* | `/admin` 管理后台操作员令牌 |
-| `--bind` | `RELAY_BIND` | `127.0.0.1` | 监听地址 |
-| `--port` | `RELAY_PORT` | `8787` | 监听端口 |
-| `--trust-proxy` | `RELAY_TRUST_PROXY` | `0` | 信任 `X-Forwarded-For` 头（反代后设为 `1`） |
-| `--state-file` | `RELAY_AUTH_STATE_FILE` | `~/.local/state/herdr-remote-relay/relay-auth.json` | 认证状态文件路径 |
-| `--allowed-origins` | `RELAY_ALLOWED_ORIGINS` | *(同源)* | 允许的跨域源，逗号分隔 |
-| `--max-clients` | `RELAY_MAX_CLIENTS_PER_HOST` | `16` | 每台工作站最大客户端连接数 |
-| `--max-hosts` | `RELAY_MAX_HOSTS` | `1024` | relay 最大工作站数 |
-| `--max-pending-handshakes` | `RELAY_MAX_PENDING_HANDSHAKES` | `1024` | 最大未认证 WebSocket 握手数 |
-| `--max-buffered-bytes` | `RELAY_MAX_BUFFERED_BYTES_PER_CLIENT` | `4194304` | 单个慢浏览器最大待发送缓冲 |
-| `--host-reconnect-grace-ms` | `RELAY_HOST_RECONNECT_GRACE_MS` | `30000` | 工作站断线恢复宽限时间 |
-| `--config` | `HERDR_RELAY_CONFIG` | *(无)* | JSON 配置文件路径 |
-
-反向代理必须转发 WebSocket `Upgrade` 头，并设置合理的空闲超时时间。relay 会关闭 WebSocket 压缩并启用 TCP NoDelay；没有浏览器连接时，工作站会停止业务 heartbeat，同时保留低频 transport keepalive（最小空闲 heartbeat 与 WebSocket ping/pong 探针）以防止反代断开空闲连接并维持 relay 存活。`deploy/` 目录下提供 nginx、systemd 与 Docker Compose 示例。
-
-## 多工作站与隔离
-
-同一个浏览器可以保存多个工作站配对，WebUI 左下角的实例切换器只显示本地已保存的实例，不会枚举 relay 上的其他工作站。`/api/status` 按设备令牌绑定的工作站隔离，只有 `RELAY_ADMIN_TOKEN` 才能查看 relay 全局状态；`/healthz` 不公开工作站和客户端数量。
-
-## 工作站连接
-
-在工作站的 `herdr-remote` TUI 中进入 **Relay** 页面：
-- 访问方式选择 **自建 relay**
-- Relay 地址填写 `wss://herdr.example.com`
-- Relay 密码填写对应的 `RELAY_PASSWORD`
-
-验证连接状态：
-```bash
-curl https://herdr.example.com/healthz
-```
-
-## 开源协议
-
-MIT

package/node_modules/herdr-remote-relay/config.example.json

@@ -1,18 +0,0 @@
-{
-  "relay": {
-    "mode": "remote",
-    "host": "127.0.0.1",
-    "port": 8787,
-    "publicUrl": "https://herdr.example.com",
-    "trustProxy": true,
-    "maxHosts": 1024,
-    "maxPendingHandshakes": 1024,
-    "maxBufferedBytesPerClient": 4194304,
-    "hostReconnectGraceMs": 30000
-  },
-  "auth": {
-    "password": "change-me",
-    "adminToken": "replace-with-a-long-random-operator-token",
-    "stateFile": "/var/lib/herdr-remote-relay/relay-auth.json"
-  }
-}

package/node_modules/herdr-remote-relay/deploy/cloudflared/config.yml.example

@@ -1,9 +0,0 @@
-# Copy this file to ~/.cloudflared/config.yml after creating a named tunnel.
-# The relay itself remains bound to 127.0.0.1.
-tunnel: YOUR_TUNNEL_UUID
-credentials-file: /home/YOUR_USER/.cloudflared/YOUR_TUNNEL_UUID.json
-
-ingress:
-  - hostname: herdr.example.com
-    service: http://127.0.0.1:8787
-  - service: http_status:404

package/node_modules/herdr-remote-relay/deploy/docker/compose.yaml

@@ -1,23 +0,0 @@
-# Put your own reverse proxy (nginx, Caddy, Traefik, Cloudflare Tunnel…) in
-# front of port 8787 and terminate TLS there.
-
-services:
-  relay:
-    image: node:22-alpine
-    command: npx -y herdr-remote-relay
-    restart: unless-stopped
-    ports:
-      - "127.0.0.1:8787:8787"
-    environment:
-      RELAY_BIND: 0.0.0.0
-      RELAY_PORT: "8787"
-      RELAY_PUBLIC_URL: https://herdr.example.com
-      # Leave empty for a public relay.
-      RELAY_PASSWORD: change-me
-      RELAY_TRUST_PROXY: "1"
-      RELAY_AUTH_STATE_FILE: /data/relay-auth.json
-    volumes:
-      - relay-state:/data
-
-volumes:
-  relay-state:

package/node_modules/herdr-remote-relay/deploy/nginx/herdr-remote-relay.conf.example

@@ -1,49 +0,0 @@
-# nginx site for a self-hosted relay. Obtain the certificate first, e.g. with
-#   sudo certbot --nginx -d herdr.example.com
-
-map $http_upgrade $connection_upgrade {
-    default upgrade;
-    ''      close;
-}
-
-server {
-    listen 80;
-    listen [::]:80;
-    server_name herdr.example.com;
-    return 301 https://$host$request_uri;
-}
-
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
-    http2 on;
-    server_name herdr.example.com;
-
-    ssl_certificate     /etc/letsencrypt/live/herdr.example.com/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/herdr.example.com/privkey.pem;
-
-    location / {
-        proxy_pass http://127.0.0.1:8787;
-        proxy_http_version 1.1;
-
-        # Required for /ws/host and /ws/client. Without these the browser falls
-        # back to nothing: the terminal never opens.
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection $connection_upgrade;
-
-        proxy_set_header Host $host;
-        # The relay checks the Origin header against the request Host, and rate
-        # limits pairing per client address.
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        # A terminal can sit idle for a long time between keystrokes; the
-        # default 60s would drop the session.
-        proxy_read_timeout 3600s;
-        proxy_send_timeout 3600s;
-
-        # Terminal output must arrive as it is produced.
-        proxy_buffering off;
-    }
-}