orbit-codex-bridge 0.0.0-stage → 0.1.0

package/relay-server.mjs

@@ -0,0 +1,684 @@
+import http from 'node:http';
+import https from 'node:https';
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import net from 'node:net';
+import { fileURLToPath } from 'node:url';
+import { WebSocketServer, WebSocket } from 'ws';
+import { RelayStore } from './relay-store.mjs';
+import { DeviceAuthorization } from './lib/device-auth.mjs';
+
+const root = path.dirname(fileURLToPath(import.meta.url));
+const maxBody = 12 * 1024 * 1024;
+const userSessionLifetime = 12 * 60 * 60 * 1000;
+const adminSessionLifetime = 8 * 60 * 60 * 1000;
+const safeError = error => String(error?.message || error).slice(0, 700);
+
+function equalSecret(left, right) {
+  const a = Buffer.from(String(left || ''));
+  const b = Buffer.from(String(right || ''));
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+
+function cookieValue(request, name) {
+  return (request.headers.cookie || '').split(';').map(part => part.trim())
+    .find(part => part.startsWith(`${name}=`))?.slice(name.length + 1) || '';
+}
+
+function originFor(request) {
+  const protocol = request.headers['x-forwarded-proto']?.toString().split(',')[0].trim()
+    || (request.socket.encrypted ? 'https' : 'http');
+  return `${protocol}://${request.headers.host}`;
+}
+
+function secureTransport(request) {
+  return Boolean(request.socket.encrypted)
+    || request.headers['x-forwarded-proto']?.toString().split(',')[0].trim() === 'https';
+}
+
+function clientIp(request) {
+  const remote = request.socket.remoteAddress || 'unknown';
+  const trustedProxy = ['127.0.0.1','::1','::ffff:127.0.0.1'].includes(remote);
+  const forwarded = request.headers['x-forwarded-for']?.toString().split(',').map(value => value.trim()).filter(Boolean).at(-1);
+  return trustedProxy && forwarded && net.isIP(forwarded) ? forwarded : remote;
+}
+
+function sameOrigin(request, requireOrigin = false) {
+  const origin = request.headers.origin;
+  return origin ? origin === originFor(request) : !requireOrigin;
+}
+
+function rejectUpgrade(socket, status = 403, message = 'Forbidden') {
+  socket.end(`HTTP/1.1 ${status} ${message}\r\nConnection: close\r\n\r\n`);
+}
+
+function deviceCookieName(deviceId) {
+  return `orbit_device_${deviceId.replaceAll('-','')}`;
+}
+
+function localCookie(request, deviceId) {
+  const value = cookieValue(request, deviceCookieName(deviceId));
+  return /^[a-zA-Z0-9_-]{20,100}$/.test(value) ? `orbit_session=${value}` : '';
+}
+
+function responseHeaders(headers, deviceId, secureCookie) {
+  const safe = { 'Content-Type':'application/json; charset=utf-8' };
+  const cookies = headers?.['set-cookie'];
+  const values = Array.isArray(cookies) ? cookies : cookies ? [cookies] : [];
+  const paired = values.find(value => typeof value === 'string' && /^orbit_session=([a-zA-Z0-9_-]{20,100}|);/.test(value));
+  if (paired) {
+    const token = paired.split(';')[0].slice('orbit_session='.length);
+    safe['Set-Cookie'] = `${deviceCookieName(deviceId)}=${token}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${token ? 43200 : 0}${secureCookie ? '; Secure' : ''}`;
+  }
+  return safe;
+}
+
+function isLocalApi(pathname, method) {
+  if (method === 'GET') return ['/api/status','/api/threads','/api/models'].includes(pathname)
+    || /^\/api\/threads\/[a-zA-Z0-9_-]{8,120}\/messages$/.test(pathname);
+  return method === 'POST' && ['/api/pair','/api/logout','/api/pair/qr'].includes(pathname);
+}
+
+function json(response, status, body, headers = {}) {
+  response.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', ...headers });
+  response.end(JSON.stringify(body));
+}
+
+async function readBody(request) {
+  let size = 0;
+  const chunks = [];
+  for await (const chunk of request) {
+    size += chunk.length;
+    if (size > maxBody) throw new Error('请求体过大。');
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks);
+}
+
+async function readJson(request) {
+  try {
+    const body = await readBody(request);
+    if (body.length > 65536) throw new Error('管理请求过大。');
+    const result = JSON.parse(body.toString() || '{}');
+    if (!result || Array.isArray(result) || typeof result !== 'object') throw new Error('请求必须是 JSON 对象。');
+    return result;
+  }
+  catch (error) { if (error instanceof SyntaxError) throw new Error('JSON 请求格式无效。'); throw error; }
+}
+
+function staticTarget(pathname) {
+  const files = {
+    '/': ['public/index.html', 'text/html'],
+    '/index.html': ['public/index.html', 'text/html'],
+    '/connect': ['public/connect.html', 'text/html'],
+    '/connect.js': ['public/connect.js', 'text/javascript'],
+    '/admin': ['public/admin.html', 'text/html'],
