orbit-codex-bridge 0.1.1 → 0.1.2

package/README.md

@@ -29,7 +29,7 @@ orbit login
 
 1. 命令会打开电脑授权页面，登录或注册 Orbit 账号，确认添加这台电脑。
 2. 手机打开 [orbit.cubesugar.tech](https://orbit.cubesugar.tech)，登录同一账号。
-3. 扫描终端显示的配对二维码，选择这台电脑，完成首次连接。
+3. 登录后选择这台电脑；账号会自动完成安全配对，无需扫码或输入本机密钥。
 4. 选择原有会话，开始使用。尚未加载的会话可先在 Codex 桌面打开，再点“重新连接”。
 
 授权信息保存在电脑本地，下次启动会自动复用。连接器默认在当前用户的后台运行，可以关闭安装终端；断网后自动重连，工作进程异常退出后自动恢复。电脑需要保持开机、联网，Codex 桌面需要保持运行。电脑重启后运行 `orbit start` 恢复连接。
@@ -90,6 +90,6 @@ npx.cmd --yes --package=orbit-codex-bridge@latest orbit rebind
 
 在 Codex 桌面打开同一条会话，再点击网页中的“重新连接”。桌面热接管依赖 Codex 内部接口，桌面版本更新后可能需要更新 Orbit。
 
-**配对二维码与密钥**
+**账号登录与设备安全**
 
-只在自己的设备上使用。每台电脑使用独立连接凭证，可在工作台移除电脑，或运行 `orbit logout` 撤销授权。连接中断时，Orbit 不会自动重发已提交的消息和审批。
+手机端只需使用 Orbit 账号登录。电脑连接凭证保存在本机，账号登录后由中继自动配对，不会要求输入或传输本机密钥。每台电脑使用独立连接凭证，可在工作台移除电脑，或运行 `orbit logout` 撤销授权。连接中断时，Orbit 不会自动重发已提交的消息和审批。

package/cli.mjs

@@ -6,7 +6,6 @@ import path from 'node:path';
 import process from 'node:process';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-import QRCode from 'qrcode';
 import { createOrbitServer } from './server.mjs';
 import { createRelayAgent } from './relay-agent.mjs';
 import {connectorStatus,installConnectorRuntime,startConnector,stopConnector,superviseConnector} from './lib/connector-service.mjs';
@@ -147,13 +146,6 @@ export async function existingOrbitUrl(port) {
   } catch { return null; }
 }
 
-async function printPairing(pairingKey, publicUrl) {
-  const pairingUrl = `${publicUrl}/#pair=${encodeURIComponent(pairingKey)}`;
-  console.log('本机配对二维码和密钥仅供自己的手机使用，请勿公开。');
-  console.log(await QRCode.toString(pairingUrl,{type:'terminal',errorCorrectionLevel:'L',small:true}));
-  console.log(`本机配对密钥：${pairingKey}`);
-}
-
 async function runComputer(config, background = false) {
   process.env.ORBIT_HOST = '127.0.0.1';
   process.env.ORBIT_PORT = String(config.port || 4318);
@@ -168,13 +160,14 @@ async function runComputer(config, background = false) {
       const info=await app.listen();
       localUrl=info.url;
       console.log(`Orbit 电脑端运行中：${localUrl}`);
-      if (!background) await printPairing(app.pairingKey,config.publicUrl);
     }
     agent = createRelayAgent({
       relayUrl:config.relayUrl,
       localUrl,
       deviceId:config.deviceId,
       agentToken:config.agentToken,
+      pairingKey:app?.pairingKey,
+      pairingKeyFile:path.join(configDirectory(),'pairing-key'),
       onReady:() => console.log(`电脑“${config.deviceName}”已安全连接 Orbit。`),
       onState:state => {
         if (background && process.connected) process.send({type:'connector-state',state:{...state,workerReady:true}},() => {});
@@ -184,6 +177,7 @@ async function runComputer(config, background = false) {
     agent.start();
     if(!app)console.log(`复用本机 Orbit：${localUrl}`);
     console.log(`手机工作台：${config.publicUrl}`);
+    console.log('手机登录同一 Orbit 账号，选择这台电脑即可，无需输入配对密钥。');
     if (!background) console.log('前台诊断模式；保持此窗口运行，按 Ctrl+C 停止。');
     await new Promise(resolve => {
       const stop = () => {
@@ -211,10 +205,7 @@ async function runBackground(config) {
   console.log('可以关闭此终端。断网自动重连，异常退出自动恢复；电脑休眠期间无法远程使用。');
   console.log('停止：orbit stop；状态：orbit status；前台诊断：orbit login --foreground');
   console.log(`诊断日志：${path.join(configDirectory(),'connector.log')}`);
-  try {
-    const key = (await fs.readFile(path.join(configDirectory(),'pairing-key'),'utf8')).trim();
-    if (key) await printPairing(key,config.publicUrl);
-  } catch (error) { if (error.code !== 'ENOENT') throw error; }
+  console.log('手机登录同一 Orbit 账号，选择这台电脑即可，无需输入配对密钥。');
 }
 
