remote-dsh 0.4.9 → 0.6.0

package/dist/bin.js

@@ -2,84 +2,58 @@
 /**
  * rdsh CLI 入口（手写参数解析，零依赖）。
  *
- *   rdsh serve [--config <path>] [--reset] [--port <n>] ...
- *   rdsh join <hub-url> [--token <t>] [--reset] [--dsh <path>]
+ *   rdsh host setup lan|cloud
+ *   rdsh host join <hub-url> [--token <t>] [--name <n>] [--dsh <p>] [--insecure]
+ *   rdsh host serve | service install|status|uninstall | leave | user ...
  *   rdsh hub serve|user|host|service ... [--config <path>]
- *   rdsh user add|passwd <name> | ls | rm <name>   [--config <path>]
- *   rdsh service install|uninstall|status          [--config <path>]
  *   rdsh --version | --help
  */
 import { createInterface } from "node:readline";
-import { serve, join, UserManager, resolveConfigPath, installService, uninstallService, serviceStatus, } from "rdsh-gateway";
+import { rm } from "node:fs/promises";
+import { hostname as osHostname } from "node:os";
+import { dirname } from "node:path";
+import { serve, join, registerJoin, findDsh, selfRevoke, readPersistedToken, clearPersistedToken, UserManager, resolveConfigPath, loadConfig, saveConfig, installService, uninstallService, serviceStatus, HOST_SERVICE_NAME, JOIN_SERVICE_NAME, HUB_SERVICE_NAME, } from "rdsh-gateway";
 import { loadHubConfig, resolveHubConfigPath, HubDb, hashPassword, serveHub, } from "rdsh-hub";
 import { VERSION } from "./index.js";
 const HELP = `rdsh — secure remote access for DeepSeek Harness
 
 Usage:
-  rdsh serve [options]      Start the gateway (LAN auth or cloud HTTPS service)
-  rdsh join <hub-url>       Connect to a hub via outbound tunnel (no ports open)
-  rdsh hub serve            Start the hub server (cloud, multi-host)
-  rdsh hub user add <name>  Create a hub user (interactive password; --no-password for first-login setup)
-  rdsh hub user passwd <n>  Reset a user's password (admin)
-  rdsh hub user rm|ls
-  rdsh hub host ls|revoke   List / revoke hosts (revoke = tunnel drops instantly)
-  rdsh hub service ...      Install hub as a systemd/launchd service
-  rdsh user add|passwd|ls|rm    Gateway users (LAN/cloud HTTPS service)
-  rdsh service install|status|uninstall
+  rdsh host setup lan|cloud   Configure this machine (LAN / cloud HTTPS gateway)
+  rdsh host join <hub-url>    Connect this machine to a hub (outbound tunnel)
+  rdsh host serve             Run the configured mode in the foreground
+  rdsh host service ...       Run as a systemd/launchd service
+  rdsh host leave             Unregister this machine from the hub
+  rdsh host user ...          Manage gateway users (LAN/cloud password auth)
+  rdsh hub serve              Start the hub server (cloud, multi-host)
+  rdsh hub user add|passwd|rm|ls|unlock|reset-2fa
+  rdsh hub audit ls           Audit log (login/2FA/sharing/email events)
+  rdsh hub host ls|revoke     List / revoke hosts (revoke drops the tunnel instantly)
+  rdsh hub service ...        Run hub as a systemd/launchd service
 
 Global:
-  --config <path>           Gateway config (default ~/.rdsh/config.json; also $RDSH_CONFIG)
-                            For hub commands: hub config (default ~/.rdsh/hub.json; also $RDSH_HUB_CONFIG)
-  --version, -v             Print version
-  --help, -h                Print this help
-
-Options (serve):
-  --port <n>                Listen port (overrides config; default 8443)
-  --host <ip>               Bind address (overrides config; default 0.0.0.0)
-  --pair-code <code>        Preset pairing code (overrides config)
-  --session-ttl <sec>       Session cookie lifetime (overrides config; default 43200)
-  --dsh <path>              dsh executable path (overrides config)
-  --reset                   Rotate session keys (all devices must re-auth)
-  --no-code                 Disable auth (trusted network ONLY!)