+    '/admin/': ['public/admin.html', 'text/html'],
+    '/admin.js': ['public/admin.js', 'text/javascript'],
+    '/admin.css': ['public/admin.css', 'text/css'],
+    '/app.js': ['public/app.js', 'text/javascript'],
+    '/style.css': ['public/style.css', 'text/css'],
+    '/layout.css': ['public/layout.css', 'text/css'],
+    '/icon.svg': ['public/icon.svg', 'image/svg+xml'],
+    '/manifest.webmanifest': ['public/manifest.webmanifest', 'application/manifest+json'],
+    '/vendor/marked.js': ['node_modules/marked/lib/marked.umd.js', 'text/javascript'],
+    '/vendor/purify.js': ['node_modules/dompurify/dist/purify.min.js', 'text/javascript']
+  };
+  return files[pathname] || null;
+}
+
+export function createRelayServer(options = {}) {
+  const adminToken = options.adminToken || process.env.ORBIT_RELAY_ADMIN_TOKEN || '';
+  if (adminToken.length < 24) throw new Error('必须设置长度至少 24 位的 ORBIT_RELAY_ADMIN_TOKEN。');
+  const host = options.host || process.env.ORBIT_RELAY_HOST || '127.0.0.1';
+  let port = Number(options.port ?? process.env.ORBIT_RELAY_PORT ?? 8443);
+  const secureCookie = options.secureCookie ?? true;
+  const registrationEnabled = options.registrationEnabled ?? process.env.ORBIT_RELAY_REGISTRATION_ENABLED !== 'false';
+  const store = options.store || new RelayStore(options.dbPath);
+  store.syncAdminToken(adminToken);
+  const requireSecureTransport = options.requireSecureTransport ?? process.env.NODE_ENV === 'production';
+  const agents = new Map();
+  const pendingHttp = new Map();
+  const browserSockets = new Map();
+  const loginAttempts = new Map();
+  const deviceAuthorization = new DeviceAuthorization(options.deviceAuthOptions);
+  let registrationsInFlight = 0;
+  let closing = false;
+  const httpServer = options.server || (
+    process.env.ORBIT_RELAY_TLS_CERT && process.env.ORBIT_RELAY_TLS_KEY
+      ? https.createServer({
+        cert: fs.readFileSync(process.env.ORBIT_RELAY_TLS_CERT),
+        key: fs.readFileSync(process.env.ORBIT_RELAY_TLS_KEY)
+      })
+      : http.createServer()
+  );
+  const wss = new WebSocketServer({ noServer:true, maxPayload:maxBody });
+
+  function secureSuffix() { return secureCookie ? '; Secure' : ''; }
+
+  function session(request, role) {
+    const name = role === 'admin' ? 'orbit_admin' : 'orbit_cloud_session';
+    const raw = cookieValue(request,name);
+    const value = store.getSession(raw,role);
+    return value ? { ...value, raw } : null;
+  }
+
+  function userSession(request) { return session(request,'user'); }
+  function adminSession(request) { return session(request,'admin'); }
+
+  function loginKey(request,role,username) {
+    return `${role}:${String(username||'').trim().toLowerCase()}:${clientIp(request)}`;
+  }
+
+  function loginAllowed(key, limit = 12) {
+    const entry=loginAttempts.get(key);
+    if(!entry)return true;
+    if(entry.reset<=Date.now()){loginAttempts.delete(key);return true}
+    return entry.count<limit;
+  }
+
+  function recordAttempt(key) {
+    if(loginAttempts.size>=10000&&!loginAttempts.has(key))loginAttempts.delete(loginAttempts.keys().next().value);
+    const entry=loginAttempts.get(key)||{count:0,reset:Date.now()+5*60*1000};
+    entry.count++;loginAttempts.set(key,entry);
+  }
+
+  function clearLoginFailures(key) {
+    loginAttempts.delete(key);
+  }
+
+  function online(deviceId) {
+    const entry=agents.get(deviceId);
+    return Boolean(entry && entry.socket.readyState===WebSocket.OPEN);
+  }
+
+  function publicDevice(device) {
+    return {id:device.id,name:device.name,status:device.status,lastSeen:device.lastSeen,online:online(device.id),createdAt:device.createdAt};
+  }
+
+  function sessionCookie(name, token, lifetime) {
+    return `${name}=${token}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${Math.floor(lifetime/1000)}${secureSuffix()}`;
+  }
+
+  function sendAgent(agent,message) {
+    if(!agent||agents.get(agent.deviceId)!==agent||agent.socket.readyState!==WebSocket.OPEN)throw new Error('这台电脑当前不在线。');
+    agent.socket.send(JSON.stringify(message));
+  }
+
+  function failPendingForDevice(deviceId,message) {
+    for(const [requestId,pending] of pendingHttp){
+      if(pending.deviceId!==deviceId)continue;
+      clearTimeout(pending.timer);pendingHttp.delete(requestId);
+      pending.reject(new Error(message));
+    }
+  }
+
+  function closeDeviceConnections(deviceId,code=1008,reason='设备已撤销。') {
+    const agent=agents.get(deviceId);
+    if(agent){agents.delete(deviceId);agent.socket.close(code,reason);}
+    failPendingForDevice(deviceId,reason);
+    for(const [bridgeId,browser] of browserSockets){
+      if(browser.deviceId===deviceId)closeBrowserSocket(bridgeId,code,reason);
