neuroalpha 0.6.13 → 0.7.1

package/server/brokers/index.js

@@ -5,7 +5,7 @@ import https from 'node:https';
 import path from 'node:path';
 import { ROOT } from '../config.js';
 import { db, kvGet, kvSet, userKvGet, userKvSet, getRun } from '../db.js';
-import { encryptSecret, decryptSecret, currentUser, currentUserId, effectivePlan, runWithUser } from '../auth/index.js';
+import { encryptSecret, decryptSecret, currentUser, currentUserId, effectivePlan, runWithUser, tradingGate } from '../auth/index.js';
 import { notifyBrokerBatch, registerBrokerHandlers } from '../notify/index.js';
 import { getSettings, normalizeParams } from '../settings.js';
 import { latestBarTs, registerRealtimeCandleFetcher } from '../data/moex.js';
@@ -22,7 +22,6 @@ import { blockingNews } from '../news/index.js';
 import { round, MSK, DAY, fmtBarMsk } from '../util.js';
 import { hub } from '../hub.js';
 import { TRUSTED_CA } from '../tls-ca.js';
-import { tradingGate } from '../instance/agent.js';
 
 export const FULLY_SUPPORTED_BROKERS = ['tbank'];
 const MANUAL_BROKERS = ['sber', 'vtb', 'alfa'];
@@ -529,14 +528,26 @@ export function getActiveAccountSignalFilters(nowTs = Date.now()) {
 }
 
 export function brokersState() {
+  const gate = tradingGate();
+  if (!gate.allowNew) {
+    return {
+      brokers: BROKER_META,
+      accounts: [],
+      trading: gate,
+      unlicensed: true,
+    };
+  }
   return {
     brokers: BROKER_META,
     accounts: loadRawAccounts().map(publicAccount),
-    trading: tradingGate(),
+    trading: gate,
+    unlicensed: false,
   };
 }
 
 export function saveBrokerAccount(input = {}) {
+  const gate = tradingGate();
+  if (!gate.allowNew) throw new Error(gate.reason);
   const list = loadRawAccounts();
   const plan = effectivePlan(currentUser());
   const id = input.id && String(input.id).trim() ? String(input.id).trim() : `brk_${crypto.randomBytes(4).toString('hex')}`;

package/server/config.js

@@ -1,53 +1,73 @@
-// Copyright (c) 2026 Roman A. Perepelkin. All rights reserved. Proprietary software.
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-import { IS_PACKAGED, BUILD } from './build-info.js';
-
-// В защищённой сборке файлы интерфейса распаковываются во временный каталог (NEUROALPHA_ROOT задаёт загрузчик)
-export const ROOT = IS_PACKAGED
-  ? path.resolve(process.env.NEUROALPHA_ROOT || process.cwd())
-  : path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-export const DATA_DIR = process.env.NEUROALPHA_DATA_DIR
-  ? path.resolve(process.env.NEUROALPHA_DATA_DIR)
-  : path.join(ROOT, 'data');
-
-if (!IS_PACKAGED) {
-  const envFile = path.join(ROOT, '.env');
-  if (fs.existsSync(envFile)) process.loadEnvFile(envFile);
-  const cwdEnv = path.resolve(process.cwd(), '.env');
-  if (cwdEnv !== envFile && fs.existsSync(cwdEnv)) process.loadEnvFile(cwdEnv);
-}
-
-export const strategyDefaults = JSON.parse(fs.readFileSync(path.join(ROOT, 'config/strategy.json'), 'utf8'));
-
-function resolveApiKey() {
-  if (process.env.LLM_API_KEY) return process.env.LLM_API_KEY.trim();
-  const file = process.env.LLM_API_KEY_FILE;
-  if (!file) return '';
-  try {
-    const raw = fs.readFileSync(path.resolve(ROOT, file), 'utf8').trim();
-    if (raw.startsWith('{')) {
-      const j = JSON.parse(raw);
-      return String(j.apiKey || j.api_key || j.key || '').trim();
-    }
-    return raw;
-  } catch {
-    return '';
-  }
-}
-
-export const llmConfig = {
-  provider: (process.env.LLM_PROVIDER || 'openai').toLowerCase(),
-  baseUrl: process.env.LLM_BASE_URL || 'https://models.odant.org/v1/chat/completions',
-  model: process.env.LLM_MODEL || 'Qwen/Qwen3.8-27B-FP8',
-  apiKey: resolveApiKey(),
