ccoding 0.2.2__py3-none-any.whl → 0.2.4__py3-none-any.whl

ccode/config.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import copy
 import json
+import secrets
 import socket
 import uuid
 from pathlib import Path
@@ -32,11 +33,13 @@ DEFAULT_REMOTE: dict[str, Any] = {
     "local": {
         "host": "127.0.0.1",
         "port": 8765,
-        "token": "",
+        "appId": "",
+        "appKey": "",
     },
     "server": {
         "url": "",
-        "token": "",
+        "appId": "",
+        "appKey": "",
         "device_name": "",
         "device_id": "",
         "auto_connect": True,
@@ -103,6 +106,10 @@ def _new_device_id() -> str:
     return f"ccode-{uuid.uuid4().hex}"
 
 
+def _new_app_id() -> str:
+    return f"app_{secrets.token_urlsafe(9)}"
+
+
 def normalize_remote(remote: Any) -> dict[str, Any]:
     normalized = copy.deepcopy(DEFAULT_REMOTE)
     if not isinstance(remote, dict):
@@ -132,18 +139,31 @@ def normalize_remote(remote: Any) -> dict[str, Any]:
         port = remote.get("port")
     if isinstance(port, int):
         normalized["local"]["port"] = port
-    token = local.get("token") if isinstance(local, dict) else None
-    if not isinstance(token, str):
-        token = remote.get("token")
-    if isinstance(token, str):
-        normalized["local"]["token"] = token
+    local_app_id = local.get("appId") if isinstance(local, dict) else None
+    local_app_key = local.get("appKey") if isinstance(local, dict) else None
+    local_token = local.get("token") if isinstance(local, dict) else None
+    if not isinstance(local_token, str):
+        local_token = remote.get("token")
+    if isinstance(local_app_id, str):
+        normalized["local"]["appId"] = local_app_id
+    elif isinstance(local_token, str) and local_token:
+        normalized["local"]["appId"] = _new_app_id()
+    if isinstance(local_app_key, str):
+        normalized["local"]["appKey"] = local_app_key
+    elif isinstance(local_token, str):
+        normalized["local"]["appKey"] = local_token
 
     server = remote.get("server") if isinstance(remote.get("server"), dict) else {}
     if isinstance(server, dict):
-        for key in ("url", "token", "device_name", "device_id"):
+        server_token = server.get("token")
+        for key in ("url", "appId", "appKey", "device_name", "device_id"):
             value = server.get(key)
             if isinstance(value, str):
                 normalized["server"][key] = value
+        if not normalized["server"].get("appId") and isinstance(server_token, str) and server_token:
+            normalized["server"]["appId"] = _new_app_id()
+        if not normalized["server"].get("appKey") and isinstance(server_token, str):
+            normalized["server"]["appKey"] = server_token
         for key in ("auto_connect", "verify_tls"):
             value = server.get(key)
             if isinstance(value, bool):

ccode/remote.py

@@ -15,20 +15,20 @@ from .remote_common import (
     _new_session_id,
     _sanitize_session_name,
     _utc_now,
+    AuthResult,
     asset_text,
-    auth_token_matches,
     file_lock,
     missing_extra_message,
+    remote_local_app_id,
+    remote_local_app_key,
     remote_local_host_port,
-    remote_local_token,
     remote_local_url,
     remote_mode,
     remote_server_config,
     remote_server_url,
     rotate_log,
-    token_matches,
+    verify_auth_payload,
     web_asset_text,
-    websocket_auth_token,
 )
 
 REMOTE_SESSIONS_PATH = CONFIG_DIR / "remote_sessions.json"
@@ -321,29 +321,33 @@ def ensure_remote_hub(config: dict[str, Any]) -> str | None:
         return f"Failed to start remote hub. See {REMOTE_SERVER_LOG_PATH} for details."
 
 
-_TOKEN_CACHE: tuple[float | None, str] = (None, "")
+_AUTH_CACHE: tuple[float | None, str, str] = (None, "", "")
 
 
-def _current_remote_token() -> str:
-    global _TOKEN_CACHE
+def _current_remote_credentials() -> tuple[str, str]:
+    global _AUTH_CACHE
     try:
         mtime = CONFIG_PATH.stat().st_mtime
     except FileNotFoundError:
         mtime = None
-    cached_mtime, cached_token = _TOKEN_CACHE
+    cached_mtime, app_id, app_key = _AUTH_CACHE
     if cached_mtime == mtime:
-        return cached_token
-    token = remote_local_token(load_config()).strip()
-    _TOKEN_CACHE = (mtime, token)
-    return token
+        return app_id, app_key
+    config = load_config()
+    app_id = remote_local_app_id(config).strip()
+    app_key = remote_local_app_key(config).strip()
+    _AUTH_CACHE = (mtime, app_id, app_key)
+    return app_id, app_key
 
 
-def _valid_token(token: str | None) -> bool:
-    return token_matches(_current_remote_token(), token)
+def _valid_auth_payload(payload: dict[str, Any], scope: str) -> AuthResult:
+    app_id, app_key = _current_remote_credentials()
+    return verify_auth_payload(app_id, app_key, payload, scope)
 
 
-def _valid_auth_token(token: str | None, authorization: str | None = None) -> bool:
-    return auth_token_matches(_current_remote_token(), token, authorization)
+def _auth_response(result: AuthResult, response_class: Any) -> Any:
+    status_code = 401 if result.error in {"auth_required", "reauth_required"} else 403
+    return response_class({"error": result.error or "auth_failed", "message": result.message}, status_code=status_code)
 
 
 async def _attach_websocket_to_session(websocket: Any, session: dict[str, Any]) -> None:
@@ -402,11 +406,11 @@ def create_app() -> Any:
 
     @app.get("/app.js")
     async def app_js() -> Response:
-        return Response(asset_text("app.js"), media_type="application/javascript")
+        return Response(asset_text("app.js"), media_type="application/javascript", headers={"Cache-Control": "no-store"})
 
     @app.get("/style.css")
     async def style_css() -> Response:
-        return Response(asset_text("style.css"), media_type="text/css")
+        return Response(asset_text("style.css"), media_type="text/css", headers={"Cache-Control": "no-store"})
 
     @app.get("/assets/{asset_name}")
     async def web_asset(asset_name: str) -> Response:
@@ -418,20 +422,22 @@ def create_app() -> Any:
         media_type = media_types.get(asset_name)
         if media_type is None:
             return Response(status_code=404)
-        return Response(web_asset_text(asset_name), media_type=media_type)
+        return Response(web_asset_text(asset_name), media_type=media_type, headers={"Cache-Control": "no-store"})
 
     @app.get("/health")
     async def health() -> dict[str, Any]:
-        return {"ok": True, "name": REMOTE_HUB_NAME, "multi_session": True}
+        return {"ok": True, "name": REMOTE_HUB_NAME, "multi_session": True, "remote_kind": "local"}
 
     @app.get("/api/sessions")
     async def sessions(
-        token: str | None = None,
-        authorization: str | None = Header(default=None),
+        x_ccode_app_id: str | None = Header(default=None),
+        x_ccode_timestamp: str | None = Header(default=None),
+        x_ccode_sign: str | None = Header(default=None),
     ) -> Response:
-        if not _valid_auth_token(token, authorization):
-            _log_event("api sessions unauthorized")
-            return JSONResponse({"error": "unauthorized"}, status_code=401)
+        auth_result = _valid_auth_payload({"appId": x_ccode_app_id, "timestamp": x_ccode_timestamp, "sign": x_ccode_sign}, "local.api")
+        if not auth_result.ok:
+            _log_event(f"api sessions unauthorized error={auth_result.error}")
+            return _auth_response(auth_result, JSONResponse)
         sessions = list_remote_sessions()
         _log_event(f"api sessions returned count={len(sessions)}")
         return JSONResponse({"sessions": sessions})
@@ -439,12 +445,14 @@ def create_app() -> Any:
     @app.get("/api/sessions/{session_id}")
     async def session_detail(
         session_id: str,
-        token: str | None = None,
-        authorization: str | None = Header(default=None),
+        x_ccode_app_id: str | None = Header(default=None),
+        x_ccode_timestamp: str | None = Header(default=None),
+        x_ccode_sign: str | None = Header(default=None),
     ) -> Response:
-        if not _valid_auth_token(token, authorization):
-            _log_event(f"api session detail unauthorized session_id={session_id}")
-            return JSONResponse({"error": "unauthorized"}, status_code=401)
+        auth_result = _valid_auth_payload({"appId": x_ccode_app_id, "timestamp": x_ccode_timestamp, "sign": x_ccode_sign}, "local.api")
+        if not auth_result.ok:
+            _log_event(f"api session detail unauthorized session_id={session_id} error={auth_result.error}")
+            return _auth_response(auth_result, JSONResponse)
         session = get_remote_session(session_id)
         if session is None or not _session_is_running(session):
             _log_event(f"api session detail not_found session_id={session_id}")
@@ -454,12 +462,14 @@ def create_app() -> Any:
 
