@hyzyn/dsh-tty 0.18.3 → 0.19.1

package/scripts/probe-smoke.mjs

@@ -0,0 +1,143 @@
+#!/usr/bin/env node
+/**
+ * @hyzyn/dsh-tty — probe 冒烟：内存 SSH server（ssh2.Server password 认证
+ * test/secret）× 真实 lib/probe.js 端到端。验证 probe 分类：
+ *   P1 正确密码 + 无 store → auth.ok=true，hostkey.state='matched'（只比对不落盘）
+ *   P2 正确密码 + store → hostkey.state='recorded'（TOFU 记录新指纹）
+ *   P3 错误密码 → auth.ok=false，error 含「认证被拒绝」
+ *   P4 端口未监听（TCP 层）→ tcp.ok=false，error 含「连接被拒绝」
+ *   P5 DNS 解析失败 → tcp.ok=false，error 含「DNS」
+ *   P6 TOFU mismatch：同 host:port 换服务器 host key → hostkey.state='mismatch'
+ *      （含指引文案与 known/current 指纹），auth.ok=false
+ *   P7 TCP 通但无 SSH banner（裸 TCP 服务）→ auth.ok=false（tcp.ok=true）
+ *
+ * 用法：pnpm --filter @hyzyn/dsh-tty build && node scripts/probe-smoke.mjs
+ * 退出码：0 = 全部 PASS，1 = 任一 FAIL。
+ */
+import { generateKeyPairSync } from 'node:crypto'
+import net from 'node:net'
+import ssh2 from 'ssh2'
+import { probeSsh } from '../lib/probe.js'
+import { TEST_PASSWORD, TEST_USER } from './lib/test-sshd.mjs'
+
+const RESULTS = []
+function pass(name) { RESULTS.push(['PASS', name]); console.log('  ✔ PASS  ' + name) }
+function fail(name, detail) { RESULTS.push(['FAIL', name, detail]); console.error('  ✘ FAIL  ' + name + (detail ? ' — ' + detail : '')) }
+
+/* 一次性内存 sshd（password 认证）；只认证不开 shell（probe 不需要） */
+function startSshd(hostKey, listenPort) {
+  return new Promise((resolve, reject) => {
+    const server = new ssh2.Server({ hostKeys: [hostKey] }, (client) => {
+      client.on('authentication', (ctx) => {
+        if (ctx.method === 'password' && ctx.username === TEST_USER && ctx.password === TEST_PASSWORD) ctx.accept()
+        else ctx.reject()
+      })
+      client.on('ready', () => { /* probe 不开 channel */ })
+      client.on('error', () => { /* 忽略 */ })
+    })
+    server.once('error', reject)
+    const onListen = () => resolve({ server, port: server.address().port })
+    if (listenPort !== undefined) server.listen(listenPort, '127.0.0.1', onListen)
+    else server.listen(0, '127.0.0.1', onListen)
+  })
+}
+/** 彻底关停：closeAllConnections 释放残留连接（probe 的 client 已 end，但
+ *  ssh2 Server 侧 socket 可能仍占用端口，必须强关才可同端口复用）。 */
+function closeSshd(s) {
+  return new Promise((resolve) => {
+    const timer = setTimeout(resolve, 3000).unref()
+    s.server.close(() => {
+      clearTimeout(timer)
+      resolve()
+    })
+    s.server.closeAllConnections?.()
+  })
+}
+
+const keyA = generateKeyPairSync('rsa', { modulusLength: 2048, privateKeyEncoding: { type: 'pkcs1', format: 'pem' } }).privateKey
+const keyB = generateKeyPairSync('rsa', { modulusLength: 2048, privateKeyEncoding: { type: 'pkcs1', format: 'pem' } }).privateKey
+
+/* 内存 hostKeyStore */
+// 0.19.0 起 HostKeyStore.get 返回该 host:port 的指纹集合（一机多把钥匙）
+function makeStore() {
+  const map = new Map()
+  return {
+    get: (host, port) => {
+      const fps = map.get(host + ':' + port)
+      return fps === undefined ? undefined : [fps]
+    },
+    record: (host, port, fingerprint) => { map.set(host + ':' + port, fingerprint) },
+    _dump: () => map,
+  }
+}
+
+async function main() {
+  const host = '127.0.0.1'
+  const sshd = await startSshd(keyA)
+  const port = sshd.port
+  const spec = { host, port, username: TEST_USER, auth: 'password', password: TEST_PASSWORD }
+  const store = makeStore()
+
+  // P1 成功无 store