+    }
+  }
+
+  function closeUserConnections(userId,code=1008,reason='账号授权已撤销。') {
+    for(const device of store.listDevices(userId))closeDeviceConnections(device.id,code,reason);
+    closeUserBrowsers(userId,code,reason);
+  }
+
+  function closeUserBrowsers(userId,code=1008,reason='账号授权已撤销。') {
+    for(const [bridgeId,browser]of browserSockets)if(browser.userId===userId)closeBrowserSocket(bridgeId,code,reason);
+  }
+
+  function closeBrowserSocket(bridgeId,code=1011,reason='电脑端连接已断开。') {
+    const entry=browserSockets.get(bridgeId);
+    if(!entry)return;
+    browserSockets.delete(bridgeId);
+    try { sendAgent(entry.agent,{type:'ws-close',bridgeId,code:1000,reason:'Browser authorization ended'}); } catch {}
+    if(entry.socket.readyState===WebSocket.OPEN)entry.socket.close(code,reason);
+  }
+
+  function chooseDevice(request,user) {
+    if(user.expiresAt && user.expiresAt<=Date.now())throw Object.assign(new Error('账号已到期。'),{status:403});
+    const devices=store.devicesForUser(user.id);
+    if(!devices.length)throw Object.assign(new Error('账号还没有绑定电脑，请联系管理员签发设备配对码。'),{status:409});
+    const requested=String(request.headers['x-orbit-device-id'] || '').trim();
+    if(requested){
+      const device=devices.find(item=>item.id===requested);
+      if(!device)throw Object.assign(new Error('目标电脑不存在或不属于当前账号。'),{status:403});
+      return device;
+    }
+    if(devices.length!==1)throw Object.assign(new Error('此账号绑定了多台电脑，请先在工作台选择目标设备。'),{status:409,code:'device_selection_required'});
+    return devices[0];
+  }
+
+  async function proxyHttp(request,response,authenticated) {
+    let device;
+    try{device=chooseDevice(request,authenticated.user)}
+    catch(error){return json(response,error.status||409,{error:safeError(error),code:error.code||'device_unavailable'})}
+    const agent=agents.get(device.id);
+    if(!agent||agent.socket.readyState!==WebSocket.OPEN)return json(response,503,{error:`电脑“${device.name}”当前不在线。`});
+    const body=await readBody(request);
+    if (!store.hasSession(authenticated.tokenHash,authenticated.user.id)) return json(response,401,{error:'请先登录云端工作台。',code:'cloud_login_required'});
+    chooseDevice(request, store.getUser(authenticated.user.id));
+    const requestId=crypto.randomUUID();
+    const headers={};
+    for(const name of ['accept','content-type','host','origin','user-agent'])if(request.headers[name])headers[name]=request.headers[name];
+    headers.cookie = localCookie(request,device.id);
+    if(pendingHttp.size>=500)return json(response,429,{error:'请求过多，请稍后重试。'});
+    const promise=new Promise((resolve,reject)=>{
+      const timer=setTimeout(()=>{pendingHttp.delete(requestId);reject(new Error('电脑端请求超时。'))},30000);
+      pendingHttp.set(requestId,{resolve,reject,timer,deviceId:device.id,agent,userId:authenticated.user.id,sessionHash:authenticated.tokenHash});
+    });
+    try{
+      sendAgent(agent,{type:'http-request',requestId,method:request.method,path:request.url,headers,body:body.toString('base64')});
+      const result=await promise;
+      if (!store.hasSession(authenticated.tokenHash,authenticated.user.id)) return json(response,401,{error:'请先登录云端工作台。',code:'cloud_login_required'});
+      response.writeHead(result.statusCode,responseHeaders(result.headers,device.id,secureCookie));
+      response.end(Buffer.from(result.body||'','base64'));
+    }catch(error){if(!response.destroyed)json(response,502,{error:safeError(error)})}
+    finally {
+      const pending=pendingHttp.get(requestId);
+      if(pending){clearTimeout(pending.timer);pendingHttp.delete(requestId)}
+    }
+  }
+
+  async function createLogin(request,response,role) {
+    if(!sameOrigin(request,true))return json(response,403,{error:'来源校验失败。'});
+    const body=await readJson(request);
+    const throttleKey=loginKey(request,role,role==='admin'?'admin':body.username);
+    const addressKey=`login-ip:${clientIp(request)}`;
+    if(!loginAllowed(throttleKey)||!loginAllowed(addressKey))return json(response,429,{error:'登录尝试过多，请稍后重试。'});
+    if(role==='admin'){
+      if(!equalSecret(body.token,adminToken)){recordAttempt(throttleKey);recordAttempt(addressKey);return json(response,401,{error:'管理员密钥不正确。'})}
+      clearLoginFailures(throttleKey);
+      const created=store.setSession(null,'admin',null,Date.now()+adminSessionLifetime);
+      store.audit('admin','admin.login',null,{});
+      return json(response,200,{ok:true},{'Set-Cookie':sessionCookie('orbit_admin',created.token,adminSessionLifetime)});
+    }
+    const user=await store.authenticateUser(body.username,body.password);
+    if(!user){recordAttempt(throttleKey);recordAttempt(addressKey);return json(response,401,{error:'用户名或密码不正确，或账号已停用。'})}
