@mrrisega/dsh-remote 0.6.0-beta.7 → 0.6.0-beta.8

package/clients/dsh-remote/test/e2ee-wecrypto-parity.test.mjs

@@ -0,0 +1,200 @@
+#!/usr/bin/env node
+/**
+ * e2ee-wecrypto-parity.test.mjs — 手机端(浏览器 WebCrypto,native.html 抽取)与
+ * 桥端(node:crypto e2ee-client.mjs)的**字节级一致性**对拍(纯函数/内存,不起进程):
+ *   - MK KAT:同一固定口令/盐 → 同一 32B hex(node 与 enterprise e2ee.js 三方一致);
+ *   - SHK/子密钥:同一 MK+a/b → 同一 hex;
+ *   - 信封(seal/open):显式 nonce/计数/方向/kind 完全一致 → node 与 wc 产出逐字段相同
+ *     (http / http-resp / w 文本+二进制 / ctrl);交叉 open 成功、篡改拒绝;
+ *   - http/ws 明文编解码与信封标记头、ws 标签解析一致。
+ *
+ * 用法: node --test test/e2ee-wecrypto-parity.test.mjs
+ */
+import assert from "node:assert/strict";
+import test from "node:test";
+import {
+  E2eeSession,
+  decodeHttpRequestPlain as nodeDecodeReq,
+  decodeHttpResponsePlain as nodeDecodeResp,
+  deriveMasterKey,
+  deriveShk,
+  encodeHttpRequestPlain as nodeEncodeReq,
+  encodeHttpResponsePlain as nodeEncodeResp,
+  envelopeRequestHeaders,
+  newSessId,
+  parseEnvelopeMarker,
+  parseWsE2eeParams,
+  randomB64
+} from "../e2ee-client.mjs";
+import { loadNativeWcCore } from "./lib-native-e2ee.mjs";
+
+// 与 e2ee-client.test.mjs 相同的 KAT 常量(enterprise deriveE2eeMasterKey 三方一致)
+const SALT_B64 = "AAECAwQFBgcICQoLDA0ODw"; // 16B 0x00..0x0f
+const EXPECTED_MK_HEX = "c73a0c5817997926c49f4902643e0203d225666b7afe60468115652ca79ec955";
+
+const wc = await loadNativeWcCore();
+const hex = (u8) => Buffer.from(u8).toString("hex");
+
+function nodeSession(over = {}) {
+  const mk = deriveMasterKey("parity-password", SALT_B64);
+  const { shk, saltH } = deriveShk(mk, randomB64(32), randomB64(32));
+  return new E2eeSession({ sessId: newSessId(), shk, saltH, ...over });
+}
+
+test("MK 派生:WebCrypto 与 node 同口令同盐逐字节一致(含 KAT)", async () => {
+  const mkWc = await wc.wcDeriveMasterKey("dsh-e2ee-test-password", SALT_B64);
+  assert.equal(mkWc.length, 32);
+  assert.equal(hex(mkWc), EXPECTED_MK_HEX); // KAT(enterprise e2ee.js 参考实现)
+  const mkNode = deriveMasterKey("dsh-e2ee-test-password", SALT_B64);
+  assert.equal(hex(mkWc), mkNode.toString("hex"));
+  // NFKC 归一(全角数字=半角)两端一致
+  const fullWc = await wc.wcDeriveMasterKey("正确口令１２３", SALT_B64);
+  const halfWc = await wc.wcDeriveMasterKey("正确口令123", SALT_B64);
+  assert.equal(hex(fullWc), hex(halfWc));
+  const fullNode = deriveMasterKey("正确口令１２３", SALT_B64);
+  assert.equal(hex(fullWc), fullNode.toString("hex"));
+  // 盐非法:wc 与 node 同样拒绝
+  await assert.rejects(() => wc.wcDeriveMasterKey("pw", "short"), /salt 非法/);
+  // 参数按服务端下发执行(iter=1 同构可算)
+  const fast = await wc.wcDeriveMasterKey("pw", SALT_B64, { alg: "pbkdf2-sha256", iter: 1, dkLen: 32, hash: "sha256" });
+  assert.equal(fast.length, 32);
+});
+
+test("SHK/子密钥:WebCrypto 与 node 在相同 a/b/MK 下逐字节一致", async () => {
+  const mkNode = deriveMasterKey("parity-password", SALT_B64);
+  const aB64 = randomB64(32);
+  const bB64 = randomB64(32);
+  const nodeShk = deriveShk(mkNode, aB64, bB64);
+  const wcMk = await wc.wcDeriveMasterKey("parity-password", SALT_B64);
+  const wcShk = await wc.wcDeriveShk(wcMk, aB64, bB64);
+  assert.equal(hex(wcShk.saltH), nodeShk.saltH.toString("hex"));
