@lasting-beauty/chat-hub 0.1.0-beta.1

package/package.json

@@ -0,0 +1,118 @@
+{
+  "name": "@lasting-beauty/chat-hub",
+  "private": false,
+  "version": "0.1.0-beta.1",
+  "description": "面向单使用者的飞书与钉钉工作信息聚合工具",
+  "license": "SEE LICENSE IN LICENSE",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Lasting-Beauty/chat-hub.git"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "tag": "next",
+    "access": "public"
+  },
+  "allowScripts": {
+    "@larksuite/cli@1.0.92": true,
+    "better-sqlite3@13.0.3": true,
+    "dingtalk-workspace-cli": false,
+    "esbuild@0.28.2": true,
+    "fsevents@2.3.3": false
+  },
+  "type": "module",
+  "bin": {
+    "chat-hub": "bin/chat-hub.mjs"
+  },
+  "files": [
+    "bin/chat-hub.mjs",
+    "cli/data-lifecycle.mjs",
+    "cli/deploy.mjs",
+    "cli/external-verification.mjs",
+    "cli/ip-certificate.mjs",
+    "cli/platform.mjs",
+    "cli/runtime.mjs",
+    "cli/server-maintenance.mjs",
+    "cli/server-verification.mjs",
+    "cli/windows-data-migration.mjs",
+    "dist",
+    "scripts/install-platform-clis.mjs",
+    "skills/chat-hub-setup/scripts/gateway.mjs"
+  ],
+  "engines": {
+    "node": ">=22.22.2 <23 || >=24.15 <25"
+  },
+  "scripts": {
+    "dev": "vite --host 127.0.0.1",
+    "dev:live": "vite --mode live --host 127.0.0.1",
+    "server:dev": "tsx watch server/index.ts",
+    "server:start": "tsx server/index.ts",
+    "server:synthetic": "tsx server/synthetic-index.ts",
+    "smoke:lark-chat": "tsx server/scripts/smoke-lark-chat.ts",
+    "smoke:calendar": "tsx server/scripts/smoke-calendar.ts",
+    "smoke:dingtalk-minutes": "tsx server/scripts/smoke-dingtalk-minutes.ts",
+    "smoke:table-materials": "tsx server/scripts/smoke-table-materials.ts",
+    "sync:lark-chat": "tsx server/scripts/sync-lark-chat.ts",
+    "data:contracts": "tsx server/scripts/cli-fixtures.ts",
+    "data:generate": "tsx server/scripts/synthetic-data.ts generate",
+    "data:validate": "tsx server/scripts/synthetic-data.ts validate",
+    "data:seed": "tsx server/scripts/synthetic-data.ts seed",
+    "test:stress-summary": "tsx server/scripts/stress-summary.ts",
+    "eval:summary": "tsx server/scripts/evaluate-summary.ts",
+    "calibrate:analysis-model": "tsx server/scripts/calibrate-analysis-model.ts",
+    "build": "npm run typecheck && npm run build:client && npm run build:server",
+    "build:client": "vite build",
+    "build:server": "esbuild server/index.ts --bundle --platform=node --format=esm --target=node22 --packages=external --outfile=dist/server/index.js",
+    "preview": "vite preview --host 127.0.0.1",
+    "preview:live": "vite preview --mode live --host 127.0.0.1",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint .",
+    "format": "prettier --check \"src/**/*.{ts,tsx,css}\" \"server/**/*.ts\" \"shared/**/*.ts\" \"tests/**/*.{ts,json}\" \"bin/**/*.mjs\" \"cli/**/*.mjs\" \"installer/**/*.{mjs,json}\" \"scripts/**/*.mjs\" \"*.{json,js,ts}\"",
+    "format:write": "prettier --write \"src/**/*.{ts,tsx,css}\" \"server/**/*.ts\" \"shared/**/*.ts\" \"tests/**/*.{ts,json}\" \"bin/**/*.mjs\" \"cli/**/*.mjs\" \"installer/**/*.{mjs,json}\" \"scripts/**/*.mjs\" \"*.{json,js,ts}\"",
+    "test": "vitest run --testTimeout=15000",
+    "test:setup": "node --test skills/chat-hub-setup/tests/gateway.test.mjs skills/chat-hub-setup/tests/runtime.test.mjs",
+    "test:cli": "node --test cli/cli.test.mjs cli/deploy.test.mjs cli/data-lifecycle.test.mjs cli/external-verification.test.mjs cli/ip-certificate.test.mjs cli/platform.test.mjs cli/server-maintenance.test.mjs cli/server-verification.test.mjs cli/windows-data-migration.test.mjs",