     @app.get("/api/session")
     async def legacy_session(
-        token: str | None = None,
-        authorization: str | None = Header(default=None),
+        x_ccode_app_id: str | None = Header(default=None),
+        x_ccode_timestamp: str | None = Header(default=None),
+        x_ccode_sign: str | None = Header(default=None),
     ) -> Response:
-        if not _valid_auth_token(token, authorization):
-            _log_event("legacy api session unauthorized")
-            return JSONResponse({"error": "unauthorized"}, status_code=401)
+        auth_result = _valid_auth_payload({"appId": x_ccode_app_id, "timestamp": x_ccode_timestamp, "sign": x_ccode_sign}, "local.api")
+        if not auth_result.ok:
+            _log_event(f"legacy api session unauthorized error={auth_result.error}")
+            return _auth_response(auth_result, JSONResponse)
         sessions = list_remote_sessions()
         _log_event(f"legacy api session requested running_count={len(sessions)}")
         if len(sessions) == 1:
@@ -471,9 +481,10 @@ def create_app() -> Any:
     async def websocket_session(websocket: FastAPIWebSocket, session_id: str) -> None:
         await websocket.accept()
         _log_event(f"websocket accepted session_id={session_id}")
-        if not _valid_token(await websocket_auth_token(websocket)):
-            _log_event(f"websocket unauthorized session_id={session_id}")
-            await websocket.send_json({"type": "status", "message": "unauthorized: invalid token"})
+        auth_result = _valid_auth_payload(dict(websocket.query_params), "local.ws")
+        if not auth_result.ok:
+            _log_event(f"websocket unauthorized session_id={session_id} error={auth_result.error}")
+            await websocket.send_json({"type": "error", "error": auth_result.error, "message": auth_result.message})
             await websocket.close(code=1008)
             return
         session = get_remote_session(session_id)
@@ -488,9 +499,10 @@ def create_app() -> Any:
     async def legacy_websocket(websocket: FastAPIWebSocket) -> None:
         await websocket.accept()
         _log_event("legacy websocket accepted")
-        if not _valid_token(await websocket_auth_token(websocket)):
-            _log_event("legacy websocket unauthorized")
-            await websocket.send_json({"type": "status", "message": "unauthorized: invalid token"})
+        auth_result = _valid_auth_payload(dict(websocket.query_params), "local.ws")
+        if not auth_result.ok:
+            _log_event(f"legacy websocket unauthorized error={auth_result.error}")
+            await websocket.send_json({"type": "error", "error": auth_result.error, "message": auth_result.message})
             await websocket.close(code=1008)
             return
         sessions = list_remote_sessions()
@@ -530,11 +542,11 @@ def run_remote_hub_forever(config: dict[str, Any]) -> str | None:
 
 def run_remote_session(config: dict[str, Any], args: list[str]) -> str | None:
     mode = remote_mode(config)
-    if mode == "local" and not remote_local_token(config).strip():
-        return "Remote token is required. Set it in the config screen or press g on the TOKEN field to generate one."
+    if mode == "local" and (not remote_local_app_id(config).strip() or not remote_local_app_key(config).strip()):
+        return "Remote app ID and app key are required. Set them in the config screen or press g on the APP ID / APP KEY fields to generate them."
     server = remote_server_config(config)
-    if mode == "server" and (not remote_server_url(config) or not str(server.get("token") or "").strip()):
-        return "Remote server URL and client token are required in server mode."
+    if mode == "server" and (not remote_server_url(config) or not str(server.get("appId") or "").strip() or not str(server.get("appKey") or "").strip()):
+        return "Remote server URL, client app ID, and client app key are required in server mode."
     error = _check_runtime()
     if error is not None:
         return error
@@ -604,7 +616,7 @@ def run_remote_session(config: dict[str, Any], args: list[str]) -> str | None:
         print(f"  {session_name}\n")
         if host == "0.0.0.0":
             print("Security warning:")
-            print("  Listening on 0.0.0.0 exposes all remote sessions to your network. Protect the access URL and token.\n")
+            print("  Listening on 0.0.0.0 exposes all remote sessions to your network. Protect the access URL and app credentials.\n")
         print("This terminal will attach to this tmux session. The web hub stays running independently.")
         print("Detach with Ctrl+B then D. Browser users can choose this session from the session list.\n")
 

ccode/remote_cli.py

@@ -8,7 +8,7 @@ from pathlib import Path
 from typing import Any
 
 from .config import load_config, mask_secret
-from .remote_common import pid_from_path, remote_display_url, remote_local_host_port, remote_local_token, remote_mode, remote_server_config, remote_server_url
+from .remote_common import pid_from_path, remote_display_url, remote_local_app_id, remote_local_app_key, remote_local_host_port, remote_mode, remote_server_config, remote_server_url
 
 
 def _format_bytes(value: int) -> str:
@@ -90,12 +90,14 @@ def print_status(kind: str | None = None) -> int:
         server = remote_server_config(config)
         print(f"  device name: {server.get('device_name') or '<unset>'}")
         print(f"  device id: {server.get('device_id') or '<unset>'}")
-        print(f"  client token: {mask_secret(str(server.get('token') or ''))}")
+        print(f"  client app id: {server.get('appId') or '<unset>'}")
+        print(f"  client app key: {mask_secret(str(server.get('appKey') or ''))}")
     else:
         host, port = remote_local_host_port(config)
         print(f"  host: {host}")
         print(f"  port: {port}")
-        print(f"  token: {mask_secret(remote_local_token(config))}")
+        print(f"  app id: {remote_local_app_id(config) or '<unset>'}")
+        print(f"  app key: {mask_secret(remote_local_app_key(config))}")
     print()
 
     if effective == "client":

ccode/remote_client.py

@@ -10,7 +10,7 @@ import time
 from typing import Any
 
 from .config import CONFIG_DIR, load_config
-from .remote_common import file_lock, http_to_ws_url, missing_extra_message, pid_from_path, remote_server_config, remote_server_url, rotate_log
+from .remote_common import build_auth_payload, file_lock, http_to_ws_url, missing_extra_message, pid_from_path, remote_server_app_id, remote_server_app_key, remote_server_config, remote_server_url, rotate_log
 
 REMOTE_CLIENT_LOCK_PATH = CONFIG_DIR / "remote_client.lock"
 REMOTE_CLIENT_PID_PATH = CONFIG_DIR / "remote_client.pid"
@@ -179,9 +179,9 @@ async def open_attach_socket(attach_id: str, session_id: str, config: dict[str,
     except ImportError:
         _log_event(missing_extra_message("remote-client", "websockets"))
         return
-    server = remote_server_config(config)
+    auth_payload = build_auth_payload(remote_server_app_id(config), remote_server_app_key(config), "client.attach")
     async with websockets.connect(_attach_url(config, attach_id), **_connect_kwargs(config)) as ws:
-        await ws.send(json.dumps({"type": "auth", "token": server.get("token") or "", "attach_id": attach_id}))
+        await ws.send(json.dumps({"type": "auth", **auth_payload, "attach_id": attach_id}))
         await attach_local_session_to_websocket(ws, session_id)
 
 
@@ -217,10 +217,11 @@ async def connect_control_loop(config: dict[str, Any]) -> None:
     from .remote import scan_remote_sessions
 
     running, _dead = scan_remote_sessions(prune=True)
+    auth_payload = build_auth_payload(remote_server_app_id(config), remote_server_app_key(config), "client.control")
     async with websockets.connect(_control_url(config), **_connect_kwargs(config)) as ws:
         await ws.send(json.dumps({
             "type": "hello",
-            "token": server.get("token") or "",
+            **auth_payload,
             "device_id": server.get("device_id") or "",
             "device_name": server.get("device_name") or "",
             "version": "0.2.0",
@@ -246,9 +247,8 @@ async def _run_loop(config: dict[str, Any]) -> None:
 def run_remote_client_forever(config: dict[str, Any]) -> str | None:
     if not remote_server_url(config):
         return "Remote server URL is required."
-    server = remote_server_config(config)
-    if not str(server.get("token") or "").strip():
-        return "Remote server client token is required."
+    if not remote_server_app_id(config).strip() or not remote_server_app_key(config).strip():
+        return "Remote server client app ID and app key are required."
     if remote_server_url(config).startswith("http://"):
         _log_event("warning: remote server URL uses plain HTTP/WS")
     try:

ccode/remote_common.py

@@ -1,16 +1,19 @@
 from __future__ import annotations
 
-import asyncio
+import base64
 import contextlib
 import datetime as dt
 import fcntl
-import json
+import hashlib
+import hmac
 import os
 import re
 import secrets
+import time
+from dataclasses import dataclass
 from importlib import resources
 from typing import Any, Iterator
-from urllib.parse import quote, urlparse
+from urllib.parse import urlencode, urlparse
 
 from .config import CONFIG_DIR
 
@@ -42,17 +45,25 @@ def remote_local_host_port(config: dict[str, Any]) -> tuple[str, int]:
     return host, port
 