-
-Options (join):
-  --token <t>               Use an existing host token (skip pairing-code flow)
-  --reset                   Forget the persisted host token and re-pair
-  --dsh <path>              dsh executable path
-
-Options (hub serve):
-  --port <n>                Listen port (overrides hub config; default 8443)
-  --host <ip>               Bind address (overrides hub config; default 0.0.0.0)
-
-Config (persistent): host, port, sessionTtlSeconds, tls{cert,key}, behindProxy,
-  allowFrom[], auth{mode: pair|password|none, pairCode, users[]}, dshPath.
-Hub config (~/.rdsh/hub.json): host, port, tls{cert,key}, dbPath, jwtKeyPath.
+  --config <path>             Host config (default ~/.rdsh/host.json; also $RDSH_CONFIG)
+                              For hub commands: hub config (default ~/.rdsh/hub.json; also $RDSH_HUB_CONFIG)
+  --version, -v               Print version
+  --help, -h                  Print this help
 `;
 /** 子命令级用法（`rdsh <cmd> --help`）。 */
 const SUB_HELP = {
-    serve: `Usage: rdsh serve [options]
+    host: `Usage: rdsh host <subcommand>
 
-Start the gateway (LAN auth or cloud HTTPS service).
+Configure and run this machine (the DSH host).
 
-Options:
-  --config <path>       Config file (default ~/.rdsh/config.json; also $RDSH_CONFIG)
-  --port <n>            Listen port (overrides config; default 8443)
-  --host <ip>           Bind address (overrides config; default 0.0.0.0)
-  --pair-code <code>    Preset pairing code (overrides config)
-  --session-ttl <sec>   Session cookie lifetime (overrides config; default 43200)
-  --dsh <path>          dsh executable path (overrides config)
-  --reset               Rotate session keys (all devices must re-auth)
-  --no-code             Disable auth (trusted network ONLY!)
-`,
-    join: `Usage: rdsh join <hub-url> [options]
-
-Connect to a hub via an outbound tunnel (no ports open on this machine).
+Subcommands:
+  setup lan              Configure a LAN gateway (pair auth, plain http)
+  setup cloud            Configure a cloud HTTPS gateway (password + TLS + allowFrom)
+  join <hub-url>         Connect to a hub (interactive token paste; --token for scripts)
+  serve                  Run the configured mode in the foreground
+  service install|status|uninstall   Run as a systemd/launchd service
+  leave                  Unregister this machine from the hub
+  user add|passwd|ls|rm  Manage gateway users
 
-Options:
-  --token <t>           Use an existing host token (skip the pair-code flow)
-  --reset               Forget the persisted host token and re-pair
-  --dsh <path>          dsh executable path
-  --insecure            Skip TLS certificate verification (self-signed hub)
+Options (setup lan):   --port <n> [--pair-code <code>]
+Options (setup cloud):  --tls-cert <path> --tls-key <path> [--port <n>] [--allow-from <cidr,...>]
+Options (join):         --token <t> --name <n> --dsh <path> --insecure
 `,
     hub: `Usage: rdsh hub <subcommand> [options]
 
@@ -87,7 +61,8 @@ Run the hub server or manage it.
 
 Subcommands:
   serve                 Start the hub server (TLS required)
-  user add|passwd|rm|ls Manage users (registration closed; admin creates accounts)
+  user add|passwd|rm|ls|unlock|reset-2fa   Manage users (admin creates accounts; unlock / reset-2fa)
+  audit ls [--user <n>] [--event <e>] [--since 24h|7d]   Query the audit log
   host ls|revoke        List / revoke hosts (revoke drops the tunnel instantly)
   service install|status|uninstall   Run hub as a systemd/launchd service
 
@@ -95,31 +70,6 @@ Options (serve):
   --config <path>       Hub config (default ~/.rdsh/hub.json; also $RDSH_HUB_CONFIG)
   --port <n>            Listen port (overrides hub config; default 8443)
   --host <ip>           Bind address (overrides hub config; default 0.0.0.0)
-`,
-    user: `Usage: rdsh user <action> [name]
-
-Manage gateway users (LAN / cloud HTTPS service).