 async function revokeComputer(config) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orbit-codex-bridge",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "type": "module",
   "description": "Connect your original Codex desktop conversations to Orbit on the web.",
   "engines": {

package/public/app.js

@@ -25,7 +25,7 @@ const paths = {
 const icon = name => `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">${paths[name] || paths.inbox}</svg>`;
 function decorate(parent = document) { parent.querySelectorAll('[data-icon]').forEach(element => { element.innerHTML = icon(element.dataset.icon); }); }
 function markdown(text) { return DOMPurify.sanitize(marked.parse(String(text || ''), { breaks: true }), { ALLOWED_TAGS: ['p','br','strong','b','em','i','s','del','ul','ol','li','blockquote','pre','code','h1','h2','h3','h4','h5','h6','hr','a','table','thead','tbody','tr','th','td','sup','sub','kbd','details','summary'], ALLOWED_ATTR: ['href','title','start','colspan','rowspan'], ALLOW_DATA_ATTR: false, ALLOW_ARIA_ATTR: false }); }
-const state = { threads: [], status: null, selected: null, selectionVersion: 0, historyStatus: 'idle', historyError: '', filter: 'all', project: null, search: '', view: 'sessions', socket: null, pending: new Map(), enabled: new Map(), baseMessages: [], olderMessages: [], cursor: null, liveMessages: new Map(), desktopMessages: [], desktopRuntime: null, selectedSettings: null, models: [], contextUsage: null, settingsBusy: false, reopenModelAfterGrant: false, pendingModelChoice: null, cloudMode: false, cloudUser: null, cloudDevices: [], cloudDeviceId: null, cloudPairCode: null, approvals: new Map(), reconnect: 0, loggedOut: false, busy: false, turnId: null };
+const state = { threads: [], status: null, selected: null, selectionVersion: 0, historyStatus: 'idle', historyError: '', filter: 'all', project: null, search: '', view: 'sessions', socket: null, pending: new Map(), enabled: new Map(), baseMessages: [], olderMessages: [], cursor: null, liveMessages: new Map(), desktopMessages: [], desktopRuntime: null, selectedSettings: null, models: [], contextUsage: null, settingsBusy: false, reopenModelAfterGrant: false, pendingModelChoice: null, cloudMode: false, cloudUser: null, cloudDevices: [], cloudDeviceId: null, approvals: new Map(), reconnect: 0, loggedOut: false, busy: false, turnId: null };
 let refreshTimer;
 let toastTimer;
 let reconnectTimer;
@@ -69,10 +69,9 @@ async function loadCloudConfig() {
   if (!cloudRegistrationEnabled) setCloudAuthMode(false);
 }
 
-function captureCloudPairCode() {
+function discardCloudPairCode() {
   const fragment=new URLSearchParams(location.hash.slice(1));
   if(!fragment.has('pair'))return;
-  state.cloudPairCode=fragment.get('pair');
   history.replaceState(null,'',location.pathname+location.search);
 }
 