-  reasoningEffort: process.env.LLM_REASONING_EFFORT || 'low',
-  maxTokens: Number(process.env.LLM_MAX_TOKENS || 4000),
-  timeoutMs: Number(process.env.LLM_TIMEOUT_MS || 90000),
-};
-llmConfig.enabled = llmConfig.provider !== 'none' && !!llmConfig.baseUrl && !!llmConfig.model && !!llmConfig.apiKey;
-
-export const PORT = Number(process.env.PORT || 3000);
-export const DEFAULT_CLOUD_URL = ((IS_PACKAGED ? BUILD.centralUrl : process.env.CLOUD_URL) || 'https://neuroalpha.odant.org').replace(/\/+$/, '');
+// Copyright (c) 2026 Roman A. Perepelkin. All rights reserved. Proprietary software.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { IS_PACKAGED, BUILD } from './build-info.js';
+
+export const ROOT = IS_PACKAGED
+  ? path.resolve(process.env.NEUROALPHA_ROOT || process.cwd())
+  : path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+// Признак запуска из локального git-репозитория разработчика (вне node_modules / кэша npx)
+const insideNodeModules = /[\\/]node_modules[\\/]|_npx/i.test(ROOT);
+export const IS_DEV_REPO = !IS_PACKAGED && !insideNodeModules && fs.existsSync(path.join(ROOT, '.git'));
+
+// Постоянный каталог данных терминала:
+// • при запуске через npx neuroalpha@latest данные ВСЕГДА живут в ~/.neuroalpha и не пропадают при обновлениях;
+// • при локальной разработке из git-репозитория (если есть ./data/trading.db или .git) сохраняется ./data.
+function resolveDataDir() {
+  if (process.env.NEUROALPHA_DATA_DIR) return path.resolve(process.env.NEUROALPHA_DATA_DIR);
+  const repoData = path.join(ROOT, 'data');
+  if (!IS_PACKAGED && !insideNodeModules && (IS_DEV_REPO || fs.existsSync(path.join(repoData, 'trading.db')))) {
+    return repoData;
+  }
+  return path.join(os.homedir(), '.neuroalpha');
+}
+
+export const DATA_DIR = resolveDataDir();
+fs.mkdirSync(DATA_DIR, { recursive: true });
+
+if (!IS_PACKAGED) {
+  for (const envFile of [path.join(DATA_DIR, '.env'), path.join(ROOT, '.env'), path.resolve(process.cwd(), '.env')]) {
+    if (fs.existsSync(envFile)) {
+      try { process.loadEnvFile(envFile); } catch { /* ignore */ }
+    }
+  }
+}
+
+export const strategyDefaults = JSON.parse(fs.readFileSync(path.join(ROOT, 'config/strategy.json'), 'utf8'));
+
+function resolveApiKey() {
+  if (process.env.LLM_API_KEY) return process.env.LLM_API_KEY.trim();
+  const file = process.env.LLM_API_KEY_FILE;
+  if (!file) return '';
+  try {
+    const raw = fs.readFileSync(path.resolve(ROOT, file), 'utf8').trim();
+    if (raw.startsWith('{')) {
+      const j = JSON.parse(raw);
+      return String(j.apiKey || j.api_key || j.key || '').trim();
+    }
+    return raw;
+  } catch {
+    return '';
+  }
+}
+
+export const llmConfig = {
+  provider: (process.env.LLM_PROVIDER || 'openai').toLowerCase(),
+  baseUrl: process.env.LLM_BASE_URL || 'https://models.odant.org/v1/chat/completions',
+  model: process.env.LLM_MODEL || 'Qwen/Qwen3.8-27B-FP8',
+  apiKey: resolveApiKey(),
+  reasoningEffort: process.env.LLM_REASONING_EFFORT || 'low',
+  maxTokens: Number(process.env.LLM_MAX_TOKENS || 4000),
+  timeoutMs: Number(process.env.LLM_TIMEOUT_MS || 90000),
+};
+llmConfig.enabled = llmConfig.provider !== 'none' && !!llmConfig.baseUrl && !!llmConfig.model && !!llmConfig.apiKey;
+
+export const PORT = Number(process.env.PORT || 3000);
+export const LISTEN_HOST = String(process.env.HOST || '').trim() || undefined;
+export const DEFAULT_CLOUD_URL = (
+  (IS_PACKAGED ? BUILD.centralUrl : (process.env.PORTAL_URL || process.env.CLOUD_URL))
+  || 'https://neuroalpha.odant.org'
+).replace(/\/+$/, '');

package/server/index.js

@@ -1,212 +1,186 @@
-// Copyright (c) 2026 Roman A. Perepelkin. All rights reserved. Proprietary software.