 
-def remote_local_token(config: dict[str, Any]) -> str:
-    return str(remote_local_config(config).get("token") or "")
+def remote_local_app_id(config: dict[str, Any]) -> str:
+    return str(remote_local_config(config).get("appId") or "")
+
+
+def remote_local_app_key(config: dict[str, Any]) -> str:
+    return str(remote_local_config(config).get("appKey") or "")
+
+
+def remote_server_app_id(config: dict[str, Any]) -> str:
+    return str(remote_server_config(config).get("appId") or "")
+
+
+def remote_server_app_key(config: dict[str, Any]) -> str:
+    return str(remote_server_config(config).get("appKey") or "")
 
 
 def remote_local_url(config: dict[str, Any], include_token: bool = False) -> str:
     host, port = remote_local_host_port(config)
-    url = f"http://{host}:{port}/"
-    token = remote_local_token(config)
-    if include_token and token:
-        return f"{url}?token={quote(token)}"
-    return url
+    return f"http://{host}:{port}/"
 
 
 def remote_server_url(config: dict[str, Any]) -> str:
@@ -98,35 +109,81 @@ def _utc_now() -> str:
     return dt.datetime.now(dt.timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
 
 
-def token_matches(expected: str, provided: str | None) -> bool:
-    value = (provided or "").strip()
-    expected = (expected or "").strip()
-    return bool(value) and bool(expected) and secrets.compare_digest(value, expected)
+AUTH_MAX_AGE_SECONDS = 24 * 60 * 60
+AUTH_FUTURE_SKEW_SECONDS = 5 * 60
 
 
-def bearer_token(authorization: str | None) -> str | None:
-    if not authorization:
-        return None
-    scheme, _, value = authorization.partition(" ")
-    if scheme.lower() != "bearer":
-        return None
-    return value.strip() or None
+@dataclass(frozen=True)
+class AuthResult:
+    ok: bool
+    error: str = ""
+    message: str = ""
+
+
+AUTH_OK = AuthResult(True)
+
+
+def new_app_id() -> str:
+    return f"app_{secrets.token_urlsafe(9)}"
 
 
-def auth_token_matches(expected: str, token: str | None = None, authorization: str | None = None) -> bool:
-    return token_matches(expected, token) or token_matches(expected, bearer_token(authorization))
+def new_app_key() -> str:
+    return secrets.token_urlsafe(32)
 
 
-async def websocket_auth_token(websocket: Any) -> str | None:
+def _auth_message(app_id: str, timestamp: str, scope: str) -> bytes:
+    return f"v1\nappId={app_id}\ntimestamp={timestamp}\nscope={scope}".encode()
+
+
+def make_auth_signature(app_key: str, app_id: str, timestamp: str, scope: str) -> str:
+    digest = hmac.new(app_key.encode(), _auth_message(app_id, timestamp, scope), hashlib.sha256).digest()
+    return base64.urlsafe_b64encode(digest).decode("ascii").rstrip("=")
+
+
+def build_auth_payload(app_id: str, app_key: str, scope: str, timestamp: int | None = None) -> dict[str, str]:
+    timestamp_value = str(int(time.time() if timestamp is None else timestamp))
+    return {
+        "appId": app_id,
+        "timestamp": timestamp_value,
+        "sign": make_auth_signature(app_key, app_id, timestamp_value, scope),
+    }
+
+
+def auth_headers(payload: dict[str, str]) -> dict[str, str]:
+    return {
+        "X-CCODE-App-Id": payload.get("appId", ""),
+        "X-CCODE-Timestamp": payload.get("timestamp", ""),
+        "X-CCODE-Sign": payload.get("sign", ""),
+    }
+
+
+def auth_query(payload: dict[str, str]) -> str:
+    return urlencode({"appId": payload.get("appId", ""), "timestamp": payload.get("timestamp", ""), "sign": payload.get("sign", "")})
+
+
+def verify_auth_payload(expected_app_id: str, expected_app_key: str, payload: dict[str, Any], scope: str) -> AuthResult:
+    app_id = str(payload.get("appId") or "").strip()
+    timestamp = str(payload.get("timestamp") or "").strip()
+    sign = str(payload.get("sign") or "").strip()
+    expected_app_id = (expected_app_id or "").strip()
+    expected_app_key = (expected_app_key or "").strip()
+    if not expected_app_id or not expected_app_key or not app_id or not timestamp or not sign:
+        return AuthResult(False, "auth_required", "Authentication required.")
+    if not hmac.compare_digest(expected_app_id, app_id):
+        return AuthResult(False, "auth_failed", "Authentication failed.")
     try:
-        raw = await asyncio.wait_for(websocket.receive_text(), timeout=10)
-        payload = json.loads(raw)
-    except (asyncio.TimeoutError, json.JSONDecodeError):
-        return None
-    if payload.get("type") != "auth":
-        return None
-    token = payload.get("token")
-    return token if isinstance(token, str) else None
+        timestamp_int = int(timestamp)
+    except ValueError:
+        return AuthResult(False, "auth_required", "Invalid authentication timestamp.")
+    age = int(time.time()) - timestamp_int
+    if age > AUTH_MAX_AGE_SECONDS:
+        return AuthResult(False, "reauth_required", "Authentication expired, please re-authenticate.")
+    if age < -AUTH_FUTURE_SKEW_SECONDS:
+        return AuthResult(False, "auth_failed", "Authentication timestamp is invalid.")
+    expected_sign = make_auth_signature(expected_app_key, app_id, timestamp, scope)
+    if not hmac.compare_digest(expected_sign, sign):
+        return AuthResult(False, "auth_failed", "Authentication failed.")
+    return AUTH_OK
 
 
 _ASSET_TEXT_CACHE: dict[str, str] = {}

ccode/remote_server.py

@@ -8,7 +8,7 @@ import time
 from dataclasses import dataclass, field
 from typing import Any
 
-from .remote_common import asset_text, auth_token_matches, missing_extra_message, token_matches, web_asset_text, websocket_auth_token
+from .remote_common import AuthResult, asset_text, missing_extra_message, verify_auth_payload, web_asset_text
 
 REMOTE_SERVER_NAME = "ccode-remote-server"
 ATTACH_TTL_SECONDS = 30
@@ -41,22 +41,33 @@ _PENDING_ATTACHES: dict[str, PendingAttach] = {}
 DEVICE_OFFLINE_TTL_SECONDS = 24 * 60 * 60
 
 
-def _admin_token() -> str:
-    return os.environ.get("CCODE_REMOTE_SERVER_ADMIN_TOKEN", "").strip()
+def _admin_app_id() -> str:
+    return os.environ.get("CCODE_REMOTE_SERVER_ADMIN_APP_ID", "").strip()
 
 
-def _client_token() -> str:
-    return os.environ.get("CCODE_REMOTE_SERVER_CLIENT_TOKEN", "").strip()
+def _admin_app_key() -> str:
+    return os.environ.get("CCODE_REMOTE_SERVER_ADMIN_APP_KEY", "").strip()
 
 
-def _valid_admin(token: str | None = None, authorization: str | None = None) -> bool:
-    expected = _admin_token()
-    return bool(expected) and auth_token_matches(expected, token, authorization)
+def _client_app_id() -> str:
+    return os.environ.get("CCODE_REMOTE_SERVER_CLIENT_APP_ID", "").strip()
 
 
-def _valid_client(token: str | None) -> bool:
-    expected = _client_token()
-    return bool(expected) and token_matches(expected, token)
+def _client_app_key() -> str:
+    return os.environ.get("CCODE_REMOTE_SERVER_CLIENT_APP_KEY", "").strip()
+
+
+def _valid_admin(payload: dict[str, Any], scope: str) -> AuthResult:
+    return verify_auth_payload(_admin_app_id(), _admin_app_key(), payload, scope)
+
+
+def _valid_client(payload: dict[str, Any], scope: str) -> AuthResult:
+    return verify_auth_payload(_client_app_id(), _client_app_key(), payload, scope)
+
+
+def _auth_response(result: AuthResult, response_class: Any) -> Any:
+    status_code = 401 if result.error in {"auth_required", "reauth_required"} else 403
+    return response_class({"error": result.error or "auth_failed", "message": result.message}, status_code=status_code)
 
 
 def _device_payload(device: DeviceConnection) -> dict[str, Any]:
@@ -147,11 +158,11 @@ def create_server_app() -> Any:
 