-
-Actions:
-  add <name>            Add a user (interactive password)
-  passwd <name>         Change a user's password (revokes all their sessions)
-  ls                    List users
-  rm <name>             Remove a user
-
-Options:
-  --config <path>       Config file (default ~/.rdsh/config.json; also $RDSH_CONFIG)
-`,
-    service: `Usage: rdsh service <action>
-
-Manage the gateway as a systemd/launchd service.
-
-Actions:
-  install               Install and start (auto-start on boot, restart on crash)
-  status                Show service status
-  uninstall             Stop and remove the service
-
-Options:
-  --config <path>       Config file (default ~/.rdsh/config.json; also $RDSH_CONFIG)
 `,
 };
 /** 参数里是否有 --help / -h。 */
@@ -151,28 +101,14 @@ async function main() {
             return;
         }
         switch (command) {
-            case "serve": {
-                const opts = parseServeArgs(rest, cli.configPath);
-                await serve(opts);
-                return;
-            }
-            case "join": {
-                const opts = parseJoinArgs(rest);
-                await join(opts);
+            case "host": {
+                await handleHost(rest, cli.configPath);
                 return;
             }
             case "hub": {
                 await handleHub(rest, cli.configPath);
                 return;
             }
-            case "user": {
-                await handleUser(rest, cli.configPath);
-                return;
-            }
-            case "service": {
-                await handleService(rest, cli.configPath);
-                return;
-            }
             default:
                 console.error(`rdsh: unknown command '${command}'. Run 'rdsh --help'.`);
                 process.exitCode = 1;
@@ -198,59 +134,118 @@ function parseGlobal(argv) {
             flags.push(argv[i]);
         }
     }
-    // 返回原始值（undefined 或显式 --config）；gateway/hub 子命令分别按自己的默认路径 resolve
     return { configPath, flags };
 }
-function parseServeArgs(args, configPath) {
-    const opts = { configPath };
-    for (let i = 0; i < args.length; i++) {
-        const flag = args[i];
-        const value = (name) => {
-            i += 1;
-            if (i >= args.length)
-                throw new Error(`missing value for ${name}`);
-            return args[i] ?? "";
-        };
-        switch (flag) {
-            case "--port": {
-                const v = Number(value(flag));
-                if (!Number.isInteger(v) || v < 0 || v > 65535)
-                    throw new Error(`invalid --port '${args[i]}'`);
-                opts.port = v;
-                break;
-            }
-            case "--host":
-                opts.host = value(flag);
-                break;
-            case "--pair-code":
-                opts.pairCode = value(flag);
-                break;
-            case "--session-ttl": {
-                const v = Number(value(flag));
-                if (!Number.isInteger(v) || v <= 0)
-                    throw new Error(`invalid --session-ttl '${args[i]}'`);
-                opts.sessionTtlSeconds = v;
-                break;
-            }
-            case "--dsh":
-                opts.dshPath = value(flag);
-                break;
-            case "--reset":
-                opts.reset = true;
-                break;
-            case "--no-code":
-                opts.noCode = true;
-                break;
-            default:
+function parsePort(v) {
+    const n = Number(v);
+    if (!Number.isInteger(n) || n < 0 || n > 65535)
+        throw new Error(`invalid port '${v}'`);
+    return n;
+}
+/** 服务 unit 的子进程 PATH：node 目录（nvm/自装）+ 系统路径，保证 spawn dsh 时 shebang 能解析 node。 */
+function nodePathEnv() {
+    return `${dirname(process.execPath)}:/usr/local/bin:/usr/bin:/bin`;
+}
+async function handleHost(args, configPath) {
+    const sub = args[0];
+    const rest = args.slice(1);
+    if (sub === undefined || hasHelp(rest)) {
+        console.log(SUB_HELP["host"] ?? HELP);
+        return;
+    }
+    switch (sub) {
+        case "setup":