+  const p1 = await probeSsh(spec, undefined)
+  if (p1.auth.ok === true && p1.tcp.ok === true && p1.hostkey.state === 'matched') pass('P1 正确密码（无 store）→ auth.ok / hostkey.matched')
+  else fail('P1 正确密码（无 store）', JSON.stringify(p1))
+
+  // P2 成功 + store 记录
+  const p2 = await probeSsh(spec, store)
+  const recorded = store._dump().get(host + ':' + port)
+  if (p2.auth.ok === true && p2.hostkey.state === 'recorded' && typeof recorded === 'string' && recorded.length === 64) pass('P2 正确密码 + store → hostkey.recorded（指纹已记录）')
+  else fail('P2 正确密码 + store', JSON.stringify(p2) + ' / store=' + String(recorded))
+
+  // P3 错误密码
+  const p3 = await probeSsh({ ...spec, password: 'wrong' }, undefined)
+  if (p3.auth.ok === false && /认证被拒绝/.test(p3.auth.error || '')) pass('P3 错误密码 → 认证被拒绝')
+  else fail('P3 错误密码', JSON.stringify(p3))
+
+  // P6 TOFU mismatch：关掉 keyA 服务端，同端口换 keyB
+  const p6port = port
+  await closeSshd(sshd)
+  const sshdB = await startSshd(keyB, p6port)
+  const store6 = makeStore()
+  const first6 = await probeSsh({ ...spec, port: p6port }, store6)
+  if (first6.hostkey.state !== 'recorded') fail('P6 预记录', JSON.stringify(first6))
+  await closeSshd(sshdB)
+  const sshdA2 = await startSshd(keyA, p6port) // 同 host:port 换回 keyA → 指纹与 store6 不一致
+  const p6 = await probeSsh({ ...spec, port: p6port }, store6)
+  const known = store6._dump().get(host + ':' + p6port)
+  if (p6.auth.ok === false && p6.hostkey.state === 'mismatch' && typeof p6.hostkey.error === 'string' && p6.hostkey.error.includes('MITM') && Array.isArray(p6.hostkey.known) && p6.hostkey.known.length === 1 && p6.hostkey.known[0] === known) pass('P6 host key 变更 → mismatch + 指引')
+  else fail('P6 host key 变更', JSON.stringify(p6) + ' / known=' + String(known))
+  await closeSshd(sshdA2)
+
+  // P4 TCP 拒绝（未监听端口）
+  const closed = net.createServer()
+  await new Promise((resolve) => closed.listen(0, '127.0.0.1', resolve))
+  const deadPort = closed.address().port
+  await new Promise((resolve) => closed.close(resolve))
+  const p4 = await probeSsh({ ...spec, port: deadPort }, undefined)
+  if (p4.tcp.ok === false && p4.auth.ok === false && /拒绝|ECONNREFUSED/.test((p4.tcp.error || '') + (p4.auth.error || ''))) pass('P4 端口未监听 → tcp 拒绝')
+  else fail('P4 端口未监听', JSON.stringify(p4))
+
+  // P5 DNS 失败
+  const p5 = await probeSsh({ ...spec, host: 'no-such-host.invalid' }, undefined)
+  if (p5.tcp.ok === false && /DNS/.test(p5.tcp.error || '')) pass('P5 DNS 解析失败 → tcp DNS')
+  else fail('P5 DNS 解析失败', JSON.stringify(p5))
+
+  // P7 TCP 通但无 SSH banner（裸 TCP 服务）
+  const plain = net.createServer((sock) => { sock.on('error', () => {}) })
+  await new Promise((resolve) => plain.listen(0, '127.0.0.1', resolve))
+  const plainPort = plain.address().port
+  const p7 = await probeSsh({ ...spec, port: plainPort }, undefined)
+  if (p7.tcp.ok === true && p7.auth.ok === false) pass('P7 裸 TCP（无 SSH）→ tcp 通 + auth 失败')
+  else fail('P7 裸 TCP', JSON.stringify(p7))
+  await new Promise((resolve) => plain.close(resolve))
+
+  const failedCount = RESULTS.filter(([kind]) => kind === 'FAIL').length
+  console.log(failedCount === 0 ? '\nprobe smoke: 全部 PASS' : `\nprobe smoke: ${failedCount} 个 FAIL`)
+  process.exit(failedCount === 0 ? 0 : 1)
+}
+
+main().catch((error) => {
+  console.error('[probe-smoke] 未捕获错误: ' + (error && error.stack ? error.stack : error))