+    clearLoginFailures(throttleKey);
+    const created=store.setSession(null,'user',user.id);
+    store.audit(`user:${user.id}`,'user.login',user.id,{});
+    return json(response,200,{ok:true},{'Set-Cookie':sessionCookie('orbit_cloud_session',created.token,userSessionLifetime)});
+  }
+
+  async function register(request,response) {
+    if(!sameOrigin(request,true))return json(response,403,{error:'来源校验失败。'});
+    if(!registrationEnabled)return json(response,403,{error:'当前暂停自助注册，请联系管理员开通账号。',code:'registration_disabled'});
+    const addressKey=`register-ip:${clientIp(request)}`;
+    if(!loginAllowed(addressKey,6)||registrationsInFlight>=4){
+      return json(response,429,{error:'注册请求过多，请五分钟后重试。'},{'Retry-After':'300'});
+    }
+    recordAttempt(addressKey);
+    registrationsInFlight++;
+    try {
+      const body=await readJson(request);
+      if(Object.keys(body).some(key=>!['username','displayName','password'].includes(key))){
+        return json(response,400,{error:'注册只接受用户名、显示名称和密码。'});
+      }
+      const user=await store.registerUser(body);
+      const created=store.setSession(null,'user',user.id);
+      return json(response,201,{user},{'Set-Cookie':sessionCookie('orbit_cloud_session',created.token,userSessionLifetime)});
+    } finally {
+      registrationsInFlight--;
+    }
+  }
+
+  function requireAdmin(request,response) {
+    const value=adminSession(request);
+    if(!value)json(response,401,{error:'请先登录管理员后台。'});
+    return value;
+  }
+
+  async function adminApi(request,response,url) {
+    if(request.method!=='GET'&&!sameOrigin(request,true))return json(response,403,{error:'来源校验失败。'});
+    if(url.pathname==='/api/admin/login'&&request.method==='POST')return createLogin(request,response,'admin');
+    if(url.pathname==='/api/admin/logout'&&request.method==='POST'){
+      const current=adminSession(request);if(current){store.revokeSession(current.raw);store.audit('admin','admin.logout',null,{})}
+      return json(response,200,{ok:true},{'Set-Cookie':'orbit_admin=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0'+secureSuffix()});
+    }
+    const administrator=requireAdmin(request,response);if(!administrator)return;
+    if(url.pathname==='/api/admin/overview'&&request.method==='GET'){
+      return json(response,200,store.overview([...agents.keys()]));
+    }
+    if(url.pathname==='/api/admin/users'&&request.method==='GET'){
+      const page=Number(url.searchParams.get('page')||1);
+      const pageSize=Number(url.searchParams.get('pageSize')||25);
+      const search=url.searchParams.get('search')||'';
+      const status=url.searchParams.get('status')||'all';
+      if(!Number.isSafeInteger(page)||page<1||page>1000000
+        ||!Number.isSafeInteger(pageSize)||pageSize<1||pageSize>100
+        ||search.length>100||!['all','active','suspended','expired'].includes(status)){
+        return json(response,400,{error:'用户列表筛选条件无效。'});
+      }
+      const result=store.listUsers({search,status,page,pageSize});
+      const devicesByUser=new Map();
+      for(const device of store.listDevicesForUsers(result.users.map(user=>user.id))){
+        const devices=devicesByUser.get(device.userId)||[];
+        devices.push(publicDevice(device));
+        devicesByUser.set(device.userId,devices);
+      }
+      return json(response,200,{
+        ...result,
+        users:result.users.map(user=>({...user,devices:devicesByUser.get(user.id)||[]}))
+      });
+    }
+    if(url.pathname==='/api/admin/users'&&request.method==='POST'){
+      const body=await readJson(request);
+      const password=body.password||crypto.randomBytes(18).toString('base64url');
+      const user=await store.createUser({...body,password});
+      return json(response,201,{user,initialPassword:password});
+    }
+    const resetMatch=url.pathname.match(/^\/api\/admin\/users\/([^/]+)\/reset-password$/);
+    if(resetMatch&&request.method==='POST'){
+      const id=decodeURIComponent(resetMatch[1]);const body=await readJson(request);
+      const password=body.password||crypto.randomBytes(18).toString('base64url');
+      if(!await store.resetPassword(id,password))return json(response,404,{error:'用户不存在。'});
+      closeUserBrowsers(id,1008,'账号密码已重置，请重新登录。');
+      return json(response,200,{ok:true,initialPassword:password});
+    }
+    const userDevices=url.pathname.match(/^\/api\/admin\/users\/([^/]+)\/devices$/);
+    if(userDevices&&request.method==='GET'){
+      const userId=decodeURIComponent(userDevices[1]);if(!store.getUser(userId))return json(response,404,{error:'用户不存在。'});