-import http from 'node:http';
-import fs from 'node:fs';
-import os from 'node:os';
-import { spawn } from 'node:child_process';
-import path from 'node:path';
-import express from 'express';
-import { WebSocketServer } from 'ws';
-import { ROOT, PORT } from './config.js';
-import { ROLE, IS_INSTANCE, IS_DESKTOP, IS_CENTRAL, INSTANCE_KIND, LISTEN_HOST } from './role.js';
-import { startInstanceAgent, setInstanceCommandHandler } from './instance/agent.js';
-import { getIdentity, isActivated } from './instance/identity.js';
-import { startCentralReconciler } from './instance/central.js';
-import { DEFAULT_CLOUD_URL } from './config.js';
-import { activeModelInfo } from './llm/client.js';
-import { markStaleRuns, removeLegacyData, removeOrphanEvents, ensureSeedRun } from './db.js';
-import { createRouter } from './api/routes.js';
-import { authMiddleware, activateLocalLicense, userFromRequest, runWithUser, getUserById } from './auth/index.js';
-import { securityHeaders, setAppCsp, isCrossOrigin } from './security.js';
-import { live } from './model/live.js';
-import { runningResearch, runningStability } from './model/research.js';
-import { startNews } from './news/index.js';
-import { startNotifyPolling } from './notify/index.js';
-import { startBrokerScheduler, brokersState, executeBrokerOrders, rejectBrokerOrders } from './brokers/index.js';
-import { chatState, askFromMessenger } from './strategist/index.js';
-import { hub } from './hub.js';
-
-markStaleRuns();
-removeLegacyData();
-removeOrphanEvents();
-ensureSeedRun();
-
-const app = express();
-app.disable('x-powered-by');
-app.use(express.json({ limit: '1mb' }));
-app.use(securityHeaders);
-app.use(authMiddleware);
-const server = http.createServer(app);
-const wss = new WebSocketServer({ server, path: '/ws' });
-
-hub.setSender((msg, { uid, global }) => {
-  const data = JSON.stringify(msg);
-  for (const c of wss.clients) {
-    if (c.readyState !== 1) continue;
-    if (global || c.uid === uid) c.send(data);
-  }
-});
-
-wss.on('connection', (ws, req) => {
-  if (isCrossOrigin(req)) {
-    ws.close(4403, 'forbidden origin');
-    return;
-  }
-  const user = userFromRequest(req);
-  if (!user) {
-    ws.close(4401, 'unauthorized');
-    return;
-  }
-  ws.uid = user.id;
-  runWithUser(user, () => {
-    ws.send(JSON.stringify({ type: 'hello', live: live.status(), chat: chatState(), running: runningResearch(), stabilityRunning: runningStability(), llm: activeModelInfo() }));
-  });
-});
-
-// Команды из Telegram / MAX, пришедшие с центра: подтверждение пакета заявок или вопрос к Стратегу
-setInstanceCommandHandler((cmd) => runWithUser(getUserById(1), async () => {
-  if (cmd.type === 'chat' && cmd.text) {
-    const res = await askFromMessenger(cmd.text, { channel: cmd.channel || 'tg' });
-    return `🤖 Стратег:\n\n${String(res?.text || 'Готово.').slice(0, 3400)}`;
-  }
-  if (cmd.type !== 'batch') return null;
-  const acc = brokersState().accounts.find((a) => a.id === cmd.accountId);
-  if (!acc) return 'Команда из мессенджера: счёт не найден.';
-  const pb = acc.pendingBatch;
-  if (!pb || pb.status !== 'pending' || (cmd.batchId && pb.id !== cmd.batchId)) {
-    return `Счёт «${acc.name}»: этот пакет заявок уже неактуален (исполнен, отклонён или заменён новым) — команда не выполнена.`;
-  }