@@ -94,7 +93,7 @@ async function api(url, body, signal) {
   const generation = workspaceGeneration;
   const headers = {};
   if (body !== undefined) headers['Content-Type'] = 'application/json';
-  if (state.cloudMode && state.cloudDeviceId && !url.startsWith('/api/cloud/')) headers['X-Orbit-Device-Id'] = state.cloudDeviceId;
+  if (state.cloudMode && state.cloudDeviceId && (!url.startsWith('/api/cloud/') || url === '/api/cloud/connect')) headers['X-Orbit-Device-Id'] = state.cloudDeviceId;
   const options = body === undefined ? { headers } : { method: 'POST', headers, body: JSON.stringify(body) };
   if (signal) options.signal = signal;
   let response;
@@ -113,7 +112,7 @@ async function api(url, body, signal) {
     if (response.status === 401 && state.cloudMode && (result.code === 'cloud_login_required' || url.startsWith('/api/cloud/') && url !== '/api/cloud/login')) {
       showCloudLogin(result.error);
       error.handled = true;
-    } else if (response.status === 401 && url !== '/api/pair' && !url.startsWith('/api/cloud/') && !state.cloudPairCode) {
+    } else if (response.status === 401 && !state.cloudMode && url !== '/api/pair' && !url.startsWith('/api/cloud/')) {
       showPairing();
       error.handled = true;
     }
@@ -127,9 +126,7 @@ function showPairing(error = '') {
   select('#workspace').hidden = true; select('#pair-screen').hidden = false;
   select('#cloud-login-screen').hidden = true; select('#cloud-device-screen').hidden = true;
   select('#pair-error').textContent = error;
-  select('#pair-screen .pair-form > p').textContent = state.cloudMode
-    ? `首次连接“${state.cloudDevices.find(device => device.id === state.cloudDeviceId)?.name || '这台电脑'}”，请扫描电脑终端中的配对二维码，或粘贴终端显示的本机配对密钥。`
-    : '输入电脑上的配对密钥。会话内容仅向已配对的设备开放。';
+  select('#pair-screen .pair-form > p').textContent = '输入电脑上的配对密钥。会话内容仅向已配对的设备开放。';
   const fragment = new URLSearchParams(location.hash.slice(1));
   if (fragment.has('pair')) { select('#pair-code').value = fragment.get('pair'); history.replaceState(null, '', location.pathname); }
 }
@@ -155,9 +152,7 @@ function showCloudDevices(message = '') {
   const quota = state.cloudUser?.maxDevices || 1;
   select('#cloud-devices-title').textContent = state.cloudDevices.length ? '选择要连接的电脑' : '连接你的第一台电脑';
   const greeting = `已登录 ${state.cloudUser?.displayName || state.cloudUser?.username}。`;
-  select('#cloud-device-message').textContent = state.cloudPairCode
-    ? `${greeting}选择发起连接的电脑，完成本机配对。${message ? ` ${message}` : ''}`
-    : message || greeting + (state.cloudDevices.length ? '选择一台电脑继续。' : '先添加你自己的电脑，连接后即可查看原有会话。');
+  select('#cloud-device-message').textContent = message || greeting + (state.cloudDevices.length ? '选择一台电脑继续，无需输入配对密钥。' : '先添加你自己的电脑，连接后即可查看原有会话。');
   select('#cloud-device-quota').textContent = `套餐 ${state.cloudUser?.plan || 'free'} · 已添加 ${state.cloudDevices.length} / ${quota} 台电脑`;
   select('#cloud-add-computer').disabled = state.cloudDevices.length >= quota;
   select('#cloud-add-computer').title = state.cloudDevices.length >= quota ? '已达到设备上限，可移除旧电脑或联系管理员调整额度。' : '';
@@ -186,19 +181,6 @@ async function connectCloudDevice(deviceId) {
     if (!device.online) { showCloudDevices(`电脑“${device.name}”尚未上线。请确认电脑已联网，在电脑终端运行 orbit login，后台启动后再点击连接。`); return; }
     state.cloudDeviceId = deviceId;
     localStorage.setItem('orbit_cloud_device_id', deviceId);
-    if (state.cloudPairCode) {
-      try {
-        await api('/api/pair', {code:state.cloudPairCode});
