SELF-HOSTED · MITSELF-HOSTED · MIT

可选：把 relay 部署在自己的服务器上Optional: run the relay on your own server

电脑端和手机端必须经过 relay 才能通信，但你不必自己部署：可以直接使用 执简_Termly 公共 relay，也可以运行这份 MIT 兼容服务。自托管只改变中继所在位置，不替代 HarmonyOS App、Termly CLI 或你自己的 AI CLI。The desktop and mobile app require a relay, but you do not have to host one. Use the 执简_Termly public relay or run this MIT-compatible service. Self-hosting only changes where the relay runs; it does not replace the HarmonyOS app, Termly CLI, or your AI CLI.

公共入口：API 使用 https://relay2.termlyhos.com，WebSocket 使用 wss://relay2.termlyhos.com。公网 443/TLS 由 Nginx 终止并反代到本机 8080。HTTPS/WSS 保护网络传输，终端正文仍由应用层 AES-256-GCM 端到端加密单独保护。Public endpoints: https://relay2.termlyhos.com for the API and wss://relay2.termlyhos.com for WebSocket. Nginx terminates public TLS on port 443 and proxies to local port 8080. HTTPS/WSS protects transport, while application-layer AES-256-GCM separately protects terminal content end to end.
termlyhos-relay 1.0.0

完整源码、MIT 许可证、Docker Compose、Node.js 部署文件与测试。Complete source, MIT license, Docker Compose, Node.js setup, and tests. SHA-256

下载源码包Download source

自托管改变什么，不改变什么What self-hosting changes

仍然必需Still required

HarmonyOS 5.0.0（API 12）及以上设备上的 执简_Termly App，以及电脑上的 Termly CLI 1.9.5 和用户自行安装的 AI CLI。The 执简_Termly app on HarmonyOS 5.0.0 (API 12)+, plus Termly CLI 1.9.5 and your separately installed AI CLI on the desktop.

由你接管You take ownership

relay 的服务器、HTTPS/WSS 入口、运行监控、更新和会话存储。公共 relay 不再经过你的连接链路。The relay server, HTTPS/WSS endpoint, monitoring, updates, and session store. The public relay is no longer in your connection path.

终端正文仍然端到端加密；relay 没有正文密钥，但会看到 IP、连接时间、会话 ID、载荷大小和客户端声明的项目、设备及 AI 工具元数据。Terminal content remains end-to-end encrypted. The relay has no content key, but can observe IPs, timing, session IDs, payload sizes, and client-declared project, device, and AI-tool metadata.

Docker ComposeDocker Compose

解压后直接构建，默认监听 3000 端口，并使用 Docker volume 持久化可恢复会话。Extract and build directly. The relay listens on port 3000 and persists resumable sessions in a Docker volume.

curl -fLO https://www.termlyhos.com/termlyhos-relay-1.0.0.tgz tar -xzf termlyhos-relay-1.0.0.tgz cd package docker compose up -d --build curl http://127.0.0.1:3000/health
公网部署必须在前方配置 HTTPS/WSS 反向代理。源码包 README 提供 Nginx 示例；不要直接把未加密的 3000 端口暴露到互联网。Public deployments need an HTTPS/WSS reverse proxy. The package README includes an Nginx example; do not expose the unencrypted port 3000 directly to the internet.

让 Termly CLI 使用你的地址Point Termly CLI to your relay

补丁最后一个参数就是 relay 根地址。使用 HTTPS 时会自动写入对应的 WSS 地址，不要添加 /ws。The final patch argument is your relay base URL. HTTPS automatically maps to WSS; do not append /ws.

npm install -g @termly-dev/cli@1.9.5 npx -y https://www.termlyhos.com/termly-relay-patch-1.1.0.tgz https://relay.example.com termly start --ai claude-code

边界要说清楚Know the boundary

relay 能做什么What the relay does

完成配对、转发密文、观测双方心跳、反馈 CLI 可达状态，并短期保存加密的待发送输入。Pair endpoints, forward ciphertext, observe heartbeats, report CLI reachability, and briefly retain encrypted pending input.

relay 不能做什么What it cannot do

不能解密终端正文，不能重启已经退出的 CLI，也不能让 Termly 1.9.5 启动它 registry 中不存在的 Kimi。It cannot decrypt terminal content, restart a terminated CLI, or make Termly 1.9.5 launch Kimi when no Kimi preset exists in its registry.

主要配置Main configuration

PORT / HOST监听端口与地址Listen port and address
SESSION_STORE_PATH会话持久化文件，默认 ./data/sessions.jsonSession store, default ./data/sessions.json
MAX_WS_CONNECTIONS / MAX_PER_IP全局与单 IP WebSocket 上限Global and per-IP WebSocket limits
MONITOR_KEY远程读取 /monitor 的运维密钥Operator key for remote /monitor access
TIER_SECRET可选的等级令牌 HMAC 密钥；当前所有等级的 TTL 都是两天Optional tier-token HMAC key; all tiers currently use a two-day TTL