#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""局域网遥控 · 中转服务器

作用：让**不在同一网络**的被控端和手表连上。

    手表 ──HTTPS──┐
                  ├──> Cloudflare 边缘 ──隧道──> cloudflared ──> 本程序 :8080
    被控端 ─HTTPS─┘

设计要点
--------
1. **盲转发**：本程序不认识上层协议，只按「配对码」把两条连接的字节流对上。
   配对、令牌校验、权限判断全部由被控端自己做 —— 所以就算这台中转机
   被攻破，也进不了用户的电脑。

2. **长轮询**（不是 WebSocket）：HTTP 长轮询在任何代理/4G 网络下都最稳，
   而且两端用标准库就能实现（被控端是 Python 标准库，手表是纯 Java 无依赖）。

3. **省内存**（这台机器只有 460MB）：
   * 队列用 deque(maxlen) 封顶，客户端不取就丢最旧的，绝不无限增长
   * 单条消息和整队都有字节上限
   * 线程按需创建，空闲就退出
   * 不引任何第三方库

接口
----
被控端：
    POST /v1/agent/register  {"deviceId","code","name","version"}  -> {"ok","token","code"}
    POST /v1/agent/poll      头 X-Token            -> 原始字节（长轮询，最多 25 秒）
    POST /v1/agent/send      头 X-Token，体=原始字节 -> {"ok"}
    POST /v1/agent/bye       头 X-Token            -> {"ok"}

控制端：
    POST /v1/client/attach   {"code","name"}       -> {"ok","session","deviceName","online"}
    POST /v1/client/poll     头 X-Session          -> 原始字节
    POST /v1/client/send     头 X-Session，体=原始字节 -> {"ok"}
    POST /v1/client/detach   头 X-Session          -> {"ok"}

公共：
    GET  /v1/health                                -> {"ok","devices","sessions",...}
    GET  /                 管理页（要 key）
"""

from __future__ import annotations

import json
import os
import re
import secrets
import socket
import sys
import threading
import time
import urllib.parse
import urllib.request
from collections import deque
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
from pathlib import Path

VERSION = "1.5.0"

# ---------------- 参数（都能用环境变量覆盖）----------------

PORT = int(os.environ.get("RELAY_PORT", "8080"))
BIND = os.environ.get("RELAY_BIND", "127.0.0.1")
DATA_DIR = Path(os.environ.get("RELAY_DATA", "/root/lanremote-relay"))

# 长轮询最多挂多久。太长会占着 Cloudflare 的连接，太短则空转请求多。
POLL_SECONDS = float(os.environ.get("RELAY_POLL", "25"))

# 单个设备最多缓多少字节没发出去。手表半天不取就丢最旧的，保住内存。
MAX_QUEUE_BYTES = int(os.environ.get("RELAY_QUEUE_BYTES",
                                     str(2 * 1024 * 1024)))
# 单次请求体上限（一个分块 256KB + JSON 外壳，给到 4MB 很宽松）
MAX_BODY = int(os.environ.get("RELAY_MAX_BODY", str(4 * 1024 * 1024)))

# 配对码：6 位数字（和手表上输的一致）
CODE_RE = re.compile(r"^\d{6}$")

# 设备多久没心跳算掉线
DEVICE_TIMEOUT = 90.0
# 一个设备最多同时挂几个手表会话
MAX_SESSIONS_PER_DEVICE = 3

# 防爆破：同一个 IP 每小时最多试几次配对码
ATTACH_LIMIT = int(os.environ.get("RELAY_ATTACH_LIMIT", "30"))
ATTACH_WINDOW = 3600.0

ADMIN_KEY = os.environ.get("RELAY_ADMIN_KEY", "")


def admin_key() -> str:
    """管理页 / 管理接口的钥匙。

    没配置就自动生成一个并记到 data/admin_key.txt。
    以前默认是空字符串，等于管理页谁都能打开 ——
    那上面能看到配对码，太不合适了。
    """
    global ADMIN_KEY
    if ADMIN_KEY:
        return ADMIN_KEY
    path = DATA_DIR / "admin_key.txt"
    try:
        if path.is_file():
            ADMIN_KEY = path.read_text(encoding="utf-8").strip()
        if not ADMIN_KEY:
            ADMIN_KEY = secrets.token_urlsafe(18)
            DATA_DIR.mkdir(parents=True, exist_ok=True)
            path.write_text(ADMIN_KEY, encoding="utf-8")
            try:
                os.chmod(path, 0o600)
            except OSError:
                pass
    except Exception:                                     # noqa: BLE001
        ADMIN_KEY = ADMIN_KEY or secrets.token_urlsafe(18)
    return ADMIN_KEY


# 管理页密码。用户指定的默认值，可以在 data/admin_password.txt 里改。
ADMIN_PASSWORD_DEFAULT = "120830"
ADMIN_PASSWORD = os.environ.get("RELAY_ADMIN_PASSWORD", "")
# 登录会话：cookie 令牌 -> 过期时间
# 成品下载目录（管理页上给人下载 APK / 整包用）。
# 只放白名单后缀的文件，文件名做严格校验防目录穿越。
DOWNLOADS_DIR = Path(__file__).resolve().parent / "downloads"
DOWNLOAD_SUFFIXES = (".apk", ".zip", ".txt", ".exe", ".idsig")


def _safe_download_name(name: str) -> str:
    """校验下载文件名。不合法返回空串。

    防目录穿越：只允许字母数字、点、横线、下划线、中文，
    且必须是白名单后缀。
    """
    name = (name or "").strip()
    if not name or len(name) > 120:
        return ""
    if "/" in name or "\\" in name or ".." in name:
        return ""
    if not name.lower().endswith(DOWNLOAD_SUFFIXES):
        return ""
    for ch in name:
        if ch.isalnum() or ch in "._-（）() 　":
            continue
        return ""
    return name


def _list_downloads() -> list:
    """列出可下载的文件（按修改时间倒序）。"""
    items = []
    try:
        if not DOWNLOADS_DIR.is_dir():
            return items
        for entry in DOWNLOADS_DIR.iterdir():
            if not entry.is_file():
                continue
            if not _safe_download_name(entry.name):
                continue
            stat = entry.stat()
            items.append({
                "name": entry.name,
                "size": stat.st_size,
                "mtime": stat.st_mtime,
            })
    except OSError:
        return items
    items.sort(key=lambda item: item["mtime"], reverse=True)
    return items

ADMIN_SESSIONS: dict = {}
ADMIN_SESSION_SECONDS = 12 * 3600


def admin_password() -> str:
    global ADMIN_PASSWORD
    if ADMIN_PASSWORD:
        return ADMIN_PASSWORD
    path = DATA_DIR / "admin_password.txt"
    try:
        if path.is_file():
            ADMIN_PASSWORD = path.read_text(encoding="utf-8").strip()
        if not ADMIN_PASSWORD:
            ADMIN_PASSWORD = ADMIN_PASSWORD_DEFAULT
            DATA_DIR.mkdir(parents=True, exist_ok=True)
            path.write_text(ADMIN_PASSWORD, encoding="utf-8")
            try:
                os.chmod(path, 0o600)
            except OSError:
                pass
    except Exception:                                     # noqa: BLE001
        ADMIN_PASSWORD = ADMIN_PASSWORD or ADMIN_PASSWORD_DEFAULT
    return ADMIN_PASSWORD


def admin_login(password: str) -> str:
    """验密码，对了就发一个会话令牌。"""
    if not password or not secrets.compare_digest(password, admin_password()):
        return ""
    token = secrets.token_urlsafe(24)
    now = time.time()
    # 顺手清掉过期的，别让字典涨
    for old, expiry in list(ADMIN_SESSIONS.items()):
        if expiry < now:
            ADMIN_SESSIONS.pop(old, None)
    ADMIN_SESSIONS[token] = now + ADMIN_SESSION_SECONDS
    return token


def admin_session_valid(token: str) -> bool:
    if not token:
        return False
    expiry = ADMIN_SESSIONS.get(token)
    if expiry is None:
        return False
    if expiry < time.time():
        ADMIN_SESSIONS.pop(token, None)
        return False
    return True


def admin_ok(supplied: str) -> bool:
    """命令行/脚本用的通道：钥匙或者密码，常数时间比较。"""
    if not supplied:
        return False
    if secrets.compare_digest(supplied, admin_key()):
        return True
    return secrets.compare_digest(supplied, admin_password())


def public_url() -> str:
    """当前隧道的公网地址。

    隧道换地址时会写进 public_url.txt（tunnel-run.sh 负责维护）。
    这里几个可能的位置都找一下，找到第一个像地址的就返回。
    """
    candidates = [
        DATA_DIR.parent / "public_url.txt",
        DATA_DIR / "public_url.txt",
        Path("/root/lanremote-relay/public_url.txt"),
    ]
    for path in candidates:
        try:
            if not path.is_file():
                continue
            text = path.read_text(encoding="utf-8").strip()
            if text.startswith("http"):
                return text
        except OSError:
            continue
    return ""


def log(message: str) -> None:
    stamp = time.strftime("%m-%d %H:%M:%S")
    print(f"[{stamp}] {message}", flush=True)


# ======================================================================
# 数据
# ======================================================================

class Device:
    """一台被控端。"""