+  process.exit(2)
+})

package/scripts/probe.mjs

@@ -0,0 +1,240 @@
+#!/usr/bin/env node
+/**
+ * @hyzyn/dsh-tty — M0 验证探针（standalone，不依赖 dsh web 宿主）。
+ *
+ * 验证四个关键假设：
+ *   A1. ctx.subprocess.spawnTerminal 能用 $SHELL 起真实 PTY，output 流能收到输出；
+ *   A2. spec.env 里覆盖 TERM=xterm-256color 能压过 node-pty 的 name:"dumb"（TUI 必需）；
+ *   A3. (handle).terminal.resize(cols, rows) 透传 node-pty 原生 resize 生效（DSH 未暴露该 API）；
+ *   A4. webServer.registerUpgrade + ws 的 WebSocketServer({noServer:true}) 握手端到端可用。
+ *
+ * 用法：pnpm --filter @hyzyn/dsh-tty probe
+ * 退出码：0 = 全部 PASS，1 = 任一 FAIL。
+ */
+import { Context } from '@deepseek-ai/cordis'
+import WebServerRuntime from '@deepseek-ai/dsh-host-webserver'
+import { LocalSubprocessRuntime } from '@deepseek-ai/dsh-subprocess-local'
+import WebSocket, { WebSocketServer } from 'ws'
+
+const RESULTS = []
+function pass(name) { RESULTS.push(['PASS', name]); console.log('  ✔ PASS  ' + name) }
+function fail(name, detail) { RESULTS.push(['FAIL', name, detail]); console.error('  ✘ FAIL  ' + name + (detail ? ' — ' + detail : '')) }
+
+/** 累积终端输出直到匹配正则，超时 reject。 */
+function expectOutput(handle, re, timeoutMs = 8000) {
+  return new Promise((resolve, reject) => {
+    let buffer = ''
+    const timer = setTimeout(() => {
+      handle.output.off('data', onData)
+      reject(new Error(`timeout waiting for ${re}; got: ${JSON.stringify(buffer.slice(-300))}`))
+    }, timeoutMs)
+    const onData = (chunk) => {
+      buffer += chunk.toString('utf8')
+      const match = buffer.match(re)
+      if (match) {
+        clearTimeout(timer)
+        handle.output.off('data', onData)
+        resolve(match)
+      }
+    }
+    handle.output.on('data', onData)
+  })
+}
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+
+/**
+ * 构造 shell argv。DSH 的 spawnTerminal 硬编码 node-pty name:"dumb"，且 node-pty
+ * 里 name 优先于 env.TERM——必须在 exec 真正的 shell 之前 export，才能让
+ * vim/htop 等 TUI 拿到 xterm-256color（M0 A2 实测结论）。
+ */
+function shellArgv(shell, { term = 'xterm-256color', colorTerm = 'truecolor' } = {}) {
+  return [shell, '-c', `export TERM='${term}'; export COLORTERM='${colorTerm}'; exec "${shell}"`]
+}
+
+async function testPty(app) {
+  console.log('\n[1/2] PTY 基础能力（spawnTerminal + TERM + resize）')
+  const shell = process.env.SHELL || '/bin/zsh'
+  const handle = await app.subprocess.spawnTerminal({
+    argv: shellArgv(shell),
+    rows: 24,
+    cols: 80,
+    cwd: process.cwd(),
+    env: { TERM: 'xterm-256color', COLORTERM: 'truecolor' },
+    graceMs: 3000,
+  })
+  console.log(`  spawned ${shell} pid=${handle.pid}`)
+
+  // 关掉终端回显：避免「输入行本身」被 expectOutput 误匹配（真实输出才可靠）。
+  await sleep(600) // 等 shell 就绪
+  handle.write('stty -echo\n').catch(() => {})
+  await sleep(200)
+
+  // A1: 输出流（printf 构造唯一标记，回显已关，匹配到的必是真实输出）
+  handle.write('printf "__PTY_READY_%s\\n" OK\n').catch(() => {})
+  try {
+    await expectOutput(handle, /__PTY_READY_[A-Z]+/)
+    pass('A1 spawnTerminal 输出流可达')
+  } catch (error) {
+    fail('A1 spawnTerminal 输出流可达', error.message)
+  }
+
+  // A2: TERM 覆盖（zsh 的 ZLE 会渲染输入行，回显行含 "%s\n"；用排除 % 与引号的正则只匹配真实输出）
+  handle.write('printf "TERMIS:%s\\n" "$TERM"\n').catch(() => {})
+  try {
+    const match = await expectOutput(handle, /TERMIS:([^\s"%']+)/)
+    if (match[1] === 'xterm-256color') pass('A2 TERM 覆盖生效（' + match[1] + '）')