+            await handleHostSetup(rest, configPath);
+            return;
+        case "join":
+            await handleHostJoin(rest, configPath);
+            return;
+        case "serve":
+            await handleHostServe(rest, configPath);
+            return;
+        case "service":
+            await handleHostService(rest, configPath);
+            return;
+        case "leave":
+            await handleHostLeave(rest, configPath);
+            return;
+        case "user":
+            await handleHostUser(rest, configPath);
+            return;
+        default:
+            throw new Error("usage: rdsh host setup|join|serve|service|leave|user");
+    }
+}
+/** `rdsh host setup lan|cloud`：写 host.json（mode + 预设字段），配置完退出。 */
+async function handleHostSetup(args, configPath) {
+    const which = args[0];
+    const target = resolveConfigPath(configPath);
+    const config = await loadConfig(target);
+    if (which === "lan") {
+        let port = config.port;
+        let pairCode = config.auth.pairCode;
+        for (let i = 1; i < args.length; i++) {
+            const flag = args[i];
+            if (flag === "--port")
+                port = parsePort(args[++i]);
+            else if (flag === "--pair-code")
+                pairCode = args[++i];
+            else
                 throw new Error(`unknown option '${flag}'`);
         }
+        config.mode = "lan";
+        config.port = port;
+        config.tls = undefined;
+        config.behindProxy = false;
+        config.allowFrom = [];
+        config.auth.mode = "pair";
+        config.auth.pairCode = pairCode;
+        config.dshPath = config.dshPath ?? findDsh() ?? undefined;
+        await saveConfig(target, config);
+        console.log(`rdsh: host 配置为 LAN 网关（pair，端口 ${port}）→ ${target}`);
+        console.log("rdsh: 运行 `rdsh host serve` 前台启动，或 `rdsh host service install` 常驻。");
+        return;
     }
-    return opts;
+    if (which === "cloud") {
+        let port = config.port;
+        let cert;
+        let key;
+        let allowFrom = [];
+        for (let i = 1; i < args.length; i++) {
+            const flag = args[i];
+            if (flag === "--port")
+                port = parsePort(args[++i]);
+            else if (flag === "--tls-cert")
+                cert = args[++i];
+            else if (flag === "--tls-key")
+                key = args[++i];
+            else if (flag === "--allow-from")
+                allowFrom = (args[++i] ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+            else
+                throw new Error(`unknown option '${flag}'`);
+        }
+        if (cert === undefined || key === undefined) {
+            throw new Error("usage: rdsh host setup cloud --tls-cert <path> --tls-key <path> [--port <n>] [--allow-from <cidr,...>]");
+        }
+        config.mode = "cloud";
+        config.port = port;
+        config.tls = { cert, key };
+        config.behindProxy = false;
+        config.allowFrom = allowFrom;
+        config.auth.mode = "password";
+        config.dshPath = config.dshPath ?? findDsh() ?? undefined;
+        await saveConfig(target, config);
+        console.log(`rdsh: host 配置为云 HTTPS 网关（password，端口 ${port}）→ ${target}`);
+        console.log("rdsh: 用 `rdsh host user add <name>` 建用户，再 `rdsh host serve` / `rdsh host service install`。");
+        return;
+    }
+    throw new Error("usage: rdsh host setup lan|cloud");
 }
-function parseJoinArgs(args) {
+/** `rdsh host join <hub>`：注册（join token）→ 写 host.json + session，配置完退出。 */
+async function handleHostJoin(args, configPath) {
     const hubUrl = args[0];
     if (hubUrl === undefined || !/^https?:\/\//.test(hubUrl)) {
-        throw new Error("usage: rdsh join <hub-url> [--token <t>] [--dsh <path>]");
+        throw new Error("usage: rdsh host join <hub-url> [--token <t>] [--name <n>] [--dsh <p>] [--insecure]");
     }
     const opts = { hubUrl };
     for (let i = 1; i < args.length; i++) {
@@ -261,45 +256,153 @@ function parseJoinArgs(args) {
                 throw new Error(`missing value for ${name}`);
             return args[i] ?? "";
         };
-        switch (flag) {