+    "test:release-policy": "node --test scripts/release-policy.node-test.mjs",
+    "test:installer": "node --test installer/test/setup.test.mjs",
+    "verify:package": "npm run build && node scripts/verify-package.mjs",
+    "verify:installer-package": "node scripts/verify-installer-package.mjs",
+    "package:internal": "npm run build && node scripts/verify-package.mjs --artifact-dir artifacts/cli",
+    "verify:release": "node scripts/verify-release.mjs",
+    "postinstall": "node scripts/install-platform-clis.mjs",
+    "prepack": "npm run build",
+    "check": "npm run format && npm run lint && npm run test && npm run build && npm run test:setup && npm run test:cli && npm run test:installer && npm run verify:installer-package && npm run test:release-policy"
+  },
+  "dependencies": {
+    "@larksuite/cli": "1.0.92",
+    "antd": "6.6.3",
+    "better-sqlite3": "13.0.3",
+    "dingtalk-workspace-cli": "1.0.60",
+    "fastify": "5.12.3",
+    "lucide-react": "1.42.0",
+    "react": "19.2.8",
+    "react-dom": "19.2.8",
+    "zod": "4.5.4"
+  },
+  "devDependencies": {
+    "@eslint/js": "10.0.1",
+    "@testing-library/jest-dom": "7.0.1",
+    "@testing-library/react": "16.3.3",
+    "@testing-library/user-event": "14.6.7",
+    "@types/better-sqlite3": "9.6.0",
+    "@types/node": "22.20.1",
+    "@types/react": "19.2.18",
+    "@types/react-dom": "19.2.7",
+    "esbuild": "0.28.2",
+    "eslint": "10.10.0",
+    "eslint-plugin-react-hooks": "7.1.1",
+    "eslint-plugin-react-refresh": "0.5.6",
+    "globals": "16.4.0",
+    "jsdom": "30.0.1",
+    "prettier": "3.9.6",
+    "tsx": "4.23.13",
+    "typescript": "6.0.2",
+    "typescript-eslint": "8.69.0",
+    "vite": "8.2.2",
+    "vitest": "5.0.0"
+  }
+}

package/scripts/install-platform-clis.mjs

@@ -0,0 +1,163 @@
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { createRequire } from 'node:module';
+import {
+  chmodSync,
+  copyFileSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  renameSync,
+  rmSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve, sep } from 'node:path';
+
+const expectedDingtalkVersion = '1.0.60';
+const packageRequire = createRequire(import.meta.url);
+const archiveByPlatform = Object.freeze({
+  'darwin-x64': 'dws-darwin-amd64.tar.gz',
+  'darwin-arm64': 'dws-darwin-arm64.tar.gz',
+  'linux-x64': 'dws-linux-amd64.tar.gz',
+  'linux-arm64': 'dws-linux-arm64.tar.gz',
+  'win32-x64': 'dws-windows-amd64.zip',
+  'win32-arm64': 'dws-windows-arm64.zip',
+});
+
+installDingtalkBinary();
+
+function installDingtalkBinary() {
+  const packageJsonPath = packageRequire.resolve('dingtalk-workspace-cli/package.json');
+  const packageRoot = dirname(packageJsonPath);
+  const manifest = JSON.parse(readFileSync(packageJsonPath, 'utf8'));
+  if (manifest.version !== expectedDingtalkVersion) {
+    throw new Error(`未经验证的钉钉 CLI 版本：${manifest.version}`);
+  }
+
+  const archiveName = archiveByPlatform[`${process.platform}-${process.arch}`];
+  if (!archiveName) {
+    throw new Error(`钉钉 CLI 不支持当前平台：${process.platform}-${process.arch}`);
+  }
+  const archivePath = join(packageRoot, 'assets', archiveName);
+  const checksumsPath = join(packageRoot, 'assets', 'checksums.txt');
+  const expectedHash = expectedArchiveHash(checksumsPath, archiveName);
+  const actualHash = sha256(archivePath);
+  if (actualHash !== expectedHash) {
+    throw new Error(`钉钉 CLI 归档 SHA-256 不匹配：${archiveName}`);
+  }
+
+  const temporaryRoot = mkdtempSync(join(tmpdir(), 'chat-hub-dws-binary-'));
+  const extractionRoot = join(temporaryRoot, 'extracted');
+  const stagedVendor = join(packageRoot, `.chat-hub-vendor-stage-${process.pid}`);
+  const backupVendor = join(packageRoot, `.chat-hub-vendor-backup-${process.pid}`);