     @app.get("/app.js")
     async def app_js() -> Response:
-        return Response(asset_text("app.js"), media_type="application/javascript")
+        return Response(asset_text("app.js"), media_type="application/javascript", headers={"Cache-Control": "no-store"})
 
     @app.get("/style.css")
     async def style_css() -> Response:
-        return Response(asset_text("style.css"), media_type="text/css")
+        return Response(asset_text("style.css"), media_type="text/css", headers={"Cache-Control": "no-store"})
 
     @app.get("/assets/{asset_name}")
     async def web_asset(asset_name: str) -> Response:
@@ -163,30 +174,47 @@ def create_server_app() -> Any:
         media_type = media_types.get(asset_name)
         if media_type is None:
             return Response(status_code=404)
-        return Response(web_asset_text(asset_name), media_type=media_type)
+        return Response(web_asset_text(asset_name), media_type=media_type, headers={"Cache-Control": "no-store"})
 
     @app.get("/health")
     async def health() -> dict[str, Any]:
         _prune_offline_devices()
-        return {"ok": True, "name": REMOTE_SERVER_NAME, "devices": len(_DEVICES)}
+        return {"ok": True, "name": REMOTE_SERVER_NAME, "devices": len(_DEVICES), "remote_kind": "server"}
 
     @app.get("/api/devices")
-    async def devices(token: str | None = None, authorization: str | None = Header(default=None)) -> Response:
-        if not _valid_admin(token, authorization):
-            return JSONResponse({"error": "unauthorized"}, status_code=401)
+    async def devices(
+        x_ccode_app_id: str | None = Header(default=None),
+        x_ccode_timestamp: str | None = Header(default=None),
+        x_ccode_sign: str | None = Header(default=None),
+    ) -> Response:
+        auth_result = _valid_admin({"appId": x_ccode_app_id, "timestamp": x_ccode_timestamp, "sign": x_ccode_sign}, "server.api")
+        if not auth_result.ok:
+            return _auth_response(auth_result, JSONResponse)
         _prune_offline_devices()
         return JSONResponse({"devices": [_device_payload(device) for device in _DEVICES.values()]})
 
     @app.get("/api/sessions")
-    async def sessions(token: str | None = None, authorization: str | None = Header(default=None)) -> Response:
-        if not _valid_admin(token, authorization):
-            return JSONResponse({"error": "unauthorized"}, status_code=401)
+    async def sessions(
+        x_ccode_app_id: str | None = Header(default=None),
+        x_ccode_timestamp: str | None = Header(default=None),
+        x_ccode_sign: str | None = Header(default=None),
+    ) -> Response:
+        auth_result = _valid_admin({"appId": x_ccode_app_id, "timestamp": x_ccode_timestamp, "sign": x_ccode_sign}, "server.api")
+        if not auth_result.ok:
+            return _auth_response(auth_result, JSONResponse)
         return JSONResponse({"sessions": _flatten_sessions()})
 
     @app.get("/api/devices/{device_id}/sessions/{session_id}")
-    async def session_detail(device_id: str, session_id: str, token: str | None = None, authorization: str | None = Header(default=None)) -> Response:
-        if not _valid_admin(token, authorization):
-            return JSONResponse({"error": "unauthorized"}, status_code=401)
+    async def session_detail(
+        device_id: str,
+        session_id: str,
+        x_ccode_app_id: str | None = Header(default=None),
+        x_ccode_timestamp: str | None = Header(default=None),
+        x_ccode_sign: str | None = Header(default=None),
+    ) -> Response:
+        auth_result = _valid_admin({"appId": x_ccode_app_id, "timestamp": x_ccode_timestamp, "sign": x_ccode_sign}, "server.api")
+        if not auth_result.ok:
+            return _auth_response(auth_result, JSONResponse)
         device, session = _get_device_session(device_id, session_id)
         if device is None or session is None:
             return JSONResponse({"error": "not_found"}, status_code=404)
@@ -201,7 +229,9 @@ def create_server_app() -> Any:
         except (asyncio.TimeoutError, json.JSONDecodeError):
             await websocket.close(code=1008)
             return
-        if hello.get("type") != "hello" or not _valid_client(hello.get("token") if isinstance(hello.get("token"), str) else None):
+        auth_result = _valid_client(hello, "client.control")
+        if hello.get("type") != "hello" or not auth_result.ok:
+            await websocket.send_json({"type": "error", "error": auth_result.error or "auth_failed", "message": auth_result.message})
             await websocket.close(code=1008)
             return
         device_id = str(hello.get("device_id") or secrets.token_urlsafe(16))
@@ -237,8 +267,15 @@ def create_server_app() -> Any:
         await websocket.accept()
         _prune_pending()
         pending = _PENDING_ATTACHES.get(attach_id)
-        token = await websocket_auth_token(websocket)
-        if pending is None or not _valid_client(token):
+        try:
+            raw = await asyncio.wait_for(websocket.receive_text(), timeout=10)
+            payload = json.loads(raw)
+        except (asyncio.TimeoutError, json.JSONDecodeError):
+            await websocket.close(code=1008)
+            return
+        auth_result = _valid_client(payload, "client.attach")
+        if pending is None or payload.get("type") != "auth" or not auth_result.ok:
+            await websocket.send_json({"type": "error", "error": auth_result.error or "auth_failed", "message": auth_result.message})
             await websocket.close(code=1008)
             return
         pending.client_ws = websocket
@@ -249,9 +286,9 @@ def create_server_app() -> Any:
     @app.websocket("/ws/devices/{device_id}/sessions/{session_id}")
     async def browser_attach(websocket: FastAPIWebSocket, device_id: str, session_id: str) -> None:
         await websocket.accept()
-        token = await websocket_auth_token(websocket)
-        if not _valid_admin(token):
-            await websocket.send_json({"type": "status", "message": "unauthorized: invalid token"})
+        auth_result = _valid_admin(dict(websocket.query_params), "server.ws")
+        if not auth_result.ok:
+            await websocket.send_json({"type": "error", "error": auth_result.error, "message": auth_result.message})
             await websocket.close(code=1008)
             return
         device, session = _get_device_session(device_id, session_id)

ccode/ui.py

@@ -42,9 +42,11 @@ _FIELD_REMOTE_ENABLED = "remote.enabled"
 _FIELD_REMOTE_MODE = "remote.mode"
 _FIELD_REMOTE_LOCAL_HOST = "remote.local.host"
 _FIELD_REMOTE_LOCAL_PORT = "remote.local.port"
-_FIELD_REMOTE_LOCAL_TOKEN = "remote.local.token"
+_FIELD_REMOTE_LOCAL_APP_ID = "remote.local.appId"
+_FIELD_REMOTE_LOCAL_APP_KEY = "remote.local.appKey"
 _FIELD_REMOTE_SERVER_URL = "remote.server.url"
-_FIELD_REMOTE_SERVER_TOKEN = "remote.server.token"
+_FIELD_REMOTE_SERVER_APP_ID = "remote.server.appId"
+_FIELD_REMOTE_SERVER_APP_KEY = "remote.server.appKey"
 _FIELD_REMOTE_SERVER_DEVICE_NAME = "remote.server.device_name"
 _FIELD_REMOTE_SERVER_DEVICE_ID = "remote.server.device_id"
 _FIELD_REMOTE_SERVER_AUTO_CONNECT = "remote.server.auto_connect"
@@ -93,9 +95,11 @@ class CursesApp:
             _FIELD_API_KEY: len(self.config.get("api_key", "")),
             _FIELD_REMOTE_LOCAL_HOST: len(str(local.get("host", ""))),
             _FIELD_REMOTE_LOCAL_PORT: len(str(local.get("port", ""))),
-            _FIELD_REMOTE_LOCAL_TOKEN: len(str(local.get("token", ""))),
+            _FIELD_REMOTE_LOCAL_APP_ID: len(str(local.get("appId", ""))),
+            _FIELD_REMOTE_LOCAL_APP_KEY: len(str(local.get("appKey", ""))),
             _FIELD_REMOTE_SERVER_URL: len(str(server.get("url", ""))),
-            _FIELD_REMOTE_SERVER_TOKEN: len(str(server.get("token", ""))),
+            _FIELD_REMOTE_SERVER_APP_ID: len(str(server.get("appId", ""))),
+            _FIELD_REMOTE_SERVER_APP_KEY: len(str(server.get("appKey", ""))),
             _FIELD_REMOTE_SERVER_DEVICE_NAME: len(str(server.get("device_name", ""))),
             _FIELD_REMOTE_SERVER_DEVICE_ID: len(str(server.get("device_id", ""))),
             _FIELD_REMOTE_SESSION_NAME: len(str(remote.get("session_name", ""))),
@@ -136,9 +140,11 @@ class CursesApp:
             _FIELD_REMOTE_MODE,
             _FIELD_REMOTE_LOCAL_HOST,
             _FIELD_REMOTE_LOCAL_PORT,
-            _FIELD_REMOTE_LOCAL_TOKEN,
+            _FIELD_REMOTE_LOCAL_APP_ID,
+            _FIELD_REMOTE_LOCAL_APP_KEY,
             _FIELD_REMOTE_SERVER_URL,
-            _FIELD_REMOTE_SERVER_TOKEN,
+            _FIELD_REMOTE_SERVER_APP_ID,
+            _FIELD_REMOTE_SERVER_APP_KEY,
             _FIELD_REMOTE_SERVER_DEVICE_NAME,
             _FIELD_REMOTE_SERVER_DEVICE_ID,
             _FIELD_REMOTE_SERVER_AUTO_CONNECT,
@@ -355,7 +361,7 @@ class CursesApp:
         y += 1
 