-        state.cloudPairCode = null;
-      } catch (error) {
-        if (error.status === 401 && !error.handled) {
-          state.cloudPairCode = null;
-          showPairing(error.message);
-          return;
-        }
-        throw error;
-      }
-    }
     await boot();
   } catch (error) {
     if (!error.handled && error.code !== 'STALE_WORKSPACE') showCloudDevices(error.message);
@@ -240,7 +222,7 @@ async function discoverCloudWorkspace() {
   catch (error) { throw new Error('无法连接工作台服务，请检查网络。'); }
   if (generation !== workspaceGeneration) return 'stale';
   if (response.status === 404) return 'local';
-  captureCloudPairCode();
+  discardCloudPairCode();
   let configError = '';
   try { await loadCloudConfig(); }
   catch (error) { configError = error.message; }
@@ -255,8 +237,8 @@ async function discoverCloudWorkspace() {
   state.cloudMode = true; state.loggedOut = false;
   state.cloudUser = workspace.user; state.cloudDevices = workspace.devices || [];
   const saved = localStorage.getItem('orbit_cloud_device_id');
-  if (!state.cloudPairCode && saved && state.cloudDevices.some(device => device.id === saved && device.status === 'active')) state.cloudDeviceId = saved;
-  else if (state.cloudDevices.length === 1 && state.cloudDevices[0].status === 'active' && !state.cloudPairCode) {
+  if (saved && state.cloudDevices.some(device => device.id === saved && device.status === 'active')) state.cloudDeviceId = saved;
+  else if (state.cloudDevices.length === 1 && state.cloudDevices[0].status === 'active') {
     state.cloudDeviceId = state.cloudDevices[0].id;
     localStorage.setItem('orbit_cloud_device_id',state.cloudDeviceId);
   } else {
@@ -280,6 +262,13 @@ async function boot() {
   try {
     const cloudState = await discoverCloudWorkspace();
     if (cloudState !== 'local' && cloudState !== 'ready') return;
+    if (cloudState === 'ready') {
+      try { await api('/api/cloud/connect',{}); }
+      catch (error) {
+        if (error.status === 404) throw new Error('云端尚未支持账号直接连接，请先更新云端 Orbit 服务到 0.1.2 或更高版本。');
+        throw error;
+      }
+    }
     state.status = await api('/api/status');
     if (generation !== workspaceGeneration) return;
     state.loggedOut = false;
@@ -397,6 +386,7 @@ function scheduleReconnect() {
   clearTimeout(reconnectTimer);
   reconnectTimer = setTimeout(async () => {
     try {
+      if (state.cloudMode) await api('/api/cloud/connect',{});
       state.status = await api('/api/status');
       state.enabled = new Map(Object.entries(state.status.execution.grants || {}));
       connectSocket();
@@ -772,12 +762,18 @@ function renderDevices() {
   cloudRow.querySelector('span:last-child').classList.toggle('pending', !state.cloudMode);
   select('#copy-url').onclick = async () => { try { await navigator.clipboard.writeText(url); toast('连接地址已复制。'); } catch { toast('浏览器不允许复制，请手动复制地址。'); } };
   select('#show-qr').onclick = async () => {
+    if (state.cloudMode) return;
     try {
       const data = await api('/api/pair/qr', { url });
       select('#qr-container').innerHTML = `<img src="${escapeHtml(data.image)}" alt="敏感的设备配对二维码"><p>${escapeHtml(data.warning)}</p>`;
       select('#qr-container').hidden = false;
     } catch (error) { toast(error.message); }
   };
+  if (state.cloudMode) {
+    const card = select('#show-qr').closest('section');
+    card.querySelector('p').textContent = '手机打开工作台，登录同一 Orbit 账号并选择这台电脑，即可继续原有会话，无需扫码或输入密钥。';
+    select('#show-qr').hidden = true;
+  }
 }
 