+  const vendor = join(packageRoot, 'vendor');
+  assertChildPath(packageRoot, stagedVendor);
+  assertChildPath(packageRoot, backupVendor);
+  assertChildPath(packageRoot, vendor);
+  let previousMoved = false;
+  let published = false;
+
+  try {
+    mkdirSync(extractionRoot, { recursive: true, mode: 0o700 });
+    execFileSync('tar', ['-xf', archivePath, '-C', extractionRoot], {
+      timeout: 120_000,
+      windowsHide: true,
+      stdio: 'pipe',
+    });
+    const extractedBinary = findBinary(extractionRoot);
+    if (!extractedBinary) throw new Error(`钉钉 CLI 归档缺少 dws 二进制：${archiveName}`);
+
+    rmSync(stagedVendor, { recursive: true, force: true });
+    rmSync(backupVendor, { recursive: true, force: true });
+    // The package is commonly installed by root, while the service runs as the
+    // dedicated chat-hub user. The directory therefore needs search permission
+    // for that user; the binary itself remains immutable to non-root users.
+    mkdirSync(stagedVendor, { mode: 0o755 });
+    const targetName = process.platform === 'win32' ? 'dws.exe' : 'dws';
+    const stagedBinary = join(stagedVendor, targetName);
+    copyFileSync(extractedBinary, stagedBinary);
+    if (process.platform !== 'win32') chmodSync(stagedBinary, 0o755);
+
+    const version = execFileSync(stagedBinary, ['--version'], {
+      encoding: 'utf8',
+      timeout: 30_000,
+      windowsHide: true,
+      stdio: 'pipe',
+    }).trim();
+    if (!/^dws version v1\.0\.60(?:\s|$)/.test(version)) {
+      throw new Error(`钉钉 CLI 二进制版本未经验证：${version}`);
+    }
+
+    if (existsSync(vendor)) {
+      if (lstatSync(vendor).isSymbolicLink()) {
+        throw new Error('拒绝替换符号链接形式的钉钉 CLI vendor 目录');
+      }
+      renameWithRetry(vendor, backupVendor);
+      previousMoved = true;
+    }
+    try {
+      renameWithRetry(stagedVendor, vendor);
+      if (process.platform !== 'win32') chmodSync(vendor, 0o755);
+      published = true;
+    } catch (error) {
+      if (previousMoved && !existsSync(vendor)) renameWithRetry(backupVendor, vendor);
+      throw error;
+    }
+    if (previousMoved) rmSync(backupVendor, { recursive: true, force: true });
+    console.log(`Chat Hub 已准备 dws ${expectedDingtalkVersion}，未安装钉钉 Agent Skills`);
+  } finally {
+    rmSync(temporaryRoot, { recursive: true, force: true });
+    rmSync(stagedVendor, { recursive: true, force: true });
+    if (published) rmSync(backupVendor, { recursive: true, force: true });
+  }
+}
+
+function expectedArchiveHash(checksumsPath, archiveName) {
+  const match = readFileSync(checksumsPath, 'utf8')
+    .split(/\r?\n/)
+    .map((line) => line.trim().match(/^([0-9a-f]{64})\s{2}(.+)$/i))
+    .find((entry) => entry?.[2] === archiveName);
+  if (!match) throw new Error(`钉钉 CLI 校验清单缺少：${archiveName}`);
+  return match[1].toLowerCase();
+}
+
+function sha256(path) {
+  return createHash('sha256').update(readFileSync(path)).digest('hex');
+}
+
+function findBinary(directory) {
+  for (const entry of readdirSync(directory, { withFileTypes: true })) {
+    const path = join(directory, entry.name);
+    const stat = lstatSync(path);
+    if (stat.isSymbolicLink()) throw new Error('钉钉 CLI 归档包含符号链接，拒绝安装');
+    if (stat.isDirectory()) {
+      const nested = findBinary(path);
+      if (nested) return nested;
+    } else if (entry.name === 'dws' || entry.name === 'dws.exe') {
+      return path;
+    }
+  }
+  return undefined;
+}
+
+function assertChildPath(parent, child) {
+  const prefix = `${resolve(parent)}${sep}`;
+  if (!resolve(child).startsWith(prefix)) throw new Error('钉钉 CLI 安装目标越界');
+}
+
+function renameWithRetry(source, destination) {