+      return json(response,200,{devices:store.listDevices(userId).map(device=>({...publicDevice(device),username:device.username}))});
+    }
+    if(userDevices&&request.method==='POST'){
+      const userId=decodeURIComponent(userDevices[1]);const body=await readJson(request);
+      const issued=store.issueDevice(userId,body.name);
+      return json(response,201,{device:publicDevice(issued.device),agentToken:issued.agentToken});
+    }
+    const userMatch=url.pathname.match(/^\/api\/admin\/users\/([^/]+)$/);
+    if(userMatch&&request.method==='PATCH'){
+      const id=decodeURIComponent(userMatch[1]);const body=await readJson(request);
+      const user=store.updateUser(id,body);
+      if(!user)return json(response,404,{error:'用户不存在。'});
+      if(user.status==='suspended'||(user.expiresAt&&user.expiresAt<=Date.now()))closeUserConnections(id,1008,'账号已停用或到期。');
+      return json(response,200,{user});
+    }
+    const deviceMatch=url.pathname.match(/^\/api\/admin\/devices\/([^/]+)$/);
+    if(deviceMatch&&request.method==='PATCH'){
+      const id=decodeURIComponent(deviceMatch[1]);const body=await readJson(request);
+      const device=store.setDeviceStatus(id,body.status,body.name);
+      if(!device)return json(response,404,{error:'设备不存在。'});
+      if(device.status==='revoked')closeDeviceConnections(id,1008,'设备访问已撤销。');
+      return json(response,200,{device:publicDevice(device)});
+    }
+    if(url.pathname==='/api/admin/audit'&&request.method==='GET'){
+      const limit=Number(url.searchParams.get('limit')||100);
+      return json(response,200,{events:store.listAudit(Number.isSafeInteger(limit)?limit:100)});
+    }
+    return json(response,404,{error:'管理员接口不存在。'});
+  }
+
+  httpServer.on('request',async(request,response)=>{
+    response.setHeader('Cache-Control','no-store');
+    response.setHeader('X-Content-Type-Options','nosniff');
+    response.setHeader('X-Frame-Options','DENY');
+    response.setHeader('Referrer-Policy','no-referrer');
+    response.setHeader('Content-Security-Policy',"default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'");
+    try{
+      const url=new URL(request.url,originFor(request));
+      if(request.method==='GET'&&url.pathname==='/healthz')return json(response,200,{ok:true});
+      if(requireSecureTransport&&!secureTransport(request))return json(response,426,{error:'生产环境要求 HTTPS。'});
+      if(url.pathname.startsWith('/api/admin/'))return await adminApi(request,response,url);
+      if(url.pathname==='/api/cloud/config'&&request.method==='GET'){
+        return json(response,200,{registrationEnabled,registrationPlan:'free',registrationMaxDevices:1});
+      }
+      if(url.pathname==='/api/cloud/register'&&request.method==='POST')return await register(request,response);
+      if(url.pathname==='/api/cloud/device-auth/start'&&request.method==='POST'){
+        if(!sameOrigin(request))return json(response,403,{error:'来源校验失败。'});
+        const key=`device-auth:${clientIp(request)}`;
+        if(!loginAllowed(key,6))return json(response,429,{error:'连接请求过多，请五分钟后重试。'});
+        recordAttempt(key);
+        const body=await readJson(request);
+        const created=deviceAuthorization.start(body.name);
+        return json(response,201,{...created,verificationUri:`${originFor(request)}/connect?code=${created.userCode}`});
+      }
+      if(url.pathname==='/api/cloud/device-auth/poll'&&request.method==='POST'){
+        if(!sameOrigin(request))return json(response,403,{error:'来源校验失败。'});
+        const body=await readJson(request);
+        const value=deviceAuthorization.poll(body.deviceCode);
+        if(value.status===410)return json(response,410,{error:'连接请求已失效，请重新运行 orbit login。'});
+        return json(response,value.status,value.result||{pending:true});
+      }
+      if(url.pathname==='/api/cloud/device-auth/ack'&&request.method==='POST'){
+        if(!sameOrigin(request))return json(response,403,{error:'来源校验失败。'});
+        const body=await readJson(request);
+        if(!deviceAuthorization.acknowledge(body.deviceCode))return json(response,410,{error:'连接请求已失效。'});
+        return json(response,200,{ok:true});
+      }
+      if(url.pathname==='/api/cloud/device-auth/request'&&request.method==='GET'){
+        const current=userSession(request);if(!current)return json(response,401,{error:'请先登录。',code:'cloud_login_required'});
+        const userKey=`device-auth-view-user:${current.user.id}`;
+        const addressKey=`device-auth-view-ip:${clientIp(request)}`;
+        if(!loginAllowed(userKey,60)||!loginAllowed(addressKey,300)){
+          return json(response,429,{error:'查看连接请求过多，请稍后再试。'},{'Retry-After':'60'});
+        }
+        recordAttempt(userKey);
+        recordAttempt(addressKey);