-  if (cmd.action === 'exec') {
-    const st = await executeBrokerOrders(acc.id);
-    const res = st.accounts.find((a) => a.id === acc.id)?.pendingBatch?.results || [];
-    const ok = res.filter((r) => r.ok).length;
-    return `✓ Счёт «${acc.name}»: отправлено брокеру ${ok} из ${res.length} заявок.${ok < res.length ? ` Ошибки: ${res.filter((r) => !r.ok).map((r) => `${r.symbol} — ${r.error}`).join('; ').slice(0, 600)}` : ''}`;
-  }
-  if (cmd.action === 'rej') {
-    rejectBrokerOrders(acc.id);
-    return `✕ Счёт «${acc.name}»: пакет заявок отклонён.`;
-  }
-  return null;
-}));
-startInstanceAgent();
-if (IS_CENTRAL) startCentralReconciler({ centralUrl: String(process.env.CENTRAL_PUBLIC_URL || DEFAULT_CLOUD_URL).replace(/\/+$/, '') });
-live.resume();
-startNews();
-startNotifyPolling();
-startBrokerScheduler();
-
-if (process.env.NEUROALPHA_API_KEY && !IS_INSTANCE) {
-  activateLocalLicense(process.env.NEUROALPHA_API_KEY, process.env.CLOUD_URL || '')
-    .then((lic) => console.log(`✓ Активирован API-ключ: тариф «${lic.planName}» (${lic.email})`))
-    .catch((e) => console.warn(`⚠ Проверка API-ключа: ${e.message}`));
-}
-
-// Проверка живости для Kubernetes (liveness/readiness), без данных
-app.get('/healthz', (req, res) => res.json({ ok: true, role: ROLE }));
-
-// Машина клиента: витрина, оферта, админка и вход живут в центре; без сессии — вход через кабинет центра
-if (IS_INSTANCE) {
-  const central = () => getIdentity().centralUrl;
-  const toCentral = (p) => (req, res) => res.redirect(`${central()}${p}`);
-  app.get(['/landing', '/landing.html'], toCentral('/landing'));
-  app.get(['/legal', '/legal.html'], toCentral('/legal'));
-  app.get(['/admin', '/admin.html'], toCentral('/landing'));
-  app.get(['/', '/index.html'], (req, res, next) => {
-    // установка на компьютер до активации — экран ввода кода из личного кабинета
-    if (IS_DESKTOP && !isActivated()) {
-      setAppCsp(res);
-      return res.sendFile(path.join(ROOT, 'public', 'activate.html'));
-    }
-    if (!req.user) return res.redirect(`${central()}/api/instances/open?i=${encodeURIComponent(getIdentity().id)}`);
-    setAppCsp(res);
-    next();
-  });
-}
-
-app.get('/landing', (req, res) => res.sendFile(path.join(ROOT, 'public', 'landing.html')));
-app.get('/legal', (req, res) => res.sendFile(path.join(ROOT, 'public', 'legal.html')));
-app.get('/admin', (req, res) => {
-  if (!req.user || req.user.role !== 'admin') return res.redirect('/landing');
-  return res.sendFile(path.join(ROOT, 'public', 'admin.html'));
-});
-app.get('/', (req, res, next) => {
-  // На центральном сервере (IS_CENTRAL) у клиентов на главном домене работает витрина и Личный кабинет (с биллингом и переходом на их PaaS-машину),
-  // а локальный торговый терминал самого центра открывается только для администратора (или в dev/instance режиме)
-  if (!req.user || (process.env.CLOUD_MODE === '1' && req.query.landing === '1') || (IS_CENTRAL && (req.user.role !== 'admin' || req.query.payment_check === '1') && req.query.terminal !== '1')) {
-    return res.sendFile(path.join(ROOT, 'public', 'landing.html'));
-  }
-  setAppCsp(res);
-  next();
-});
-app.use('/api', createRouter());
-app.use('/docs', express.static(path.join(ROOT, 'docs')));
-app.use(express.static(path.join(ROOT, 'public')));
-
-function lanUrls() {
