's'

web2.py

@@ -46,8 +46,9 @@ from web2_relay_pro import (
     write_url_config_for_channel,
 )
 from web2_youtube_ini import parse_youtube_ini, serialize_youtube_ini
-from web2_host_caps import gpu_status_payload
+from web2_host_caps import gpu_status_payload, machine_summary_payload
 from web2_douyin_preview import fetch_douyin_anchor_name
+from web2_pocketbase import REQUIRE_PB, pb_auth_refresh_and_validate
 
 
 @asynccontextmanager
@@ -243,7 +244,7 @@ register_wechat_chatbot_routes(app, BASE_DIR)
 
 @app.get("/client/overview")
 async def client_overview():
-    """Electron 工作台：频道列表、微信摘要（EasyTier 节点由主进程 easytier-cli 查询）。"""
+    """Electron 工作台：频道列表、微信摘要。"""
     return build_client_overview(CONFIG_DIR, BASE_DIR)
 
 
@@ -385,6 +386,12 @@ async def host_gpu_status():
     return gpu_status_payload()
 
 
+@app.get("/host/machine_summary")
+async def host_machine_summary():
+    """本机 hostname / OS / 架构等，供会员遥测写入 PocketBase。"""
+    return machine_summary_payload()
+
+
 @app.post("/douyin/room_previews")
 async def douyin_room_previews(request: Request):
     try:
@@ -580,7 +587,12 @@ async def _stop_legacy_youtube_if_online() -> None:
 
 # ---------------- PM2 控制路由 ----------------
 @app.get("/start")
-async def start(process: str = Query(..., description="进程名")):
+async def start(request: Request, process: str = Query(..., description="进程名")):
+    if REQUIRE_PB:
+        tok = (request.headers.get("x-pb-token") or "").strip()
+        ok, msg, _ = await pb_auth_refresh_and_validate(tok)
+        if not ok:
+            return JSONResponse({"output": msg}, status_code=403)
     if not process_valid(process):
         return JSONResponse({"output": f"无效进程名: {process}"}, status_code=400)
     cid = relay_channel_id_from_pm2_name(process)
@@ -633,7 +645,12 @@ async def stop(process: str = Query(..., description="进程名")):
 
 
 @app.get("/restart")
-async def restart(process: str = Query(..., description="进程名")):
+async def restart(request: Request, process: str = Query(..., description="进程名")):
+    if REQUIRE_PB:
+        tok = (request.headers.get("x-pb-token") or "").strip()
+        ok, msg, _ = await pb_auth_refresh_and_validate(tok)
+        if not ok:
+            return JSONResponse({"output": msg}, status_code=403)
     if not process_valid(process):
         return JSONResponse({"output": f"无效进程名: {process}"}, status_code=400)
     cid = relay_channel_id_from_pm2_name(process)