rdsh-gateway 0.1.0 → 0.2.0

package/dist/join.js

@@ -0,0 +1,352 @@
+/**
+ * join.ts — `rdsh join <hub-url>`：出站隧道客户端（公网模式，M3）。
+ *
+ * 流程：spawn dsh（复用）→ 绑定（配对码轮询 或 --token 直填）→ WSS 隧道（?token=）
+ * → 帧循环（OPEN http/ws → 本地 dsh 转发 → 响应帧回传）→ 断线指数退避重连。
+ *
+ * 安全：只出站（不监听任何入站端口）；hub 认证在层 1，gateway 侧只认隧道内来源。
+ */
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { WebSocket } from "ws";
+import { FrameParser, FRAME_TYPE, encodeFrame, jsonPayload, parseJsonPayload } from "rdsh-tunnel";
+import { findDsh, spawnDsh } from "./spawn-dsh.js";
+import { rewriteHeadersForDsh } from "./proxy.js";
+const PENDING_POLL_MS = 5_000;
+const BIND_TIMEOUT_MS = 10 * 60 * 1000; // 配对码 10 分钟
+const HEARTBEAT_MS = 30_000;
+const RECONNECT_BASE_MS = 1_000;
+const RECONNECT_MAX_MS = 60_000;
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/** 绑定流程：POST /api/hosts/pending → 打印配对码 → 轮询取 host token。 */
+async function bind(hubUrl, insecure) {
+    const pendingRes = await hubRequest(hubUrl, "/api/hosts/pending", { method: "POST", insecure });
+    if (!pendingRes.ok) {
+        throw new Error(`hub rejected pending request: HTTP ${pendingRes.status}`);
+    }
+    const pending = pendingRes.body;
+    console.log(`rdsh join: pair code: ${pending.code}`);
+    console.log(`rdsh join: sign in to ${hubUrl} and enter this code (10 min) to bind this host.`);
+    console.log(`rdsh join: waiting for binding...`);
+    const deadline = Date.now() + BIND_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+        await sleep(PENDING_POLL_MS);
+        const res = await hubRequest(hubUrl, `/api/hosts/pending/${pending.pendingId}`, { method: "GET", insecure });
+        if (!res.ok)
+            continue;
+        const body = res.body;
+        if (body.status === "bound" && typeof body.token === "string") {
+            console.log("rdsh join: bound — establishing tunnel...");
+            return body.token;
+        }
+    }
+    throw new Error("binding timed out (10 min): re-run rdsh join to get a new code");
+}
+/** hub HTTP 调用（node:https 支持自签跳过校验 —— undici fetch 不受 NODE_TLS_REJECT_UNAUTHORIZED 影响）。 */
+function hubRequest(baseUrl, path, opts) {
+    const url = new URL(baseUrl + path);
+    const lib = url.protocol === "https:" ? httpsRequest : httpRequest;
+    return new Promise((resolve, reject) => {
+        const req = lib({
+            host: url.hostname,
+            port: url.port === "" ? undefined : Number(url.port),
+            path: url.pathname + url.search,
+            method: opts.method,
+            headers: { "content-type": "application/json" },
+            rejectUnauthorized: !opts.insecure,
+        }, (res) => {
+            const chunks = [];
+            res.on("data", (c) => chunks.push(c));
+            res.on("end", () => {
+                let body = {};
+                try {
+                    body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+                }
+                catch {
+                    /* 非 JSON */
+                }
+                resolve({ ok: res.statusCode !== undefined && res.statusCode >= 200 && res.statusCode < 300, status: res.statusCode ?? 0, body });
+            });
+            res.on("error", reject);
+        });
+        req.on("error", reject);
+        req.end(opts.method === "POST" ? "{}" : undefined);
+    });
+}
+export async function join(opts) {
+    const hubWsBase = opts.hubUrl.replace(/^https/, "wss").replace(/^http/, "ws");
+    const foundDsh = findDsh(opts.dshPath);
+    if (foundDsh === null) {
+        throw new Error("cannot find 'dsh' in PATH. Install DeepSeek Harness first, or pass --dsh <path>.");
+    }
+    const dsh = await spawnDsh(foundDsh);
+    const target = { host: "127.0.0.1", port: dsh.port };
+    const token = opts.token ?? (await bind(opts.hubUrl, opts.insecure === true));
+    console.log(`rdsh join: dsh web on 127.0.0.1:${dsh.port}`);
+    console.log(`rdsh join: connecting to ${opts.hubUrl}...`);
+    const parser = new FrameParser();
+    /** http 流：streamId → 本地请求（写请求体 / 结束）。 */
+    const httpStreams = new Map();
+    /** ws 流：streamId → 本地 ws 客户端（DATA 帧 → upstream）。 */
+    const wsStreams = new Map();
+    let shuttingDown = false;
+    let reconnectDelay = RECONNECT_BASE_MS;
+    let heartbeat;
+    const shutdown = async (signal) => {
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
+        console.log(`\nrdsh: received ${signal}, shutting down...`);
+        if (heartbeat !== undefined)
+            clearInterval(heartbeat);
+        await dsh.stop();
+        process.exit(0);
+    };