-  return Object.entries(os.networkInterfaces())
-    .filter(([name]) => !/vethernet|wsl|docker|hyper-v|virtualbox|vmware/i.test(name))
-    .flatMap(([, list]) => list || [])
-    .filter((a) => a && a.family === 'IPv4' && !a.internal)
-    .map((a) => `http://${a.address}:${PORT}`);
-}
-
-function fmtClickableUrl(url, out = process.stdout) {
-  if (!out?.isTTY) return url;
-  const osc8 = Boolean(
-    process.env.WT_SESSION
-    || process.env.TERM_PROGRAM
-    || process.env.COLORTERM
-    || process.env.FORCE_HYPERLINK === '1'
-    || (process.platform !== 'win32' && process.env.TERM && process.env.TERM !== 'dumb'),
-  );
-  const styled = `\x1b[4;96m${url}\x1b[0m`;
-  return osc8 ? `\x1b]8;;${url}\x1b\\${styled}\x1b]8;;\x1b\\` : styled;
-}
-
-const shouldOpenBrowser = process.env.OPEN_BROWSER === '1'
-  || (process.env.OPEN_BROWSER !== '0'
-    && process.env.NO_BROWSER !== '1'
-    && !process.argv.includes('--no-browser')
-    && !process.execArgv.includes('--watch')
-    && !IS_CENTRAL
-    && (!IS_INSTANCE || IS_DESKTOP)
-    && (process.platform === 'win32' || process.platform === 'darwin' || Boolean(process.env.DISPLAY || process.env.WAYLAND_DISPLAY)));
-
-wss.on('error', () => {});
-server.on('error', (e) => {
-  const clientUrl = `http://localhost:${PORT}`;
-  if (e.code === 'EADDRINUSE') {
-    console.error(`Порт ${PORT} занят: сервер уже запущен? Клиент: ${fmtClickableUrl(clientUrl, process.stderr)}`);
-    if (shouldOpenBrowser) openBrowser(clientUrl);
-  } else {
-    console.error(e);
-  }
-  process.exit(1);
-});
-
-server.listen(PORT, LISTEN_HOST, () => {
-  const ident = IS_INSTANCE ? getIdentity() : null;
-  let ver = '';
-  try { ver = ` v${JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8')).version}`; } catch { /* ignore */ }
-  console.log(`◈ НейроАльфа${ver} запущена${IS_INSTANCE ? ` (${INSTANCE_KIND}) · машина ${ident.id || 'не активирована'} · центр ${ident.centralUrl}` : (IS_CENTRAL ? ' · центр' : '')}`);
-  const llm = activeModelInfo();
-  console.log(`  ИИ-стратег: ${llm.enabled ? `${llm.provider} · ${llm.model}` : 'выключен (Настройки → Модели ИИ)'}`);
-  if (!LISTEN_HOST || LISTEN_HOST === '0.0.0.0') for (const url of lanUrls()) console.log(`  В сети:     ${fmtClickableUrl(url)}`);
-  const clientUrl = `http://localhost:${PORT}`;
-  const enterHint = process.stdin?.isTTY && !IS_CENTRAL ? '  (Enter — открыть в браузере)' : '';
-  console.log(`  Клиент:     ${fmtClickableUrl(clientUrl)}${enterHint}`);
-  if (shouldOpenBrowser) openBrowser(clientUrl);
-  if (process.stdin?.isTTY && !IS_CENTRAL) {
-    process.stdin.on('data', () => openBrowser(clientUrl));
-    process.stdin.unref?.();
-  }
-});
-
-function openBrowser(url) {
-  const [cmd, args] = process.platform === 'win32' ? ['cmd', ['/c', 'start', '""', url]]
-    : process.platform === 'darwin' ? ['open', [url]] : ['xdg-open', [url]];
-  spawn(cmd, args, { detached: true, stdio: 'ignore', windowsHide: true, windowsVerbatimArguments: true }).on('error', () => {}).unref();
-}
-
-const shutdown = () => { live.suspend().finally(() => server.close(() => process.exit(0))); setTimeout(() => process.exit(0), 2000); };
-process.on('SIGINT', shutdown);
-process.on('SIGTERM', shutdown);
+// Copyright (c) 2026 Roman A. Perepelkin. All rights reserved. Proprietary software.