 function closeNav() { select('#workspace').classList.remove('nav-open'); select('#scrim').hidden = true; }

package/public/index.html

@@ -30,11 +30,11 @@
 </section>
 <section id="cloud-device-screen" class="devices-view cloud-device-screen" hidden>
 <header class="cloud-device-header"><div><span class="eyebrow">YOUR CONNECTED COMPUTERS</span><h1 id="cloud-devices-title">选择要连接的电脑</h1><p id="cloud-device-message">只显示绑定到你账号的设备。</p><p id="cloud-device-quota"></p></div><div class="cloud-device-actions"><button id="cloud-refresh-devices" class="button small" type="button">刷新状态</button><button id="cloud-add-computer" class="primary" type="button">添加电脑</button><button id="cloud-logout-picker" class="button small" type="button">退出登录</button></div></header>
-<section id="cloud-onboarding" class="cloud-onboarding" hidden><div><span class="mini-badge">FIRST CONNECTION</span><h2>一条命令，连接你的电脑</h2><p>电脑需要运行 Codex 桌面应用。Windows 用户复制下面命令到 PowerShell 运行。</p><ol><li>命令会检查 Node.js 24+，缺少时通过 winget 安装。</li><li>浏览器打开后登录此 Orbit 账号，确认添加这台电脑。</li><li>授权完成后，终端会启动 Orbit 并显示手机配对二维码；用手机扫描完成首次连接。</li></ol><div class="cloud-command-box"><pre class="cloud-install-command"><code id="cloud-install-command"></code></pre><button id="cloud-copy-install" class="button small" type="button">复制命令</button></div><p id="cloud-install-status" class="cloud-install-status" role="status"></p><p class="cloud-release-note">如果电脑没有 winget，请先从 nodejs.org 安装 Node.js 24+。winget 可能会请求系统安装授权。</p><p class="cloud-release-note">macOS / Linux：先安装 Node.js 24+，再运行 <code>npx --yes --package=orbit-codex-bridge orbit login</code>。</p></div></section>
+<section id="cloud-onboarding" class="cloud-onboarding" hidden><div><span class="mini-badge">FIRST CONNECTION</span><h2>一条命令，连接你的电脑</h2><p>电脑需要运行 Codex 桌面应用。Windows 用户复制下面命令到 PowerShell 运行。</p><ol><li>命令会检查 Node.js 24+，缺少时通过 winget 安装。</li><li>浏览器打开后登录此 Orbit 账号，确认添加这台电脑。</li><li>手机登录同一账号，选择已上线的电脑即可使用，无需扫码或输入配对密钥。</li></ol><div class="cloud-command-box"><pre class="cloud-install-command"><code id="cloud-install-command"></code></pre><button id="cloud-copy-install" class="button small" type="button">复制命令</button></div><p id="cloud-install-status" class="cloud-install-status" role="status"></p><p class="cloud-release-note">如果电脑没有 winget，请先从 nodejs.org 安装 Node.js 24+。winget 可能会请求系统安装授权。</p><p class="cloud-release-note">macOS / Linux：先安装 Node.js 24+，再运行 <code>npx --yes --package=orbit-codex-bridge@latest orbit login</code>。</p></div></section>
 <div id="cloud-devices-list" class="device-grid cloud-device-list"></div></section>
 <section id="pair-screen" class="pair-screen" hidden>
 <div class="pair-art"><a class="brand light" href="/"><img src="/icon.svg" alt=""><span>orbit<span class="brand-dot">.</span></span></a><div class="orbital-art"><div class="orbit-ring ring-one"></div><div class="orbit-ring ring-two"></div><div class="orbit-core">o</div><span class="orbit-point"></span></div><div class="pair-copy"><span class="eyebrow">YOUR WORK. IN YOUR ORBIT.</span><h1>会话留在电脑，<br>灵感随你出发。</h1><p>不复制上下文，不从头再来。<br>从熟悉的项目，找到原来的对话。</p></div><span class="art-caption">LOCAL FIRST / BUILT FOR CONTINUITY</span></div>
-<div class="pair-form-wrap"><div class="pair-form"><span class="mini-badge">PRIVATE WORKSPACE</span><h2>连接你的工作台</h2><p>输入电脑上的配对密钥。会话内容仅向已配对的设备开放。</p><form id="pair-form"><label for="pair-code">设备配对密钥</label><input id="pair-code" type="password" placeholder="粘贴本机配对密钥" autocomplete="off" required><button class="primary full" type="submit">安全连接 <span>↗</span></button><p id="pair-error" class="error" role="alert"></p></form><div class="pair-help"><span data-icon="shield"></span><div><strong>你的会话，不必搬家</strong><p>首版默认只读。不会自动恢复、停止或改写原有对话。</p></div></div><details><summary>在哪里找到密钥？</summary><p>在 Orbit 目录运行 <code>Get-Content .runtime\pairing-key</code>。仅用于可信设备；它不是模型 API Key。</p></details></div><footer>ORBIT / 0.1 PREVIEW <span>原生记录 · 本地优先</span></footer></div>
+<div class="pair-form-wrap"><div class="pair-form"><span class="mini-badge">PRIVATE WORKSPACE</span><h2>连接你的工作台</h2><p>输入电脑上的配对密钥。会话内容仅向已配对的设备开放。</p><form id="pair-form"><label for="pair-code">设备配对密钥</label><input id="pair-code" type="password" placeholder="粘贴本机配对密钥" autocomplete="off" required><button class="primary full" type="submit">安全连接 <span>↗</span></button><p id="pair-error" class="error" role="alert"></p></form><div class="pair-help"><span data-icon="shield"></span><div><strong>原会话始终留在电脑</strong><p>选择原会话后，消息和操作会发送到这台电脑上正在运行的 Codex。</p></div></div><details><summary>在哪里找到密钥？</summary><p>在 Orbit 目录运行 <code>Get-Content .runtime\pairing-key</code>。仅用于可信设备；它不是模型 API Key。</p></details></div><footer>ORBIT <span>原生会话 · 电脑执行</span></footer></div>
 </section>
 <div id="workspace" class="workspace" hidden>
 <button id="scrim" class="scrim" aria-label="收起导航" hidden></button>