+    process.on("SIGINT", () => void shutdown("SIGINT"));
+    process.on("SIGTERM", () => void shutdown("SIGTERM"));
+    process.on("SIGHUP", () => void shutdown("SIGHUP"));
+    function handleFrame(frame, client) {
+        switch (frame.type) {
+            case FRAME_TYPE.PING: {
+                client.send(encodeFrame(FRAME_TYPE.PONG, frame.streamId, frame.payload));
+                return;
+            }
+            case FRAME_TYPE.PONG:
+                return;
+            case FRAME_TYPE.OPEN: {
+                handleOpen(frame, client);
+                return;
+            }
+            case FRAME_TYPE.DATA: {
+                const ws = wsStreams.get(frame.streamId);
+                if (ws !== undefined) {
+                    if (ws.upstream.readyState === ws.upstream.OPEN) {
+                        ws.upstream.send(frame.payload, { binary: true });
+                    }
+                    else {
+                        ws.queue.push(frame.payload);
+                    }
+                    return;
+                }
+                const http = httpStreams.get(frame.streamId);
+                if (http !== undefined)
+                    http.up.write(frame.payload);
+                return;
+            }
+            case FRAME_TYPE.CLOSE: {
+                closeStream(frame.streamId);
+                return;
+            }
+            case FRAME_TYPE.ERROR: {
+                closeStream(frame.streamId);
+                return;
+            }
+            default:
+                return;
+        }
+    }
+    function closeStream(streamId) {
+        const ws = wsStreams.get(streamId);
+        if (ws !== undefined) {
+            wsStreams.delete(streamId);
+            try {
+                ws.upstream.terminate();
+            }
+            catch {
+                /* 已关闭 */
+            }
+            return;
+        }
+        const http = httpStreams.get(streamId);
+        if (http !== undefined) {
+            httpStreams.delete(streamId);
+            http.up.end();
+        }
+    }
+    function handleOpen(frame, client) {
+        let kind;
+        let method = "GET";
+        let path = "/";
+        let headers = {};
+        try {
+            const p = parseJsonPayload(frame);
+            kind = p.kind;
+            if (typeof p.method === "string")
+                method = p.method;
+            if (typeof p.path === "string")
+                path = p.path;
+            if (typeof p.headers === "object" && p.headers !== null)
+                headers = p.headers;
+        }
+        catch {
+            client.send(encodeFrame(FRAME_TYPE.ERROR, frame.streamId, jsonPayload({ code: "BAD_OPEN", message: "malformed open" })));
+            return;
+        }
+        if (kind === "ws") {
+            openWsStream(frame, client, path, headers);
+            return;
+        }
+        if (kind !== "http") {
+            client.send(encodeFrame(FRAME_TYPE.ERROR, frame.streamId, jsonPayload({ code: "BAD_OPEN", message: "unknown kind" })));
+            return;
+        }
+        const streamId = frame.streamId;
+        // http 转发：本地 dsh（loopback http）
+        const up = httpRequest({
+            host: target.host,
+            port: target.port,
+            path,
+            method,
+            headers: rewriteHeadersForDsh(headers, target),
+        }, (upRes) => {
+            client.send(encodeFrame(FRAME_TYPE.OPEN, streamId, jsonPayload({
+                kind: "http",
+                status: upRes.statusCode ?? 502,
+                reason: upRes.statusMessage,
+                headers: normalizeRespHeaders(upRes.headers),
+            })));
+            upRes.on("data", (chunk) => {
+                if (client.readyState === client.OPEN) {
+                    client.send(encodeFrame(FRAME_TYPE.DATA, streamId, chunk));
+                }
+            });
+            upRes.on("end", () => {
+                if (client.readyState === client.OPEN) {
+                    client.send(encodeFrame(FRAME_TYPE.CLOSE, streamId, jsonPayload({ code: 0 })));
+                }
+                httpStreams.delete(streamId);
+            });
+            upRes.on("error", () => {
+                if (client.readyState === client.OPEN) {
+                    client.send(encodeFrame(FRAME_TYPE.CLOSE, streamId, jsonPayload({ code: 502, message: "upstream error" })));
+                }
+                httpStreams.delete(streamId);
+            });
+        });
+        up.on("error", () => {
+            if (client.readyState === client.OPEN) {
