商业产业 Hacker News AI 2026-08-19T03:26 正文 ok 870 words

Show HN：随时随地通过任意设备控制家中旧电脑上的 AI Agent

英文标题：🔶 Show HN: Control AI Agents on Your Old PC at Home from Any Device Anywhere

Relay 是一个私有化、自托管的远程控制台，可让开发者从手机、Web 或桌面端操作运行在自己电脑上的 Claude Code、Codex、OpenCode 和 Hermes。项目采用 Flutter 客户端与 Node.js 后端架构，源代码、Shell 权限和 CLI 凭据均保留在用户自控的后端主机上，不依赖 Relay 云账户或托管中间人。它支持持久化会话、多 Agent Swarm、远程文件管理、可恢复终端及 Claude/Codex 配额工作流，并以每台设备独立、可撤销的加密凭据进行访问控制。项目提醒，Relay 并非沙箱，Agent 与终端进程拥有后端操作系统用户的权限，公开部署时应使用受限非 root 用户并配置 TLS。

打开原文相关 3 · 机会 1

1.6 KB

3.5 KB

1.3 KB

1.2 KB

103.1 KB

119.0 KB

76.4 KB

55.4 KB

54.6 KB

82.5 KB

中文

在你的机器上运行 AI 编程 Agent。从任意屏幕控制它们。

一个私有、自托管的远程驾驶舱，支持 Claude Code、Codex、OpenCode 和 Hermes。

中文 · 安装后端 · 安全 · 手册

Relay 会将你的源代码、Shell 访问权限和 CLI 凭据保留在你控制的电脑上。其 Flutter 客户端可从手机、Web 或桌面端连接到运行在项目旁的小型 Node.js 后端——无需 Relay 云账户，也没有托管中间人。

🖥️
在代码所在之处运行
你的 Agent 和项目保留在后端机器上。 | 📱
一个客户端，覆盖所有屏幕
在移动端、Web 和桌面端使用同一套界面。 | 🔐
天生私密
为每台设备导入一份加密且可撤销的凭据。
---|---|---

让真实的编程会话始终触手可及

流式接收回复、取消当前轮次、搜索历史记录、导出 Markdown，并在工作持续进行时切换到其他界面。每个 workdir + agent 上下文最多支持八个具名、可恢复的会话。

通过移动端聊天、协作并管理文件


持久化聊天
可从任何地方跟进长期运行的 Agent 会话。	Swarm
让专业化 Agent 在同一份共享记录中工作。	远程文件
浏览、上传、下载，并更改当前工作树。

这些截图在 Chromium 中针对隔离的演示后端采集；其中不包含生产环境凭据或项目数据。

flowchart LR
    C["Flutter client<br/>Phone · Web · Desktop"]
    R["Relay backend<br/>Node.js on your machine"]
    A["Persistent agent sessions<br/>Claude · Codex · OpenCode · Hermes"]
    F["Projects and files"]
    T["Resumable PTY shell"]

    C -->|"authenticated HTTP + SSE"| R
    R -->|"local CLI protocols"| A
    R -->|"filesystem policy"| F
    C -. "single-use WebSocket ticket" .-> T
    R --> T

加载中

活动 workdir 归属于每个客户端，并会随每次请求发送。一个会话的作用域为 workdir + agent + session，因此无关会话可以并发运行，而不会共享全局后端目录。

| 能力 | 为你提供的功能
---|---|---
💬 | 实时、持久化聊天 | 流式回复、取消、具名会话、跨设备历史记录、搜索和 Markdown 导出。
🐝 | 多 Agent Swarm | 共享记录、按成员设置角色与控制项、并行工作波次、受限的 @mention 交接，以及可复用的 JSON 模板。
🎛️ | Agent 控制项 | 模型、推理强度、权限等级、安装/认证状态、凭据到期倒计时，以及 Claude/Codex 的快速模式。
📁 | 文件和终端 | 允许路径浏览、上传、下载、压缩文件夹、workdir 切换，以及每个设备凭据对应一个可恢复 PTY。
📊 | 配额工作流 | Claude/Codex 用量视图，以及为下一个检测到的五小时重置时间排队的一条提示词。
🔔 | 通知 | 应用内/浏览器提醒；已配置的部署还可选用 Web Push 和 Android FCM。