         y += 1
-        addstr_safe(stdscr, y, x, "─── Remote/Web  [space/enter]=toggle  [g]=generate token ─────────────")
+        addstr_safe(stdscr, y, x, "─── Remote/Web  [space/enter]=toggle  [g]=generate app id/key ───────")
         y += 1
         remote = self.config.setdefault("remote", {})
         local = remote.setdefault("local", {})
@@ -366,9 +372,11 @@ class CursesApp:
             (_FIELD_REMOTE_MODE, "MODE:", str(remote.get("mode", "local"))),
             (_FIELD_REMOTE_LOCAL_HOST, "LOCAL HOST:", str(local.get("host", ""))),
             (_FIELD_REMOTE_LOCAL_PORT, "LOCAL PORT:", str(local.get("port", ""))),
-            (_FIELD_REMOTE_LOCAL_TOKEN, "LOCAL TOKEN:", mask_secret(str(local.get("token", "")))),
+            (_FIELD_REMOTE_LOCAL_APP_ID, "LOCAL APP ID:", str(local.get("appId", ""))),
+            (_FIELD_REMOTE_LOCAL_APP_KEY, "LOCAL APP KEY:", mask_secret(str(local.get("appKey", "")))),
             (_FIELD_REMOTE_SERVER_URL, "SERVER URL:", str(server.get("url", ""))),
-            (_FIELD_REMOTE_SERVER_TOKEN, "CLIENT TOKEN:", mask_secret(str(server.get("token", "")))),
+            (_FIELD_REMOTE_SERVER_APP_ID, "CLIENT APP ID:", str(server.get("appId", ""))),
+            (_FIELD_REMOTE_SERVER_APP_KEY, "CLIENT APP KEY:", mask_secret(str(server.get("appKey", "")))),
             (_FIELD_REMOTE_SERVER_DEVICE_NAME, "DEVICE NAME:", str(server.get("device_name", ""))),
             (_FIELD_REMOTE_SERVER_DEVICE_ID, "DEVICE ID:", str(server.get("device_id", ""))),
             (_FIELD_REMOTE_SERVER_AUTO_CONNECT, "AUTO CONNECT:", "on" if server.get("auto_connect") else "off"),
@@ -379,10 +387,10 @@ class CursesApp:
             is_focused = focused == field
             label_x = x
             value_x = x + 22
-            if field == _FIELD_REMOTE_LOCAL_TOKEN and is_focused:
-                display = str(local.get("token", ""))
-            if field == _FIELD_REMOTE_SERVER_TOKEN and is_focused:
-                display = str(server.get("token", ""))
+            if field == _FIELD_REMOTE_LOCAL_APP_KEY and is_focused:
+                display = str(local.get("appKey", ""))
+            if field == _FIELD_REMOTE_SERVER_APP_KEY and is_focused:
+                display = str(server.get("appKey", ""))
             addstr_safe(stdscr, y, label_x, label)
             addstr_safe(stdscr, y, value_x, display or "<unset>", curses.A_REVERSE if is_focused else 0)
             if field == _FIELD_REMOTE_LOCAL_HOST and str(local.get("host", "")) == "0.0.0.0":
@@ -484,9 +492,11 @@ class CursesApp:
         elif focused in (
             _FIELD_REMOTE_LOCAL_HOST,
             _FIELD_REMOTE_LOCAL_PORT,
-            _FIELD_REMOTE_LOCAL_TOKEN,
+            _FIELD_REMOTE_LOCAL_APP_ID,
+            _FIELD_REMOTE_LOCAL_APP_KEY,
             _FIELD_REMOTE_SERVER_URL,
-            _FIELD_REMOTE_SERVER_TOKEN,
+            _FIELD_REMOTE_SERVER_APP_ID,
+            _FIELD_REMOTE_SERVER_APP_KEY,
             _FIELD_REMOTE_SERVER_DEVICE_NAME,
             _FIELD_REMOTE_SERVER_DEVICE_ID,
             _FIELD_REMOTE_SESSION_NAME,
@@ -569,14 +579,14 @@ class CursesApp:
                 save_config(self.config)
             return
 
-        if focused in (_FIELD_REMOTE_LOCAL_TOKEN, _FIELD_REMOTE_SERVER_TOKEN) and key in (ord("g"), ord("G")):
-            token = secrets.token_urlsafe(24)
+        if focused in (_FIELD_REMOTE_LOCAL_APP_ID, _FIELD_REMOTE_SERVER_APP_ID, _FIELD_REMOTE_LOCAL_APP_KEY, _FIELD_REMOTE_SERVER_APP_KEY) and key in (ord("g"), ord("G")):
+            value = f"app_{secrets.token_urlsafe(9)}" if focused in (_FIELD_REMOTE_LOCAL_APP_ID, _FIELD_REMOTE_SERVER_APP_ID) else secrets.token_urlsafe(32)
             remote = self.config.setdefault("remote", {})
-            target = remote.setdefault("local" if focused == _FIELD_REMOTE_LOCAL_TOKEN else "server", {})
-            target["token"] = token
-            self.config_cursor[focused] = len(token)
+            target = remote.setdefault("local" if focused in (_FIELD_REMOTE_LOCAL_APP_ID, _FIELD_REMOTE_LOCAL_APP_KEY) else "server", {})
+            target["appId" if focused in (_FIELD_REMOTE_LOCAL_APP_ID, _FIELD_REMOTE_SERVER_APP_ID) else "appKey"] = value
+            self.config_cursor[focused] = len(value)
             save_config(self.config)
-            self.status_message = "Remote token regenerated."
+            self.status_message = "Remote app credential regenerated."
             return
 
         # 文本字段
@@ -586,9 +596,11 @@ class CursesApp:
         if focused in (
             _FIELD_REMOTE_LOCAL_HOST,
             _FIELD_REMOTE_LOCAL_PORT,
-            _FIELD_REMOTE_LOCAL_TOKEN,
+            _FIELD_REMOTE_LOCAL_APP_ID,
+            _FIELD_REMOTE_LOCAL_APP_KEY,
             _FIELD_REMOTE_SERVER_URL,
-            _FIELD_REMOTE_SERVER_TOKEN,
+            _FIELD_REMOTE_SERVER_APP_ID,
+            _FIELD_REMOTE_SERVER_APP_KEY,
             _FIELD_REMOTE_SERVER_DEVICE_NAME,
             _FIELD_REMOTE_SERVER_DEVICE_ID,
             _FIELD_REMOTE_SESSION_NAME,

ccode/web/app.js

@@ -1,7 +1,8 @@
 const terminalEl = document.getElementById("terminal");
 const sessionListEl = document.getElementById("session-list");
 const tokenFormEl = document.getElementById("token-form");
-const tokenInputEl = document.getElementById("token-input");
+const appIdInputEl = document.getElementById("app-id-input");
+const appKeyInputEl = document.getElementById("app-key-input");
 const statusEl = document.getElementById("status");
 const actionsEl = document.getElementById("actions");
 const actionsToggleButton = document.getElementById("actions-toggle");
@@ -26,9 +27,11 @@ const inputSequences = {
   left: "\x1b[D",
 };
 
-const tokenStorageKey = "ccode.remote.adminToken";
+const authStorageKey = "ccode.remote.authTicket";
+const appIdStorageKey = "ccode.remote.appId";
 const fontSizeStorageKey = "ccode.remote.terminalFontSize";
-let token = window.sessionStorage.getItem(tokenStorageKey) || "";
+let authTicket = loadAuthTicket();
+let remoteKind = "local";
 let socket = null;
 let term = null;
 let fitAddon = null;
@@ -40,10 +43,66 @@ let resizeFrame = null;
 let viewportHeight = "";
 let keyboardInset = "";
 