+                client.send(encodeFrame(FRAME_TYPE.ERROR, streamId, jsonPayload({ code: "UPSTREAM_UNREACHABLE", message: "dsh not reachable" })));
+            }
+            httpStreams.delete(streamId);
+        });
+        httpStreams.set(streamId, { up });
+    }
+    function openWsStream(frame, client, path, headers) {
+        const streamId = frame.streamId;
+        const upstream = new WebSocket(`ws://${target.host}:${target.port}${path}`, {
+            headers: rewriteHeadersForDsh(headers, target),
+        });
+        const queue = [];
+        wsStreams.set(streamId, { upstream, queue });
+        upstream.on("open", () => {
+            for (const q of queue)
+                upstream.send(q, { binary: true });
+            queue.length = 0;
+        });
+        upstream.on("message", (data, isBinary) => {
+            const buf = Array.isArray(data)
+                ? Buffer.concat(data)
+                : Buffer.isBuffer(data)
+                    ? data
+                    : Buffer.from(data);
+            if (client.readyState === client.OPEN) {
+                client.send(encodeFrame(FRAME_TYPE.DATA, streamId, buf));
+            }
+        });
+        const cleanup = () => {
+            wsStreams.delete(streamId);
+            if (client.readyState === client.OPEN) {
+                client.send(encodeFrame(FRAME_TYPE.CLOSE, streamId, jsonPayload({ code: 0 })));
+            }
+        };
+        upstream.on("close", cleanup);
+        upstream.on("error", cleanup);
+    }
+    function connect() {
+        if (shuttingDown)
+            return;
+        const url = `${hubWsBase}/tunnel?token=${encodeURIComponent(token)}`;
+        const client = new WebSocket(url, { rejectUnauthorized: opts.insecure !== true });
+        client.on("open", () => {
+            reconnectDelay = RECONNECT_BASE_MS;
+            console.log("rdsh join: tunnel established (heartbeat 30s)");
+            if (heartbeat !== undefined)
+                clearInterval(heartbeat);
+            heartbeat = setInterval(() => {
+                if (client.readyState === client.OPEN) {
+                    client.send(encodeFrame(FRAME_TYPE.PING, 0, jsonPayload({ ts: Date.now() })));
+                }
+            }, HEARTBEAT_MS);
+        });
+        client.on("message", (data, isBinary) => {
+            if (!isBinary)
+                return;
+            const chunk = Array.isArray(data)
+                ? Buffer.concat(data)
+                : Buffer.isBuffer(data)
+                    ? data
+                    : Buffer.from(data);
+            let frames;
+            try {
+                frames = parser.push(chunk);
+            }
+            catch {
+                client.terminate();
+                return;
+            }
+            for (const frame of frames)
+                handleFrame(frame, client);
+        });
+        client.on("close", () => {
+            if (heartbeat !== undefined) {
+                clearInterval(heartbeat);
+                heartbeat = undefined;
+            }
+            for (const s of httpStreams.values()) {
+                try {
+                    s.up.destroy();
+                }
+                catch {
+                    /* 已断 */
+                }
+            }
+            httpStreams.clear();
+            for (const s of wsStreams.values()) {
+                try {
+                    s.upstream.terminate();
+                }
+                catch {
+                    /* 已断 */
+                }
+            }
+            wsStreams.clear();
+            if (shuttingDown)
+                return;
+            console.log(`rdsh join: tunnel lost — reconnecting in ${Math.round(reconnectDelay / 1000)}s...`);
+            setTimeout(connect, reconnectDelay + Math.random() * 500);
+            reconnectDelay = Math.min(reconnectDelay * 2, RECONNECT_MAX_MS);
+        });
+        client.on("error", () => {
+            try {
+                client.terminate();
+            }
+            catch {
+                /* 已关闭 */
+            }
+        });
+    }
+    connect();
+}
+function normalizeRespHeaders(headers) {
+    const out = {};
+    for (const [k, v] of Object.entries(headers)) {
+        if (v === undefined)
+            continue;
+        // hop-by-hop 头由各自连接管理，不透传
+        if (k === "transfer-encoding" || k === "connection" || k === "keep-alive" || k === "upgrade")
+            continue;
+        out[k] = Array.isArray(v) ? v : String(v);
+    }
+    return out;
+}
+//# sourceMappingURL=join.js.map