+  assert.equal(hex(wcShk.shk), nodeShk.shk.toString("hex"));
+});
+
+/** 同参数在 node 与 wc 各建一个会话(显式 a/b → SHK 一致)。 */
+async function twinSessions() {
+  const mkNode = deriveMasterKey("parity-password", SALT_B64);
+  const aB64 = randomB64(32);
+  const bB64 = randomB64(32);
+  const sessId = newSessId();
+  const wcMk = await wc.wcDeriveMasterKey("parity-password", SALT_B64);
+  const { shk: wcShk, saltH: wcSaltH } = await wc.wcDeriveShk(wcMk, aB64, bB64);
+  const nodeS = new E2eeSession({ sessId, ...deriveShk(mkNode, aB64, bB64) });
+  const wcS = new wc.WcE2eeSession({ sessId, shk: wcShk, saltH: wcSaltH });
+  return { nodeS, wcS, sessId };
+}
+
+const NONCE_12 = () => Buffer.from("00112233445566778899aabb", "hex");
+const NONCE_12_B64 = "ABEiM0RVZneImaq7";
+
+test("信封逐字段一致:http 请求 / http 响应 / w(文本·二进制)/ ctrl", async () => {
+  const { nodeS, wcS } = await twinSessions();
+
+  // http 请求(node key-info reqNonce 默认 = 信封 n)
+  const reqPlain = nodeEncodeReq({ method: "POST", path: "/api/session/s1/messages?b=2", headers: { "content-type": "application/json", "x-test": "v" }, bodyB64: Buffer.from("你好 世界").toString("base64") });
+  const envNode = nodeS.seal({ kind: "http", dir: "p2b", counter: 7, data: reqPlain, nonce: NONCE_12() });
+  const envWc = await wcS.seal({ kind: "http", dir: "p2b", counter: 7, data: reqPlain, nonceBytes: NONCE_12() });
+  assert.deepEqual(envWc, envNode, "http p2b 信封应与 node 完全一致");
+  // 交叉 open 成功
+  const openedByWc = await wcS.open({ kind: "http", dir: "p2b", env: envNode, counter: envNode.c });
+  assert.equal(Buffer.from(openedByWc.data).toString(), Buffer.from(reqPlain).toString());
+
+  // http 响应(http-resp key-info reqNonce = 请求 n;n 为响应 nonce)
+  const respPlain = nodeEncodeResp({ status: 200, headers: { "content-type": "application/json", "content-encoding": "gzip", "content-length": "10", "x-a": "1" }, bodyBuffer: Buffer.from("hello-gzip-body") });
+  const envRespN = nodeS.seal({ kind: "http-resp", dir: "b2p", counter: 3, data: respPlain, reqNonceB64: NONCE_12_B64, nonce: NONCE_12() });
+  const envRespW = await wcS.seal({ kind: "http-resp", dir: "b2p", counter: 3, data: respPlain, reqNonceB64: NONCE_12_B64, nonceBytes: NONCE_12() });
+  assert.deepEqual(envRespW, envRespN, "http-resp b2p 信封应与 node 完全一致");
+  const openedResp = await wcS.open({ kind: "http-resp", dir: "b2p", env: envRespN, counter: envRespN.c, reqNonceB64: NONCE_12_B64 });
+  const rp = nodeDecodeResp(Buffer.from(openedResp.data));
+  assert.equal(rp.status, 200);
+  assert.equal(rp.enc, "gzip");
+  assert.equal(rp.headers["content-type"], "application/json");
+  assert.equal(rp.headers["content-encoding"], undefined);
+
+  // w 文本 + 二进制
+  const wsLabel = "/api/events.mux?w=0011223344556677";
+  for (const [data, t] of [["ping-你好", undefined], [Buffer.from([0, 1, 2, 253, 254, 255]), 1]]) {
+    const envWN = nodeS.seal({ kind: "w", dir: "p2b", counter: 0, data, t, wsLabel, nonce: NONCE_12() });
+    const envWW = await wcS.seal({ kind: "w", dir: "p2b", counter: 0, data: Buffer.isBuffer(data) ? new Uint8Array(data) : data, t, wsLabel, nonceBytes: NONCE_12() });