+  const retriable = new Set(['EPERM', 'EACCES', 'EBUSY']);
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      renameSync(source, destination);
+      return;
+    } catch (error) {
+      if (!retriable.has(error?.code) || attempt >= 7) throw error;
+      const delay = Math.min(25 * 2 ** attempt, 400);
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, delay);
+    }
+  }
+}

package/skills/chat-hub-setup/scripts/gateway.mjs

@@ -0,0 +1,360 @@
+import http from 'node:http';
+import https from 'node:https';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { isIP } from 'node:net';
+
+const hopHeaders = new Set([
+  'connection',
+  'keep-alive',
+  'transfer-encoding',
+  'upgrade',
+  'proxy-authorization',
+  'proxy-authenticate',
+  'te',
+  'trailer',
+]);
+const secureHeaders = {
+  'cache-control': 'no-store',
+  'x-content-type-options': 'nosniff',
+  'referrer-policy': 'no-referrer',
+  'content-security-policy': "frame-ancestors 'none'",
+};
+function json(res, status, value) {
+  res.writeHead(status, { ...secureHeaders, 'content-type': 'application/json; charset=utf-8' });
+  res.end(JSON.stringify(value));
+}
+function failure(res, status, code, message) {
+  json(res, status, { ok: false, error: { code, message, retryable: false } });
+}
+function loopback(address) {
+  return ['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(address);
+}
+function ipv4Number(value) {
+  const parts = value.split('.').map(Number);
+  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255))
+    return undefined;
+  return parts.reduce((sum, part) => ((sum << 8) | part) >>> 0, 0);
+}
+export function sameSubnet(address, lanIp, netmask) {
+  const peer = ipv4Number(address?.replace(/^::ffff:/, '') ?? '');
+  const ip = ipv4Number(lanIp);
+  const mask = ipv4Number(netmask);
+  return (
+    peer !== undefined && ip !== undefined && mask !== undefined && (peer & mask) === (ip & mask)
+  );
+}
+async function body(req) {
+  let result = '';
+  for await (const chunk of req) {
+    result += chunk;
+    if (result.length > 4096) throw new Error('request_too_large');
+  }
+  return JSON.parse(result);
+}
+function localAction(req, port) {
+  return (
+    loopback(req.socket.remoteAddress) &&
+    req.headers.host === `127.0.0.1:${port}` &&
+    req.headers.origin === `http://127.0.0.1:${port}` &&
+    req.headers['x-chat-hub-local-action'] === 'phone-pair'
+  );
+}
+function proxy(
+  req,
+  res,
+  port,
+  secure,
+  phoneHttp = false,
+  publicProxy = false,
+  publicScheme = 'https',
+) {
+  const forwardedFor = publicProxy
+    ? String(req.headers['x-forwarded-for'] ?? '')
+        .split(',')[0]
+        .trim()
+    : '';
+  const headers = Object.fromEntries(
+    Object.entries(req.headers).filter(
+      ([key]) =>
+        !hopHeaders.has(key) &&
+        !key.startsWith('x-forwarded-') &&
+        key !== 'forwarded' &&
+        key !== 'x-chat-hub-token',
+    ),
+  );
+  if (phoneHttp && headers.cookie) {
+    // A prior HTTPS Secure cookie cannot be overwritten from HTTP. Use a separate
+    // browser cookie and translate it only on this authenticated phone entrance.
+    headers.cookie = headers.cookie
+      .split(';')
+      .map((part) => part.trim())
+      .filter((part) => !part.startsWith('chat_hub_session='))
+      .map((part) => part.replace(/^chat_hub_http_session=/, 'chat_hub_session='))
+      .join('; ');
+  }
+  if (publicProxy && isIP(forwardedFor)) headers['x-forwarded-for'] = forwardedFor;
+  if (publicProxy) headers['x-forwarded-proto'] = publicScheme;
+  // Preserve Host and Origin: a phone must never acquire local-only platform controls.