package/dist/login-page.d.ts

@@ -0,0 +1,4 @@
+/**
+ * login-page.ts — 用户名/密码登录页（内联纯 HTML/CSS/JS，零外部资源）。
+ */
+export declare function loginPageHtml(): string;

package/dist/login-page.js

@@ -0,0 +1,86 @@
+/**
+ * login-page.ts — 用户名/密码登录页（内联纯 HTML/CSS/JS，零外部资源）。
+ */
+export function loginPageHtml() {
+    return `<!doctype html>
+<html lang="zh-CN">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>rdsh 登录</title>
+<style>
+  :root { color-scheme: dark; }
+  * { box-sizing: border-box; margin: 0; }
+  body {
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+    background: #0f172a; color: #e2e8f0; min-height: 100vh;
+    display: flex; align-items: center; justify-content: center; padding: 24px;
+  }
+  main { width: 100%; max-width: 340px; text-align: center; }
+  .logo { font-size: 40px; font-weight: 800; color: #38bdf8; letter-spacing: 1px; }
+  .hint { margin: 16px 0 24px; color: #94a3b8; font-size: 14px; line-height: 1.6; }
+  label { display: block; text-align: left; color: #94a3b8; font-size: 13px; margin: 12px 0 6px; }
+  input {
+    width: 100%; padding: 12px; font-size: 16px;
+    background: #1e293b; color: #f1f5f9; border: 1px solid #334155; border-radius: 10px;
+    outline: none;
+  }
+  input:focus { border-color: #38bdf8; }
+  button {
+    width: 100%; margin-top: 18px; padding: 13px; font-size: 16px; font-weight: 600;
+    background: #0284c7; color: #fff; border: 0; border-radius: 10px; cursor: pointer;
+  }
+  button:disabled { opacity: .5; cursor: wait; }
+  .error { margin-top: 14px; color: #f87171; font-size: 14px; min-height: 20px; }
+</style>
+</head>
+<body>
+<main>
+  <div class="logo">rdsh</div>
+  <p class="hint">登录以访问 DeepSeek Harness 智能体。</p>
+  <form id="login-form">
+    <label for="name">用户名</label>
+    <input id="name" name="name" autocomplete="username" autofocus required>
+    <label for="password">密码</label>
+    <input id="password" name="password" type="password" autocomplete="current-password" required>
+    <button type="submit" id="submit">登录</button>
+  </form>
+  <p class="error" id="error" hidden></p>
+</main>
+<script>
+  const form = document.getElementById("login-form");
+  const nameInput = document.getElementById("name");
+  const passInput = document.getElementById("password");
+  const submit = document.getElementById("submit");
+  const error = document.getElementById("error");
+  form.addEventListener("submit", async (e) => {
+    e.preventDefault();
+    error.hidden = true;
+    submit.disabled = true;
+    try {
+      const res = await fetch("/login", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ name: nameInput.value.trim(), password: passInput.value }),
+      });
+      if (res.ok) { location.href = "/"; return; }
+      if (res.status === 429) {
+        const secs = Number(res.headers.get("Retry-After") || 600);
+        error.textContent = "尝试次数过多，请 " + Math.ceil(secs / 60) + " 分钟后再试";
+      } else {
+        error.textContent = "用户名或密码错误";
+      }
+      error.hidden = false;
+    } catch {
+      error.textContent = "网络错误，请重试";
+      error.hidden = false;
+    } finally {
+      submit.disabled = false;
+      passInput.select();
+    }
+  });
+</script>
+</body>
+</html>`;
+}
+//# sourceMappingURL=login-page.js.map