Claude Code 和 Codex 是主要集成。OpenCode 和 Hermes 则作为实验性、由主机管理的集成提供。四者均将其凭据保留在后端主机上；Relay 不会替你登录任何 Agent。

1. 准备后端机器

在 Linux、macOS 或 Windows 上安装 Node.js 18+ 和至少一个受支持的 CLI。Claude 和 Codex 必须已在该主机上登录；OpenCode 和 Hermes 使用在该主机上管理的供应商配置。

在仓库根目录中，针对后端操作系统运行安装命令：

后端操作系统	安装命令
Linux	`./backends/linux/setup.sh`
macOS	`./backends/macos/setup.sh`
Windows PowerShell	`.\backends\windows\setup.ps1`

安装程序会引导你配置直连、具名 Cloudflare Tunnel 或临时 Quick Tunnel。在将直连部署公开暴露前，请使用 HTTPS。Linux 还需要 PM2 以及后端要求中列出的原生工具；Unix 主机需要 zip 才能下载文件夹。

2. 导入加密设备凭据

安装程序会输出一个加密二维码，并在 server/credentials/ 下写入 .relay.png / .relay.json 文件。通过摄像头、图片/文件或粘贴 JSON 导入其中之一，然后输入其密码短语。摄像头扫描仅支持移动端；所有客户端均支持通过文件或粘贴 JSON 导入。请为每台设备生成独立且可撤销的凭据。

3. 选择项目并开始工作

选择后端、设置 workdir，然后打开一个 Agent 对话或 Swarm。有关服务命令、网络细节和平台说明，请继续阅读后端指南。

每条 HTTP API 路由都需要可撤销的 bearer token；失败尝试会被限速。
凭据导出采用 PBKDF2-HMAC-SHA256 和 AES-256-GCM。
终端会将该 bearer token 换取一个短期、单次使用的 WebSocket ticket；长期 token 永远不会出现在 socket URL 中。
文件 API 会拒绝已知的 Relay、SSH、Claude 和 Codex 密钥路径，并可通过 RELAY_FS_ROOTS 进一步限制。
配额报告可能读取和刷新主机 OAuth 文件，但 token 值绝不会到达 Relay API 或客户端。

重要提示

Relay 不是沙箱。Agent 和终端进程拥有后端操作系统用户的权限。请以受限的非 root 用户运行它，为公开部署终止 TLS，并首先阅读 SECURITY.md 和生产环境检查清单。

flutter pub get
flutter analyze --no-pub
flutter test --no-pub
npm --prefix server install
npm --prefix server test

使用 flutter run 运行客户端。要提供自托管的 Web 构建版本：

flutter build web --no-pub --pwa-strategy=none --no-web-resources-cdn
npm --prefix server start

这些 Web 参数会有意禁用 service worker，并在本地打包 CanvasKit。Windows 发布构建已经过验证；macOS/Linux 桌面打包和安全存储验证的成熟度较低。参见开发手册。

Relay/
├── lib/          shared Flutter client
├── server/       Node.js backend and tests
├── backends/     OS-specific install/service adapters
├── docs/         operations and architecture handbook
├── scripts/      development, deployment, and screenshot helpers
└── test/         Flutter tests

贡献者和编程 Agent 应阅读 AGENTS.md。发布历史见 CHANGELOG.md，Relay 按 MIT License 发布。

English / 原文

Run AI coding agents on your machine. Control them from any screen.

A private, self-hosted remote cockpit for Claude Code, Codex, OpenCode, and Hermes.

中文 · Install a backend · Security · Handbook

Relay leaves your source code, shell access, and CLI credentials on the computer you control. Its Flutter client connects from phone, Web, or desktop to a small Node.js backend running beside your projects—there is no Relay cloud account and no hosted middleman.

🖥️
Runs where your code lives
Your agents and projects stay on your backend machine. | 📱
One client, every screen
Use the same interface on mobile, Web, and desktop. | 🔐
Private by design
Import an encrypted, revocable credential for each device.
---|---|---

Keep real coding sessions within reach

Stream replies, cancel a turn, search history, export Markdown, and switch away while work continues. Each workdir + agent context supports up to eight named, resumable conversations.

Chat, coordinate, and manage files from mobile


Persistent chat
Follow a long-running agent session from anywhere.	Swarms
Let specialized agents work in one shared transcript.	Remote files
Browse, upload, download, and change the active work tree.