package/relay-agent.mjs

@@ -1,11 +1,13 @@
 import http from 'node:http';
 import https from 'node:https';
+import fs from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import WebSocket from 'ws';
 
 const maxBody = 12 * 1024 * 1024;
 const isLoopback = url => ['localhost','127.0.0.1','[::1]'].includes(url.hostname);
+const root = path.dirname(fileURLToPath(import.meta.url));
 
 export function createRelayAgent(options = {}) {
   const relay = new URL(options.relayUrl || process.env.ORBIT_RELAY_URL || '');
@@ -48,53 +50,90 @@ export function createRelayAgent(options = {}) {
     requests.clear();
   }
 
-  function localRequest(message, cloudSocket) {
+  function requestLocal(method, targetPath, headers, body, cloudSocket) {
+    return new Promise((resolve,reject) => {
+      if (socket !== cloudSocket || cloudSocket.readyState !== WebSocket.OPEN) return reject(new Error('云端连接已断开。'));
+      if (requests.size >= 100) return reject(new Error('电脑端请求过多，请稍后重试。'));
+      const target = new URL(targetPath,local);
+      const transport = target.protocol === 'https:' ? https : http;
+      const request = transport.request(target,{method,headers:{...headers,host:local.host,origin:local.origin},timeout:25000},response => {
+        const chunks = [];
+        let size = 0;
+        response.on('data',chunk => {
+          size += chunk.length;
+          if (size > maxBody) request.destroy(new Error('本机响应过大。'));
+          else chunks.push(chunk);
+        });
+        response.on('error',error => request.destroy(error));
+        response.on('end',() => {
+          requests.delete(request);
+          resolve({statusCode:response.statusCode || 502,headers:{
+            'content-type':response.headers['content-type'] || 'application/json',
+            ...(response.headers['set-cookie'] ? {'set-cookie':response.headers['set-cookie']} : {})
+          },body:Buffer.concat(chunks)});
+        });
+      });
+      requests.add(request);
+      request.on('timeout',() => request.destroy(new Error('本机 Orbit 响应超时。')));
+      request.on('error',error => {
+        requests.delete(request);
+        reject(error);
+      });
+      request.end(body);
+    });
+  }
+
+  function respondLocal(message, cloudSocket, result) {
+    if (socket === cloudSocket && cloudSocket.readyState === WebSocket.OPEN) {
+      cloudSocket.send(JSON.stringify({type:'http-response',requestId:message.requestId,...result,body:result.body.toString('base64')}));
+    }
+  }
+
+  async function localRequest(message, cloudSocket) {
     if (typeof message.path !== 'string' || !message.path.startsWith('/api/') || message.path.startsWith('//')
       || !['GET','POST'].includes(message.method)) return cloudSocket.close(1008,'Invalid local target');
     const target = new URL(message.path,local);
     if (target.origin !== local.origin) return cloudSocket.close(1008,'Invalid local target');
     const body = Buffer.from(message.body || '', 'base64');
-    if (body.length > maxBody || requests.size >= 100) return;
-    const transport = target.protocol === 'https:' ? https : http;
-    let finished = false;
-    const respond = (statusCode,headers,responseBody) => {
-      if (finished) return;
-      finished = true;
-      if (socket === cloudSocket && cloudSocket.readyState === WebSocket.OPEN) {
-        cloudSocket.send(JSON.stringify({type:'http-response',requestId:message.requestId,statusCode,headers,body:responseBody.toString('base64')}));
-      }
-    };
+    if (body.length > maxBody) return;
     const headers = {};
     for (const name of ['accept','content-type','cookie','user-agent']) {
       const value = message.headers?.[name];
       if (typeof value === 'string') headers[name] = value;
     }
-    headers.host = local.host;
-    headers.origin = local.origin;
-    const request = transport.request(target,{method:message.method,headers,timeout:25000},response => {
-      const chunks = [];
-      let size = 0;
