@mrrisega/dsh-remote 0.4.9 → 0.6.0-beta.0

package/packages/{dsh-remote-ui → dsh-remote-web}/lib/index.js

@@ -1,11 +1,12 @@
-// dsh-remote-ui — node half (host plugin)
+// dsh-remote-web — node half (host plugin)（2026-09 由 dsh-remote-ui 更名 dsh-remote-web；卸载/清理兼容旧名）
 //
-// 提供 /dsh-remote/* 同源 HTTP 路由，供浏览器半的配置面板调用：
-//   - 读写 dsh-remote-open/.dsh-config.json（0600）
+// 提供 /dsh-remote/* 同源 HTTP 路由，供浏览器半的「远程访问」设置面板调用：
+//   - 读写配置目录下 .dsh-config.json（0600）
 //   - 查询/启停 bridge（launchctl，plist 缺失时自动生成，逻辑与 dsh-setup.mjs 一致）
-//   - 代理 relay API（captcha / register / login / public-config），直连、不走系统代理
+//   - 代理 relay API（captcha / register / login / public-config），直连、不走系统代理；
+//     另代理企业端一次性访问密钥 / 授权设备（/api/auth-key、/api/mobile-sessions、…/revoke，Bearer）供面板「📱 远程访问」卡使用
 //   - 自管理 self*（版本可见 / 新版检测 / 一键在线更新 / 彻底卸载）：插件市场没有更新卸载按钮，
-//     面板内即官方管理入口；更新=后台 npx @mrrisega/dsh-remote@latest（幂等补齐运行环境并重启 bridge）；
+//     面板内即官方管理入口；更新=后台 npx 按 dist-tag(默认 latest,DSH_UPDATE_TAG 可切 beta/alpha)（幂等补齐运行环境并重启 bridge）；
 //     彻底卸载=profile 插件清理（uninstallSelf）+ 运行时清理（uninstallRuntime：停 bridge 自启动 /
 //     删 plist|unit / 杀残留进程 / 清空配置目录 ~/.dsh-remote），0.4.7 起回归真正「未安装」状态
 //   - 运行时自愈：缺运行环境自动后台安装、登录后自动拉起 bridge（0.4.2 起）
@@ -144,7 +145,7 @@ function sweepStaleMarkers(relayDir) {
     if (dead === false || (dead === null && expired)) {
       try { rmSync(p, { force: true }); } catch { /* ignore */ }
       appendLogLine(relayDir, AUTO_INSTALL_LOG,
-        `[dsh-remote-ui] 清理残留标记 ${name}（pid=${info.pid ?? "?"}, at=${new Date(info.at).toISOString()}${dead === false ? ", 进程已死" : ", 已超时"}）`);
+        `[dsh-remote-web] 清理残留标记 ${name}（pid=${info.pid ?? "?"}, at=${new Date(info.at).toISOString()}${dead === false ? ", 进程已死" : ", 已超时"}）`);
     }
   }
 }
@@ -378,7 +379,7 @@ function ensureRuntime(relayDir) {
   try {
     mkdirSync(relayDir, { recursive: true });
     const log = join(relayDir, AUTO_INSTALL_LOG);
-    const child = spawn(npxCommand(), ["--yes", "@mrrisega/dsh-remote"], {
+    const child = spawn(npxCommand(), ["--yes", UPDATE_SPEC], {
       detached: true,
       env: spawnEnv({ npm_config_registry: "https://registry.npmjs.org" }),
       stdio: ["ignore", openSync(log, "a"), openSync(log, "a")]
@@ -392,13 +393,13 @@ function ensureRuntime(relayDir) {
     child.on("error", (e) => {
       clear();
       appendLogLine(relayDir, AUTO_INSTALL_LOG, `[auto-install] 启动失败: ${e.message}`);
-      console.warn(`[dsh-remote-ui] 自动安装子进程启动失败: ${e.message}`);
+      console.warn(`[dsh-remote-web] 自动安装子进程启动失败: ${e.message}`);
     });
     child.unref();
-    console.log(`[dsh-remote-ui] 检测到缺少桌面运行环境,已在后台自动安装(日志: ${log}),完成后将自动启动 bridge`);
+    console.log(`[dsh-remote-web] 检测到缺少桌面运行环境,已在后台自动安装(日志: ${log}),完成后将自动启动 bridge`);
     return false;
   } catch (e) {
-    console.warn(`[dsh-remote-ui] 自动安装启动失败: ${e.message}`);
+    console.warn(`[dsh-remote-web] 自动安装启动失败: ${e.message}`);
     try { rmSync(marker, { force: true }); } catch { /* ignore */ }
     return false;
   }
@@ -698,6 +699,109 @@ async function relayInviteRecords(relayDir) {
   return { records: r.body.records || [], rewards: r.body.rewards || [] };
 }
 