    __slots__ = ("device_id", "code", "name", "version", "token",
                 "last_seen", "connected_at", "to_client", "to_agent",
                 "event", "bytes_in", "bytes_out", "current_session",
                 "active_session", "lan_ips", "port")

    def __init__(self, device_id: str, code: str, name: str,
                 version: str = "") -> None:
        self.device_id = device_id
        self.code = code
        self.name = name
        self.version = version
        self.token = secrets.token_hex(24)
        # 这台电脑的局域网 IP 和监听端口。
        # 手表拿它判断"要不要切成局域网直连"。
        self.lan_ips: list = []
        self.port: int = 0
        self.last_seen = time.time()
        self.connected_at = time.time()
        self.to_client = bytearray()          # 被控端 -> 手表
        self.to_agent = bytearray()           # 手表 -> 被控端
        self.event = threading.Event()        # 有新数据时唤醒长轮询
        self.bytes_in = 0
        self.bytes_out = 0
        # 当前挂在这台设备上的手表会话令牌。变了就说明手表换了一台/重连了，
        # 被控端据此重开一条会话，避免把上一条的状态带过来。
        self.current_session = ""
        # 当前挂在这台设备上的 Session 对象。数据来了只唤醒它，
        # 不要让已经被顶掉的旧会话把数据截胡。
        self.active_session = None

    def online(self) -> bool:
        return (time.time() - self.last_seen) < DEVICE_TIMEOUT

    def push_to_agent(self, data: bytes) -> None:
        if not data:
            return
        self.bytes_in += len(data)
        self._append(self.to_agent, data)
        self.event.set()

    def push_to_client(self, data: bytes) -> None:
        if not data:
            return
        self.bytes_out += len(data)
        self._append(self.to_client, data)
        self.event.set()
        # 同时叫醒当前那个会话的长轮询（旧会话已经被替换，不该再拿数据）
        session = self.active_session
        if session is not None:
            session.event.set()

    @staticmethod
    def _append(buffer: bytearray, data: bytes) -> None:
        """往队列里塞数据，超上限就丢最旧的 —— 内存优先。"""
        buffer.extend(data)
        overflow = len(buffer) - MAX_QUEUE_BYTES
        if overflow > 0:
            del buffer[:overflow]


class Session:
    """一个手表连接。"""

    __slots__ = ("token", "device_id", "code", "name", "ip",
                 "created", "last_seen", "event", "replaced")

    def __init__(self, device_id: str, code: str, name: str, ip: str) -> None:
        self.token = secrets.token_hex(24)
        self.device_id = device_id
        self.code = code
        self.name = name
        self.ip = ip
        self.created = time.time()
        self.last_seen = time.time()
        # 自己的唤醒事件。每个会话独立等待，避免被顶掉的旧会话截胡数据。
        self.event = threading.Event()
        self.replaced = False


class SessionReplaced(Exception):
    """这个会话已经被新的手表顶替了 —— 它必须让位，不能继续取数据。"""


class Relay:
    def __init__(self) -> None:
        self.lock = threading.RLock()
        self.devices: dict = {}            # device_id -> Device
        self.codes: dict = {}              # code -> device_id
        self.sessions: dict = {}           # session_token -> Session
        self.attach_log: dict = {}         # ip -> [时间戳]
        # 被新连接顶替掉的会话：token -> 原因。
        # 留着是为了能明确告诉旧客户端"你是被顶掉的"，
        # 而不是含糊的 401 —— 否则它会以为自己只是过期了，然后抢回来。
        self.retired: dict = {}
        self.started = time.time()
        self.total_requests = 0
        self.state_file = DATA_DIR / "relay_state.json"
        self._load()

    # ---------------- 持久化（只存配对码，恢复单设备单配对码制）--------

    def _load(self) -> None:
        try:
            raw = json.loads(self.state_file.read_text(encoding="utf-8"))
        except Exception:                                 # noqa: BLE001
            return
        for item in raw.get("codes", []):
            device_id = str(item.get("deviceId", ""))
            code = str(item.get("code", ""))
            if device_id and CODE_RE.match(code):
                self.codes[code] = device_id
                log(f"恢复配对码绑定：设备 {device_id[:12]}… -> {code}")

    def _save(self) -> None:
        try:
            DATA_DIR.mkdir(parents=True, exist_ok=True)
            payload = {"codes": [
                {"deviceId": did, "code": code}
                for code, did in sorted(self.codes.items())
            ]}
            tmp = self.state_file.with_suffix(".tmp")
            tmp.write_text(json.dumps(payload, ensure_ascii=False, indent=2),
                           encoding="utf-8")
            tmp.replace(self.state_file)
        except Exception as exc:                          # noqa: BLE001
            log(f"保存状态失败：{exc}")

    # ---------------- 被控端 ----------------

    def register(self, body: dict) -> dict:
        """被控端上线登记。

        **单设备单配对码制**：
          * 一台设备第一次来 -> 记下它报的码
          * 同一台设备（deviceId 一样）以后再来 -> 一律用它**原来那个码**，
            它要是报了别的码，告诉它用旧的
          * 一个码不能同时属于两台设备 -> 拒绝
        """
        device_id = str(body.get("deviceId") or "").strip()
        code = str(body.get("code") or "").strip()
        name = str(body.get("name") or "").strip()[:40] or "未命名设备"
        version = str(body.get("version") or "").strip()[:20]
        # 这台电脑的局域网 IP + 端口（手表判断要不要走局域网直连）
        raw_ips = body.get("lanIps")
        lan_ips = []
        if isinstance(raw_ips, list):
            for item in raw_ips[:8]:
                text = str(item).strip()
                # 只收看起来像 IPv4 的，别把乱七八糟的东西转给手表
                parts = text.split(".")
                if len(parts) == 4 and all(
                        p.isdigit() and 0 <= int(p) <= 255 for p in parts):
                    lan_ips.append(text)
        try:
            listen_port = int(body.get("port") or 0)
        except (TypeError, ValueError):
            listen_port = 0
        if not (0 < listen_port < 65536):
            listen_port = 0

        if not device_id or len(device_id) > 80:
            return {"ok": False, "error": "deviceId 不合法"}
        if not CODE_RE.match(code):
            return {"ok": False, "error": "配对码必须是 6 位数字"}

        with self.lock:
            known = self.codes.get(code)
            if known and known != device_id:
                # codeTaken 让客户端能精确识别这种冲突，
                # 不用去匹配中文错误文案（文案一改就坏）。
                log(f"配对码 {code} 已被 {known} 占用，拒绝 {device_id}")
                return {"ok": False,
                        "codeTaken": True,
                        "error": "该配对码已被使用，请换一个配对码"}

            # 这台设备以前配过码吗？
            old_code = None
            for existing_code, existing_device in self.codes.items():
                if existing_device == device_id:
                    old_code = existing_code
                    break

            if old_code and old_code != code:
                log(f"设备 {name} 报了新码 {code}，按单设备单码制改回 {old_code}")
                code = old_code

            self.codes[code] = device_id
            device = self.devices.get(device_id)
            if device is None:
                device = Device(device_id, code, name, version)
                self.devices[device_id] = device
            else:
                device.code = code
                device.name = name
                device.version = version
                device.token = secrets.token_hex(24)
                device.last_seen = time.time()
            # 每次登记都刷新局域网信息（IP 可能变，端口也可能改）
            device.lan_ips = lan_ips
            device.port = listen_port
            self._save()
            log(f"被控端上线：{name}  码 {code}  ({device_id[:12]}…)")

            note = ""
            if old_code and old_code != str(body.get("code") or "").strip():
                note = (f"这台设备之前设过配对码 {old_code}，"
                        f"已按「单设备单配对码」沿用它")
            return {"ok": True, "token": device.token, "code": code,
                    "note": note, "pollSeconds": POLL_SECONDS}

    def device_by_token(self, token: str) -> Device | None:
        if not token:
            return None
        with self.lock:
            for device in self.devices.values():
                if secrets.compare_digest(device.token, token):
                    return device
        return None

    # ---------------- 控制端 ----------------

    def attach(self, body: dict, ip: str) -> dict:
        code = str(body.get("code") or "").strip()
        name = str(body.get("name") or "").strip()[:40] or "手表"

        if not CODE_RE.match(code):
            return {"ok": False, "error": "配对码要是 6 位数字"}

        with self.lock:
            now = time.time()
            hits = [t for t in self.attach_log.get(ip, [])
                    if now - t < ATTACH_WINDOW]
            if len(hits) >= ATTACH_LIMIT:
                wait = int(ATTACH_WINDOW - (now - hits[0]))
                log(f"配对尝试过多：{ip}")
                return {"ok": False,
                        "error": f"尝试次数过多，请等 {wait} 秒"}
            hits.append(now)
            self.attach_log[ip] = hits

            device_id = self.codes.get(code)
            if not device_id:
                return {"ok": False, "error": "没有设备在用这个配对码",
                        "needPair": True}
            device = self.devices.get(device_id)
            if device is None or not device.online():
                return {"ok": False, "error": "设备不在线", "offline": True,
                        "deviceName": device.name if device else ""}