These screenshots were captured in Chromium against an isolated demo backend; they contain no production credentials or project data.

flowchart LR
    C["Flutter client<br/>Phone · Web · Desktop"]
    R["Relay backend<br/>Node.js on your machine"]
    A["Persistent agent sessions<br/>Claude · Codex · OpenCode · Hermes"]
    F["Projects and files"]
    T["Resumable PTY shell"]

    C -->|"authenticated HTTP + SSE"| R
    R -->|"local CLI protocols"| A
    R -->|"filesystem policy"| F
    C -. "single-use WebSocket ticket" .-> T
    R --> T

The active workdir belongs to each client and is sent on every request. A conversation is scoped by workdir + agent + session, so unrelated sessions can run concurrently without sharing a global backend directory.

| Capability | What it gives you
---|---|---
💬 | Live, persistent chat | Streaming replies, cancellation, named sessions, cross-device history, search, and Markdown export.
🐝 | Multi-agent Swarms | Shared transcripts, per-member roles and controls, parallel waves, bounded @mention handoffs, and reusable JSON templates.
🎛️ | Agent controls | Model, reasoning effort, permission tier, install/auth status, credential-expiry countdown, and Fast mode for Claude/Codex.
📁 | Files and terminal | Allowed-path browsing, uploads, downloads, zipped folders, workdir switching, and one resumable PTY per device credential.
📊 | Quota workflows | Claude/Codex usage views plus one queued prompt for the next detected five-hour reset.
🔔 | Notifications | In-app/browser alerts, with optional Web Push and Android FCM for configured deployments.

Claude Code and Codex are the primary integrations. OpenCode and Hermes are available as experimental, host-managed integrations. All four keep their credentials on the backend host; Relay never logs an agent in for you.

1. Prepare the backend machine

Install Node.js 18+ and at least one supported CLI on Linux, macOS, or Windows. Claude and Codex must already be logged in on that host; OpenCode and Hermes use the provider configuration managed there.

Run the setup command for your backend OS from the repository root:

Backend OS	Setup command
Linux	`./backends/linux/setup.sh`
macOS	`./backends/macos/setup.sh`
Windows PowerShell	`.\backends\windows\setup.ps1`

The installer walks through direct access, a named Cloudflare Tunnel, or a temporary Quick Tunnel. Use HTTPS before exposing a direct deployment publicly. Linux also needs PM2 and the native tools listed in the backend requirements; Unix hosts need zip for folder downloads.

2. Import an encrypted device credential

Setup prints an encrypted QR code and writes .relay.png / .relay.json files under server/credentials/. Import one by camera, image/file, or pasted JSON, then enter its passphrase. Camera scanning is mobile-only; every client supports file or pasted-JSON import. Generate a separate revocable credential for each device.

3. Pick a project and start working

Choose the backend, set the workdir, and open an agent conversation or Swarm. For service commands, networking details, and platform notes, continue with the backend guide.

Every HTTP API route requires a revocable bearer token; failed attempts are rate-limited.
Credential exports use PBKDF2-HMAC-SHA256 and AES-256-GCM.
The terminal exchanges that bearer token for a short-lived, single-use WebSocket ticket; the long-lived token never appears in the socket URL.
The file API denies known Relay, SSH, Claude, and Codex secret paths and can be restricted further with RELAY_FS_ROOTS.
Quota reporting may read and refresh host OAuth files, but token values never reach the Relay API or client.

Important

Relay is not a sandbox. Agent and terminal processes have the permissions of the backend OS user. Run it as a restricted non-root user, terminate TLS for public deployments, and read SECURITY.md plus the production checklist first.

flutter pub get
flutter analyze --no-pub
flutter test --no-pub
npm --prefix server install
npm --prefix server test

Run the client with flutter run. To serve a self-hosted Web build:

flutter build web --no-pub --pwa-strategy=none --no-web-resources-cdn
npm --prefix server start

The Web flags intentionally disable the service worker and bundle CanvasKit locally. Windows release builds have been exercised; macOS/Linux desktop packaging and secure-storage validation are less mature. See the development handbook.

Relay/
├── lib/          shared Flutter client
├── server/       Node.js backend and tests
├── backends/     OS-specific install/service adapters
├── docs/         operations and architecture handbook
├── scripts/      development, deployment, and screenshot helpers
└── test/         Flutter tests

Contributors and coding agents should read AGENTS.md. Release history is in CHANGELOG.md, and Relay is released under the MIT License.