+// ---------- 一次性访问密钥 / 已授权设备代理（E1 企业端新增 auth-key / mobile-sessions） ----------
+
+/** 从 relay 响应里尽量提取人类可读错误信息（兼容 {error:{message}} / {error:".."} / {message} / 纯文本）。 */
+function relayErrorMessage(r) {
+  const b = r && typeof r === "object" ? r.body : null;
+  if (b && typeof b === "object") {
+    if (typeof b.error === "string" && b.error) return b.error;
+    if (b.error && typeof b.error === "object") {
+      if (typeof b.error.message === "string" && b.error.message) return b.error.message;
+    }
+    if (typeof b.message === "string" && b.message) return b.message;
+  }
+  if (typeof b === "string" && b.trim()) return b.trim();
+  const st = r && r.status;
+  return st ? `企业端请求失败（HTTP ${st}）` : "企业端不可达，请稍后重试";
+}
+
+/** 未登录（无账号/自建密钥）时的统一返回文案。 */
+function notLoggedInJson() {
+  return { ok: false, error: "尚未登录：请先在「账号」卡片登录手机号账号（或切换到自建服务）后重试", hint: "login_required" };
+}
+
+/**
+ * 透传企业端响应体：契约字段可能在顶层或 data 子对象里（容错）。
+ * 返回扁平对象；数组字段只取首层数组。
+ */
+function flattenRelayBody(r) {
+  const b = r && typeof r === "object" && r.body && typeof r.body === "object" ? r.body : {};
+  const d = b.data && typeof b.data === "object" ? { ...b.data, ...b } : b;
+  return d;
+}
+
+/**
+ * GET /dsh-remote/access-key → 创建一次性访问密钥（企业端 POST /api/auth-key，Bearer device-login token）。
+ * 契约容错：url 必须可用；qr_data_url 取不到时返回 null（UI 只展示链接并说明“二维码暂不可用”，不报错）。
+ */
+async function proxyCreateAccessKey(relayDir, res) {
+  const token = await relayToken(relayDir).catch(() => "");
+  if (!token) return sendJson(res, 401, notLoggedInJson());
+  const r = await relayFetch(relayDir, "/api/auth-key", {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+    body: JSON.stringify({}),
+  });
+  const d = flattenRelayBody(r);
+  const url = typeof d.url === "string" ? d.url.trim() : "";
+  if (!r.ok || !url) {
+    // url 不可用是硬失败（企业端契约缺陷）；错误码/状态透传给 UI 展示
+    const err = r.ok && !url ? "企业端未返回可用的访问地址（缺 url）" : relayErrorMessage(r);
+    return sendJson(res, (r && r.status) || 502, { ok: false, error: err, relayStatus: (r && r.status) || 0 });
+  }
+  return sendJson(res, 200, {
+    ok: true,
+    url,
+    key: d.key ?? null,
+    expires_at: d.expires_at ?? null,
+    ttl_ms: d.ttl_ms ?? null,
+    qr_data_url: d.qr_data_url ?? null,
+    relayStatus: (r && r.status) || 200,
+  });
+}
+
+/**
+ * GET /dsh-remote/mobile-sessions → 已授权设备列表（企业端 POST /api/mobile-sessions，Bearer）。
+ */
+async function proxyMobileSessions(relayDir, res) {
+  const token = await relayToken(relayDir).catch(() => "");
+  if (!token) return sendJson(res, 401, notLoggedInJson());
+  const r = await relayFetch(relayDir, "/api/mobile-sessions", {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}` },
+  });
+  const d = flattenRelayBody(r);
+  const sessions = Array.isArray(d.sessions) ? d.sessions : [];
+  if (!r.ok) {
+    return sendJson(res, (r && r.status) || 502, { ok: false, error: relayErrorMessage(r), relayStatus: (r && r.status) || 0, sessions });
+  }
+  return sendJson(res, 200, { ok: true, sessions, relayStatus: (r && r.status) || 200 });
+}
+
+/**
+ * POST /dsh-remote/mobile-sessions/revoke（body {id}）→ 取消配对（企业端 POST /api/mobile-sessions/:id/revoke，Bearer）。
+ */
+async function proxyRevokeMobileSession(relayDir, req, res) {
+  const body = await readJsonBody(req);
+  if (body.__parseError) return sendJson(res, 400, { ok: false, error: "JSON 解析失败" });
+  const id = String(body.id ?? "").trim();
+  if (!id) return sendJson(res, 400, { ok: false, error: "缺少参数 id（会话 ID）" });
+  const token = await relayToken(relayDir).catch(() => "");
+  if (!token) return sendJson(res, 401, notLoggedInJson());
+  const r = await relayFetch(relayDir, `/api/mobile-sessions/${encodeURIComponent(id)}/revoke`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}` },
+  });
+  const d = flattenRelayBody(r);
+  // 兼容两种成功形态：HTTP ok，或 body.ok === true（允许企业端 200 + ok:false 表示业务失败）
+  const ok = !!(r.ok && d.ok !== false);
+  if (!ok) {
+    return sendJson(res, (r && r.status) || 502, { ok: false, error: relayErrorMessage(r), relayStatus: (r && r.status) || 0 });
+  }
+  return sendJson(res, 200, { ok: true, relayStatus: (r && r.status) || 200 });
+}
+
 // ---------- 综合状态 ----------
 