+  const upstream = http.request(
+    { host: '127.0.0.1', port, path: req.url, method: req.method, headers, timeout: 15000 },
+    (response) => {
+      const outgoing = Object.fromEntries(
+        Object.entries(response.headers).filter(([key]) => !hopHeaders.has(key)),
+      );
+      if (phoneHttp && outgoing['set-cookie']) {
+        outgoing['set-cookie'] = outgoing['set-cookie'].map((cookie) =>
+          cookie.replace(/^chat_hub_session=/, 'chat_hub_http_session='),
+        );
+      }
+      if (secure && outgoing['set-cookie']) {
+        outgoing['set-cookie'] = outgoing['set-cookie'].map((cookie) =>
+          /;\s*Secure(?:;|$)/i.test(cookie) ? cookie : `${cookie}; Secure`,
+        );
+      }
+      res.writeHead(response.statusCode ?? 502, { ...outgoing, ...secureHeaders });
+      response.pipe(res);
+      response.on('error', () => res.destroy());
+    },
+  );
+  upstream.on('timeout', () => upstream.destroy());
+  upstream.on('error', () => {
+    if (!res.headersSent)
+      failure(res, 502, 'gateway_unavailable', '本机服务暂不可用，请在电脑检查运行状态');
+    else res.destroy();
+  });
+  req.on('aborted', () => upstream.destroy());
+  req.pipe(upstream);
+}
+
+export async function startGateway(config) {
+  let pairing;
+  let failures = 0;
+  let failureWindow = Date.now();
+  const servers = [];
+  const phoneSecure = config.phoneProtocol !== 'http';
+  const phonePort = phoneSecure ? config.httpsPort : config.httpPort;
+  const phoneOrigin = config.lanIp
+    ? `${phoneSecure ? 'https' : 'http'}://${config.lanIp}:${phonePort}`
+    : undefined;
+  const transportGuide = phoneSecure
+    ? `<p>首次先在手机安装并信任本机证书。</p><p>证书下载：${config.lanIp ? `http://${config.lanIp}:${config.httpPort}/certificate` : '未启用'}</p><p>证书指纹（请在手机核对）：${config.fingerprint ?? ''}</p>`
+    : '<p>无需安装证书。HTTP 不加密访问码、会话与工作内容，仅在可信局域网使用。</p>';
+  const nonce = randomBytes(18).toString('base64url');
+  const page = `<!doctype html><html lang="zh-CN"><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>Chat Hub 手机连接</title><style nonce="${nonce}">body{max-width:640px;margin:50px auto;padding:20px;font:17px system-ui;color:#25312e;background:#f7f8fa}button{padding:12px;background:#287968;color:white;border:0;border-radius:8px}pre{font-size:24px;white-space:pre-wrap}</style><h1>连接手机</h1><p>电脑和手机保持同一局域网。打开手机地址，在“本地访问密钥”输入框填写这里生成的短时配对码，即可登录。</p>${transportGuide}<p>手机地址：${phoneOrigin ?? '未启用手机访问'}</p><button id="pair">生成一次性配对码</button><pre id="code"></pre><p>有效期 10 分钟，成功使用后失效；仅在这里显示，不写入日志。平台授权仍在电脑完成。</p><a href="/">返回 Chat Hub</a><script nonce="${nonce}">document.querySelector('#pair').onclick=async()=>{const r=await fetch('/__setup/pair',{method:'POST',headers:{'x-chat-hub-local-action':'phone-pair'}});const v=await r.json();document.querySelector('#code').textContent=r.ok?v.code:v.error.message;};</script></html>`;
+  const localHandler = async (req, res) => {
+    if (!loopback(req.socket.remoteAddress) || req.headers.host !== `127.0.0.1:${config.httpPort}`)
+      return failure(res, 403, 'invalid_host', '请使用本机入口');
+    if (req.url === '/__setup/status' && req.method === 'GET')
+      return json(res, 200, { ok: true, id: config.id, mode: config.mode, phoneOrigin });
+    if (req.url === '/__setup/phone' && req.method === 'GET') {
+      res.writeHead(200, {
+        ...secureHeaders,
+        'content-type': 'text/html; charset=utf-8',
+        'content-security-policy': `default-src 'none'; connect-src 'self'; script-src 'nonce-${nonce}'; style-src 'nonce-${nonce}'; frame-ancestors 'none'`,
+      });
+      return res.end(page);
+    }
+    if (req.url === '/__setup/pair') {
+      if (req.method !== 'POST' || !localAction(req, config.httpPort))
+        return failure(res, 403, 'local_action_required', '请在电脑手机连接页生成配对码');
+      if (!config.lanIp) return failure(res, 409, 'lan_disabled', '本次未启用手机入口');