-            case "--token":
-                opts.token = value(flag);
-                break;
-            case "--reset":
-                opts.reset = true;
-                break;
-            case "--dsh":
-                opts.dshPath = value(flag);
-                break;
-            case "--insecure":
-                opts.insecure = true;
-                break;
-            default:
-                throw new Error(`unknown option '${flag}'`);
+        if (flag === "--token")
+            opts.token = value(flag);
+        else if (flag === "--name")
+            opts.name = value(flag);
+        else if (flag === "--dsh")
+            opts.dshPath = value(flag);
+        else if (flag === "--insecure")
+            opts.insecure = true;
+        else if (flag === "--reset")
+            opts.reset = true;
+        else
+            throw new Error(`unknown option '${flag}'`);
+    }
+    if (opts.token === undefined && readPersistedToken(hubUrl) === null) {
+        // 无 --token 且无持久化 session：TTY 交互粘贴 token；非 TTY 报错不 hang
+        if (process.stdin.isTTY) {
+            const pasted = (await promptLine("Paste your join token (hub portal → Add host): ")).trim();
+            if (pasted === "")
+                throw new Error("需要 join token（hub portal → 添加主机 生成）");
+            opts.token = pasted;
+        }
+        else {
+            throw new Error("无持久化 session 且未提供 --token；交互式运行粘贴 token");
         }
     }
-    return opts;
+    const outcome = await registerJoin(opts);
+    const target = resolveConfigPath(configPath);
+    const config = await loadConfig(target);
+    config.mode = "join";
+    config.hub = hubUrl;
+    config.name = opts.name ?? osHostname();
+    config.insecure = outcome.insecure;
+    config.dshPath = opts.dshPath ?? findDsh() ?? config.dshPath;
+    await saveConfig(target, config);
+    console.log(`rdsh: host 已接入 ${hubUrl}（${config.name}）—— session 已保存`);
+    console.log("rdsh: 运行 `rdsh host serve` 前台启动，或 `rdsh host service install` 常驻。");
+}
+/** `rdsh host serve`：前台常驻，读 host.json 按 mode 分发（join→隧道，lan/cloud→网关）。 */
+async function handleHostServe(_args, configPath) {
+    const target = resolveConfigPath(configPath);
+    const config = await loadConfig(target);
+    if (config.mode === "join") {
+        if (config.hub === undefined)
+            throw new Error("host.json 缺 hub（join 模式）；先 `rdsh host join <hub>`");
+        await join({ hubUrl: config.hub, name: config.name, insecure: config.insecure, dshPath: config.dshPath });
+        return;
+    }
+    await serve({ configPath: target });
 }
-async function handleUser(args, configPath) {
+/** `rdsh host service install|status|uninstall`：读 host.json mode 装对应服务（unit 不含 token）。 */
+async function handleHostService(args, configPath) {
+    const action = args[0];
+    const target = resolveConfigPath(configPath);
+    switch (action) {
+        case "install": {
+            await maybeRegisterForServiceInstall(args, target);
+            const config = await loadConfig(target);
+            const name = config.mode === "join" ? JOIN_SERVICE_NAME : HOST_SERVICE_NAME;
+            // host 服务会 spawn dsh（shebang `#!/usr/bin/env node`），nvm/自装 node 下需补 node 目录到 PATH（防 127）
+            console.log(await installService({ name, args: ["host", "serve"], configPath: target, pathEnv: nodePathEnv() }));
+            console.log(`rdsh: host service installed (${name}) —— 开机自启 + 崩溃重启。`);
+            return;
+        }
+        case "status": {
+            const config = await loadConfig(target);
+            const name = config.mode === "join" ? JOIN_SERVICE_NAME : HOST_SERVICE_NAME;
+            console.log(`rdsh host service (${name}): ${await serviceStatus(name)}`);
+            return;
+        }
+        case "uninstall": {
+            const config = await loadConfig(target);
+            const name = config.mode === "join" ? JOIN_SERVICE_NAME : HOST_SERVICE_NAME;
+            console.log(await uninstallService(name));
+            return;
+        }
+        default:
+            throw new Error("usage: rdsh host service install|status|uninstall");