            # 一台设备同时只留一个手表会话。
            # （之前留 3 个，但被控端只有一条到中转的流，分不清哪段字节
            #   属于哪个手表 —— 所以这里改成新的来了就踢旧的。）
            for stale_token, stale in list(self.sessions.items()):
                if stale.device_id == device_id:
                    self.sessions.pop(stale_token, None)
                    self.retired[stale_token] = "replaced"
                    stale.replaced = True
                    # 立刻叫醒它挂着的长轮询 —— 否则它会一直等下去，
                    # 等新数据来时把本该给新手表的数据抢走。
                    stale.event.set()
                    log(f"踢掉旧会话 {stale_token[:8]}…（同一设备只允许一个）")
            # 清掉太老的顶替记录，别让字典涨
            if len(self.retired) > 200:
                for old_token in list(self.retired)[:100]:
                    self.retired.pop(old_token, None)

            session = Session(device_id, code, name, ip)
            self.sessions[session.token] = session
            device.current_session = session.token
            device.active_session = session
            # 换会话了：把上一条留在队列里的半截数据清掉，
            # 不然新手表会收到上一个手表没取走的残留字节。
            device.to_client.clear()
            log(f"手表接入：{name} ({ip}) -> {device.name}")
            return {"ok": True, "session": session.token,
                    "deviceName": device.name, "online": True,
                    # 手表拿这两个判断"是不是和电脑在同一个网络"，
                    # 是的话就切成局域网直连（快得多）。
                    "lanIps": list(device.lan_ips),
                    "port": device.port,
                    "pollSeconds": POLL_SECONDS}

    def session_by_token(self, token: str) -> Session | None:
        if not token:
            return None
        with self.lock:
            session = self.sessions.get(token)
            if session is None:
                return None
            session.last_seen = time.time()
            return session

    def session_replaced(self, token: str) -> bool:
        """这个令牌是不是「被新连接顶掉」的（而不是过期/不存在）。"""
        if not token:
            return False
        with self.lock:
            return self.retired.get(token) == "replaced"

    # ---------------- 收发 ----------------

    def agent_take(self, device: Device, wait: float) -> bytes:
        """被控端取走「手表发来的」数据；没有就挂着等。"""
        return self._take(device, device.to_agent, wait, "agent")

    def agent_put(self, device: Device, data: bytes) -> None:
        """被控端把「要发给手表」的数据放进来。"""
        device.push_to_client(data)

    def client_take(self, session: Session, wait: float) -> bytes:
        """手表取走「被控端发来的」数据。

        注意这里**不能**复用 _take：那个是按设备的事件等的，
        会把被顶掉的旧会话和新会话混在一起等，导致数据被旧会话截胡。
        每个会话等自己的 event，并且每轮先看自己是不是已经被顶替了。
        """
        deadline = time.time() + wait
        while True:
            if session.replaced:
                raise SessionReplaced()
            with self.lock:
                device = self.devices.get(session.device_id)
                if device is None:
                    return b""
                if device.to_client:
                    data = bytes(device.to_client)
                    device.to_client.clear()
                    device.event.clear()
                    session.event.clear()
                    return data
            remaining = deadline - time.time()
            if remaining <= 0:
                return b""
            session.event.wait(min(remaining, 0.5))
            session.event.clear()

    def client_put(self, session: Session, data: bytes) -> None:
        """手表把「要发给被控端」的数据放进来。"""
        with self.lock:
            device = self.devices.get(session.device_id)
        if device is not None:
            device.push_to_agent(data)

    def _take(self, device: Device, buffer: bytearray, wait: float,
              who: str) -> bytes:
        """从队列里取数据。空了就等，最多 wait 秒。

        用 device.event 做唤醒：另一端 push 时会 set()，这里立刻醒来，
        不用轮询 —— 省 CPU，这台机器只有 4 个核还要跑 4G 模块。
        """
        deadline = time.time() + wait
        while True:
            if who == "agent":
                device.last_seen = time.time()
            with self.lock:
                if buffer:
                    data = bytes(buffer)
                    buffer.clear()
                    device.event.clear()
                    return data
            remaining = deadline - time.time()
            if remaining <= 0:
                if who == "agent":
                    device.last_seen = time.time()
                return b""
            device.event.wait(min(remaining, 1.0))
            device.event.clear()

    # ---------------- 统计 / 管理 ----------------

    def snapshot(self) -> dict:
        with self.lock:
            now = time.time()
            devices = []
            for device in self.devices.values():
                sessions = [s for s in self.sessions.values()
                            if s.device_id == device.device_id]
                devices.append({
                    "deviceId": device.device_id,
                    "code": device.code,
                    "name": device.name,
                    # 手表用这两个判断能不能走局域网直连
                    "lanIps": list(device.lan_ips),
                    "port": device.port,
                    "version": device.version,
                    "online": device.online(),
                    "idleSeconds": int(now - device.last_seen),
                    "sessions": len(sessions),
                    "queuedToClient": len(device.to_client),
                    "queuedToAgent": len(device.to_agent),
                    "bytesIn": device.bytes_in,
                    "bytesOut": device.bytes_out,
                })
            devices.sort(key=lambda d: d["name"])
            return {
                "ok": True,
                "version": VERSION,
                "uptimeSeconds": int(now - self.started),
                "devices": devices,
                "sessions": len(self.sessions),
                "totalRequests": self.total_requests,
                "memoryKB": _rss_kb(),
            }

    def kick(self, device_id: str) -> int:
        with self.lock:
            gone = [t for t, s in self.sessions.items()
                    if s.device_id == device_id]
            for token in gone:
                self.sessions.pop(token, None)
            device = self.devices.get(device_id)
            if device is not None:
                device.to_agent.clear()
                device.to_client.clear()
                device.last_seen = 0        # 标成掉线，逼它重连
            return len(gone)

    def delete_device(self, *, device_id: str = "", code: str = "") -> dict:
        """删掉一台设备，**连同它的配对码绑定和所有会话**。

        这就是管理页上「删除设备」按钮做的事。
        和 kick/forget 的区别：
            kick    只踢会话，设备还在，码还占着
            forget  只抹码绑定，设备还挂在列表上
            delete  三样一起清 —— 那台设备下次可以重新设任意配对码

        返回做了什么，便于界面显示。
        """
        target = None
        with self.lock:
            if device_id:
                target = self.devices.get(device_id)
            if target is None and code:
                owner = self.codes.get(code)
                if owner:
                    target = self.devices.get(owner)
                    device_id = owner
        if target is None:
            return {"ok": False, "error": "找不到这台设备"}

        removed_sessions = self.kick(target.device_id)

        with self.lock:
            self.devices.pop(target.device_id, None)
            # 把它的码绑定一起删掉
            gone_codes = [c for c, owner in list(self.codes.items())
                          if owner == target.device_id]
            for item in gone_codes:
                self.codes.pop(item, None)
            # 清掉可能残留的会话记录
            for token in list(getattr(self, "sessions", {}).keys()):
                self.sessions.pop(token, None)
            self._save()

        log(f"管理操作：删除设备 {target.name}（码 {target.code}），"
            f"踢掉 {removed_sessions} 个会话，清掉 {len(gone_codes)} 条码绑定")
        return {
            "ok": True,
            "deleted": target.device_id,
            "name": target.name,
            "code": target.code,
            "kicked": removed_sessions,
            "codesCleared": gone_codes,
        }

    def forget(self, code: str) -> bool:
        """抹掉一个配对码绑定（让那台设备下次可以设新码）。"""
        with self.lock:
            device_id = self.codes.pop(code, None)
            if not device_id:
                return False
            device = self.devices.get(device_id)
            if device is not None:
                self.devices.pop(device_id, None)
            self._save()
            return True


def _rss_kb() -> int:
    """自己占了多少内存（KB）。省内存的项目得能看见自己吃多少。"""
    try:
        with open("/proc/self/status", encoding="utf-8") as handle:
            for line in handle:
                if line.startswith("VmRSS:"):
                    return int(line.split()[1])
    except Exception:                                     # noqa: BLE001
        pass
    return 0


RELAY = Relay()


# ======================================================================
# HTTP 层
# ======================================================================

def _query(url: str, name: str) -> str:
    """从 URL 里取一个查询参数（不引 urllib，省内存）。"""
    if "?" not in url:
        return ""
    try:
        from urllib.parse import parse_qs
        values = parse_qs(url.split("?", 1)[1]).get(name) or []
        return values[0] if values else ""
    except Exception:                                     # noqa: BLE001
        return ""


def _login_page(message: str = "") -> bytes:
    """管理页登录页（输密码，不再是 URL 里带钥匙）。"""
    notice = ('<p class="bad">' + message + '</p>') if message else ''
    html = """<!doctype html><html lang=zh><meta charset=utf-8>
<meta name=viewport content="width=device-width,initial-scale=1">
<title>中转服务器 · 登录</title>
<style>
 body{font:14px/1.6 -apple-system,'Microsoft YaHei',sans-serif;
      background:#0f1117;color:#e6edf3;display:flex;align-items:center;
      justify-content:center;height:100vh;margin:0}
 .box{background:#161b22;border:1px solid #30363d;border-radius:12px;
      padding:28px 32px;width:320px}
 h1{font-size:17px;margin:0 0 4px}
 .sub{color:#8b949e;font-size:12px;margin-bottom:18px}
 input{width:100%;box-sizing:border-box;background:#0d1117;color:#e6edf3;
      border:1px solid #30363d;border-radius:7px;padding:9px 11px;font-size:15px}
 input:focus{outline:none;border-color:#1f6feb}
 button{width:100%;margin-top:14px;background:#1f6feb;color:#fff;border:0;
      border-radius:7px;padding:10px;font-size:14px;cursor:pointer}
 button:hover{background:#388bfd}
 .bad{color:#f85149;font-size:12px;margin:10px 0 0}
 .foot{color:#6e7681;font-size:11px;margin-top:16px;text-align:center}
</style>
<div class=box>
<h1>中转服务器</h1>
<div class=sub>局域网遥控 · 管理后台</div>
<form method=post action=/admin/login>
  <input type=password name=password placeholder=管理密码 autofocus
         autocomplete=current-password>
  <button type=submit>登 录</button>
</form>
""" + notice + """
<div class=foot>只显示设备与流量，看不到任何传输内容</div>
</div></html>"""
    return html.encode("utf-8")


class Handler(BaseHTTPRequestHandler):
    protocol_version = "HTTP/1.1"
    server_version = f"LanRemoteRelay/{VERSION}"