+        const value=deviceAuthorization.preview(url.searchParams.get('code'));
+        return value?json(response,200,value):json(response,410,{error:'连接请求已失效，请在电脑重新运行 orbit login。'});
+      }
+      if(url.pathname==='/api/cloud/device-auth/approve'&&request.method==='POST'){
+        if(!sameOrigin(request,true))return json(response,403,{error:'来源校验失败。'});
+        const current=userSession(request);if(!current)return json(response,401,{error:'请先登录。',code:'cloud_login_required'});
+        const userKey=`device-auth-approve-user:${current.user.id}`;
+        const addressKey=`device-auth-approve-ip:${clientIp(request)}`;
+        if(!loginAllowed(userKey,12)||!loginAllowed(addressKey,60)){
+          return json(response,429,{error:'电脑确认尝试过多，请稍后重试。'},{'Retry-After':'300'});
+        }
+        recordAttempt(userKey);
+        recordAttempt(addressKey);
+        const body=await readJson(request);
+        deviceAuthorization.approve(body.userCode, name=>{
+          const issued=store.issueDevice(current.user.id,name,`user:${current.user.id}`);
+          return {device:publicDevice(issued.device),agentToken:issued.agentToken};
+        });
+        return json(response,200,{ok:true});
+      }
+      if(url.pathname==='/api/cloud/device-auth/revoke'&&request.method==='POST'){
+        if(!sameOrigin(request))return json(response,403,{error:'来源校验失败。'});
+        const match=request.headers.authorization?.match(/^Bearer ([a-zA-Z0-9_-]{32,100})$/);
+        if(!match)return json(response,401,{error:'电脑凭证无效。'});
+        const body=await readJson(request);
+        if(Object.keys(body).some(key=>key!=='deviceId')||typeof body.deviceId!=='string'){
+          return json(response,400,{error:'撤销请求格式无效。'});
+        }
+        const device=store.authenticateDevice(match[1],body.deviceId);
+        if(!device)return json(response,404,{error:'电脑凭证已失效或设备不存在。'});
+        store.setDeviceStatus(device.id,'revoked',undefined,`user:${device.userId}`);
+        closeDeviceConnections(device.id,1008,'设备访问已撤销。');
+        return json(response,200,{ok:true});
+      }
+      if(url.pathname==='/api/cloud/login'&&request.method==='POST')return await createLogin(request,response,'user');
+      if(url.pathname==='/api/cloud/logout'&&request.method==='POST'){
+        if(!sameOrigin(request,true))return json(response,403,{error:'来源校验失败。'});
+        const current=userSession(request);if(current){store.revokeSession(current.raw);store.audit(`user:${current.user.id}`,'user.logout',current.user.id,{});closeUserBrowsers(current.user.id,1008,'用户已退出登录。')}
+        return json(response,200,{ok:true},{'Set-Cookie':'orbit_cloud_session=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0'+secureSuffix()});
+      }
+      if(url.pathname==='/api/cloud/me'&&request.method==='GET'){
+        const current=userSession(request);if(!current)return json(response,401,{error:'请先登录。',code:'cloud_login_required'});
+        return json(response,200,{user:current.user,devices:store.devicesForUser(current.user.id).map(device=>publicDevice(device))});
+      }
+      if(url.pathname==='/api/cloud/devices'&&request.method==='POST'){
+        if(!sameOrigin(request,true))return json(response,403,{error:'来源校验失败。'});
+        const current=userSession(request);if(!current)return json(response,401,{error:'请先登录。',code:'cloud_login_required'});
+        const body=await readJson(request);
+        if(Object.keys(body).some(key=>key!=='name'))return json(response,400,{error:'添加电脑只接受设备名称。'});
+        const issued=store.issueDevice(current.user.id,body.name,`user:${current.user.id}`);
+        return json(response,201,{device:publicDevice(issued.device),agentToken:issued.agentToken});
+      }
+      const revokeDevice=url.pathname.match(/^\/api\/cloud\/devices\/([a-zA-Z0-9_-]{8,100})\/revoke$/);
+      if(revokeDevice&&request.method==='POST'){
+        if(!sameOrigin(request,true))return json(response,403,{error:'来源校验失败。'});
+        const current=userSession(request);if(!current)return json(response,401,{error:'请先登录。',code:'cloud_login_required'});
+        const owned=store.listDevices(current.user.id).find(device=>device.id===revokeDevice[1]);
+        if(!owned)return json(response,404,{error:'电脑不存在。'});
+        store.setDeviceStatus(owned.id,'revoked',undefined,`user:${current.user.id}`);
+        closeDeviceConnections(owned.id,1008,'设备访问已撤销。');
+        return json(response,200,{ok:true});
+      }
+      if(url.pathname==='/api/cloud/choose-device'&&request.method==='POST'){
+        if(!sameOrigin(request,true))return json(response,403,{error:'来源校验失败。'});
+        const current=userSession(request);if(!current)return json(response,401,{error:'请先登录。'});