+    }
+}
+/** 一行接入：`host service install <hub-url> --token <t> [--name <n>]` → 注册 + 写 host.json（再装服务）。 */
+async function maybeRegisterForServiceInstall(args, target) {
+    const maybeHub = args[1];
+    if (maybeHub === undefined || !/^https?:\/\//.test(maybeHub))
+        return; // 无 <hub>，走读 host.json 路径
+    const joinOpts = { hubUrl: maybeHub };
+    for (let i = 2; i < args.length; i++) {
+        const flag = args[i];
+        if (flag === "--token")
+            joinOpts.token = args[++i];
+        else if (flag === "--name")
+            joinOpts.name = args[++i];
+        else if (flag === "--dsh")
+            joinOpts.dshPath = args[++i];
+        else if (flag === "--insecure")
+            joinOpts.insecure = true;
+        else
+            throw new Error(`unknown option '${flag}'`);
+    }
+    const outcome = await registerJoin(joinOpts);
+    const cfg = await loadConfig(target);
+    cfg.mode = "join";
+    cfg.hub = maybeHub;
+    cfg.name = joinOpts.name ?? osHostname();
+    cfg.insecure = outcome.insecure;
+    cfg.dshPath = joinOpts.dshPath ?? findDsh() ?? cfg.dshPath;
+    await saveConfig(target, cfg);
+}
+/** `rdsh host leave`：self-revoke + 清 session + 删 host.json → 未配置。 */
+async function handleHostLeave(_args, configPath) {
+    const target = resolveConfigPath(configPath);
+    const config = await loadConfig(target);
+    if (config.mode !== "join" || config.hub === undefined) {
+        throw new Error("当前不是 join 模式（或缺 hub），无需 leave");
+    }
+    const token = readPersistedToken(config.hub);
+    if (token === null) {
+        console.log("rdsh: 本地无 session 文件，仅清理配置");
+    }
+    else {
+        await selfRevoke(config.hub, token, config.insecure === true);
+        console.log("rdsh: 已在 hub 自吊销本机");
+    }
+    clearPersistedToken(config.hub);
+    await rm(target, { force: true });
+    console.log(`rdsh: host 已注销（清理 ${target}）—— 回到未配置状态`);
+}
+/** `rdsh host user add|passwd|ls|rm`：本机网关用户（写 host.json auth.users）。 */
+async function handleHostUser(args, configPath) {
     const action = args[0];
     const um = new UserManager(resolveConfigPath(configPath));
     switch (action) {
         case "add": {
             const name = args[1];
             if (name === undefined)
-                throw new Error("usage: rdsh user add <name>");
+                throw new Error("usage: rdsh host user add <name>");
             const password = await promptPassword(`password for ${name}: `);
             const again = await promptPassword("confirm: ");
             if (password !== again)
                 throw new Error("passwords do not match");
             await um.add(name, password);
-            console.log(`rdsh: user '${name}' added (config: ${configPath})`);
+            console.log(`rdsh: user '${name}' added`);
             return;
         }
         case "passwd": {
             const name = args[1];
             if (name === undefined)
-                throw new Error("usage: rdsh user passwd <name>");
+                throw new Error("usage: rdsh host user passwd <name>");
             const password = await promptPassword(`new password for ${name}: `);
             const again = await promptPassword("confirm: ");
             if (password !== again)
@@ -318,7 +421,7 @@ async function handleUser(args, configPath) {
         case "rm": {
             const name = args[1];
             if (name === undefined)
-                throw new Error("usage: rdsh user rm <name>");
+                throw new Error("usage: rdsh host user rm <name>");
             const ok = await um.remove(name);
             if (!ok)
                 throw new Error(`user '${name}' not found`);
@@ -326,24 +429,7 @@ async function handleUser(args, configPath) {
             return;
         }
         default:
-            throw new Error("usage: rdsh user add|passwd|ls|rm");
-    }
-}
-async function handleService(args, configPath) {
-    const action = args[0];
-    switch (action) {
-        case "install":
-            console.log(await installService(resolveConfigPath(configPath)));