    # 关掉逐条访问日志 —— 4G 机器上写日志很费
    def log_message(self, fmt, *args):                    # noqa: A003
        pass

    # ---------------- 小工具 ----------------

    def _send(self, code: int, body: bytes = b"",
              content_type: str = "application/json",
              extra: dict | None = None) -> None:
        self.send_response(code)
        self.send_header("Content-Type", content_type)
        self.send_header("Content-Length", str(len(body)))
        self.send_header("Cache-Control", "no-store")
        for name, value in (extra or {}).items():
            self.send_header(name, value)
        self.end_headers()
        if body:
            try:
                self.wfile.write(body)
            except (BrokenPipeError, ConnectionResetError):
                pass

    def _json(self, code: int, payload: dict) -> None:
        self._send(code, json.dumps(payload, ensure_ascii=False).encode("utf-8"))

    def _body(self) -> bytes:
        """读请求体。支持 Content-Length 和 chunked 两种。

        为什么必须支持 chunked：
            Cloudflare 转发时如果拿不到原始 Content-Length，
            就会用 Transfer-Encoding: chunked。
            而 Python 的 BaseHTTPRequestHandler **不会**自动解码 chunked。
            不读走的话，残留的 "0\r\n\r\n" 会被当成下一个请求行，
            报 "Bad request syntax ('0')"，整条连接错位 ——
            表现就是隧道那边不停 502/530，可用率上不去。
        """
        transfer = (self.headers.get("Transfer-Encoding") or "").lower()
        if "chunked" in transfer:
            return self._body_chunked()
        try:
            length = int(self.headers.get("Content-Length") or 0)
        except ValueError:
            return b""
        if length <= 0:
            return b""
        if length > MAX_BODY:
            # 超限也要读掉，否则残留数据同样会污染下一条请求
            self._drain(length)
            return b""
        return self._read_exact(length)

    def _read_exact(self, length: int) -> bytes:
        """保证读满 length 字节（rfile.read 在慢连接上可能读不满）。"""
        chunks = []
        remaining = length
        while remaining > 0:
            piece = self.rfile.read(remaining)
            if not piece:
                break
            chunks.append(piece)
            remaining -= len(piece)
        return b"".join(chunks)

    def _drain(self, length: int) -> None:
        """把多余的请求体读掉丢弃，避免污染下一个请求。"""
        remaining = min(length, MAX_BODY * 2)
        while remaining > 0:
            piece = self.rfile.read(min(remaining, 65536))
            if not piece:
                break
            remaining -= len(piece)

    def _body_chunked(self) -> bytes:
        """按 RFC 7230 解码 chunked 请求体。

        注意最后那个 0 长度的 chunk 后面还有一段 trailer（通常为空），
        一定要读掉 —— 残留就是 "Bad request syntax ('0')" 的来源。
        """
        data = bytearray()
        while True:
            line = self.rfile.readline(256)
            if not line:
                break
            line = line.strip()
            if not line:
                continue
            size_text = line.split(b";")[0].strip()
            try:
                size = int(size_text, 16)
            except ValueError:
                break
            if size <= 0:
                # 末尾 trailer：读到空行为止
                while True:
                    trailer = self.rfile.readline(256)
                    if not trailer or trailer.strip() == b"":
                        break
                break
            if len(data) + size > MAX_BODY:
                self._drain(size + 2)
                break
            data += self._read_exact(size)
            self.rfile.readline(8)          # 每个 chunk 结尾的 CRLF
        return bytes(data)

    def _json_body(self) -> dict:
        raw = self._body()
        if not raw:
            return {}
        try:
            value = json.loads(raw.decode("utf-8", "replace"))
            return value if isinstance(value, dict) else {}
        except Exception:                                 # noqa: BLE001
            return {}

    def _redirect(self, location: str) -> None:
        self.send_response(302)
        self.send_header("Location", location)
        self.send_header("Content-Length", "0")
        self.end_headers()

    def _admin_cookie(self) -> str:
        """从 Cookie 里取管理会话令牌。"""
        raw = self.headers.get("Cookie") or ""
        for piece in raw.split(";"):
            name, _, value = piece.strip().partition("=")
            if name == "lr_admin":
                return value
        return ""

    def _admin_gate(self) -> bool:
        """管理页/管理接口的统一入口：Cookie 或 X-Admin 头。"""
        if admin_session_valid(self._admin_cookie()):
            return True
        return admin_ok(self.headers.get("X-Admin") or "")

    def _client_ip(self) -> str:
        # 走 Cloudflare，真实 IP 在 CF-Connecting-IP 里
        return (self.headers.get("CF-Connecting-IP")
                or self.headers.get("X-Forwarded-For", "").split(",")[0].strip()
                or self.client_address[0])

    # ---------------- 路由 ----------------

    def do_GET(self):                                     # noqa: N802
        RELAY.total_requests += 1
        path = self.path.split("?")[0]

        # 当前公网地址。故意不需要登录 ——
        # 地址本来就要填到手表里，不是秘密；而且隧道换地址时
        # 用户就是靠这个页面知道新地址的。
        if path in ("/url", "/v1/url"):
            url = public_url()
            body = (url or "（还没有地址，隧道可能没起来）") + "\n"
            self._send(200, body.encode("utf-8"),
                       "text/plain; charset=utf-8")
            return

        # 只读查询：这个配对码有没有被别的电脑占？
        # 安装时要"先检查再决定要不要改防火墙"，而检查不能真去注册
        # （一注册就等于自己占了它）。所以单独开一个只读接口。
        if path in ("/v1/code/check", "/v1/check"):
            query = urllib.parse.urlparse(self.path).query
            wanted = (urllib.parse.parse_qs(query).get("code") or [""])[0]
            wanted = wanted.strip()
            if not CODE_RE.match(wanted):
                self._json(400, {"ok": False, "error": "配对码要是 6 位数字"})
                return
            with RELAY.lock:
                owner = RELAY.codes.get(wanted)
                device = RELAY.devices.get(owner) if owner else None
            self._json(200, {
                "ok": True,
                "code": wanted,
                "taken": bool(owner),
                "deviceName": device.name if device else "",
                "online": bool(device and device.online()),
            })
            return

        # ---- 成品下载（挂在管理页上给人下 APK / 整包）----
        if path == "/v1/downloads":
            self._json(200, {"ok": True, "files": _list_downloads()})
            return

        if path.startswith("/download/"):
            wanted = urllib.parse.unquote(path[len("/download/"):])
            safe = _safe_download_name(wanted)
            if not safe:
                self._json(400, {"ok": False, "error": "文件名不合法"})
                return
            target = DOWNLOADS_DIR / safe
            if not target.is_file():
                self._json(404, {"ok": False, "error": "没有这个文件"})
                return
            try:
                size = target.stat().st_size
            except OSError as exc:
                self._json(500, {"ok": False, "error": f"读不到: {exc}"})
                return
            if safe.lower().endswith(".apk"):
                content_type = "application/vnd.android.package-archive"
            elif safe.lower().endswith(".zip"):
                content_type = "application/zip"
            elif safe.lower().endswith(".txt"):
                content_type = "text/plain; charset=utf-8"
            else:
                content_type = "application/octet-stream"
            self.send_response(200)
            self.send_header("Content-Type", content_type)
            self.send_header("Content-Length", str(size))
            # 文件名可能含中文，用 RFC 5987 编码
            quoted = urllib.parse.quote(safe)
            self.send_header(
                "Content-Disposition",
                f"attachment; filename*=UTF-8''{quoted}")
            self.send_header("Cache-Control", "no-store")
            self.end_headers()

            # 分块流式发送，不要一次性 read_bytes 再 write ——
            # 大文件（19MB）那样会先攒满内存、数据也迟迟不开始流动；
            # 而 Cloudflare 有 100 秒的源站响应上限，越晚开始发越容易被掐。
            sent = 0
            try:
                with target.open("rb") as stream:
                    while True:
                        chunk = stream.read(65536)
                        if not chunk:
                            break
                        self.wfile.write(chunk)
                        sent += len(chunk)
                self.wfile.flush()
            except (BrokenPipeError, ConnectionResetError):
                # 客户端/边缘主动断开（比如大文件超时），正常现象
                log(f"下载中断：{safe}（已发 {sent}/{size} 字节）")
                return
            except OSError as exc:
                log(f"下载出错：{safe}（已发 {sent}/{size} 字节）{exc}")
                return
            log(f"下载：{safe}（{sent} 字节）")
            return

        if path in ("/v1/health", "/health"):
            snap = RELAY.snapshot()
            snap["service"] = "lanremote-relay"
            self._json(200, snap)
            return

        # ---- 退出登录 ----
        if path == "/admin/logout":
            token = self._admin_cookie()
            ADMIN_SESSIONS.pop(token, None)
            self._send(302, b"", "text/html; charset=utf-8")
            # 手动补 Location 和清 Cookie
            return