+import http from 'node:http';
+import fs from 'node:fs';
+import os from 'node:os';
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import express from 'express';
+import { WebSocketServer } from 'ws';
+import { ROOT, DATA_DIR, PORT, LISTEN_HOST, DEFAULT_CLOUD_URL } from './config.js';
+import { activeModelInfo } from './llm/client.js';
+import { registerLocalLlamaProvider } from './llm/providers.js';
+import { setLocalModelReadyHook, resumeSavedLocalEngineOnStartup, getLocalEngineQuickStatus } from './llm/local-engine.js';
+import { markStaleRuns, removeLegacyData, removeOrphanEvents, ensureSeedRun } from './db.js';
+import { createRouter } from './api/routes.js';
+import {
+  authMiddleware, activateLocalLicense, userFromRequest, runWithUser,
+  getTerminalLicenseState, startAutonomousLicenseWatcher,
+} from './auth/index.js';
+import { securityHeaders, setAppCsp, isCrossOrigin } from './security.js';
+import { live } from './model/live.js';
+import { runningResearch, runningStability } from './model/research.js';
+import { startNews } from './news/index.js';
+import { startNotifyPolling } from './notify/index.js';
+import { startBrokerScheduler } from './brokers/index.js';
+import { chatState } from './strategist/index.js';
+import { hub } from './hub.js';
+
+markStaleRuns();
+removeLegacyData();
+removeOrphanEvents();
+ensureSeedRun();
+
+setLocalModelReadyHook((info) => {
+  registerLocalLlamaProvider(info);
+  hub.emit({ type: 'llm:changed', llm: activeModelInfo() });
+  hub.emit({ type: 'chat:state', state: chatState() });
+});
+
+const app = express();
+app.disable('x-powered-by');
+app.use(express.json({ limit: '1mb' }));
+app.use(securityHeaders);
+app.use(authMiddleware);
+const server = http.createServer(app);
+const wss = new WebSocketServer({ server, path: '/ws' });
+
+hub.setSender((msg, { uid, global }) => {
+  const data = JSON.stringify(msg);
+  for (const c of wss.clients) {
+    if (c.readyState !== 1) continue;
+    if (global || c.uid === uid) c.send(data);
+  }
+});
+
+wss.on('connection', (ws, req) => {
+  if (isCrossOrigin(req)) {
+    ws.close(4403, 'forbidden origin');
+    return;
+  }
+  const user = userFromRequest(req);
+  if (!user) {
+    ws.close(4401, 'unauthorized');
+    return;
+  }
+  ws.uid = user.id;
+  runWithUser(user, () => {
+    ws.send(JSON.stringify({
+      type: 'hello',
+      live: live.status(),
+      chat: chatState(),
+      running: runningResearch(),
+      stabilityRunning: runningStability(),
+      llm: activeModelInfo(),
+      localLlm: getLocalEngineQuickStatus(),
+    }));
+  });
+});
+
+startAutonomousLicenseWatcher();
+resumeSavedLocalEngineOnStartup();
+live.resume();
+startNews();
+startNotifyPolling();
+startBrokerScheduler();
+
+const cliToken = process.env.NEUROALPHA_TOKEN || process.env.NEUROALPHA_API_KEY || '';
+if (cliToken && cliToken.startsWith('na_tok_')) {
+  activateLocalLicense(cliToken, process.env.PORTAL_URL || process.env.CLOUD_URL || '')
+    .then((lic) => console.log(`  ✓ Активирована лицензия: тариф «${lic.planName}» (${lic.email})`))
+    .catch((e) => console.warn(`  ⚠ Активация токена: ${e.message}`));
+}
+
+app.get('/healthz', (req, res) => res.json({ ok: true, app: 'neuroalpha' }));
+
+app.get(['/legal', '/legal.html'], (req, res) => {
+  const portalUrl = getTerminalLicenseState().portalUrl || DEFAULT_CLOUD_URL;
+  res.redirect(`${portalUrl}/legal`);
+});
+
+// Если терминал ещё не активирован токеном из ЛК ИЛИ открыт по внешней сети/на VPS без сессии — показываем экран активации / входа
+app.get(['/', '/index.html'], (req, res, next) => {