+    else fail('A2 TERM 覆盖生效', '得到 ' + match[1] + '，期望 xterm-256color')
+  } catch (error) {
+    fail('A2 TERM 覆盖生效', error.message)
+  }
+
+  // A3: resize 透传（stty size 输出 "rows cols"）
+  handle.write('stty size\n').catch(() => {})
+  const before = await expectOutput(handle, /^(\d+) (\d+)$/m).catch(() => null)
+  try {
+    ;(handle).terminal.resize(100, 30)
+    await sleep(300)
+    handle.write('stty size\n').catch(() => {})
+    const resized = await expectOutput(handle, /^(\d+) (\d+)$/m)
+    const ok = Number(resized[1]) === 30 && Number(resized[2]) === 100
+    console.log(`    before=${before ? before[1] + 'x' + before[2] : 'n/a'} after-resize=${resized[1]}x${resized[2]}（期望 30x100）`)
+    if (ok) pass('A3 resize 透传生效')
+    else fail('A3 resize 透传生效', `stty 报告 ${resized[1]}x${resized[2]}`)
+  } catch (error) {
+    fail('A3 resize 透传生效', error.message)
+  }
+
+  handle.write('stty echo\n').catch(() => {})
+
+  // A1b: terminate 树级清理（best-effort：幸存者竞态时降级为直接 SIGKILL）
+  try {
+    const donePromise = handle.done
+    await handle.terminate()
+    const outcome = await donePromise
+    console.log(`    terminate → exitCode=${outcome.exitCode} signal=${outcome.signal}`)
+    pass('A1b terminate 树级清理并给出退出事实')
+  } catch (error) {
+    fail('A1b terminate 树级清理并给出退出事实', error.message)
+  }
+}
+
+/** best-effort 终止：terminate() 抛「幸存者」竞态时降级为对顶层 shell 直接 SIGKILL。 */
+async function forceKill(handle) {
+  try {
+    await handle.terminate()
+  } catch (error) {
+    console.warn('    terminate() 报幸存者竞态，降级 SIGKILL：' + error.message)
+    try {
+      await handle.terminal.kill('SIGKILL')
+    } catch {
+      /* 已退出 */
+    }
+  }
+}
+
+async function testWs(app) {
+  console.log('\n[2/2] WebSocket upgrade 路由（registerUpgrade + ws 握手）')
+  const wss = new WebSocketServer({ noServer: true })
+
+  /** 宿主侧会话逻辑（M1 会照此骨架落进 src/index.ts） */
+  const onConnection = (ws) => {
+    let handle = null
+    const send = (msg) => { if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify(msg)) }
+    ws.on('message', async (raw) => {
+      let msg
+      try { msg = JSON.parse(raw.toString()) } catch { return }
+      if (msg.t === 'spawn') {
+        try {
+          handle = await app.subprocess.spawnTerminal({
+            argv: shellArgv(process.env.SHELL || '/bin/zsh'),
+            rows: msg.rows ?? 24,
+            cols: msg.cols ?? 80,
+            cwd: process.cwd(),
+            env: { TERM: 'xterm-256color', COLORTERM: 'truecolor' },
+            graceMs: 3000,
+          })
+          send({ t: 'ready', pid: handle.pid })
+          handle.output.on('data', (chunk) => send({ t: 'data', d: chunk.toString('utf8') }))
+          handle.done.then((outcome) => {
+            send({ t: 'exit', code: outcome.exitCode, signal: outcome.signal })
+            ws.close()
+          })
+        } catch (error) {
+          send({ t: 'error', m: error.message })
+        }
+      } else if (msg.t === 'input' && handle) {
+        handle.write(String(msg.d ?? '')).catch(() => {})
+      } else if (msg.t === 'resize' && handle) {
+        try { handle.terminal.resize(Number(msg.cols), Number(msg.rows)) } catch { /* 透传失败不致命 */ }
+      } else if (msg.t === 'kill' && handle) {
+        await forceKill(handle)
+      }
+    })
+    ws.on('close', () => { if (handle) forceKill(handle) })
+  }