+function loadAuthTicket() {
+  try {
+    const ticket = JSON.parse(window.sessionStorage.getItem(authStorageKey) || "null");
+    return ticket && ticket.appId && ticket.timestamp && ticket.signs ? ticket : null;
+  } catch (error) {
+    return null;
+  }
+}
+
 function setStatus(message) {
   statusEl.textContent = message;
 }
 
+function authMessage(appId, timestamp, scope) {
+  return `v1\nappId=${appId}\ntimestamp=${timestamp}\nscope=${scope}`;
+}
+
+function base64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return window.btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+async function signAuth(appId, appKey, timestamp, scope) {
+  const encoder = new TextEncoder();
+  const key = await window.crypto.subtle.importKey("raw", encoder.encode(appKey), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const signature = await window.crypto.subtle.sign("HMAC", key, encoder.encode(authMessage(appId, timestamp, scope)));
+  return base64Url(new Uint8Array(signature));
+}
+
+async function createAuthTicket(appId, appKey) {
+  const timestamp = String(Math.floor(Date.now() / 1000));
+  const scopes = ["local.api", "local.ws", "server.api", "server.ws"];
+  const signs = {};
+  for (const scope of scopes) {
+    signs[scope] = await signAuth(appId, appKey, timestamp, scope);
+  }
+  return { appId, timestamp, signs };
+}
+
+function authHeaders(scope) {
+  return {
+    "X-CCODE-App-Id": authTicket.appId,
+    "X-CCODE-Timestamp": authTicket.timestamp,
+    "X-CCODE-Sign": authTicket.signs[scope] || "",
+  };
+}
+
+function authQuery(scope) {
+  return new URLSearchParams({ appId: authTicket.appId, timestamp: authTicket.timestamp, sign: authTicket.signs[scope] || "" }).toString();
+}
+
+function clearAuthTicket(message = "enter app credentials") {
+  window.sessionStorage.removeItem(authStorageKey);
+  authTicket = null;
+  showTokenMode(message);
+}
+
 function sendInput(data) {
   if (!socket || socket.readyState !== WebSocket.OPEN) {
     return;
@@ -190,7 +249,7 @@ function closeSocket() {
   }
 }
 
-function showTokenMode(message = "enter token") {
+function showTokenMode(message = "enter app credentials") {
   closeSocket();
   currentSession = null;
   terminalEl.hidden = true;
@@ -205,8 +264,9 @@ function showTokenMode(message = "enter token") {
   refreshButton.hidden = true;
   changeTokenButton.hidden = true;
   setStatus(message);
-  tokenInputEl.value = token;
-  tokenInputEl.focus();
+  appIdInputEl.value = window.sessionStorage.getItem(appIdStorageKey) || authTicket?.appId || "";
+  appKeyInputEl.value = "";
+  appIdInputEl.focus();
 }
 
 function showListMode() {
@@ -297,7 +357,7 @@ function renderSessions(sessions) {
 }
 
 async function loadSessions() {
-  if (!token) {
+  if (!authTicket) {
     showTokenMode();
     return;
   }
@@ -307,12 +367,11 @@ async function loadSessions() {
   try {
     const response = await fetch("/api/sessions", {
       cache: "no-store",
-      headers: { Authorization: `Bearer ${token}` },
+      headers: authHeaders(`${remoteKind}.api`),
     });
     if (response.status === 401) {
-      window.sessionStorage.removeItem(tokenStorageKey);
-      token = "";
-      showTokenMode("unauthorized: invalid token");
+      const payload = await response.json().catch(() => ({}));
+      clearAuthTicket(payload.error === "reauth_required" ? "authentication expired: enter app credentials" : "unauthorized: invalid app credentials");
       return;
     }
     if (!response.ok) {
@@ -334,7 +393,7 @@ function sessionWsPath(session) {
 }
 
 function connect() {
-  if (!token) {
+  if (!authTicket) {
     showTokenMode();
     return;
   }
@@ -347,13 +406,9 @@ function connect() {
   closeSocket();
   term.clear();
   const protocol = window.location.protocol === "https:" ? "wss:" : "ws:";
-  socket = new WebSocket(`${protocol}//${window.location.host}${sessionWsPath(currentSession)}`);
+  socket = new WebSocket(`${protocol}//${window.location.host}${sessionWsPath(currentSession)}?${authQuery(`${remoteKind}.ws`)}`);
   setStatus("connecting");
 
-  socket.addEventListener("open", () => {
-    socket.send(JSON.stringify({ type: "auth", token }));
-  });
-
   socket.addEventListener("message", (event) => {
     const payload = JSON.parse(event.data);
     if (payload.type === "output") {
@@ -364,15 +419,17 @@ function connect() {
         fitAndSendResize();
         term.focus();
       }
+    } else if (payload.type === "error") {
+      if (payload.error === "reauth_required" || payload.error === "auth_required" || payload.error === "auth_failed") {
+        clearAuthTicket(payload.message || "enter app credentials");
+      }
     }
   });
 
   socket.addEventListener("close", (event) => {
     if (event.code === 1008) {
-      if (statusEl.textContent === "unauthorized: invalid token") {
-        window.sessionStorage.removeItem(tokenStorageKey);
-        token = "";
-        showTokenMode("unauthorized: invalid token");
+      if (statusEl.textContent !== "connected") {
+        clearAuthTicket("enter app credentials");
       }
       return;
     }
@@ -394,21 +451,22 @@ function openSession(session) {
   connect();
 }
 
-tokenFormEl.addEventListener("submit", (event) => {
+tokenFormEl.addEventListener("submit", async (event) => {
   event.preventDefault();
-  token = tokenInputEl.value.trim();
-  if (!token) {
-    showTokenMode("enter token");
+  const appId = appIdInputEl.value.trim();
+  const appKey = appKeyInputEl.value.trim();
+  if (!appId || !appKey) {
+    showTokenMode("enter app credentials");
     return;
   }
-  window.sessionStorage.setItem(tokenStorageKey, token);
+  authTicket = await createAuthTicket(appId, appKey);
+  window.sessionStorage.setItem(authStorageKey, JSON.stringify(authTicket));
+  window.sessionStorage.setItem(appIdStorageKey, appId);
   loadSessions();
 });
 
 changeTokenButton.addEventListener("click", () => {
-  window.sessionStorage.removeItem(tokenStorageKey);
-  token = "";
-  showTokenMode("enter token");
+  clearAuthTicket("enter app credentials");
 });
 window.addEventListener("resize", requestFitAndSendResize);
 actionsToggleButton.addEventListener("click", () => {
@@ -451,4 +509,15 @@ if (window.visualViewport) {
 }
 updateViewportInsets();
 
-loadSessions();
+async function initialize() {
+  try {
+    const response = await fetch("/health", { cache: "no-store" });
+    const payload = await response.json();
+    remoteKind = payload.remote_kind === "server" ? "server" : "local";
+  } catch (error) {
+    remoteKind = "local";
+  }
+  loadSessions();
+}
+
+initialize();

ccode/web/index.html

@@ -12,23 +12,25 @@
       <header>
         <div>
           <h1>ccode remote</h1>
-          <p id="status">enter token</p>
+          <p id="status">enter app credentials</p>
         </div>
         <button id="actions-toggle" class="actions-toggle" type="button" hidden>Menu</button>
         <div id="actions" class="actions">
           <button id="back" type="button" hidden>Sessions</button>
           <button id="refresh" type="button" hidden>Refresh</button>
-          <button id="change-token" type="button" hidden>Change token</button>
+          <button id="change-token" type="button" hidden>Change credentials</button>
           <button id="focus" type="button" hidden>Focus terminal</button>
           <button id="reconnect" type="button" hidden>Reconnect</button>
         </div>
       </header>
       <form id="token-form" class="token-panel">
-        <label for="token-input">Remote token</label>
+        <label for="app-id-input">Remote app credentials</label>
         <div class="token-row">
-          <input id="token-input" type="password" autocomplete="current-password" placeholder="Paste your configured token" />
+          <input id="app-id-input" autocomplete="username" placeholder="App ID" />
+          <input id="app-key-input" type="password" autocomplete="current-password" placeholder="App Key" />
           <button type="submit">Continue</button>
         </div>
+        <small>App Key is only used locally to create a 24-hour signature.</small>
       </form>
       <section id="session-list" hidden></section>
       <div id="terminal" tabindex="0" hidden></div>

{ccoding-0.2.2.dist-info → ccoding-0.2.4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ccoding
-Version: 0.2.2
+Version: 0.2.4
 Summary: Curses-based Claude Code launcher
 Project-URL: Homepage, https://github.com/8DE4732A/ccode
 Project-URL: Repository, https://github.com/8DE4732A/ccode
@@ -173,8 +173,8 @@ uv sync --extra remote          # 同时安装 client/server 依赖
 