-            console.log("rdsh: service installed — it starts on boot and restarts on crash.");
-            return;
-        case "status":
-            console.log(`rdsh service: ${await serviceStatus()}`);
-            return;
-        case "uninstall":
-            console.log(await uninstallService());
-            return;
-        default:
-            throw new Error("usage: rdsh service install|status|uninstall");
+            throw new Error("usage: rdsh host user add|passwd|ls|rm");
     }
 }
 /** 打开 hub 数据库（读 hub config 定位 dbPath）。 */
@@ -352,6 +438,56 @@ async function openHubDb(configPath) {
     const config = await loadHubConfig(hubConfigPath);
     return new HubDb(config.dbPath);
 }
+/** `rdsh hub audit ls [--user <name>] [--event <e>] [--since 24h|7d]`。 */
+async function handleHubAudit(args, configPath) {
+    const db = await openHubDb(configPath);
+    try {
+        // 兼容 `audit ls` 与 `audit`（ls 为可选位置参数）
+        const opts = args[0] === "ls" ? args.slice(1) : args;
+        const filter = {};
+        for (let i = 0; i < opts.length; i++) {
+            const flag = opts[i];
+            if (flag === "--user") {
+                const name = opts[++i];
+                if (name === undefined)
+                    throw new Error("missing value for --user");
+                const u = db.getUserByName(name);
+                if (u === null)
+                    throw new Error(`user '${name}' not found`);
+                filter.userId = u.id;
+            }
+            else if (flag === "--event") {
+                filter.event = opts[++i];
+                if (filter.event === undefined)
+                    throw new Error("missing value for --event");
+            }
+            else if (flag === "--since") {
+                const v = opts[++i];
+                if (v === undefined)
+                    throw new Error("missing value for --since");
+                const m = /^(\d+)([hd])$/.exec(v);
+                if (m === null)
+                    throw new Error(`invalid --since '${v}' (use like 24h or 7d)`);
+                filter.since = Date.now() - Number(m[1]) * (m[2] === "h" ? 3_600_000 : 86_400_000);
+            }
+            else {
+                throw new Error(`unknown option '${flag}'`);
+            }
+        }
+        const events = db.listAudit(filter);
+        if (events.length === 0) {
+            console.log("(no events)");
+            return;
+        }
+        for (const e of events) {
+            const user = e.userId !== null ? db.getUserById(e.userId) : null;
+            console.log(`${new Date(e.createdAt).toISOString()}  ${user?.name ?? "-"}  ${e.event}  ip=${e.ip}  ${e.detailJson}`);
+        }
+    }
+    finally {
+        db.close();
+    }
+}
 async function handleHub(args, configPath) {
     const sub = args[0];
     const rest = args.slice(1);
@@ -373,26 +509,30 @@ async function handleHub(args, configPath) {
             await handleHubHost(rest, configPath);
             return;
         }
+        case "audit": {
+            await handleHubAudit(rest, configPath);
+            return;
+        }
         case "service": {
             const action = rest[0];
             const hubConfigPath = resolveHubConfigPath(configPath);
             switch (action) {
                 case "install":
-                    console.log(await installService(hubConfigPath, ["hub", "serve"]));
-                    console.log("rdsh: hub service installed — starts on boot and restarts on crash.");
+                    console.log(await installService({ name: HUB_SERVICE_NAME, args: ["hub", "serve"], configPath: hubConfigPath }));
+                    console.log(`rdsh: hub service installed (${HUB_SERVICE_NAME}) —— 开机自启 + 崩溃重启。`);
                     return;
                 case "status":
-                    console.log(`rdsh hub service: ${await serviceStatus()}`);
+                    console.log(`rdsh hub service (${HUB_SERVICE_NAME}): ${await serviceStatus(HUB_SERVICE_NAME)}`);
                     return;
                 case "uninstall":
-                    console.log(await uninstallService());