+  wss.on('connection', onConnection)
+  app.webServer.registerUpgrade({
+    path: '/api/dsh-tty/ws',
+    handler: (req, socket, head) => {
+      wss.handleUpgrade(req, socket, head, (ws) => wss.emit('connection', ws, req))
+    },
+  })
+
+  const url = `ws://127.0.0.1:${app.webServer.port}/api/dsh-tty/ws`
+  const client = new WebSocket(url)
+  const received = []
+  let sawExit = false
+  let sawResizeAck = false
+
+  const result = await new Promise((resolve) => {
+    const timer = setTimeout(() => resolve({ ok: false, error: 'WS 端到端超时', received }), 15000)
+    client.on('open', () => {
+      client.send(JSON.stringify({ t: 'spawn', cols: 80, rows: 24 }))
+    })
+    client.on('message', (raw) => {
+      const msg = JSON.parse(raw.toString())
+      received.push(msg.t)
+      if (msg.t === 'ready') {
+        client.send(JSON.stringify({ t: 'resize', cols: 100, rows: 30 }))
+        client.send(JSON.stringify({ t: 'input', d: 'echo __WS_PROBE_OK__\n' }))
+      } else if (msg.t === 'data' && String(msg.d).includes('__WS_PROBE_OK__')) {
+        client.send(JSON.stringify({ t: 'kill' }))
+      } else if (msg.t === 'exit') {
+        sawExit = true
+        clearTimeout(timer)
+        client.close()
+        resolve({ ok: true, received })
+      }
+    })
+    client.on('error', (error) => {
+      clearTimeout(timer)
+      resolve({ ok: false, error: error.message, received })
+    })
+  })
+
+  if (result.ok && sawExit) pass('A4 registerUpgrade + ws 握手端到端（spawn→resize→input→data→kill→exit）')
+  else fail('A4 registerUpgrade + ws 握手端到端（spawn→resize→input→data→kill→exit）', result.error || '未见 exit 帧')
+}
+
+async function main() {
+  const app = new Context()
+  const wsFiber = app.plugin(WebServerRuntime, { host: '127.0.0.1', port: 0 })
+  const subFiber = app.plugin(LocalSubprocessRuntime)
+  await wsFiber.await()
+  await subFiber.await()
+  console.log(`webServer listening on 127.0.0.1:${app.webServer.port}`)
+
+  await testPty(app)
+  await testWs(app)
+
+  const failed = RESULTS.filter(([kind]) => kind === 'FAIL')
+  console.log(`\n==== M0 结果：${RESULTS.length - failed.length}/${RESULTS.length} PASS ====`)
+  for (const [kind, name, detail] of RESULTS) console.log(`  ${kind === 'PASS' ? '✔' : '✘'} ${name}${detail ? ' — ' + detail : ''}`)
+  process.exit(failed.length > 0 ? 1 : 0)
+}
+
+main().catch((error) => {
+  console.error('probe 崩溃：', error)
+  process.exit(1)
+})

package/scripts/sftplimits-smoke.mjs

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+/**
+ * @hyzyn/dsh-tty — sftpLimits 配置贯通冒烟：POST /api/dsh-tty/config 带
+ * sftpLimits → GET 回读正确；缺省回落默认；非法值拒绝；normalizePatch 拦截。
+ * 用法：node scripts/sftplimits-smoke.mjs
+ */
+import { Context } from '@deepseek-ai/cordis'
+import WebServerRuntime from '@deepseek-ai/dsh-host-webserver'
+import { name, inject, apply } from '../lib/index.js'
+
+const RESULTS = []
+function pass(name) { RESULTS.push(['PASS', name]); console.log('  ✔ PASS  ' + name) }
+function fail(name, detail) { RESULTS.push(['FAIL', name, detail]); console.error('  ✘ FAIL  ' + name + (detail ? ' — ' + detail : '')) }
+
+async function run() {
+  const app = new Context()
+  const wsFiber = app.plugin(WebServerRuntime, { host: '127.0.0.1', port: 0 })
+  const stubFiber = app.plugin({
+    name: 'settings-stub',
+    apply: (ctx) => {