 async function composeStatus(relayDir) {
@@ -789,7 +893,7 @@ async function proxyFeedback(relayDir, req, res, pathname) {
   const url = new URL(suffix.replace(/^\//, ""), base);
   const headers = {
     "x-dsh-device": cfg.device_id || "",
-    "x-dsh-client": "dsh-remote-ui/0.1.0",
+    "x-dsh-client": `dsh-remote-web/${PLUGIN_VERSION}`,
   };
   if (cfg.phone) headers["x-dsh-phone"] = String(cfg.phone);
   const auth = req.headers.authorization;
@@ -836,28 +940,41 @@ async function proxyFeedback(relayDir, req, res, pathname) {
 
 // ---------- 自管理：版本 / 在线更新 / 彻底卸载（面板内“版本与更新”卡片） ----------
 
+/** 插件 id / 包名（2026-09 由 dsh-remote-ui 更名）。 */
+const PLUGIN_ID = "dsh-remote-web";
+/** 更名前 id（≤0.4.9）：彻底卸载/清理时一并移除，防旧拷贝残留。 */
+const PLUGIN_LEGACY_IDS = ["dsh-remote-ui"];
+const PLUGIN_ALL_IDS = [PLUGIN_ID, ...PLUGIN_LEGACY_IDS];
 /** 插件自身发布版本（与 dsh-remote 根包同步递增）。 */
-const PLUGIN_VERSION = "0.4.9";
+const PLUGIN_VERSION = "0.6.0-beta.0";
 const UPDATE_LOG = ".dsh-update.log";
 const UPDATE_MARKER = ".dsh-update-running";
 
-/** 查询 npm 最新版（官方源优先，失败回退 npmmirror；纯服务端无 CORS 限制）。 */
+/**
+ * 更新通道（发布策略）：普通用户只拉稳定 dist-tag `latest`；预发(alpha/beta)由作者/内测
+ * 通过 `DSH_UPDATE_TAG=beta`（或显式版本号）拉取。迭代一律先发 beta/alpha，稳定后才升 latest。
+ */
+const UPDATE_TAG = (process.env.DSH_UPDATE_TAG || "latest").replace(/^@/, "");
+const UPDATE_SPEC = `@mrrisega/dsh-remote@${UPDATE_TAG}`;
+
+/** 查询所选通道(npm dist-tag)最新版（官方源优先，失败回退 npmmirror；纯服务端无 CORS 限制）。 */
 async function npmLatestVersion() {
   for (const reg of ["https://registry.npmjs.org/@mrrisega/dsh-remote", "https://registry.npmmirror.com/@mrrisega/dsh-remote"]) {
     try {
       const res = await fetch(reg, { signal: AbortSignal.timeout(8000) });
       if (!res.ok) continue;
       const j = await res.json();
-      if (j && j["dist-tags"] && typeof j["dist-tags"].latest === "string") return j["dist-tags"].latest;
+      const tags = j && j["dist-tags"] ? j["dist-tags"] : {};
+      if (typeof tags[UPDATE_TAG] === "string") return tags[UPDATE_TAG];
     } catch { /* 试下一个源 */ }
   }
   return "";
 }
 