-      response.on('data',chunk => {
-        size += chunk.length;
-        if (size > maxBody) request.destroy(new Error('本机响应过大。'));
-        else chunks.push(chunk);
-      });
-      response.on('error',error => request.destroy(error));
-      response.on('end',() => {
-        requests.delete(request);
-        respond(response.statusCode || 502,{
-          'content-type':response.headers['content-type'] || 'application/json',
-          ...(response.headers['set-cookie'] ? {'set-cookie':response.headers['set-cookie']} : {})
-        },Buffer.concat(chunks));
+    try {
+      respondLocal(message,cloudSocket,await requestLocal(message.method,message.path,headers,body,cloudSocket));
+    } catch (error) {
+      respondLocal(message,cloudSocket,{statusCode:502,headers:{},body:Buffer.from(JSON.stringify({error:error.message}))});
+    }
+  }
+
+  async function connectAccount(message, cloudSocket) {
+    try {
+      const cookie = message.headers?.cookie || '';
+      if (cookie) {
+        const current = await requestLocal('GET','/api/status',{cookie},undefined,cloudSocket);
+        if (current.statusCode === 200) {
+          respondLocal(message,cloudSocket,{statusCode:200,headers:{},body:Buffer.from('{"ok":true}')});
+          return;
+        }
+        if (current.statusCode !== 401) throw new Error('本机连接状态异常。');
+      }
+      const filename = options.pairingKeyFile || process.env.ORBIT_PAIRING_KEY_FILE || path.join(root,'.runtime','pairing-key');
+      const pairingKey = String(options.pairingKey || await fs.readFile(filename,'utf8')).trim();
+      if (!/^[a-zA-Z0-9_-]{20,100}$/.test(pairingKey)) throw new Error('本机凭证不可用。');
+      const paired = await requestLocal('POST','/api/pair',{'content-type':'application/json'},
+        Buffer.from(JSON.stringify({code:pairingKey})),cloudSocket);
+      if (paired.statusCode !== 200 || !paired.headers['set-cookie']?.some(value => /^orbit_session=[a-zA-Z0-9_-]{20,100};/.test(value))) {
+        throw new Error('本机鉴权未完成。');
+      }
+      respondLocal(message,cloudSocket,{statusCode:200,headers:paired.headers,body:Buffer.from('{"ok":true}')});
+    } catch {
+      respondLocal(message,cloudSocket,{
+        statusCode:503,headers:{},
+        body:Buffer.from(JSON.stringify({error:'电脑连接器未能完成账号连接，请在电脑上运行 orbit restart，或更新连接器后重试。',code:'local_account_connect_failed'}))
       });
-    });
-    requests.add(request);
-    request.on('timeout',() => request.destroy(new Error('本机 Orbit 响应超时。')));
-    request.on('error',error => {
-      requests.delete(request);
-      respond(502,{'content-type':'application/json'},Buffer.from(JSON.stringify({error:error.message})));
-    });
-    request.end(body);
+    }
   }
 
   function openLocalSocket(message, cloudSocket) {
@@ -135,7 +174,7 @@ export function createRelayAgent(options = {}) {
     let pendingPing = null;
     let pingSentAt = 0;
     cloudSocket.on('open',() => {
-      cloudSocket.send(JSON.stringify({type:'agent-auth',token,deviceId}));
+      cloudSocket.send(JSON.stringify({type:'agent-auth',token,deviceId,capabilities:['account-connect']}));
       heartbeatTimer = setInterval(() => {
         if (socket !== cloudSocket || cloudSocket.readyState !== WebSocket.OPEN) return;
         if (pendingPing !== null) {
@@ -162,6 +201,7 @@ export function createRelayAgent(options = {}) {
       if (message.type === 'agent-ready') {
         clearTimeout(readyTimer);retry = 0;onState({status:'online'});onReady(message);return;
       }
+      if (message.type === 'account-connect') return void connectAccount(message,cloudSocket);
       if (message.type === 'http-request') return localRequest(message,cloudSocket);
       if (message.type === 'ws-open') return openLocalSocket(message,cloudSocket);
       const bridge = bridges.get(message.bridgeId);

package/relay-server.mjs

@@ -254,12 +254,15 @@ export function createRelayServer(options = {}) {
     return devices[0];
   }
 