+      if (pairing?.pending) return failure(res, 409, 'pair_in_progress', '正在完成配对，请稍后');
+      const code = randomBytes(8).toString('hex').toUpperCase();
+      pairing = { code, expiresAt: Date.now() + 600000, pending: false };
+      return json(res, 200, { code: code.match(/.{4}/g).join('-'), expiresInSeconds: 600 });
+    }
+    if (req.url.startsWith('/__setup/')) return failure(res, 404, 'not_found', '入口不存在');
+    proxy(req, res, config.frontendPort, false);
+  };
+  const publicHost = config.publicHost ?? config.publicDomain;
+  const publicScheme = config.publicScheme ?? 'https';
+  const publicSecure = publicScheme === 'https';
+  const publicPort = publicSecure ? 443 : 80;
+  const publicOrigin = publicHost ? `${publicScheme}://${publicHost}` : undefined;
+  const publicHandler = async (req, res) => {
+    const allowedHost =
+      req.headers.host === publicHost || req.headers.host === `${publicHost}:${publicPort}`;
+    if (
+      !loopback(req.socket.remoteAddress) ||
+      !allowedHost ||
+      req.headers['x-forwarded-proto'] !== publicScheme
+    ) {
+      return failure(
+        res,
+        403,
+        'gateway_required',
+        `公网入口只接受来自本机 Caddy 的 ${publicScheme.toUpperCase()} 请求`,
+      );
+    }
+    if (req.headers.origin && req.headers.origin !== publicOrigin)
+      return failure(res, 403, 'invalid_origin', '请求来源不正确');
+    if (!['GET', 'HEAD'].includes(req.method) && req.headers.origin !== publicOrigin)
+      return failure(res, 403, 'invalid_origin', '请求来源不正确');
+    if (
+      req.url.startsWith('/__setup/') ||
+      req.url === '/api/session/local' ||
+      req.url.startsWith('/api/local-access/')
+    ) {
+      return failure(res, 403, 'local_action_required', '公网入口不提供本机专用操作');
+    }
+    proxy(req, res, config.frontendPort, publicSecure, false, true, publicScheme);
+  };
+  const lanAllowed = (req, port) =>
+    req.headers.host === `${config.lanIp}:${port}` &&
+    sameSubnet(req.socket.remoteAddress, config.lanIp, config.netmask);
+  const phoneHandler = async (req, res) => {
+    if (!lanAllowed(req, phonePort)) return failure(res, 403, 'lan_only', '仅限当前局域网访问');
+    if (req.headers.origin && req.headers.origin !== phoneOrigin)
+      return failure(res, 403, 'invalid_origin', '请使用手机入口');
+    if (!['GET', 'HEAD'].includes(req.method) && req.headers.origin !== phoneOrigin)
+      return failure(res, 403, 'invalid_origin', '请求来源不正确');
+    if (
+      req.url.startsWith('/__setup/') ||
+      req.url === '/api/session/local' ||
+      req.url.startsWith('/api/local-access/') ||
+      req.url.includes('/auth-flows/') ||
+      (req.url.startsWith('/api/connections') && req.method !== 'GET')
+    ) {
+      return failure(res, 403, 'local_action_required', '此操作请在电脑本机页面完成');
+    }
+    if (req.url === '/api/session' && req.method === 'POST') {
+      if (Date.now() - failureWindow > 60000) {
+        failures = 0;
+        failureWindow = Date.now();
+      }
+      if (failures >= 5) return failure(res, 429, 'rate_limited', '尝试过于频繁，请一分钟后重试');
+      let candidate;
+      try {
+        candidate = (await body(req)).token;
+      } catch {
+        candidate = undefined;
+      }
+      const normalized =
+        typeof candidate === 'string' ? candidate.replaceAll('-', '').toUpperCase() : '';
+      if (
+        !pairing ||
+        pairing.pending ||
+        pairing.expiresAt <= Date.now() ||
+        !/^[A-F0-9]{16}$/.test(normalized) ||
+        normalized.length !== pairing.code.length ||
+        !timingSafeEqual(Buffer.from(normalized), Buffer.from(pairing.code))
+      ) {
+        failures++;
+        return failure(res, 401, 'unauthorized', '配对码无效或已过期，请在电脑重新生成');
+      }
+      pairing.pending = true;
+      try {
+        // Exchange a user-confirmed one-time phone code for the app's existing session.