-/** 以 detached 子进程执行 `npx --yes @mrrisega/dsh-remote@latest`（env 可覆盖 npm 源）。 */
+/** 以 detached 子进程执行 `npx --yes <UPDATE_SPEC>`（env 可覆盖 npm 源/更新通道）。 */
 function spawnUpdater(relayDir, extraEnv) {
   const log = join(relayDir, UPDATE_LOG);
-  return spawn(npxCommand(), ["--yes", "@mrrisega/dsh-remote@latest"], {
+  return spawn(npxCommand(), ["--yes", UPDATE_SPEC], {
     detached: true,
     cwd: homedir(),
     env: spawnEnv(extraEnv), // PATH 补 node 目录：App 最小 PATH 下也能跑 npx
@@ -866,7 +983,7 @@ function spawnUpdater(relayDir, extraEnv) {
 }
 
 /**
- * 后台执行在线一键更新：npx @mrrisega/dsh-remote@latest（幂等自愈：补运行环境/更新 bridge/收敛 include）。
+ * 后台执行在线一键更新：npx 按 dist-tag(默认 latest)（幂等自愈：补运行环境/更新 bridge/收敛 include）。
  * 稳健性：
  *   - npx 用绝对路径 + PATH 补全解析（App 拉起的 dsh web PATH 最小化时不再 ENOENT 静默失败）；
  *   - 【官方源优先】镜像(npmmirror)滞后时会把旧版(如 0.4.4)当成最新安装，旧 pluginCmd 会把
@@ -879,7 +996,7 @@ function runOnlineUpdate(relayDir) {
     mkdirSync(relayDir, { recursive: true });
     const marker = join(relayDir, UPDATE_MARKER);
     if (existsSync(marker)) return { ok: false, detail: "已有更新在进行中，请稍候" };
-    appendLogLine(relayDir, UPDATE_LOG, `[update] 开始在线更新 @mrrisega/dsh-remote@latest (${new Date().toISOString()})`);
+    appendLogLine(relayDir, UPDATE_LOG, `[update] 开始在线更新 ${UPDATE_SPEC} (${new Date().toISOString()})`);
 