-  async function proxyHttp(request,response,authenticated) {
+  async function proxyHttp(request,response,authenticated,accountConnect = false) {
     let device;
     try{device=chooseDevice(request,authenticated.user)}
     catch(error){return json(response,error.status||409,{error:safeError(error),code:error.code||'device_unavailable'})}
     const agent=agents.get(device.id);
     if(!agent||agent.socket.readyState!==WebSocket.OPEN)return json(response,503,{error:`电脑“${device.name}”当前不在线。`});
+    if(accountConnect&&!agent.accountConnect)return json(response,409,{
+      error:'请在电脑上更新 Orbit 连接器到 0.1.2 或更高版本后重试。',code:'connector_upgrade_required'
+    });
     const body=await readBody(request);
     if (!store.hasSession(authenticated.tokenHash,authenticated.user.id)) return json(response,401,{error:'请先登录云端工作台。',code:'cloud_login_required'});
     chooseDevice(request, store.getUser(authenticated.user.id));
@@ -273,9 +276,12 @@ export function createRelayServer(options = {}) {
       pendingHttp.set(requestId,{resolve,reject,timer,deviceId:device.id,agent,userId:authenticated.user.id,sessionHash:authenticated.tokenHash});
     });
     try{
-      sendAgent(agent,{type:'http-request',requestId,method:request.method,path:request.url,headers,body:body.toString('base64')});
+      sendAgent(agent,accountConnect
+        ? {type:'account-connect',requestId,headers:{cookie:headers.cookie}}
+        : {type:'http-request',requestId,method:request.method,path:request.url,headers,body:body.toString('base64')});
       const result=await promise;
       if (!store.hasSession(authenticated.tokenHash,authenticated.user.id)) return json(response,401,{error:'请先登录云端工作台。',code:'cloud_login_required'});
+      chooseDevice(request,store.getUser(authenticated.user.id));
       response.writeHead(result.statusCode,responseHeaders(result.headers,device.id,secureCookie));
       response.end(Buffer.from(result.body||'','base64'));
     }catch(error){if(!response.destroyed)json(response,502,{error:safeError(error)})}
@@ -530,12 +536,13 @@ export function createRelayServer(options = {}) {
         if(!device)return json(response,403,{error:'设备不属于当前账号。'});
         return json(response,200,{device:publicDevice(device)});
       }
-      if(isLocalApi(url.pathname,request.method)){
+      const accountConnect=url.pathname==='/api/cloud/connect'&&request.method==='POST';
+      if(accountConnect||isLocalApi(url.pathname,request.method)){
         if(request.method!=='GET'&&!sameOrigin(request,true))return json(response,403,{error:'来源校验失败。'});
         const current=userSession(request);if(!current)return json(response,401,{error:'请先登录云端工作台。',code:'cloud_login_required'});
         const devices=store.devicesForUser(current.user.id);
         if(devices.length>Number(current.user.maxDevices))return json(response,403,{error:'设备数量超出套餐额度。'});
-        return await proxyHttp(request,response,current);
+        return await proxyHttp(request,response,current,accountConnect);
       }
       const file=staticTarget(url.pathname);
       if(file&&['GET','HEAD'].includes(request.method)){
@@ -565,7 +572,8 @@ export function createRelayServer(options = {}) {
             agent=store.authenticateDevice(message.token,message.deviceId);
             if(!agent){clearTimeout(authTimer);return websocket.close(1008,'Agent authentication failed')}
             clearTimeout(authTimer);
-            const entry={socket:websocket,deviceId:agent.id,userId:agent.userId,name:agent.name,isAlive:true};
+            const entry={socket:websocket,deviceId:agent.id,userId:agent.userId,name:agent.name,isAlive:true,
+              accountConnect:Array.isArray(message.capabilities)&&message.capabilities.includes('account-connect')};
             const previous=agents.get(agent.id);
             if(previous&&previous.socket!==websocket)closeDeviceConnections(agent.id,1012,'Replaced by a newer agent');
             agents.set(agent.id,entry);