+      ctx.provide('settings', { register: () => ({ get: () => ({}), update: async () => {} }) })
+      ctx.provide('tools', { register: () => () => {} })
+      // 与真实契约同形（section/context 返回注销器）：插件热应用时会调用重建
+      ctx.provide('systemPrompt', {
+        section: () => () => {},
+        context: () => () => {},
+      })
+    },
+  })
+  await stubFiber.await()
+  const pluginFiber = app.plugin({ name, inject, apply }, { maxSessions: 4 })
+  await wsFiber.await()
+  await pluginFiber.await()
+  const port = app.webServer.port
+  await new Promise((resolve) => setTimeout(resolve, 300))
+
+  const getConfig = async () => (await (await fetch(`http://127.0.0.1:${port}/api/dsh-tty/config`)).json()).config
+  const post = async (body) => {
+    const res = await fetch(`http://127.0.0.1:${port}/api/dsh-tty/config`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(body),
+    })
+    return { status: res.status, data: await res.json().catch(() => ({})) }
+  }
+
+  // 1. 缺省值：配置未提供 → 默认 1024/2048/1000
+  const c0 = await getConfig()
+  if (c0.sftpLimits?.maxDownloadMb === 1024 && c0.sftpLimits?.maxUploadMb === 2048 && c0.sftpLimits?.maxUploadFiles === 1000) pass('S1 缺省 sftpLimits（1024/2048/1000）')
+  else fail('S1 缺省 sftpLimits', JSON.stringify(c0.sftpLimits))
+
+  // 2. 提交合法值 → 回读生效
+  const r2 = await post({ sftpLimits: { maxDownloadMb: 512, maxUploadMb: 0, maxUploadFiles: 200 } })
+  if (r2.status === 200 && r2.data.ok === true) {
+    const c2 = await getConfig()
+    if (c2.sftpLimits.maxDownloadMb === 512 && c2.sftpLimits.maxUploadMb === 0 && c2.sftpLimits.maxUploadFiles === 200) pass('S2 提交 sftpLimits 热生效（512/0/200，0=不限）')
+    else fail('S2 提交 sftpLimits 热生效', JSON.stringify(c2.sftpLimits))
+  } else fail('S2 提交 sftpLimits 热生效', JSON.stringify(r2))
+
+  // 3. 部分提交（只改一项）→ 其余保持
+  const r3 = await post({ sftpLimits: { maxDownloadMb: 256 } })
+  if (r3.status === 200 && r3.data.ok === true) {
+    const c3 = await getConfig()
+    if (c3.sftpLimits.maxDownloadMb === 256 && c3.sftpLimits.maxUploadMb === 0 && c3.sftpLimits.maxUploadFiles === 200) pass('S3 部分提交只改对应项')
+    else fail('S3 部分提交只改对应项', JSON.stringify(c3.sftpLimits))
+  } else fail('S3 部分提交只改对应项', JSON.stringify(r3))
+
+  // 4. 非法值拒绝
+  const r4 = await post({ sftpLimits: { maxDownloadMb: -5 } })
+  if (r4.status === 400 && /整数/.test(r4.data.error || '')) pass('S4 负值拒绝')
+  else fail('S4 负值拒绝', JSON.stringify(r4))
+  const r5 = await post({ sftpLimits: { maxUploadFiles: 99999999 } })
+  if (r5.status === 400 && /整数/.test(r5.data.error || '')) pass('S5 超上限拒绝')
+  else fail('S5 超上限拒绝', JSON.stringify(r5))
+  const r6 = await post({ sftpLimits: 'not-an-object' })
+  if (r6.status === 400 && /对象/.test(r6.data.error || '')) pass('S6 非对象拒绝')
+  else fail('S6 非对象拒绝', JSON.stringify(r6))
+
+  // 7. 未知键仍拦截（原行为保持）
+  const r7 = await post({ bogus: 1 })
+  if (r7.status === 400 && /未知配置项/.test(r7.data.error || '')) pass('S7 未知配置项仍拒绝')
+  else fail('S7 未知配置项仍拒绝', JSON.stringify(r7))
+
+  const failedCount = RESULTS.filter(([kind]) => kind === 'FAIL').length
+  console.log(failedCount === 0 ? '\nsftpLimits smoke: 全部 PASS' : `\nsftpLimits smoke: ${failedCount} 个 FAIL`)
+  process.exit(failedCount === 0 ? 0 : 1)
+}
+
+run().catch((error) => {
+  console.error('[sftplimits-smoke] 崩溃: ' + (error && error.stack ? error.stack : error))
+  process.exit(2)
+})