package/dist/proxy.d.ts

@@ -12,6 +12,13 @@ export interface ForwardOptions {
      */
     htmlInject?: string;
 }
+/**
+ * 重写转发头以通过 DSH 围栏（isTrustedApiRequest 要求 Host/Origin 一致且为 loopback）。
+ * - Host → 127.0.0.1:<port>（M1 事实：DSH 只信任 loopback/trusted Host）
+ * - Origin 同步改写为 http://127.0.0.1:<port>（浏览器视角仍同源，不影响 CORS）
+ * 供 forwardHttp / createUpgradeProxy / join.ts（隧道→本地转发）复用。
+ */
+export declare function rewriteHeadersForDsh(headers: Record<string, string | string[] | undefined>, target: ProxyTarget): Record<string, string | string[] | undefined>;
 /** 转发一个 HTTP 请求（含 SSE：响应流式写回，零缓冲）。 */
 export declare function forwardHttp(req: IncomingMessage, res: ServerResponse, target: ProxyTarget, opts?: ForwardOptions): void;
 /**

package/dist/proxy.js

@@ -6,17 +6,23 @@
  */
 import { request } from "node:http";
 import { WebSocket, WebSocketServer } from "ws";
+/**
+ * 重写转发头以通过 DSH 围栏（isTrustedApiRequest 要求 Host/Origin 一致且为 loopback）。
+ * - Host → 127.0.0.1:<port>（M1 事实：DSH 只信任 loopback/trusted Host）
+ * - Origin 同步改写为 http://127.0.0.1:<port>（浏览器视角仍同源，不影响 CORS）
+ * 供 forwardHttp / createUpgradeProxy / join.ts（隧道→本地转发）复用。
+ */
+export function rewriteHeadersForDsh(headers, target) {
+    const out = { ...headers };
+    out.host = `${target.host}:${target.port}`;
+    if (out.origin !== undefined) {
+        out.origin = `http://${target.host}:${target.port}`;
+    }
+    return out;
+}
 /** 转发一个 HTTP 请求（含 SSE：响应流式写回，零缓冲）。 */
 export function forwardHttp(req, res, target, opts) {
-    const headers = { ...req.headers };
-    headers.host = `${target.host}:${target.port}`;
-    // DSH 围栏（isTrustedApiRequest）要求 Origin.host === Host.host。
-    // 浏览器 Origin 是网关的 LAN 地址（如 http://192.168.x.x:8443），而 Host 已被
-    // 重写为 loopback —— 不一致会 403。改写 Origin 使其与 Host 一致；浏览器视角
-    // 请求仍是发往网关的同源请求，不影响 CORS。
-    if (headers.origin !== undefined) {
-        headers.origin = `http://${target.host}:${target.port}`;
-    }
+    const headers = rewriteHeadersForDsh(req.headers, target);
     const upstream = request({
         host: target.host,
         port: target.port,
@@ -77,12 +83,7 @@ export function forwardHttp(req, res, target, opts) {
 export function createUpgradeProxy(target) {
     const wss = new WebSocketServer({ noServer: true });
     wss.on("connection", (clientWs, req) => {
-        const headers = { ...req.headers };
-        headers.host = `${target.host}:${target.port}`;
-        // 同 forwardHttp：改写 Origin 使其与重写后的 Host 一致，通过 DSH 围栏校验
-        if (headers.origin !== undefined) {
-            headers.origin = `http://${target.host}:${target.port}`;
-        }
+        const headers = rewriteHeadersForDsh(req.headers, target);
         const upstreamUrl = `ws://${target.host}:${target.port}${req.url ?? "/"}`;
         const upstream = new WebSocket(upstreamUrl, { headers });
         const queue = [];