 - `↑ / ↓`：移动字段焦点
 - `Enter / Space`：切换开关项
-- 文本输入：编辑 BASE_URL / API_KEY、remote local/server URL/token/device/prefix 等字段
-- `g`：在 Remote local token 或 server client token 字段重新生成访问 token
+- 文本输入：编辑 BASE_URL / API_KEY、remote local/server URL/appId/appKey/device/prefix 等字段
+- `g`：在 Remote appId 或 appKey 字段重新生成对应值
 - `ESC`：自动保存并返回主界面
 
 ## 配置文件
@@ -209,11 +209,13 @@ uv sync --extra remote          # 同时安装 client/server 依赖
     "local": {
       "host": "127.0.0.1",
       "port": 8765,
-      "token": ""
+      "appId": "",
+      "appKey": ""
     },
     "server": {
       "url": "",
-      "token": "",
+      "appId": "",
+      "appKey": "",
       "device_name": "",
       "device_id": "",
       "auto_connect": true,
@@ -232,6 +234,8 @@ Remote/Web 让 Claude Code 运行在 tmux session 中，浏览器通过 WebSocke
 | `local` | 直接访问本机 local hub | 当前这台机器 | 单机使用，或把这一台机器通过 tunnel 暴露出去 |
 | `server` | 访问公网中心 `ccode-remote-server` | 各客户端设备本机 | 多设备、NAT 后设备、统一入口管理多个 sessions |
 
+Remote/Web 使用 appId/appKey HMAC 认证。网络请求只携带 `appId`、`timestamp` 和 `sign`，其中 `sign` 由 appKey 计算，appKey 不会被发送。浏览器端只保存 24 小时有效的签名票据，过期后需要重新输入 appKey；客户端 connector 会从本地配置读取 appKey 并在重连时自动重新签名。旧版配置中的 `token` 会在读取时迁移为 `appKey`，并自动生成 `appId`。
+
 ### local 模式
 
 local 模式会在本机启动一个共享 FastAPI hub。浏览器直接访问这个 hub，hub 再 attach 到本机 tmux session。
@@ -262,23 +266,23 @@ claude
    - `MODE`：`local`
    - `LOCAL HOST`：默认 `127.0.0.1`
    - `LOCAL PORT`：默认 `8765`
-   - `LOCAL TOKEN`：手动输入，或在该字段按 `g` 生成
+   - `LOCAL APP ID` / `LOCAL APP KEY`：手动输入，或在对应字段按 `g` 生成
 
 3. 回到主界面，按 `r` 开启 Remote/Web，再按 `Enter` 启动 remote session。
 
-4. 浏览器打开终端输出的本地地址，输入 `LOCAL TOKEN`，选择 session 后进入 terminal。
+4. 浏览器打开终端输出的本地地址，输入 `LOCAL APP ID` / `LOCAL APP KEY`，选择 session 后进入 terminal。
 
-local 模式默认只监听 `127.0.0.1`。终端只输出不带 token 的本地访问地址。浏览器打开页面后需要手动输入 token，前端会用 `sessionStorage` 做浏览器会话级缓存；关闭该浏览器会话后需要重新输入。所有 session list、session API 和 WebSocket 连接仍然需要 token。
+local 模式默认只监听 `127.0.0.1`。终端只输出不带认证信息的本地访问地址。浏览器打开页面后需要手动输入 appId/appKey，前端只保存由 appKey 生成的 24 小时 HMAC 签名票据，不保存 appKey；票据过期或关闭浏览器会话后需要重新输入。所有 session list、session API 和 WebSocket 连接仍然需要签名认证。
 
-每个启用 Remote/Web 的 `ccode` 进程都会创建一个唯一 tmux session，session 名由配置里的 `session_name` 前缀、时间戳和进程号组成，例如 `ccode-claude-20260509-153022-12345`。本机只启动一个共享 remote hub，多个本地 `ccode` 进程会复用同一个 host/port/token。浏览器认证后会先显示 session 列表，选择某个 session 后进入 terminal，也可以返回列表重新选择。
+每个启用 Remote/Web 的 `ccode` 进程都会创建一个唯一 tmux session，session 名由配置里的 `session_name` 前缀、时间戳和进程号组成，例如 `ccode-claude-20260509-153022-12345`。本机只启动一个共享 remote hub，多个本地 `ccode` 进程会复用同一个 host/port/appId/appKey。浏览器认证后会先显示 session 列表，选择某个 session 后进入 terminal，也可以返回列表重新选择。
 
-如果通过 Cloudflare Tunnel、Nginx、Caddy 等反向代理暴露 local hub，建议额外叠加 Cloudflare Access、Basic Auth 或 OAuth2 proxy。监听 `0.0.0.0` 会把所有 remote sessions 暴露给网络内可达主机，请保护好访问入口和 token。
+如果通过 Cloudflare Tunnel、Nginx、Caddy 等反向代理暴露 local hub，建议额外叠加 Cloudflare Access、Basic Auth 或 OAuth2 proxy。监听 `0.0.0.0` 会把所有 remote sessions 暴露给网络内可达主机，请保护好访问入口和 app credentials。
 
 ```bash
 cloudflared tunnel --url http://127.0.0.1:8765
 ```
 
-local hub 日志写入 `~/.ccode/remote_server.log`，记录 hub 启停、session 注册、session API 和 WebSocket 连接状态，不记录 token。启动 hub 前如果日志超过 5 MiB 会自动轮转，默认保留 3 个历史文件（`.1`、`.2`、`.3`）。
+local hub 日志写入 `~/.ccode/remote_server.log`，记录 hub 启停、session 注册、session API 和 WebSocket 连接状态，不记录 appKey。启动 hub 前如果日志超过 5 MiB 会自动轮转，默认保留 3 个历史文件（`.1`、`.2`、`.3`）。
 
 ### server 模式和 `ccode-remote-server`
 
@@ -289,7 +293,7 @@ local hub 日志写入 `~/.ccode/remote_server.log`，记录 hub 启停、sessio
 ```text
                   Browser
                      │
-                     │ HTTPS/WSS + admin token
+                     │ HTTPS/WSS + admin HMAC
                      ▼
           ┌───────────────────────┐
           │ ccode-remote-server   │
@@ -314,31 +318,35 @@ local hub 日志写入 `~/.ccode/remote_server.log`，记录 hub 启停、sessio
 
 server 不反连客户端，所以客户端可以在 NAT、家庭网络或公司内网后面。只要客户端能主动访问 server，就可以注册设备和暴露自己的 remote sessions。
 
-#### server token
+#### server app credentials
 
-server token 不会自动生成，必须通过环境变量显式设置：
+server app credentials 不会自动生成，必须通过环境变量显式设置。认证时网络上传输 appId、timestamp 和 HMAC sign，不传输 appKey：
 
-- `CCODE_REMOTE_SERVER_ADMIN_TOKEN`：浏览器 Web UI / `/api/*` / browser WebSocket 使用的管理 token。
-- `CCODE_REMOTE_SERVER_CLIENT_TOKEN`：各设备客户端 connector 注册和心跳使用的 token。
+- `CCODE_REMOTE_SERVER_ADMIN_APP_ID` / `CCODE_REMOTE_SERVER_ADMIN_APP_KEY`：浏览器 Web UI / `/api/*` / browser WebSocket 使用的管理凭据。
+- `CCODE_REMOTE_SERVER_CLIENT_APP_ID` / `CCODE_REMOTE_SERVER_CLIENT_APP_KEY`：各设备客户端 connector 注册和心跳使用的客户端凭据。
 - `CCODE_REMOTE_SERVER_HOST` / `CCODE_REMOTE_SERVER_PORT`：可选，默认监听 `127.0.0.1:8765`。
 
 启动中心 server：
 
 ```bash
-CCODE_REMOTE_SERVER_ADMIN_TOKEN="admin-secret" \
-CCODE_REMOTE_SERVER_CLIENT_TOKEN="client-secret" \
+CCODE_REMOTE_SERVER_ADMIN_APP_ID="admin-app" \
+CCODE_REMOTE_SERVER_ADMIN_APP_KEY="admin-secret" \
+CCODE_REMOTE_SERVER_CLIENT_APP_ID="client-app" \
+CCODE_REMOTE_SERVER_CLIENT_APP_KEY="client-secret" \
 ccode-remote-server --host 127.0.0.1 --port 8765
 ```
 
 如果使用源码开发环境运行：
 