+                    console.log(await uninstallService(HUB_SERVICE_NAME));
                     return;
                 default:
                     throw new Error("usage: rdsh hub service install|status|uninstall");
             }
         }
         default:
-            throw new Error("usage: rdsh hub serve|user|host|service");
+            throw new Error("usage: rdsh hub serve|user|host|audit|service");
     }
 }
 function parseHubServeArgs(args, configPath) {
@@ -450,7 +590,6 @@ async function handleHubUser(args, configPath) {
                 if (db.getUserByName(name) !== null)
                     throw new Error(`user '${name}' already exists`);
                 if (noPassword) {
-                    // 首次登录自设密码（must_change=1，密码占位不可用）
                     db.createUser(name, "scrypt:disabled", new Date().toISOString(), true);
                     console.log(`rdsh: user '${name}' created — they must set a password on first sign-in (${hubConfigPath})`);
                 }
@@ -489,12 +628,35 @@ async function handleHubUser(args, configPath) {
                 console.log(`rdsh: user '${name}' removed (their hosts removed)`);
                 return;
             }
+            case "unlock": {
+                const name = args[1];
+                if (name === undefined)
+                    throw new Error("usage: rdsh hub user unlock <name>");
+                const user = db.getUserByName(name);
+                if (user === null)
+                    throw new Error(`user '${name}' not found`);
+                db.unlockAccount(user.id);
+                console.log(`rdsh: user '${name}' unlocked`);
+                return;
+            }
+            case "reset-2fa": {
+                const name = args[1];
+                if (name === undefined)
+                    throw new Error("usage: rdsh hub user reset-2fa <name>");
+                const user = db.getUserByName(name);
+                if (user === null)
+                    throw new Error(`user '${name}' not found`);
+                db.clearTotpSecret(user.id);
+                db.bumpVersion(user.id);
+                console.log(`rdsh: 2FA reset for '${name}' (their sessions revoked)`);
+                return;
+            }
             default:
-                throw new Error("usage: rdsh hub user add|passwd|ls|rm");
+                throw new Error("usage: rdsh hub user add|passwd|ls|rm|unlock|reset-2fa");
         }
     }
     finally {
-        db.close(); // 抛错路径也必须关闭 SQLite 句柄（否则进程挂住）
+        db.close();
     }
 }
 async function handleHubHost(args, configPath) {
@@ -562,11 +724,21 @@ function promptPassword(prompt) {
         });
     }
     // 非 TTY（管道/重定向）：一次性读完 stdin（EOF），逐行消费。
-    // 注意：不能每次调用新建 readline —— 第二个 interface 会读不到剩余行。
     process.stdout.write(prompt);
     return nextPipeLine();
 }
 let pipeLines = null;
+/** 读取一行（echo，用于粘贴 token 等非敏感输入）。 */
+function promptLine(prompt) {
+    process.stdout.write(prompt);
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+        rl.question("", (answer) => {
+            rl.close();
+            resolve(answer);
+        });
+    });
+}
 function nextPipeLine() {
     if (pipeLines !== null) {
         return Promise.resolve(pipeLines.shift() ?? "");
@@ -578,6 +750,7 @@ function nextPipeLine() {
         rl.on("close", () => resolve(pipeLines.shift() ?? ""));
     });
 }
-// 管理命令（serve/join 常驻不 resolve）完成后显式退出：避免 TTY stdin / 句柄残留导致进程挂住
+// 管理命令（host setup/join/leave/service/user 完成后）显式退出：
+// 常驻命令（host serve / hub serve）不 resolve，靠信号退出。
 void main().then(() => process.exit(process.exitCode ?? 0));
 //# sourceMappingURL=bin.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "remote-dsh",
-  "version": "0.4.9",
+  "version": "0.6.0",
   "description": "Secure remote access for DeepSeek Harness: rdsh serve / rdsh join / rdsh hub",
   "license": "MIT",
   "type": "module",
@@ -23,8 +23,8 @@
     "node": ">=22"
   },
   "dependencies": {
-    "rdsh-gateway": "0.2.3",
-    "rdsh-hub": "0.2.4"
+    "rdsh-gateway": "0.4.0",
+    "rdsh-hub": "0.4.0"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",