     let retried = false;
     const clear = () => { try { rmSync(marker, { force: true }); } catch { /* ignore */ } };
@@ -925,25 +1042,37 @@ function uninstallSelf(relayDir, profileDir, patchFile, pkgFile) {
   const out = { removedPatch: false, removedDep: false, removedDir: false, removedBundle: false };
   try {
     const patch = readFileSync(patchFile, "utf8");
+    // 兼容当前与历史（dsh-remote-ui）两种管理标记
     const cleaned = patch
-      .replace(/\n?# >>> dsh-remote-ui .*?# <<< dsh-remote-ui\s*/s, "\n")
+      .replace(/\n?# >>> dsh-remote-(?:web|ui) .*?# <<< dsh-remote-(?:web|ui)\s*/s, "\n")
       .replace(/\n{3,}/g, "\n\n")
       .trimEnd() + "\n";
     if (cleaned !== patch) { writeFileSync(patchFile, cleaned); out.removedPatch = true; }
   } catch { /* 无 patch 忽略 */ }
   try {
     const pkg = JSON.parse(readFileSync(pkgFile, "utf8"));
-    if (pkg.dependencies && pkg.dependencies["dsh-remote-ui"]) { delete pkg.dependencies["dsh-remote-ui"]; out.removedDep = true; }
+    if (pkg.dependencies) {
+      let removed = false;
+      for (const id of PLUGIN_ALL_IDS) {
+        if (pkg.dependencies[id] !== undefined) { delete pkg.dependencies[id]; removed = true; }
+      }
+      if (removed) out.removedDep = true;
+    }
     const bundles = pkg.dsh && pkg.dsh.profile && Array.isArray(pkg.dsh.profile.bundles) ? pkg.dsh.profile.bundles : null;
     if (bundles) {
-      const i = bundles.indexOf("dsh-remote-ui");
-      if (i >= 0) { bundles.splice(i, 1); out.removedBundle = true; }
+      const filtered = bundles.filter((b) => !PLUGIN_ALL_IDS.includes(b));
+      if (filtered.length !== bundles.length) {
+        pkg.dsh.profile.bundles = filtered;
+        out.removedBundle = true;
+      }
     }
     if (out.removedDep || out.removedBundle) writeFileSync(pkgFile, JSON.stringify(pkg, null, 2) + "\n");
   } catch { /* 无 package.json 忽略 */ }
   try {
-    rmSync(join(profileDir, "dsh-remote-ui-plugin"), { recursive: true, force: true });
-    rmSync(join(profileDir, "node_modules", "dsh-remote-ui"), { recursive: true, force: true });
+    for (const id of PLUGIN_ALL_IDS) {
+      rmSync(join(profileDir, `${id}-plugin`), { recursive: true, force: true });
+      rmSync(join(profileDir, "node_modules", id), { recursive: true, force: true });
+    }
     out.removedDir = true;
   } catch { /* ignore */ }
   return out;
@@ -957,8 +1086,10 @@ function registerRoutes(ctx, relayDir) {
   let profileDir = join(homedir(), ".dsh", "profiles", "web");
   try {
     const here = fileURLToPath(import.meta.url);
-    // 依次尝试两种安装布局；split()[0] 未命中时返回原串，需显式判断后再试下一种
-    let m = here.split("/dsh-remote-ui-plugin/")[0];
+    // 依次尝试两种安装布局（当前名优先，历史名兜底）；split()[0] 未命中时返回原串，需显式判断后再试下一种
+    let m = here.split("/dsh-remote-web-plugin/")[0];
+    if (m === here) m = here.split("/node_modules/dsh-remote-web/")[0];
+    if (m === here) m = here.split("/dsh-remote-ui-plugin/")[0];
     if (m === here) m = here.split("/node_modules/dsh-remote-ui/")[0];
     if (m !== here) profileDir = m;
   } catch { /* 保持默认 */ }
@@ -1011,7 +1142,7 @@ function registerRoutes(ctx, relayDir) {
         if (rt.removedPlist) bits.push("自启动项已删除");
         if (rt.killedPids.length) bits.push(`已结束 ${rt.killedPids.length} 个残留进程`);
         if (rt.removedDir) bits.push("配置目录已清空（账号/密钥/固化运行时等）");
-        bits.push("请重启 dsh web 后完全卸载生效（本插件与远程控制将消失）；如需再次使用，在插件市场重新安装即可。");
+        bits.push("请重启 dsh web 后完全卸载生效（本插件与「远程访问」面板将消失）；如需再次使用，在插件市场重新安装即可。");
         sendJson(res, 200, {
           ok: true,
           ...prof, // removedPatch / removedDep / removedBundle / removedDir(profile 插件目录)
@@ -1067,6 +1198,30 @@ function registerRoutes(ctx, relayDir) {
         });
       },
     },
+    // 一次性访问密钥（📱 远程访问卡）：GET 即创建新 key，企业端 POST /api/auth-key（Bearer）
+    {
+      method: "GET",
+      path: "/dsh-remote/access-key",
+      handler: async (_req, res) => {
+        await proxyCreateAccessKey(relayDir, res);
+      },
+    },
+    // 已授权设备列表（企业端 POST /api/mobile-sessions，Bearer）
+    {
+      method: "GET",
+      path: "/dsh-remote/mobile-sessions",
+      handler: async (_req, res) => {
+        await proxyMobileSessions(relayDir, res);
+      },
+    },
+    // 取消已授权设备配对（企业端 POST /api/mobile-sessions/:id/revoke，Bearer）
+    {
+      method: "POST",
+      path: "/dsh-remote/mobile-sessions/revoke",
+      handler: async (req, res) => {
+        await proxyRevokeMobileSession(relayDir, req, res);
+      },
+    },
     {
       method: "POST",
       path: "/dsh-remote/config",
@@ -1272,7 +1427,7 @@ function registerRoutes(ctx, relayDir) {
           return;
         }
         Promise.resolve(route.handler(req, res)).catch((e) => {
-          ctx.logger?.warn?.(`dsh-remote-ui: ${route.method} ${route.path} failed: ${e?.stack || e}`);
+          ctx.logger?.warn?.(`dsh-remote-web: ${route.method} ${route.path} failed: ${e?.stack || e}`);
           if (!res.headersSent) sendJson(res, 500, { ok: false, error: String(e?.message || e) });
           else res.end();
         });
@@ -1297,10 +1452,10 @@ export function apply(ctx, config = {}) {
   UNINSTALLED_DIRS.delete(relayDir);
   // 清理上次进程残留的安装/更新 marker（宿主被重启/强杀时子进程清理回调会丢失）
   sweepStaleMarkers(relayDir);
-  ctx.effect(() => registerRoutes(ctx, relayDir), "dsh-remote-ui: /dsh-remote routes");
+  ctx.effect(() => registerRoutes(ctx, relayDir), "dsh-remote-web: /dsh-remote routes");
   // 0.1.2-rc.1+ 浏览器会话代持：换取 Harness 会话 Cookie 供 bridge 上游携带（手机点设备不再 401 白页）
-  ctx.effect(() => scheduleHarnessMint(ctx, relayDir), "dsh-remote-ui: harness browser-session mint");
+  ctx.effect(() => scheduleHarnessMint(ctx, relayDir), "dsh-remote-web: harness browser-session mint");
   // 插件市场一键全功能:缺桌面运行环境则自动安装,登录后自动拉起 bridge(不依赖用户跑 npx)
-  ctx.effect(() => scheduleRuntime(relayDir), "dsh-remote-ui: runtime self-provision");
-  ctx.logger?.info?.(`dsh-remote-ui: /dsh-remote routes ready (relayDir=${relayDir})`);
+  ctx.effect(() => scheduleRuntime(relayDir), "dsh-remote-web: runtime self-provision");
+  ctx.logger?.info?.(`dsh-remote-web: /dsh-remote routes ready (relayDir=${relayDir})`);
 }