        # ---- 管理接口（GET）----
        if path == "/v1/admin/netcheck":
            # 网络体检：中转和 cloudflared 在同一台机器上，
            # 所以能直接读它的指标，不用用户去 SSH 敲命令。
            if not self._admin_gate():
                self._json(401, {"ok": False, "error": "请先登录"})
                return
            info = {"ok": True}
            # --- cloudflared 的连接数等 ---
            try:
                request = urllib.request.Request(
                    "http://127.0.0.1:20241/metrics",
                    headers={"User-Agent": "LanRemoteRelay/1.0"})
                with urllib.request.urlopen(request, timeout=4) as response:
                    text = response.read(65536).decode("utf-8", "replace")
                wanted = {
                    "cloudflared_tunnel_ha_connections": "tunnelConnections",
                    "cloudflared_tunnel_total_requests": "tunnelRequests",
                    "cloudflared_tunnel_tcp_active_sessions":
                        "tunnelTcpSessions",
                }
                for line in text.splitlines():
                    if line.startswith("#"):
                        continue
                    parts = line.split()
                    if len(parts) < 2:
                        continue
                    key = wanted.get(parts[0])
                    if key:
                        try:
                            info[key] = int(float(parts[1]))
                        except ValueError:
                            pass
                info["tunnelMetrics"] = True
            except Exception as exc:                      # noqa: BLE001
                info["tunnelMetrics"] = False
                info["tunnelError"] = f"{type(exc).__name__}"
            # --- 自己这边的概况 ---
            snap = RELAY.snapshot()
            info["devices"] = len(snap["devices"])
            info["online"] = sum(1 for d in snap["devices"] if d["online"])
            info["sessions"] = snap["sessions"]
            info["memoryKB"] = snap["memoryKB"]
            info["uptimeSeconds"] = snap["uptimeSeconds"]
            info["publicUrl"] = public_url() or ""
            # --- 每条设备是不是从局域网来的 ---
            lan_devices = []
            for device in snap["devices"]:
                for ip in (device.get("lanIps") or []):
                    if ip:
                        lan_devices.append(ip)
                        break
            info["lanDevices"] = len(lan_devices)
            self._json(200, info)
            return

        if path.startswith("/v1/admin/"):
            if not self._admin_gate():
                self._json(401, {"ok": False, "error": "请先登录"})
                return
            if path == "/v1/admin/devices":
                self._json(200, RELAY.snapshot())
                return
            self._json(404, {"ok": False, "error": "没有这个管理接口"})
            return

        if path in ("/", "/admin"):
            # 管理页要登录 —— 上面会显示配对码，不能谁都能看
            if not self._admin_gate():
                self._send(200, _login_page(
                    "密码不对，再试一次" if _query(self.path, "bad") else ""
                ), "text/html; charset=utf-8")
                return
            self._admin_page()
            return

        self._json(404, {"ok": False, "error": "没有这个接口"})

    def do_POST(self):                                    # noqa: N802
        RELAY.total_requests += 1
        path = self.path.split("?")[0]

        try:
            self._route_post(path)
        except Exception as exc:                          # noqa: BLE001
            log(f"处理 {path} 出错：{exc}")
            self._json(500, {"ok": False, "error": "服务器内部错误"})

    def _route_post(self, path: str) -> None:
        # ---- 被控端 ----
        if path == "/v1/agent/register":
            result = RELAY.register(self._json_body())
            log(f"注册请求 -> ok={result.get('ok')}")
            self._json(200 if result.get("ok") else 400, result)
            return

        if path == "/v1/agent/poll":
            device = RELAY.device_by_token(self.headers.get("X-Token", ""))
            if device is None:
                self._json(401, {"ok": False, "error": "令牌无效"})
                return
            session_at_start = device.current_session
            data = RELAY.agent_take(device, POLL_SECONDS)
            self._send(200, data, "application/octet-stream",
                       extra={"X-Relay-Session": device.current_session or "-",
                              "X-Relay-Session-AtStart": session_at_start or "-"})
            return

        if path == "/v1/agent/send":
            device = RELAY.device_by_token(self.headers.get("X-Token", ""))
            if device is None:
                self._json(401, {"ok": False, "error": "令牌无效"})
                return
            data = self._body()
            RELAY.agent_put(device, data)
            self._json(200, {"ok": True, "queued": len(data)})
            return

        if path == "/v1/agent/bye":
            device = RELAY.device_by_token(self.headers.get("X-Token", ""))
            if device is not None:
                device.last_seen = 0
                device.current_session = ""
                log(f"被控端下线：{device.name}")
            self._json(200, {"ok": True})
            return

        # ---- 控制端 ----
        if path == "/v1/client/attach":
            result = RELAY.attach(self._json_body(), self._client_ip())
            self._json(200 if result.get("ok") else 403, result)
            return

        if path == "/v1/client/poll":
            token = self.headers.get("X-Session", "")
            session = RELAY.session_by_token(token)
            if session is None:
                if RELAY.session_replaced(token):
                    # 明确告诉它"你是被顶掉的"，客户端就不会抢回来了
                    self._json(409, {"ok": False, "replaced": True,
                                     "error": "已被另一台手表接管"})
                    return
                self._json(401, {"ok": False, "error": "会话无效"})
                return
            try:
                data = RELAY.client_take(session, POLL_SECONDS)
            except SessionReplaced:
                self._json(409, {"ok": False, "replaced": True,
                                 "error": "已被另一台手表接管"})
                return
            self._send(200, data, "application/octet-stream")
            return

        if path == "/v1/client/send":
            token = self.headers.get("X-Session", "")
            session = RELAY.session_by_token(token)
            if session is None:
                if RELAY.session_replaced(token):
                    self._json(409, {"ok": False, "replaced": True,
                                     "error": "已被另一台手表接管"})
                    return
                self._json(401, {"ok": False, "error": "会话无效"})
                return
            data = self._body()
            RELAY.client_put(session, data)
            self._json(200, {"ok": True, "queued": len(data)})
            return

        # ---- 登录 ----
        if path == "/admin/login":
            form = self._body().decode("utf-8", "replace")
            password = ""
            for piece in form.split("&"):
                name, _, value = piece.partition("=")
                if name == "password":
                    from urllib.parse import unquote_plus
                    password = unquote_plus(value)
            token = admin_login(password)
            if not token:
                log(f"管理页登录失败，来自 {self._client_ip()}")
                self._redirect("/?bad=1")
                return
            log(f"管理页登录成功，来自 {self._client_ip()}")
            self.send_response(302)
            self.send_header("Location", "/")
            self.send_header(
                "Set-Cookie",
                f"lr_admin={token}; Path=/; HttpOnly; SameSite=Lax; "
                f"Max-Age={ADMIN_SESSION_SECONDS}")
            self.send_header("Content-Length", "0")
            self.end_headers()
            return

        # ---- 管理接口（要登录）----
        if path.startswith("/v1/admin/"):
            if not self._admin_gate():
                self._json(401, {"ok": False, "error": "请先登录"})
                return

            if path == "/v1/admin/devices":
                self._json(200, RELAY.snapshot())
                return

            if path == "/v1/admin/kick":
                device_id = str(self._json_body().get("deviceId") or "")
                if not device_id:
                    self._json(400, {"ok": False, "error": "要给 deviceId"})
                    return
                gone = RELAY.kick(device_id)
                log(f"管理操作：踢掉 {device_id[:12]}… 的 {gone} 个会话")
                self._json(200, {"ok": True, "kicked": gone})
                return

            if path == "/v1/admin/delete_many":
                # 批量删除：勾几台删几台。
                # 和"删除全部"的区别是不动没勾的，也不清孤儿绑定。
                body = self._json_body()
                wanted = body.get("deviceIds") or []
                if not isinstance(wanted, list):
                    self._json(400, {"ok": False,
                                     "error": "deviceIds 要是数组"})
                    return
                wanted = [str(item).strip() for item in wanted if str(item).strip()]
                if not wanted:
                    self._json(400, {"ok": False, "error": "没有勾选任何设备"})
                    return
                results = [RELAY.delete_device(device_id=item)
                           for item in wanted]
                done = [r for r in results if r.get("ok")]
                failed = [r for r in results if not r.get("ok")]
                log(f"管理操作：批量删除 {len(done)}/{len(wanted)} 台设备")
                self._json(200, {
                    "ok": True,
                    "requested": len(wanted),
                    "deleted": len(done),
                    "failed": len(failed),
                    "devices": done,
                    "errors": failed[:10],
                })
                return

            if path in ("/v1/admin/delete", "/v1/admin/delete_all"):
                body = self._json_body()
                if path == "/v1/admin/delete_all":
                    # 一次删光（清场用）
                    with RELAY.lock:
                        all_ids = list(RELAY.devices.keys())
                    results = [RELAY.delete_device(device_id=item)
                               for item in all_ids]
                    done = [r for r in results if r.get("ok")]
                    # 还要清掉**孤儿绑定** —— 设备早就下线、但配对码
                    # 还占着的记录。不清的话，用户想用的码可能一直
                    # 被一台不存在的机器占着（"我的码怎么被占了"）。
                    with RELAY.lock:
                        orphans = list(RELAY.codes.items())
                        RELAY.codes.clear()
                        RELAY._save()
                    log(f"管理操作：清场 —— 删除 {len(done)} 台设备，"
                        f"清掉 {len(orphans)} 条配对码绑定（含孤儿）")
                    self._json(200, {"ok": True, "deleted": len(done),
                                     "orphansCleared": len(orphans),
                                     "devices": done})
                    return

                device = str(body.get("deviceId") or "").strip()
                code = str(body.get("code") or "").strip()
                if not device and not code:
                    self._json(400, {"ok": False,
                                     "error": "要给 deviceId 或 code"})
                    return
                result = RELAY.delete_device(device_id=device, code=code)
                self._json(200 if result.get("ok") else 404, result)
                return

            if path == "/v1/admin/forget":
                code = str(self._json_body().get("code") or "").strip()
                if not CODE_RE.match(code):
                    self._json(400, {"ok": False, "error": "配对码要是 6 位数字"})
                    return
                done = RELAY.forget(code)
                log(f"管理操作：抹掉配对码 {code} -> {done}")
                self._json(200, {"ok": True, "forgotten": done})
                return

            self._json(404, {"ok": False, "error": "没有这个管理接口"})
            return

        if path == "/v1/client/detach":
            session = RELAY.session_by_token(self.headers.get("X-Session", ""))
            if session is not None:
                relay_sessions = getattr(RELAY, "sessions", {})
                relay_sessions.pop(session.token, None)
                RELAY.retired.pop(session.token, None)
            self._json(200, {"ok": True})
            return

        self._json(404, {"ok": False, "error": "没有这个接口"})