+        const body=await readJson(request);
+        const device=store.devicesForUser(current.user.id).find(item=>item.id===body.deviceId);
+        if(!device)return json(response,403,{error:'设备不属于当前账号。'});
+        return json(response,200,{device:publicDevice(device)});
+      }
+      if(isLocalApi(url.pathname,request.method)){
+        if(request.method!=='GET'&&!sameOrigin(request,true))return json(response,403,{error:'来源校验失败。'});
+        const current=userSession(request);if(!current)return json(response,401,{error:'请先登录云端工作台。',code:'cloud_login_required'});
+        const devices=store.devicesForUser(current.user.id);
+        if(devices.length>Number(current.user.maxDevices))return json(response,403,{error:'设备数量超出套餐额度。'});
+        return await proxyHttp(request,response,current);
+      }
+      const file=staticTarget(url.pathname);
+      if(file&&['GET','HEAD'].includes(request.method)){
+        const [relative,type]=file;const filename=path.join(root,relative);
+        if(!fs.existsSync(filename))return json(response,404,{error:'静态文件不存在。'});
+        response.writeHead(200,{'Content-Type':`${type}; charset=utf-8`});
+        if(request.method==='HEAD')return response.end();
+        return fs.createReadStream(filename).pipe(response);
+      }
+      return json(response,404,{error:'页面不存在。'});
+    }catch(error){if(!response.headersSent)json(response,error.status||400,{error:safeError(error)});else response.end()}
+  });
+
+  httpServer.on('upgrade',(request,socket,head)=>{
+    let url;try{url=new URL(request.url,originFor(request))}catch{return rejectUpgrade(socket)}
+    if(requireSecureTransport&&!secureTransport(request))return rejectUpgrade(socket,400,'TLS Required');
+    if(url.pathname==='/agent'){
+      wss.handleUpgrade(request,socket,head,websocket=>{
+        let agent=null;
+        websocket.on('error',()=>{});
+        const authTimer=setTimeout(()=>websocket.close(1008,'Agent authentication timeout'),8000);
+        websocket.on('message',(raw,isBinary)=>{
+          let message;try{message=JSON.parse(raw.toString())}catch{return websocket.close(1003,'Invalid message')}
+          if(!message||typeof message!=='object')return websocket.close(1003,'Invalid message');
+          if(!agent){
+            if(message.type!=='agent-auth'){clearTimeout(authTimer);return websocket.close(1008,'Agent authentication failed')}
+            agent=store.authenticateDevice(message.token,message.deviceId);
+            if(!agent){clearTimeout(authTimer);return websocket.close(1008,'Agent authentication failed')}
+            clearTimeout(authTimer);
+            const entry={socket:websocket,deviceId:agent.id,userId:agent.userId,name:agent.name,isAlive:true};
+            const previous=agents.get(agent.id);
+            if(previous&&previous.socket!==websocket)closeDeviceConnections(agent.id,1012,'Replaced by a newer agent');
+            agents.set(agent.id,entry);
+            store.audit(`user:${agent.userId}`,'device.connected',agent.id,{});
+            websocket.send(JSON.stringify({type:'agent-ready',deviceId:agent.id,name:agent.name}));
+            websocket.on('pong',()=>{entry.isAlive=true;store.touchDevice(agent.id)});
+            return;
+          }
+          if(agents.get(agent.id)?.socket!==websocket)return websocket.close(1008,'Agent replaced or revoked');
+          if(message.type==='http-response'){
+            const pending=pendingHttp.get(message.requestId);
+            if(!pending||pending.agent.socket!==websocket)return;
+            if(!Number.isInteger(message.statusCode)||message.statusCode<200||message.statusCode>599||typeof message.body!=='string')return websocket.close(1003,'Invalid HTTP response');
+            clearTimeout(pending.timer);pendingHttp.delete(message.requestId);pending.resolve(message);return;
+          }
+          const browser=browserSockets.get(message.bridgeId);
+          if(!browser||browser.agent.socket!==websocket)return;
+          if(message.type==='ws-opened')return;
+          if(message.type==='ws-data'&&typeof message.data==='string'&&browser.socket.readyState===WebSocket.OPEN)browser.socket.send(
+            message.dataType==='binary'?Buffer.from(message.data,'base64'):Buffer.from(message.data,'base64'),
+            {binary:message.dataType==='binary'}
+          );
+          else if(message.type==='ws-close')closeBrowserSocket(message.bridgeId,1000,'电脑端连接已关闭。');
+          else if(message.type==='ws-error')closeBrowserSocket(message.bridgeId,1011,'电脑端 WebSocket 错误。');
+        });
+        websocket.on('close',()=>{
+          clearTimeout(authTimer);
+          if(!closing&&agent&&agents.get(agent.id)?.socket===websocket){