package/packages/{dsh-remote-ui → dsh-remote-web}/package.json

@@ -1,7 +1,7 @@
 {
-  "name": "dsh-remote-ui",
-  "version": "0.1.0",
-  "description": "公网远程控制 DeepSeek Harness（dsh web）：安装即得专属加密地址，人在外面也能用手机访问电脑上的 dsh——无需同一局域网/WiFi、无需公网 IP 与内网穿透，全程加密；手机端 100% 还原电脑体验（对话/工具/审批/设置）。技术用户可选自建服务，流量走自己的服务器。Remote control DeepSeek Harness (dsh web) from anywhere over the public internet — install, get an encrypted URL, use it from your phone on any network (dual-half cordis plugin: Settings panel + same-origin /dsh-remote routes).",
+  "name": "dsh-remote-web",
+  "version": "0.5.0",
+  "description": "公网远程控制 DeepSeek Harness（dsh web）：安装即得专属加密地址，人在外面也能用手机访问电脑上的 dsh——无需同一局域网/WiFi、无需公网 IP 与内网穿透，全程加密；手机端 100% 还原电脑体验（对话/工具/审批/设置）。技术用户可选自建服务，流量走自己的服务器。Remote control DeepSeek Harness (dsh web) from anywhere over the public internet — install, get an encrypted URL, use it from your phone on any network (dual-half cordis plugin: Settings panel + same-origin /dsh-remote routes). (2026-09 由 dsh-remote-ui 更名 / renamed from dsh-remote-ui; dsh-remote 的 dsh web 插件半，不是纯 UI/皮肤插件)",
   "type": "module",
   "main": "lib/index.js",
   "exports": {
@@ -33,11 +33,11 @@
   "repository": {
     "type": "git",
     "url": "git+https://github.com/mrRisega/dsh-remote.git",
-    "directory": "packages/dsh-remote-ui"
+    "directory": "packages/dsh-remote-web"
   },
   "bugs": {
     "url": "https://github.com/mrRisega/dsh-remote/issues"
   },
-  "homepage": "https://github.com/mrRisega/dsh-remote/tree/main/packages/dsh-remote-ui#readme",
+  "homepage": "https://github.com/mrRisega/dsh-remote/tree/main/packages/dsh-remote-web#readme",
   "license": "PolyForm-Noncommercial-1.0.0"
 }