    # ---------------- 管理页 ----------------

    def _admin_page(self) -> None:
        snap = RELAY.snapshot()
        rows = []
        for device in snap["devices"]:
            online = device["online"]
            badge = ("<span class='badge on'>在线</span>" if online
                     else "<span class='badge off'>离线</span>")
            rows.append(
                "<tr>"
                "<td class=pickcell>"
                f'<input type=checkbox class=pick value="{_esc(device["deviceId"])}">'
                "</td>"
                # data-l 是给窄屏用的：表格变成卡片时，
                # 每个值前面用 ::before 显示这个标签（见 CSS 的 @media）
                f'<td class=name data-l="设备">'
                f'<span class="dot {"on" if online else "off"}"></span>'
                f'<span class=v>{_esc(device["name"])}</span>'
                f'<div class=sub2>{_esc(device["deviceId"])}</div></td>'
                f'<td data-l="配对码"><span class=val>'
                f'<code>{_esc(device["code"])}</code></span></td>'
                f'<td data-l="状态"><span class=val>{badge}</span></td>'
                f'<td data-l="空闲"><span class=val>'
                f'{device["idleSeconds"]}s</span></td>'
                f'<td data-l="待发(表/机)"><span class=val>'
                f'{device["queuedToClient"]} / '
                f'{device["queuedToAgent"]}</span></td>'
                f'<td class=num data-l="流量(入/出)"><span class=val>'
                f'{_kb(device["bytesIn"])} / {_kb(device["bytesOut"])}'
                f'</span></td>'
                '<td class=ops><button class="btn del" '
                f'data-device="{_esc(device["deviceId"])}" '
                f'data-name="{_esc(device["name"])}" '
                f'data-code="{_esc(device["code"])}">删除</button></td>'
                "</tr>")

        online_count = sum(1 for d in snap["devices"] if d["online"])
        url_text = public_url() or ""
        url_display = _esc(url_text) if url_text else "（还没有地址，隧道可能没起来）"

        empty = ('<tr><td colspan=8 class=empty>'
                 '<div class=big>还没有电脑连上来</div>'
                 '<div>在被控端双击 ykxmz.exe 设好配对码，'
                 '手表上输那 6 位数字就能连上。</div></td></tr>')

        html = f"""<!doctype html><html lang=zh>
<meta charset=utf-8>
<meta name=viewport content="width=device-width,initial-scale=1">
<title>ykxmz 中转服务器</title>
<style>
 *{{box-sizing:border-box}}
 :root{{
   --bg:#0d1117; --panel:#161b22; --panel2:#1c2128; --border:#30363d;
   --fg:#e6edf3; --dim:#8b949e; --muted:#6e7681;
   --accent:#2f81f7; --ok:#3fb950; --danger:#f85149; --warn:#d29922;
 }}
 html,body{{max-width:100%;overflow-x:hidden}}
 body{{margin:0;padding:0;background:var(--bg);color:var(--fg);
   font:14px/1.6 -apple-system,BlinkMacSystemFont,'Segoe UI',
   'Microsoft YaHei',sans-serif;-webkit-font-smoothing:antialiased}}
 .wrap{{width:100%;max-width:1120px;margin:0 auto;padding:22px 20px 40px}}

 /* ---------- 头部 ---------- */
 header{{display:flex;align-items:center;gap:12px;
   padding-bottom:16px;border-bottom:1px solid var(--border);
   margin-bottom:20px;flex-wrap:wrap}}
 .logo{{width:38px;height:38px;border-radius:10px;flex:none;
   background:linear-gradient(140deg,#2f81f7,#1f6feb);
   display:flex;align-items:center;justify-content:center;
   font-weight:700;font-size:15px;color:#fff;letter-spacing:-.5px}}
 .brand h1{{margin:0;font-size:17px;font-weight:600;letter-spacing:.2px}}
 .brand .sub{{color:var(--dim);font-size:12px}}
 .meta{{margin-left:auto;text-align:right;color:var(--muted);font-size:12px;
   line-height:1.5}}
 .meta b{{color:var(--dim);font-weight:500}}
 .meta a.logout{{color:var(--dim);text-decoration:none;
   border-bottom:1px dashed #484f58;transition:.12s}}
 .meta a.logout:hover{{color:var(--accent);border-bottom-color:var(--accent)}}

 /* ---------- 通用卡片 ---------- */
 .panel{{background:var(--panel);border:1px solid var(--border);
   border-radius:12px;padding:16px 18px;margin-bottom:16px}}
 .panel .label{{color:var(--dim);font-size:12px;margin-bottom:8px;
   display:flex;align-items:center;gap:6px}}

 /* ---------- 公网地址 ---------- */
 .urlrow{{display:flex;align-items:center;gap:10px;flex-wrap:wrap}}
 .url{{flex:1;min-width:220px;font:600 15px/1.5 ui-monospace,Consolas,
   'Courier New',monospace;color:#79c0ff;word-break:break-all;
   background:#0b1220;border:1px solid #1f6feb44;border-radius:8px;
   padding:10px 12px}}
 .url.empty{{color:var(--muted);font-weight:400;font-style:normal}}

 /* ---------- 统计 ---------- */
 .stats{{display:grid;gap:12px;margin-bottom:16px;
   grid-template-columns:repeat(auto-fit,minmax(140px,1fr))}}
 .stat{{background:var(--panel);border:1px solid var(--border);
   border-radius:12px;padding:14px 16px;position:relative;overflow:hidden}}
 .stat .n{{font-size:26px;font-weight:650;line-height:1.15;
   letter-spacing:-.5px}}
 .stat .t{{color:var(--dim);font-size:12px;margin-top:2px}}
 .stat::after{{content:'';position:absolute;left:0;top:0;bottom:0;width:3px;
   background:var(--accent);opacity:.65}}
 .stat.ok::after{{background:var(--ok)}}
 .stat.warn::after{{background:var(--warn)}}
 .stat.mute::after{{background:#484f58}}

 /* ---------- 工具条 ---------- */
 .toolbar{{display:flex;align-items:center;gap:10px;flex-wrap:wrap;
   margin-bottom:12px}}
 .toolbar .spacer{{flex:1}}
 .tip{{color:var(--muted);font-size:12px}}

 /* ---------- 按钮 ---------- */
 button{{font-family:inherit;font-size:13px;cursor:pointer;
   border-radius:8px;padding:7px 14px;border:1px solid var(--border);
   background:var(--panel2);color:var(--fg);transition:.12s}}
 button:hover{{background:#262c36;border-color:#484f58}}
 button:active{{transform:translateY(1px)}}
 button:disabled{{opacity:.4;cursor:not-allowed;transform:none}}
 button.primary{{background:var(--accent);border-color:var(--accent);
   color:#fff;font-weight:600}}
 button.primary:hover{{background:#4a95f8;border-color:#4a95f8}}
 button.del{{background:#2d1214;border-color:#6e2b2b;color:#ff7b72}}
 button.del:hover{{background:#4a1a1e;border-color:#a33;color:#ffa198}}
 button.del:disabled{{opacity:.4}}
 button.small{{padding:5px 11px;font-size:12px}}

 /* ---------- 表格 ---------- */
 .tablewrap{{background:var(--panel);border:1px solid var(--border);
   border-radius:12px;overflow:hidden;max-width:100%}}
 table{{width:100%;max-width:100%;border-collapse:collapse;
   table-layout:fixed}}
 th,td{{padding:11px 14px;text-align:left;font-size:13px;
   border-bottom:1px solid #21262d;vertical-align:middle;
   overflow-wrap:anywhere;min-width:0}}
 th{{background:var(--panel2);color:var(--dim);font-weight:500;
   font-size:12px;white-space:nowrap}}
 tbody tr{{transition:background .1s}}
 tbody tr:hover td{{background:#1b222c}}
 tbody tr:last-child td{{border-bottom:none}}
 td.name{{font-weight:500}}
 td.num{{font-family:ui-monospace,Consolas,monospace;color:var(--dim);
   font-size:12px}}
 td.ops{{text-align:right;white-space:nowrap}}
 .sub2{{color:var(--muted);font-size:11px;font-weight:400;
   font-family:ui-monospace,Consolas,monospace;margin-top:1px}}
 .val{{min-width:0;overflow-wrap:anywhere;word-break:break-word}}
 td.empty{{text-align:center;padding:44px 20px;color:var(--dim)}}
 td.empty .big{{font-size:15px;color:var(--fg);margin-bottom:6px;font-weight:500}}
 code{{background:#21262d;padding:2px 8px;border-radius:6px;
   letter-spacing:1.5px;font-family:ui-monospace,Consolas,monospace;
   font-size:13px;color:#79c0ff}}
 .dot{{display:inline-block;width:7px;height:7px;border-radius:50%;
   margin-right:7px;vertical-align:middle;background:#484f58}}
 .dot.on{{background:var(--ok);box-shadow:0 0 0 3px #3fb95022}}
 .badge{{font-size:11px;padding:2px 8px;border-radius:20px;
   border:1px solid transparent;white-space:nowrap}}
 .badge.on{{color:var(--ok);background:#3fb9501a;border-color:#3fb95040}}
 .badge.off{{color:var(--muted);background:#6e76811a;border-color:#6e768140}}
 .pickcell{{width:38px;text-align:center;padding-right:0}}
 input[type=checkbox]{{width:15px;height:15px;cursor:pointer;
   accent-color:var(--accent);vertical-align:middle}}
 tr.picked td{{background:#1c2733}}
 tr.picked:hover td{{background:#213042}}