+            agents.delete(agent.id);store.audit(`user:${agent.userId}`,'device.disconnected',agent.id,{});
+            failPendingForDevice(agent.id,'电脑端代理已断开。');
+            for(const [bridgeId,browser]of browserSockets)if(browser.deviceId===agent.id)closeBrowserSocket(bridgeId,1011,'电脑端代理已断开。');
+          }
+        });
+      });
+      return;
+    }
+    if(url.pathname!=='/socket'||!sameOrigin(request,true))return rejectUpgrade(socket);
+    const current=userSession(request);if(!current)return rejectUpgrade(socket);
+    let device;
+    const deviceId=url.searchParams.get('deviceId');
+    const deviceRequest={headers:{'x-orbit-device-id':deviceId||''}};
+    try{device=chooseDevice(deviceRequest,current.user)}catch{return rejectUpgrade(socket,403,'Device Not Allowed')}
+    const agent=agents.get(device.id);
+    if(!agent||agent.socket.readyState!==WebSocket.OPEN)return rejectUpgrade(socket,503,'Agent Unavailable');
+    wss.handleUpgrade(request,socket,head,websocket=>{
+      websocket.on('error',()=>{});
+      const bridgeId=crypto.randomUUID();
+      const browserEntry={socket:websocket,agent,deviceId:device.id,userId:current.user.id,sessionHash:current.tokenHash,isAlive:true};
+      browserSockets.set(bridgeId,browserEntry);
+      websocket.on('pong',()=>{browserEntry.isAlive=true});
+      sendAgent(agent,{type:'ws-open',bridgeId,path:'/socket',headers:{
+        cookie:localCookie(request,device.id),origin:originFor(request),
+        host:request.headers.host||'',deviceId:device.id
+      }});
+      websocket.on('message',(data,isBinary)=>{
+        const user=store.getUser(current.user.id);
+        if(!store.hasSession(current.tokenHash,current.user.id)||user?.status!=='active'||user.expiresAt&&user.expiresAt<=Date.now()){
+          closeBrowserSocket(bridgeId,1008,'登录已失效。');return;
+        }
+        try { sendAgent(agent,{type:'ws-data',bridgeId,dataType:isBinary?'binary':'text',data:Buffer.from(data).toString('base64')}); }
+        catch { closeBrowserSocket(bridgeId,1011,'电脑端已断开。'); }
+      });
+      websocket.on('close',()=>{
+        browserSockets.delete(bridgeId);
+        try{sendAgent(agent,{type:'ws-close',bridgeId,code:1000,reason:'浏览器关闭连接。'})}catch{}
+      });
+    });
+  });
+
+  const heartbeat=setInterval(()=>{
+    store.cleanup();
+    deviceAuthorization.cleanup();
+    for(const agent of agents.values()){
+      const user=store.getUser(agent.userId);
+      const device=store.listDevices(agent.userId).find(entry=>entry.id===agent.id&&entry.status==='active');
+      if(!user||user.status!=='active'||(user.expiresAt&&user.expiresAt<=Date.now())||!device){closeDeviceConnections(agent.id,1008,'用户或设备访问已撤销。');continue}
+      if(!agent.isAlive){agent.socket.terminate();continue}
+      agent.isAlive=false;agent.socket.ping();
+    }
+    for(const [bridgeId,browser]of browserSockets){
+      if(!store.hasSession(browser.sessionHash,browser.userId)){closeBrowserSocket(bridgeId,1008,'登录已失效。');continue}
+      const user=store.getUser(browser.userId);
+      if(!user||user.status!=='active'||(user.expiresAt&&user.expiresAt<=Date.now())){closeBrowserSocket(bridgeId,1008,'账号已停用或到期。');continue}
+      if(!browser.isAlive){closeBrowserSocket(bridgeId,1001,'浏览器连接超时。');continue}
+      browser.isAlive=false;browser.socket.ping();
+    }
+    for(const [key,attempt]of loginAttempts)if(attempt.reset<=Date.now())loginAttempts.delete(key);
+  },30000);
+  heartbeat.unref();
+
+  async function listen(){
+    await new Promise((resolve,reject)=>{httpServer.once('error',reject);httpServer.listen(port,host,resolve)});
+    port=httpServer.address().port;
+    return{host,port,secure:httpServer instanceof https.Server};
+  }
+  async function close(){
+    if(closing)return;
+    closing=true;
+    clearInterval(heartbeat);
+    for(const agent of agents.values())failPendingForDevice(agent.deviceId,'中继服务停止。');
+    for(const client of wss.clients)client.terminate();
+    agents.clear();browserSockets.clear();
+    await new Promise(resolve=>wss.close(resolve));
+    httpServer.closeAllConnections();
+    await new Promise(resolve=>httpServer.close(resolve));
+    store.close();
+  }
+  return{listen,close,server:httpServer,store,agents,browserSockets};
+}
+
+if(process.argv[1]&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url)){
+  const app=createRelayServer();const info=await app.listen();
+  console.log(`Orbit relay listening on ${info.host}:${info.port}${info.secure?' · TLS':' · behind HTTPS proxy'}`);
+  process.once('SIGINT',()=>app.close().then(()=>process.exit(0)));
+  process.once('SIGTERM',()=>app.close().then(()=>process.exit(0)));
+}