package/dist/serve.d.ts

@@ -1,15 +1,16 @@
 export interface ServeOptions {
-    host: string;
-    port: number;
+    host?: string;
+    port?: number;
     pairCode?: string;
-    sessionTtlSeconds: number;
+    sessionTtlSeconds?: number;
     dshPath?: string;
     reset?: boolean;
-    /** true = 跳过配对码认证（仅限完全可信网络！打印警告） */
     noCode?: boolean;
+    /** 配置文件路径（--config / $RDSH_CONFIG / 默认 ~/.rdsh/config.json） */
+    configPath?: string;
 }
 /**
- * 启动 LAN 认证网关。进程常驻：SIGINT/SIGTERM 时先关网关再终止 dsh 子进程。
- * 启动失败（dsh 缺失/启动失败/端口占用）→ 抛错（CLI 负责以非零码退出）。
+ * 启动网关。进程常驻：SIGINT/SIGTERM/SIGHUP 时先关网关再终止 dsh 子进程。
+ * 启动失败（dsh 缺失/TLS 缺失/端口占用/安全约束）→ 抛错（CLI 以非零码退出）。
  */
 export declare function serve(opts: ServeOptions): Promise<void>;

package/dist/serve.js

@@ -1,49 +1,88 @@
 /**
- * serve.ts — `rdsh serve` 编排：spawn dsh → 启动网关 → 打印启动信息 → 生命周期。
+ * serve.ts — `rdsh serve` 编排：加载 config（CLI 覆盖）→ 解析 TLS → 启动网关 → 生命周期。
  */
 import { networkInterfaces } from "node:os";
 import { startGateway } from "./server.js";
 import { findDsh, spawnDsh } from "./spawn-dsh.js";
+import { loadConfig, resolveConfigPath } from "./config.js";
+import { UserManager } from "./auth.js";
+import { loadTls } from "./tls.js";
 /**
- * 启动 LAN 认证网关。进程常驻：SIGINT/SIGTERM 时先关网关再终止 dsh 子进程。
- * 启动失败（dsh 缺失/启动失败/端口占用）→ 抛错（CLI 负责以非零码退出）。
+ * 启动网关。进程常驻：SIGINT/SIGTERM/SIGHUP 时先关网关再终止 dsh 子进程。
+ * 启动失败（dsh 缺失/TLS 缺失/端口占用/安全约束）→ 抛错（CLI 以非零码退出）。
  */
 export async function serve(opts) {
-    const dshPath = findDsh(opts.dshPath);
-    if (dshPath === null) {
-        throw new Error("cannot find 'dsh' in PATH. Install DeepSeek Harness first, or pass --dsh <path>.");
+    const configPath = resolveConfigPath(opts.configPath);
+    const config = await loadConfig(configPath);
+    // CLI 参数优先于 config（持久配置在 config，CLI 做临时覆盖/调试）
+    const host = opts.host ?? config.host;
+    const port = opts.port ?? config.port;
+    const sessionTtlSeconds = opts.sessionTtlSeconds ?? config.sessionTtlSeconds;
+    const dshPath = opts.dshPath ?? config.dshPath;
+    const authMode = opts.noCode ? "none" : config.auth.mode;
+    const pairCode = opts.pairCode ?? config.auth.pairCode;
+    const foundDsh = findDsh(dshPath);
+    if (foundDsh === null) {
+        throw new Error("cannot find 'dsh' in PATH. Install DeepSeek Harness first, or set dshPath in config / pass --dsh <path>.");
     }
-    const dsh = await spawnDsh(dshPath);
-    if (opts.noCode) {
-        console.warn("\n⚠  rdsh: --no-code 已启用 —— 跳过配对码认证！\n" +
-            "     任何能访问该端口的设备都将直接操作 DSH（可执行任意命令）。\n" +
-            "     仅限完全可信的局域网（家庭/公司内网）使用！\n");
+    const dsh = await spawnDsh(foundDsh);
+    // TLS 决策：有 tls.cert/key → https；无 → http（behindProxy 或 pair/none）。
+    // password + http + 非反代 → server.ts 安全约束拒绝启动（需自行提供证书）。
+    const tlsMaterial = await loadTls(config.tls, config.behindProxy);
+    const userManager = authMode === "password" ? new UserManager(configPath) : undefined;
+    if (opts.noCode || authMode === "none") {
+        console.warn("\n⚠  rdsh: 认证已禁用（auth.mode=none / --no-code）—— 任何能访问该端口的设备将直接操作 DSH！\n" +
+            "     仅限完全可信网络！\n");
+    }
+    let gateway;
+    try {
+        gateway = await startGateway({
+            host,
+            port,
+            pairCode,
+            sessionTtlSeconds,
+            dshPort: dsh.port,
+            reset: opts.reset,