 /* ---------- 提示条 ---------- */
 #toast{{position:fixed;left:50%;bottom:26px;transform:translate(-50%,20px);
   background:#1f6feb;color:#fff;padding:11px 20px;border-radius:10px;
   font-size:13px;box-shadow:0 8px 24px #0008;opacity:0;
   transition:.22s;pointer-events:none;max-width:88vw;text-align:center}}
 #toast.show{{opacity:1;transform:translate(-50%,0)}}
 #toast.err{{background:#b62324}}
 #toast.ok{{background:#1a7f37}}

 footer{{color:var(--muted);font-size:12px;margin-top:22px;
   padding-top:14px;border-top:1px solid var(--border);line-height:1.7}}

 /* ---------- 窄屏：表格变卡片 ---------- */
 @media (max-width:720px){{
   .wrap{{padding:16px 12px 32px}}
   /* 从根上保证不会有东西超出容器。
      表格在窄屏变成卡片式，这几条必须写死，
      不然 table-layout:fixed 对 display:block 的行不起作用。 */
   table,tbody,tr,td{{display:block;width:100%;max-width:100%;
     box-sizing:border-box}}
   .meta{{margin-left:0;text-align:left;width:100%}}
   .stats{{grid-template-columns:repeat(2,minmax(0,1fr));gap:8px}}
   .stat{{padding:11px 13px}}
   .stat .n{{font-size:21px}}
   .urlrow{{flex-direction:column;align-items:stretch}}
   .url{{min-width:0;font-size:13px}}
   thead{{display:none}}
   tbody tr{{display:block;border-bottom:1px solid var(--border);
     padding:12px 14px 14px;position:relative}}
   tbody tr:last-child{{border-bottom:none}}
   /* 每个值一行：左边标签、右边值。
      min-width:0 + overflow-wrap 是关键 ——
      少了它，长配对码/流量会把容器撑破、右边的值被截掉。 */
   tbody td{{display:flex;justify-content:space-between;align-items:baseline;
     gap:14px;border:none;padding:3px 0;text-align:right;
     min-width:0;max-width:100%;overflow-wrap:anywhere;word-break:break-word}}
   tbody td .val{{flex:1 1 auto;min-width:0;text-align:right}}
   td.name{{display:block}}
   tbody td::before{{content:attr(data-l);color:var(--dim);font-size:12px;
     text-align:left;flex:none}}
   tbody td>*{{min-width:0}}
   /* 设备名占满整行，不参与"标签/值"那一套 */
   td.name{{display:block;text-align:left;padding:0 32px 8px 0}}
   td.name::before{{content:'';display:none}}
   td.name .v{{font-size:15px}}
   td.pickcell{{position:absolute;right:12px;top:12px;width:auto;
     padding:0;min-width:0}}
   td.pickcell::before{{content:'';display:none}}
   td.ops{{justify-content:flex-end;padding-top:10px;margin-top:4px;
     border-top:1px solid #21262d}}
   td.ops::before{{content:'';display:none}}
   td.empty{{display:block;text-align:center}}
   td.empty::before{{content:'';display:none}}
 }}
</style>

<div class=wrap>
 <header>
   <div class=logo>yx</div>
   <div class=brand>
     <h1>ykxmz 中转服务器</h1>
     <div class=sub>远程控制 · 跨网络中转</div>
   </div>
   <div class=meta>
     <div>版本 <b>{_esc(snap['version'])}</b> · 已运行 <b>{_uptime(snap['uptimeSeconds'])}</b></div>
     <div>本进程内存 <b>{snap['memoryKB'] // 1024} MB</b> · 累计请求 <b>{snap['totalRequests']}</b>
       · <a href="/admin/logout" class=logout>退出登录</a></div>
   </div>
 </header>

 <div class=panel>
   <div class=label>当前公网地址 —— 手表「中转设置」里填这个</div>
   <div class=urlrow>
     <div class="url{' empty' if not url_text else ''}" id=urlBox>{url_display}</div>
     <button class="btn primary" id=copyUrl {'disabled' if not url_text else ''}>复制</button>
   </div>
 </div>

 <div class=panel id=netPanel>
   <div class=label>网络体检 —— 走的是局域网还是隧道？</div>
   <div id=netBody class=tip>点下面按钮测一下</div>
   <div style="margin-top:10px">
     <button class="btn small" id=netBtn>测一下</button>
   </div>
 </div>

 <div class=panel id=dlPanel>
   <div class=label>下载最新版</div>
   <div id=dlBody class=tip>正在读…</div>
 </div>

 <div class=stats>
   <div class=stat><div class=n>{len(snap['devices'])}</div><div class=t>登记设备</div></div>
   <div class="stat {'ok' if online_count else 'mute'}"><div class=n>{online_count}</div><div class=t>在线</div></div>
   <div class="stat {'warn' if snap['sessions'] else 'mute'}"><div class=n>{snap['sessions']}</div><div class=t>手表会话</div></div>
   <div class=stat><div class=n>{len(RELAY.codes)}</div><div class=t>配对码占用</div></div>
 </div>

 <div class=toolbar>
   <button class="btn del" id=delPicked>删除选中</button>
   <button class="btn del" id=delAll>删除全部设备</button>
   <div class=spacer></div>
   <label class=tip style="cursor:pointer;display:flex;align-items:center;gap:6px">
     <input type=checkbox id=autoRef checked> 自动刷新（10 秒）
   </label>
 </div>
 <div class=tip style="margin:-4px 0 12px">
   删除会连配对码一起清掉，那台设备下次可以重新设码。
 </div>

 <div class=tablewrap>
  <table>
   <thead><tr>
     <th class=pickcell><input type=checkbox id=pickAll title="全选"></th>
     <th>设备</th><th>配对码</th><th>状态</th>
     <th>空闲</th><th>待发(表/机)</th><th>流量(入/出)</th><th></th>
   </tr></thead>
   <tbody>
   {''.join(rows) or empty}
   </tbody>
  </table>
 </div>

 <footer>
   数据来自 /v1/health · 只显示配对码与流量，看不到任何传输内容<br>
   中转只是转发字节，不解析、不存储会话内容。
 </footer>
</div>

<div id=toast></div>

<script>
const toast = (msg, kind) => {{
  const el = document.getElementById('toast');
  el.textContent = msg;
  el.className = kind ? ('show ' + kind) : 'show';
  clearTimeout(el._t);
  el._t = setTimeout(() => {{ el.className = ''; }}, 2600);
}};

const post = async (path, payload) => {{
  const r = await fetch(path, {{
    method: 'POST',
    headers: {{'Content-Type': 'application/json'}},
    body: JSON.stringify(payload || {{}})
  }});
  return r.json();
}};

// ---------------- 单台删除 ----------------
document.querySelectorAll('button.del[data-device]').forEach(b => {{
  b.onclick = async () => {{
    const name = b.dataset.name, code = b.dataset.code;
    if (!confirm('删除设备「' + name + '」（配对码 ' + code + '）？\\n\\n'
               + '这会：\\n  1. 断开它现在的手表连接\\n'
               + '  2. 从服务器删掉这台设备\\n'
               + '  3. 清掉它的配对码绑定')) return;
    try {{
      const j = await post('/v1/admin/delete', {{deviceId: b.dataset.device}});
      if (j.ok) {{
        toast('已删除「' + (j.name || name) + '」，清掉配对码 '
              + (j.codesCleared || []).length + ' 条', 'ok');
        setTimeout(() => location.reload(), 700);
      }} else {{
        toast('删除失败：' + (j.error || '未知错误'), 'err');
      }}
    }} catch (e) {{
      toast('请求出错：' + e, 'err');
    }}
  }};
}});

// ---------------- 批量选择 ----------------
const picks = () => Array.from(document.querySelectorAll('input.pick'));
const picked = () => picks().filter(c => c.checked).map(c => c.value);

function refreshPickState() {{
  const chosen = picked().length;
  const btn = document.getElementById('delPicked');
  if (btn) {{
    btn.disabled = chosen === 0;
    btn.textContent = chosen ? ('删除选中 (' + chosen + ')') : '删除选中';
  }}
  picks().forEach(c => {{
    const tr = c.closest('tr');
    if (tr) tr.classList.toggle('picked', c.checked);
  }});
  const all = document.getElementById('pickAll');
  if (all) {{
    const total = picks().length;
    all.checked = total > 0 && chosen === total;
    all.indeterminate = chosen > 0 && chosen < total;
  }}
}}

picks().forEach(c => c.addEventListener('change', refreshPickState));
const pickAll = document.getElementById('pickAll');
if (pickAll) pickAll.addEventListener('change', () => {{
  picks().forEach(c => {{ c.checked = pickAll.checked; }});
  refreshPickState();
}});
refreshPickState();

