xianyu-hunter-hermes-skill/skill/xianyu-hunter-monitor/references/web-login-lan-and-kill-stale-server-2026-05.md

Web login button + LAN exposure notes (2026-05)

Session learning from BOSS testing xianyu-hunter login from a LAN browser.

Symptoms

• Dashboard was reachable from LAN at http://192.168.2.69:3000, because lsof -nP -iTCP:3000 -sTCP:LISTEN showed TCP *:3000 (LISTEN).
• BOSS could not find a login entry in the Web UI because public/index.html only had + 新建任务.
• node tools/xianyu_ops.mjs stop can report no-recorded-server / lose .runtime state while an old node server.mjs is still listening on port 3000. In that case new code is not active until the old PID is killed.

Fix pattern

1. Add server imports:

import { checkLogin } from './lib/login.mjs';
import { closeBrowser } from './lib/browser.mjs';

2. Add API routes before server.listen:

app.post('/api/login/open', async (req, res) => {
  try {
    const logs = [];
    const ok = await checkLogin(msg => logs.push(msg));
    res.json({ ok, loggedIn: ok, logs });
  } catch (err) {
    res.status(500).json({ ok: false, error: err.message });
  }
});

app.post('/api/login/close-browser', async (req, res) => {
  await closeBrowser();
  res.json({ ok: true });
});

3. Add a Web UI header button:

<button class="btn" onclick="openLoginWindow()">打开闲鱼登录窗口</button>

4. Add openLoginWindow() in public/app.js near apiPost():

async function openLoginWindow() {
  alert('即将在 Mac 桌面打开一个 Chromium 闲鱼窗口；请通过远程桌面/屏幕共享在那个窗口里完成扫码或验证码登录。');
  try {
    const result = await apiPost('/api/login/open', {});
    const logs = (result.logs || []).join('\n');
    if (result.loggedIn) {
      alert(`登录状态正常。\n\n${logs}`);
    } else {
      alert(`还未检测到登录完成，请在弹出的 Chromium 窗口里登录后再试。\n\n${logs}`);
    }
  } catch (err) {
    alert(`打开登录窗口失败：${err.message}`);
  }
}

Verification

cd /Users/chick/.Hermes/workspace/research/xianyu-hunter
node --check server.mjs
node --check public/app.js
lsof -nP -iTCP:3000 -sTCP:LISTEN
curl -sS http://127.0.0.1:3000/ | grep -o '打开闲鱼登录窗口' | head -1
curl -sS -X POST http://127.0.0.1:3000/api/login/close-browser

If curl -X POST /api/login/close-browser returns an HTML Cannot POST page, the stale server is still running. Kill the actual listening PID from lsof and restart:

kill -TERM <pid>
sleep 2
kill -KILL <pid> 2>/dev/null || true
PORT=3000 node server.mjs

Run the final server as a tracked background process in Hermes rather than using shell-level nohup wrappers.