package/packages/dsh-remote-web/test/access-key-sessions.test.mjs

@@ -0,0 +1,211 @@
+// 插件 node 半新增代理回归：/dsh-remote/access-key | mobile-sessions | mobile-sessions/revoke
+// （企业端 E1 契约：POST /api/auth-key、POST /api/mobile-sessions、POST /api/mobile-sessions/:id/revoke，Bearer device-login JWT）
+// 覆盖：Bearer 透传、字段扁平化、未登录 401、qr 缺失容错、上游错误透传。
+import assert from "node:assert/strict";
+import http from "node:http";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { apply } from "../lib/index.js";
+
+const EXPIRES = 1893456000000;
+const QR = "data:image/png;base64,AAAA";
+
+/** 假企业端：记录收到的请求（method/path/authorization），按场景回包。 */
+function startFakeRelay(opts = {}) {
+  const seen = [];
+  const srv = http.createServer(async (req, res) => {
+    const url = new URL(req.url, "http://x");
+    const send = (code, obj) => {
+      res.writeHead(code, { "content-type": "application/json" });
+      res.end(JSON.stringify(obj));
+    };
+    const rec = { method: req.method, path: url.pathname, authorization: req.headers.authorization || "" };
+    seen.push(rec);
+    if (req.method === "POST" && url.pathname === "/api/device-login") return send(200, { token: "jwt-abc" });
+    if (req.method === "POST" && url.pathname === "/api/auth-key") {
+      if (opts.authKeyFail) return send(500, { error: { message: "server boom" } });
+      const body = { ok: true, key: "K1", url: "https://app.test/a/K1", expires_at: EXPIRES, ttl_ms: 1800000 };
+      if (!opts.noQr) body.qr_data_url = QR;
+      return send(200, body);
+    }
+    if (req.method === "POST" && url.pathname === "/api/mobile-sessions") {
+      return send(200, {
+        ok: true,
+        sessions: [
+          { id: "ms_1", label: "iPhone 15", os: "iOS", browser: "Safari", created_at: 1700000000000, last_seen_at: 1700000600000, revoked_at: null },
+          { id: "ms_2", label: "Pixel", os: "Android", browser: "Chrome", created_at: 1700000000000, last_seen_at: null, revoked_at: 1700001000000 },
+        ],
+      });
+    }
+    if (req.method === "POST" && url.pathname === "/api/mobile-sessions/ms_1/revoke") return send(200, { ok: true });
+    if (req.method === "POST" && url.pathname === "/api/mobile-sessions/ghost/revoke") return send(404, { error: { message: "not_found" } });
+    send(404, { error: { code: "not_found" } });
+  });
+  return new Promise((resolve) => srv.listen(0, "127.0.0.1", () => resolve({ srv, seen, port: srv.address().port })));
+}
+
+/** 以假 relay 为 api_url 装载插件路由（boot），返回 http server base 与收集的 routes。 */
+async function bootRelay(relayPort, cfgExtra = {}) {
+  const tempDir = await mkdtemp(path.join(os.tmpdir(), "dsh-aks-"));
+  await writeFile(path.join(tempDir, ".dsh-config.json"), JSON.stringify({
+    phone: "13800000000",
+    password: "pw",
+    device_id: "dev-aks",
+    api_url: `http://127.0.0.1:${relayPort}`,
+    ...cfgExtra,
+  }));
+  const routes = new Map();
+  apply({
+    webServer: { register(route) { routes.set(route.path, route.handler); return () => {}; } },
+    effect(register) { return register(); },
+    logger: { info() {}, warn() {} }
+  }, { relayDir: tempDir });
+  const host = http.createServer((req, res) => {
+    const url = new URL(req.url, "http://x");
+    const handler = routes.get(url.pathname);
+    (handler || ((_r, rs) => { rs.writeHead(404); rs.end(); }))(req, res);
+  });
+  await new Promise((resolve) => host.listen(0, "127.0.0.1", resolve));
+  return { host, base: `http://127.0.0.1:${host.address().port}`, tempDir };
+}
+
+test("access-key 路由：创建一次性密钥并透传字段（含 qr_data_url），Bearer 已带上", async () => {
+  const relay = await startFakeRelay();
+  const { host, base, tempDir } = await bootRelay(relay.port);
+  try {
+    const r = await (await fetch(`${base}/dsh-remote/access-key`)).json();
+    assert.equal(r.ok, true);
+    assert.equal(r.url, "https://app.test/a/K1");
+    assert.equal(r.key, "K1");
+    assert.equal(r.expires_at, EXPIRES);
+    assert.equal(r.ttl_ms, 1800000);
+    assert.equal(r.qr_data_url, QR);
+    const up = relay.seen.find((s) => s.path === "/api/auth-key");
+    assert.equal(up.method, "POST");
+    assert.equal(up.authorization, "Bearer jwt-abc", "应携带 device-login JWT");
+  } finally {
+    host.close();
+    relay.srv.close();
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("access-key 容错：企业端未返回 qr_data_url 时仍成功，qr 字段为 null", async () => {
+  const relay = await startFakeRelay({ noQr: true });
+  const { host, base, tempDir } = await bootRelay(relay.port);
+  try {
+    const r = await (await fetch(`${base}/dsh-remote/access-key`)).json();
+    assert.equal(r.ok, true);
+    assert.equal(r.url, "https://app.test/a/K1");
+    assert.equal(r.qr_data_url, null, "qr 缺失不致命（UI 只展示链接/复制/打开）");