 ```bash
-CCODE_REMOTE_SERVER_ADMIN_TOKEN="admin-secret" \
-CCODE_REMOTE_SERVER_CLIENT_TOKEN="client-secret" \
+CCODE_REMOTE_SERVER_ADMIN_APP_ID="admin-app" \
+CCODE_REMOTE_SERVER_ADMIN_APP_KEY="admin-secret" \
+CCODE_REMOTE_SERVER_CLIENT_APP_ID="client-app" \
+CCODE_REMOTE_SERVER_CLIENT_APP_KEY="client-secret" \
 uv run --extra remote-server ccode-remote-server --host 127.0.0.1 --port 8765
 ```
 
-浏览器访问 server 页面时输入 `admin-secret`。如果未设置 `CCODE_REMOTE_SERVER_ADMIN_TOKEN`，管理 API 会返回 401，页面上任何 token 都无法通过认证。
+浏览器访问 server 页面时输入 admin appId/appKey。前端只保存 24 小时有效的 HMAC 签名票据，不保存 appKey。如果未设置 `CCODE_REMOTE_SERVER_ADMIN_APP_ID` / `CCODE_REMOTE_SERVER_ADMIN_APP_KEY`，管理 API 会返回 401。
 
 #### 客户端设备配置
 
@@ -352,7 +360,7 @@ uv tool install 'ccoding[remote-client]'
 
 - `MODE`：`server`
 - `SERVER URL`：中心 server 地址，例如 `http://127.0.0.1:8765`；如果只填 `127.0.0.1:8765`，会自动按 `http://127.0.0.1:8765` 处理
-- `CLIENT TOKEN`：与 server 的 `CCODE_REMOTE_SERVER_CLIENT_TOKEN` 一致
+- `CLIENT APP ID` / `CLIENT APP KEY`：与 server 的 `CCODE_REMOTE_SERVER_CLIENT_APP_ID` / `CCODE_REMOTE_SERVER_CLIENT_APP_KEY` 一致
 - `DEVICE NAME`：设备显示名，可留空后由配置迁移填充 hostname
 - `DEVICE ID`：稳定设备 ID，可留空后自动生成
 - `AUTO CONNECT`：是否默认自动连接中心 server
@@ -384,7 +392,7 @@ server 只做 registry/router/relay，不保存 terminal frame data，不保存
 
 #### Cloudflare Tunnel / 反向代理
 
-如果用 Cloudflare Tunnel 暴露中心 server，只需要 tunnel server 这一处入口，多台客户端设备都配置同一个 `SERVER URL` 和 `CLIENT TOKEN`：
+如果用 Cloudflare Tunnel 暴露中心 server，只需要 tunnel server 这一处入口，多台客户端设备都配置同一个 `SERVER URL` 和 `CLIENT APP ID` / `CLIENT APP KEY`：
 
 ```bash
 cloudflared tunnel --url http://127.0.0.1:8765

{ccoding-0.2.2.dist-info → ccoding-0.2.4.dist-info}/RECORD

@@ -2,26 +2,26 @@ ccode/__init__.py,sha256=bbPH1IiDNbRuQvhS_fNfXhPDKeMQ5R6oS4ngv_7zHZ8,170
 ccode/__main__.py,sha256=bYt9eEaoRQWdejEHFD8REx9jxVEdZptECFsV7F49Ink,30
 ccode/api.py,sha256=ZohlOtb64zU9f7A-CGhPcSluT8D30Be9OG6yAvucBnE,5126
 ccode/cli.py,sha256=SovAIOMH75HW2Ci8Kl6EKnJ2_lwl7Fx-l7WVWDSiAxY,247
-ccode/config.py,sha256=7z5AOrMBkJ0y8oeoLkVlQjwkDoH-V5fACd4hTcO6jow,7559
+ccode/config.py,sha256=B14xX1e34YEUA4gqhl5dJt-55McnaJcXCpPU6Zakhss,8522
 ccode/env_schema.json,sha256=4_VpMYRwzxMbvO-i9loPvW6spKiHSWBVE-xRUuWYu8c,35490
 ccode/logo.py,sha256=L8nkF8Zx4YlrFGnVONpEc7sWF2aAB3cyoQdtISF-SVM,5514
-ccode/remote.py,sha256=_jJWtGfH77tykYQvPrRmxADRoRfpjDj0OT0VLWXY0l8,23547
-ccode/remote_cli.py,sha256=YwYoSY15JlisEidIYR4lIURvpYwGafBIn-TkZ3Lg9EA,8398
-ccode/remote_client.py,sha256=tuh-jDyp3muG-4siZTtNC98sK2NQu80E9lhHtb_fgaY,9366
-ccode/remote_common.py,sha256=B2qmlS8n9Ik4-GpGtlIQQKBQM4qkOEMgXqMsijzC6Fc,6093
-ccode/remote_server.py,sha256=HjzKEZLeOzsm9Rf-hSLhzlJSIwGjpn_zLbMeHoJRiuk,11894
-ccode/ui.py,sha256=R4yKNMoMZCryoDyCHcXrGQ7sh02BYM8tEjY9ndEq4VE,37274
+ccode/remote.py,sha256=X7coJG7JQapFvDWMoOegno7TSbNkq4zuV5MtB4l4b_I,24971
+ccode/remote_cli.py,sha256=nblydZh4XiksnZitLp_9RTmuJuGBVCYK_o1vzyA2PeM,8569
+ccode/remote_client.py,sha256=5UjWK-bTns4jSCON7hTu-S3U5kf4X0ZLH4ql9in3z8Q,9597
+ccode/remote_common.py,sha256=9eJeUJTaQQojTLcF7gz8X0dFM5nO3vM5q7bC-YSd8bE,8244
+ccode/remote_server.py,sha256=CqKKiE55yAfGkYOcXIOqELROCkY5rtr-Z3GnyBq3taQ,13692
+ccode/ui.py,sha256=eoCjHkUAVadsGSAisQ7_BI4DaPdjYnX9cAeh2zzkI58,38274
 ccode/web/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-ccode/web/app.js,sha256=w9CbPuf2uAACCaBrXRxUGWphP4Fp_XP7iHY7KSUeEag,13150
-ccode/web/index.html,sha256=zLI7h4iLKXUWXvlFqD3h_HZDmnwg8P2agNKCXB9qEJY,2469
+ccode/web/app.js,sha256=ErtM9fmAHvYp1QAks3kObqCkpghA0_nFNXSC2kbxvwo,15823
+ccode/web/index.html,sha256=sBGKxXidj6X4e8LqcITDHsrefZadwZy9JIBLRW5aeoQ,2644
 ccode/web/style.css,sha256=3RClaSS48-Ne2PQOwG5rhwbPwZKxyp-gG_OmKYRQAzo,4270
 ccode/web/assets/addon-fit.js,sha256=uj6iVs4GIKCZKhl9bJuupkgj_JPY2gep42bKmUPBhSc,1521
 ccode/web/assets/xterm-LICENSE,sha256=tWn2KdAPJiaoEA3yoXmCEFNWIeQhZN_UJqb-Wqx7DM0,1261
 ccode/web/assets/xterm-addon-fit-LICENSE,sha256=4lbwEYivUn5NBtIdBvv3ha6cUNSzKL8Dy-C6fwqkIo8,1103
 ccode/web/assets/xterm.css,sha256=hUp8D7cOixoIPBZ5ergnKZ-xh0T1rTTyJ7SDN-Myk8Y,7112
 ccode/web/assets/xterm.js,sha256=FJA1ef9UZkzXL46GmeaWGmJywhhj7Bw7EYzcivXUqXI,488663
-ccoding-0.2.2.dist-info/METADATA,sha256=uqOhoUzG38ibC7m7nuarEN8OwOvahN-VC6L0jszTgQ4,18444
-ccoding-0.2.2.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-ccoding-0.2.2.dist-info/entry_points.txt,sha256=uxtngaM0Eazhs4dCpcQvAIVdQBRLJ_6u-BpN3pYaGrQ,125
-ccoding-0.2.2.dist-info/licenses/LICENSE,sha256=ghzeEUUCG5lu2DDgFe37bgLJk_0_Y6v-ulXwmYWjQ20,1065
-ccoding-0.2.2.dist-info/RECORD,,
+ccoding-0.2.4.dist-info/METADATA,sha256=l1dPEwJjue2Bv5sYIHhmRuCNCgc7DBL5y0fUtm4HH3k,19551
+ccoding-0.2.4.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+ccoding-0.2.4.dist-info/entry_points.txt,sha256=uxtngaM0Eazhs4dCpcQvAIVdQBRLJ_6u-BpN3pYaGrQ,125
+ccoding-0.2.4.dist-info/licenses/LICENSE,sha256=ghzeEUUCG5lu2DDgFe37bgLJk_0_Y6v-ulXwmYWjQ20,1065
+ccoding-0.2.4.dist-info/RECORD,,