+  if (!req.user) {
+    setAppCsp(res);
+    return res.sendFile(path.join(ROOT, 'public', 'activate.html'));
+  }
+  setAppCsp(res);
+  return next();
+});
+
+app.use('/api', createRouter());
+app.use('/docs', express.static(path.join(ROOT, 'docs')));
+app.use(express.static(path.join(ROOT, 'public')));
+
+function openBrowser(url) {
+  try {
+    if (process.platform === 'win32') {
+      spawn('cmd', ['/c', 'start', '""', url], { detached: true, stdio: 'ignore', windowsHide: true, windowsVerbatimArguments: true }).on('error', () => {}).unref();
+    } else if (process.platform === 'darwin') {
+      spawn('open', [url], { detached: true, stdio: 'ignore' }).on('error', () => {}).unref();
+    } else if (process.env.DISPLAY || process.env.WAYLAND_DISPLAY) {
+      spawn('xdg-open', [url], { detached: true, stdio: 'ignore' }).on('error', () => {}).unref();
+    }
+  } catch { /* ignore */ }
+}
+
+function lanUrls() {
+  return Object.entries(os.networkInterfaces())
+    .filter(([name]) => !/vethernet|wsl|docker|hyper-v|virtualbox|vmware/i.test(name))
+    .flatMap(([, list]) => list || [])
+    .filter((a) => a && a.family === 'IPv4' && !a.internal)
+    .map((a) => `http://${a.address}:${PORT}`);
+}
+
+function fmtClickableUrl(url, out = process.stdout) {
+  if (!out?.isTTY) return url;
+  const osc8 = Boolean(
+    process.env.WT_SESSION
+    || process.env.TERM_PROGRAM
+    || process.env.COLORTERM
+    || process.env.FORCE_HYPERLINK === '1'
+    || (process.platform !== 'win32' && process.env.TERM && process.env.TERM !== 'dumb'),
+  );
+  const styled = `\x1b[4;96m${url}\x1b[0m`;
+  return osc8 ? `\x1b]8;;${url}\x1b\\${styled}\x1b]8;;\x1b\\` : styled;
+}
+
+const shouldOpenBrowser = process.env.OPEN_BROWSER === '1'
+  || (process.env.OPEN_BROWSER !== '0'
+    && process.env.NO_BROWSER !== '1'
+    && !process.argv.includes('--no-browser')
+    && !process.execArgv.includes('--watch')
+    && (process.platform === 'win32' || process.platform === 'darwin' || Boolean(process.env.DISPLAY || process.env.WAYLAND_DISPLAY)));
+
+wss.on('error', () => {});
+server.on('error', (e) => {
+  const clientUrl = `http://localhost:${PORT}`;
+  if (e.code === 'EADDRINUSE') {
+    console.error(`Порт ${PORT} занят: терминал уже запущен? Клиент: ${fmtClickableUrl(clientUrl, process.stderr)}`);
+    if (shouldOpenBrowser) openBrowser(clientUrl);
+  } else {
+    console.error(e);
+  }
+  process.exit(1);
+});
+
+server.listen(PORT, LISTEN_HOST, () => {
+  let ver = '';
+  try { ver = ` v${JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8')).version}`; } catch { /* ignore */ }
+  const lic = getTerminalLicenseState();
+  const licInfo = lic.valid
+    ? `${lic.planName}${lic.perpetual ? ' (бессрочно)' : ''}`
+    : 'лицензия не активна (торговля отключена)';
+  console.log(`◈ НейроАльфа Терминал${ver} запущен · ${licInfo}`);
+  console.log(`  Данные:     ${DATA_DIR}`);
+  const llm = activeModelInfo();
+  console.log(`  ИИ-стратег: ${llm.enabled ? `${llm.provider} · ${llm.model}` : 'выключен (Настройки → Модели ИИ)'}`);
+  if (!LISTEN_HOST || LISTEN_HOST === '0.0.0.0') for (const url of lanUrls()) console.log(`  В сети:     ${fmtClickableUrl(url)}`);
+  const clientUrl = `http://localhost:${PORT}`;
+  const enterHint = process.stdin?.isTTY ? '  (Enter — открыть в браузере)' : '';
+  console.log(`  Клиент:     ${fmtClickableUrl(clientUrl)}${enterHint}`);
+  if (shouldOpenBrowser) openBrowser(clientUrl);
+  if (process.stdin?.isTTY) {
+    process.stdin.on('data', () => openBrowser(clientUrl));
+    process.stdin.unref?.();
+  }
+});