+        // The platform/API master secret is never read, copied or returned.
+        const response = await fetch(`http://127.0.0.1:${config.apiPort}/api/session/local`, {
+          method: 'POST',
+          headers: {
+            origin: `http://127.0.0.1:${config.httpPort}`,
+            'x-chat-hub-local-action': 'local-session',
+          },
+          signal: AbortSignal.timeout(5000),
+        });
+        const cookie = response.headers
+          .getSetCookie()
+          .find((entry) => entry.startsWith('chat_hub_session='));
+        if (!response.ok || !cookie) throw new Error('session_unavailable');
+        pairing = undefined;
+        res.setHeader(
+          'set-cookie',
+          phoneSecure
+            ? `${cookie}; Secure`
+            : cookie.replace(/^chat_hub_session=/, 'chat_hub_http_session='),
+        );
+        return json(res, 200, { ok: true, data: { authenticated: true } });
+      } catch {
+        if (pairing) pairing.pending = false;
+        return failure(res, 503, 'session_unavailable', '本机会话暂不可用，请在电脑检查服务后重试');
+      }
+    }
+    proxy(req, res, config.frontendPort, phoneSecure, !phoneSecure);
+  };
+  const listen = async (server, port, host) => {
+    server.requestTimeout = 15000;
+    server.headersTimeout = 10000;
+    server.maxConnections = 32;
+    server.on('clientError', (_error, socket) => socket.destroy());
+    servers.push(server);
+    await new Promise((resolve, reject) => {
+      server.once('error', reject);
+      server.listen(port, host, resolve);
+    });
+  };
+  const wrap = (handler) => (req, res) =>
+    Promise.resolve(handler(req, res)).catch(() => {
+      if (!res.headersSent) failure(res, 500, 'gateway_error', '入口暂不可用');
+      else res.destroy();
+    });
+  try {
+    await listen(
+      http.createServer(wrap(config.entryMode === 'public' ? publicHandler : localHandler)),
+      config.httpPort,
+      '127.0.0.1',
+    );
+    if (config.lanIp && !phoneSecure) {
+      await listen(http.createServer(wrap(phoneHandler)), config.httpPort, config.lanIp);
+    } else if (config.lanIp) {
+      const certificate = readFileSync(config.caCert);
+      await listen(
+        http.createServer((req, res) => {
+          if (
+            !lanAllowed(req, config.httpPort) ||
+            req.url !== '/certificate' ||
+            req.method !== 'GET'
+          )
+            return failure(res, 403, 'https_required', '请使用 HTTPS 手机入口');
+          res.writeHead(200, {
+            ...secureHeaders,
+            'content-type': 'application/x-x509-ca-cert',
+            'content-disposition': 'attachment; filename="chat-hub-ca.crt"',
+          });
+          res.end(certificate);
+        }),
+        config.httpPort,
+        config.lanIp,
+      );
+      await listen(
+        https.createServer(
+          {
+            key: readFileSync(config.serverKey),
+            cert: readFileSync(config.serverCert),
+            minVersion: 'TLSv1.2',
+          },
+          wrap(phoneHandler),
+        ),
+        config.httpsPort,
+        config.lanIp,
+      );
+    }
+  } catch (error) {
+    await Promise.all(
+      servers
+        .filter((server) => server.listening)
+        .map(
+          (server) =>
+            new Promise((resolve) => {
+              server.closeAllConnections();
+              server.close(resolve);
+            }),
+        ),
+    );
+    throw error;
+  }
+  return {
+    close: () =>
+      Promise.all(
+        servers.map(
+          (server) =>
+            new Promise((resolve) => {
+              server.closeAllConnections();
+              server.close(resolve);
+            }),
+        ),
+      ),
+  };
+}