// ---------------- 批量删除 ----------------
const delPicked = document.getElementById('delPicked');
if (delPicked) delPicked.onclick = async () => {{
  const ids = picked();
  if (!ids.length) return;
  if (!confirm('删除选中的 ' + ids.length + ' 台设备？\\n\\n'
               + '会断开它们现在的手表连接，并清掉它们占的配对码。'))
    return;
  delPicked.disabled = true;
  try {{
    const j = await post('/v1/admin/delete_many', {{deviceIds: ids}});
    if (j.ok) {{
      toast('已删除 ' + j.deleted + ' 台设备'
            + (j.failed ? ('，' + j.failed + ' 台失败') : ''), 'ok');
      setTimeout(() => location.reload(), 700);
    }} else {{
      toast('删除失败：' + (j.error || '未知错误'), 'err');
      delPicked.disabled = false;
    }}
  }} catch (e) {{
    toast('请求出错：' + e, 'err');
    delPicked.disabled = false;
  }}
}};

// ---------------- 删除全部 ----------------
const delAll = document.getElementById('delAll');
if (delAll) delAll.onclick = async () => {{
  if (!confirm('删除**全部**设备（连同所有配对码）？\\n\\n'
             + '清场用，删完所有电脑都要重新设码。')) return;
  try {{
    const j = await post('/v1/admin/delete_all');
    toast('已删除 ' + (j.deleted || 0) + ' 台设备', 'ok');
    setTimeout(() => location.reload(), 700);
  }} catch (e) {{
    toast('请求出错：' + e, 'err');
  }}
}};

// ---------------- 复制公网地址 ----------------
const copyUrl = document.getElementById('copyUrl');
if (copyUrl) copyUrl.onclick = async () => {{
  const text = document.getElementById('urlBox').textContent.trim();
  try {{
    await navigator.clipboard.writeText(text);
    toast('地址已复制', 'ok');
  }} catch (e) {{
    // 非安全上下文（http 且不是 localhost）没有 clipboard API，
    // 退回到老办法：选中 + execCommand
    const range = document.createRange();
    range.selectNodeContents(document.getElementById('urlBox'));
    const sel = window.getSelection();
    sel.removeAllRanges();
    sel.addRange(range);
    try {{ document.execCommand('copy'); toast('地址已复制', 'ok'); }}
    catch (e2) {{ toast('复制失败，请手动选中', 'err'); }}
  }}
}};

// ---------------- 网络体检 ----------------
const netBtn = document.getElementById('netBtn');
if (netBtn) netBtn.onclick = async () => {{
  const body = document.getElementById('netBody');
  body.textContent = '正在测…';
  try {{
    const r = await fetch('/v1/admin/netcheck');
    const j = await r.json();
    if (!j.ok) {{
      body.innerHTML = '<span style="color:#f85149">读不到：'
        + (j.error || '未知') + '</span>';
      return;
    }}
    const rows = [];
    if (j.tunnelMetrics) {{
      const conns = j.tunnelConnections || 0;
      const color = conns >= 2 ? '#3fb950'
        : (conns === 1 ? '#d29922' : '#f85149');
      rows.push('隧道连接数：<b style="color:' + color + '">' + conns
        + '</b>' + (conns === 0 ? '（断了，看门狗会重启）' : ''));
      rows.push('隧道累计请求：' + (j.tunnelRequests || 0));
    }} else {{
      rows.push('<span style="color:#d29922">读不到隧道指标'
        + (j.tunnelError ? '（' + j.tunnelError + '）' : '') + '</span>');
    }}
    rows.push('登记设备：' + j.devices + '（在线 ' + j.online + '）');
    rows.push('手表会话：' + j.sessions);
    rows.push('中转内存：' + Math.round(j.memoryKB / 1024) + ' MB');
    rows.push('已运行：' + j.uptimeSeconds + ' 秒');
    if (j.publicUrl) {{
      rows.push('公网地址：<code style="letter-spacing:0">'
        + j.publicUrl + '</code>');
    }}
    body.innerHTML = rows.map(t => '<div style="margin:2px 0">' + t
      + '</div>').join('');
    // 顺便测一下这台机器的公网往返
    const t0 = performance.now();
    try {{
      await fetch('/v1/health?t=' + Date.now(), {{cache: 'no-store'}});
      const ms = Math.round(performance.now() - t0);
      body.innerHTML += '<div style="margin:2px 0">浏览器到中转往返：<b>'
        + ms + ' ms</b>'
        + (ms < 300 ? '（很顺）' : (ms < 1000 ? '（一般）' : '（有点慢）'))
        + '</div>';
    }} catch (e) {{
      body.innerHTML += '<div style="margin:2px 0;color:#f85149">'
        + '浏览器到中转：失败（' + e + '）</div>';
    }}
  }} catch (e) {{
    body.textContent = '请求出错：' + e;
  }}
}};

// ---------------- 下载（就一个链接）----------------
(async () => {{
  const body = document.getElementById('dlBody');
  if (!body) return;
  try {{
    const r = await fetch('/v1/downloads');
    const j = await r.json();
    const files = (j && j.files) || [];
    if (!files.length) {{
      body.innerHTML = '<span style="color:#8b949e">服务器上还没有成品。</span>';
      return;
    }}
    // 优先挑被控端整包；没有就挑第一个 zip；再没有就第一个
    const pick = files.find(f => /agent/i.test(f.name))
              || files.find(f => /\.zip$/i.test(f.name))
              || files[0];
    const mb = (pick.size / 1024 / 1024).toFixed(2);
    body.innerHTML =
      '<a href="/download/' + encodeURIComponent(pick.name) + '" '
      + 'style="display:inline-block;padding:10px 20px;border-radius:6px;'
      + 'background:#238636;color:#fff;text-decoration:none;'
      + 'font-weight:600;font-size:15px">'
      + '⬇ 下载 ' + pick.name + '</a>'
      + '<div style="color:#6e7681;font-size:12px;margin-top:8px">'
      + mb + ' MB · 也可以去 '
      + '<a href="https://gitee.com/xmz7891/ykxmz/releases" target="_blank" '
      + 'rel="noopener" style="color:#79c0ff">Gitee 历史版本</a>'
      + '</div>';
  }} catch (e) {{
    body.innerHTML = '<span style="color:#f85149">读不到：' + e + '</span>';
  }}
}})();

// ---------------- 自动刷新 ----------------
const autoRef = document.getElementById('autoRef');
let autoTimer = null;
function setupAuto() {{
  clearInterval(autoTimer);
  if (autoRef && autoRef.checked) {{
    autoTimer = setInterval(() => {{
      // 有勾选/删除操作进行中就先别刷新，免得打断
      if (picked().length === 0 && !document.hidden) location.reload();
    }}, 10000);
  }}
}}
if (autoRef) {{
  autoRef.addEventListener('change', () => {{
    try {{ localStorage.setItem('lr_autoref', autoRef.checked ? '1' : '0'); }}
    catch (e) {{}}
    setupAuto();
  }});
  try {{
    const saved = localStorage.getItem('lr_autoref');
    if (saved === '0') autoRef.checked = false;
  }} catch (e) {{}}
  setupAuto();
}}
</script>
</html>"""
        self._send(200, html.encode("utf-8"), "text/html; charset=utf-8")

def _esc(text) -> str:
    return (str(text).replace("&", "&amp;").replace("<", "&lt;")
            .replace(">", "&gt;").replace('"', "&quot;"))


def _kb(value: int) -> str:
    if value < 1024:
        return f"{value} B"
    if value < 1024 * 1024:
        return f"{value / 1024:.1f} KB"
    return f"{value / 1024 / 1024:.1f} MB"


def _uptime(seconds: int) -> str:
    days, rest = divmod(int(seconds), 86400)
    hours, rest = divmod(rest, 3600)
    minutes = rest // 60
    if days:
        return f"{days} 天 {hours} 小时"
    if hours:
        return f"{hours} 小时 {minutes} 分"
    return f"{minutes} 分"


# ======================================================================
# 启动
# ======================================================================

class Server(ThreadingHTTPServer):
    daemon_threads = True
    allow_reuse_address = True
    request_queue_size = 64


def main() -> int:
    DATA_DIR.mkdir(parents=True, exist_ok=True)
    try:
        server = Server((BIND, PORT), Handler)
    except OSError as exc:
        print(f"监听 {BIND}:{PORT} 失败：{exc}")
        return 1

    log(f"中转服务器 v{VERSION} 启动，监听 {BIND}:{PORT}")
    log(f"长轮询 {POLL_SECONDS:.0f} 秒 · 队列上限 "
        f"{MAX_QUEUE_BYTES // 1024} KB · 数据目录 {DATA_DIR}")
    key = admin_key()
    log(f"管理页：http://<本机>:{PORT}/?key={key}")
    log(f"（钥匙也在 {DATA_DIR / 'admin_key.txt'}）")

    try:
        server.serve_forever()
    except KeyboardInterrupt:
        log("收到中断，退出")
    finally:
        server.server_close()
    return 0


if __name__ == "__main__":
    sys.exit(main())