+  } finally {
+    host.close();
+    relay.srv.close();
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("mobile-sessions 路由：列表透传，Bearer 已带上", async () => {
+  const relay = await startFakeRelay();
+  const { host, base, tempDir } = await bootRelay(relay.port);
+  try {
+    const r = await (await fetch(`${base}/dsh-remote/mobile-sessions`)).json();
+    assert.equal(r.ok, true);
+    assert.equal(r.sessions.length, 2);
+    assert.equal(r.sessions[0].label, "iPhone 15");
+    assert.equal(r.sessions[0].os, "iOS");
+    const up = relay.seen.find((s) => s.path === "/api/mobile-sessions");
+    assert.equal(up.method, "POST");
+    assert.equal(up.authorization, "Bearer jwt-abc");
+  } finally {
+    host.close();
+    relay.srv.close();
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("mobile-sessions/revoke 路由：body {id} 转发到 /api/mobile-sessions/:id/revoke，成功返回 ok", async () => {
+  const relay = await startFakeRelay();
+  const { host, base, tempDir } = await bootRelay(relay.port);
+  try {
+    const r = await (await fetch(`${base}/dsh-remote/mobile-sessions/revoke`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ id: "ms_1" }),
+    })).json();
+    assert.equal(r.ok, true);
+    const up = relay.seen.find((s) => s.path === "/api/mobile-sessions/ms_1/revoke");
+    assert.ok(up, "应转发到 /api/mobile-sessions/ms_1/revoke");
+    assert.equal(up.authorization, "Bearer jwt-abc");
+
+    // 缺 id → 400
+    const bad = await (await fetch(`${base}/dsh-remote/mobile-sessions/revoke`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({}),
+    })).json();
+    assert.equal(bad.ok, false);
+    assert.match(String(bad.error), /id/);
+  } finally {
+    host.close();
+    relay.srv.close();
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("未登录（无账号配置）→ 三条路由统一 401 提示登录，不请求企业端", async () => {
+  const relay = await startFakeRelay();
+  const tempDir = await mkdtemp(path.join(os.tmpdir(), "dsh-aks-401-"));
+  await writeFile(path.join(tempDir, ".dsh-config.json"), JSON.stringify({ api_url: `http://127.0.0.1:${relay.port}` }));
+  const routes = new Map();
+  apply({
+    webServer: { register(route) { routes.set(route.path, route.handler); return () => {}; } },
+    effect(register) { return register(); },
+    logger: { info() {}, warn() {} }
+  }, { relayDir: tempDir });
+  const host = http.createServer((req, res) => {
+    const url = new URL(req.url, "http://x");
+    const handler = routes.get(url.pathname);
+    (handler || ((_r, rs) => { rs.writeHead(404); rs.end(); }))(req, res);
+  });
+  await new Promise((resolve) => host.listen(0, "127.0.0.1", resolve));
+  try {
+    const base = `http://127.0.0.1:${host.address().port}`;
+    for (const [method, p] of [["GET", "/dsh-remote/access-key"], ["GET", "/dsh-remote/mobile-sessions"]]) {
+      const r = await (await fetch(`${base}${p}`, { method })).json();
+      assert.equal(r.ok, false);
+      assert.equal((await (await fetch(`${base}${p}`, { method }))).status, 401, `${p} 应返回 401`);
+      assert.match(String(r.error), /尚未登录/);
+    }
+    const rev = await (await fetch(`${base}/dsh-remote/mobile-sessions/revoke`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ id: "ms_1" }),
+    })).json();
+    assert.equal(rev.ok, false);
+    assert.match(String(rev.error), /尚未登录/);
+    assert.ok(!relay.seen.some((s) => s.path.startsWith("/api/auth-key") || s.path.startsWith("/api/mobile-sessions")), "未登录不应请求企业端");
+  } finally {
+    host.close();
+    relay.srv.close();
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("上游错误透传：auth-key 5xx 时包装 ok:false + 服务端 error.message", async () => {
+  const relay = await startFakeRelay({ authKeyFail: true });
+  const { host, base, tempDir } = await bootRelay(relay.port);
+  try {
+    const res = await fetch(`${base}/dsh-remote/access-key`);
+    assert.equal(res.status, 500, "应透传上游状态码");
+    const r = await res.json();
+    assert.equal(r.ok, false);
+    assert.match(String(r.error), /server boom/);
+  } finally {
+    host.close();
+    relay.srv.close();
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});

package/packages/{dsh-remote-ui → dsh-remote-web}/test/feedback-proxy.test.mjs

@@ -58,7 +58,7 @@ test("反馈代理：附加设备身份/手机号，透传 thread_token", async
     assert.equal(echo.url, "/api/feedback");
     assert.equal(echo.headers["x-dsh-device"], "dev-testproxy123");
     assert.equal(echo.headers["x-dsh-phone"], "13800000000");
-    assert.equal(echo.headers["x-dsh-client"], "dsh-remote-ui/0.1.0");
+    assert.equal(echo.headers["x-dsh-client"], "dsh-remote-web/0.5.0");
     assert.equal(echo.headers.authorization, "Bearer thread-token-abc");
     assert.equal(echo.body.category, "bug");