+            noCode: opts.noCode,
+            authMode,
+            authVersion: config.auth.version,
+            allowFrom: config.allowFrom,
+            behindProxy: config.behindProxy,
+            tlsMaterial,
+            userManager,
+            configPath,
+        });
+    }
+    catch (err) {
+        // 启动失败（端口占用 / 安全约束拒绝）→ 先停掉已 spawn 的 dsh，避免残留
+        await dsh.stop().catch(() => undefined);
+        throw err;
     }
-    const gateway = await startGateway({
-        host: opts.host,
-        port: opts.port,
-        pairCode: opts.pairCode,
-        sessionTtlSeconds: opts.sessionTtlSeconds,
-        dshPort: dsh.port,
-        reset: opts.reset,
-        noCode: opts.noCode,
-    });
     const lan = lanAddresses();
-    const displayHost = opts.host === "0.0.0.0" ? (lan[0] ?? "127.0.0.1") : opts.host;
-    console.log(`rdsh serve: gateway on http://${displayHost}:${gateway.actualPort}`);
-    if (opts.host === "0.0.0.0" && lan.length > 0) {
-        console.log(`rdsh serve: LAN: ${lan.map((ip) => `http://${ip}:${gateway.actualPort}`).join(", ")}`);
+    const scheme = tlsMaterial === null ? "http" : "https";
+    const displayHost = host === "0.0.0.0" ? (lan[0] ?? "127.0.0.1") : host;
+    console.log(`rdsh serve: gateway on ${scheme}://${displayHost}:${gateway.actualPort}`);
+    if (host === "0.0.0.0" && lan.length > 0) {
+        console.log(`rdsh serve: LAN: ${lan.map((ip) => `${scheme}://${ip}:${gateway.actualPort}`).join(", ")}`);
     }
     console.log(`rdsh serve: dsh web on 127.0.0.1:${dsh.port}`);
-    console.log(`rdsh serve: pair code: ${gateway.pair.codeValue()}`);
-    console.log("rdsh serve: enter the pair code in the browser on your other device.");
+    console.log(`rdsh serve: auth mode: ${authMode}${authMode === "password" ? ` (config: ${configPath})` : authMode === "pair" ? ` (pair code: ${gateway.pair.codeValue()})` : ""}`);
+    if (config.allowFrom.length > 0)
+        console.log(`rdsh serve: allow_from: ${config.allowFrom.join(", ")}`);
+    if (tlsMaterial !== null)
+        console.log(`rdsh serve: TLS: custom cert (${config.tls.cert})`);
+    if (config.behindProxy)
+        console.log("rdsh serve: behind_proxy: true (TLS terminated by reverse proxy)");
+    if (authMode === "password")
+        console.log("rdsh serve: sign in with `rdsh user` credentials in the browser login page.");
+    else if (authMode === "pair")
+        console.log("rdsh serve: enter the pair code in the browser on your other device.");
     let shuttingDown = false;
     const shutdown = async (signal) => {
         if (shuttingDown)
-            return; // 幂等：重复信号不再处理
+            return;
         shuttingDown = true;
         console.log(`\nrdsh: received ${signal}, shutting down...`);
-        // 停止接受新连接；残留活跃连接由进程退出时由 OS 清理
         gateway.server.close();
         let code;
         try {
@@ -52,12 +91,10 @@ export async function serve(opts) {
         catch {
             code = 1;
         }
-        // 必须显式退出：仅设 exitCode 会因残留句柄（信号监听器/管道）而挂住
         process.exit(code === 0 ? 0 : 1);
     };
     process.on("SIGINT", () => void shutdown("SIGINT"));
     process.on("SIGTERM", () => void shutdown("SIGTERM"));
-    // 覆盖默认行为：SIGHUP（关终端/断 SSH）也优雅清理，避免 dsh 子进程成为孤儿
     process.on("SIGHUP", () => void shutdown("SIGHUP"));
 }
 function lanAddresses() {