diff --git a/hub_auth.py b/hub_auth.py
index bb928d6..c66ae60 100644
--- a/hub_auth.py
+++ b/hub_auth.py
@@ -11,8 +11,6 @@ import threading
 import time
 from typing import Any
 
-from flask import request
-
 # 中控打开实例链接有效期（秒），默认 2 小时
 HUB_SSO_TTL_SEC = int(os.getenv("HUB_SSO_TTL_SEC", "7200"))
 
@@ -25,10 +23,17 @@ def hub_bridge_token() -> str:
 
 
 def request_allowed(session_logged_in: bool, auth_disabled: bool) -> bool:
+    """各 Flask 实例 login_required / hub_bridge 用；延迟导入 flask，避免中控 FastAPI venv 强依赖 Flask。"""
     if auth_disabled or session_logged_in:
         return True
     tok = hub_bridge_token()
-    if tok and request.headers.get("X-Hub-Token") == tok:
+    if not tok:
+        return False
+    try:
+        from flask import request
+    except ImportError:
+        return False
+    if request.headers.get("X-Hub-Token") == tok:
         return True
     return False