+    assert.deepEqual(envWW, envWN, "w 信封应与 node 完全一致");
+    const back = await wcS.open({ kind: "w", dir: "p2b", env: envWN, counter: envWN.c, wsLabel });
+    assert.equal(back.t, t === 1 ? 1 : 0);
+    if (t === 1) assert.deepEqual(Buffer.from(back.data), data);
+    else assert.equal(Buffer.from(back.data).toString("utf8"), data);
+  }
+
+  // ctrl 探针
+  const probePlain = JSON.stringify({ p: "dsh-e2ee-probe-v1", t: 1700000000000, c: 0 });
+  const envCN = nodeS.seal({ kind: "ctrl", dir: "p2b", counter: 0, data: probePlain, nonce: NONCE_12() });
+  const envCW = await wcS.seal({ kind: "ctrl", dir: "p2b", counter: 0, data: probePlain, nonceBytes: NONCE_12() });
+  assert.deepEqual(envCW, envCN, "ctrl 信封应与 node 完全一致");
+});
+
+test("交叉开包 + 篡改拒绝(方向/kind/密文被改 → wc 与 node 同判)", async () => {
+  const { nodeS, wcS } = await twinSessions();
+  const plain = nodeEncodeReq({ method: "GET", path: "/api/x", headers: {}, bodyB64: "" });
+  const envN = nodeS.seal({ kind: "http", dir: "p2b", counter: 1, data: plain, nonce: NONCE_12() });
+  const envW = await wcS.seal({ kind: "http", dir: "p2b", counter: 1, data: plain, nonceBytes: NONCE_12() });
+
+  // 双向交叉开包(不同实现、同一会话材料)
+  const n2w = await wcS.open({ kind: "http", dir: "p2b", env: envN, counter: envN.c });
+  const w2n = nodeS.open({ kind: "http", dir: "p2b", env: envW, counter: envW.c });
+  assert.equal(Buffer.from(n2w.data).toString("utf8"), Buffer.from(plain).toString("utf8"));
+  assert.equal(Buffer.from(w2n.data).toString("utf8"), Buffer.from(plain).toString("utf8"));
+
+  // 篡改密文:node 拒 + wc 拒(auth_failed)
+  const tampered = { ...envW, d: (() => { const b = Buffer.from(envW.d, "base64url"); b[3] ^= 0xff; return b.toString("base64url"); })() };
+  assert.throws(() => nodeS.open({ kind: "http", dir: "p2b", env: tampered, counter: tampered.c }), (e) => e.code === "auth_failed");
+  await assert.rejects(() => wcS.open({ kind: "http", dir: "p2b", env: tampered, counter: tampered.c }), (e) => e && e.code === "auth_failed");
+  // 错误方向(wc 侧密钥域分离 → auth 失败)
+  await assert.rejects(() => wcS.open({ kind: "http", dir: "b2p", env: envW, counter: envW.c }), (e) => e && e.code === "auth_failed");
+  // 会话不符 → bad_session
+  const other = new E2eeSession({ sessId: newSessId(), shk: Buffer.alloc(32, 9), saltH: Buffer.alloc(32, 9) });
+  await assert.rejects(() => wcS.open({ kind: "http", dir: "p2b", env: { ...envW, s: other.sessId }, counter: envW.c }), (e) => e && e.code === "bad_session");
+});
+
+test("信封标记头 / 明文编解码 / ws 标签:浏览器与 node 同构", async () => {
+  const sessId = newSessId();
+  const hNode = envelopeRequestHeaders(sessId, "http");
+  const hWc = wc.wcEnvelopeHeaders(sessId, "http");
+  assert.deepEqual(hWc, hNode);
+  assert.deepEqual(wc.wcParseEnvelopeMarker(hWc), parseEnvelopeMarker(hNode));
+  assert.equal(wc.wcHasEnvelopeMarker(hWc), true);
+  assert.equal(wc.wcHasEnvelopeMarker({ "content-type": "text/html" }), false);
+
+  const req = { method: "POST", path: "/api/echo?b=2", headers: { "content-type": "application/json", "x-test": "abc" }, bodyB64: Buffer.from("payload").toString("base64") };
+  const bNode = Buffer.from(nodeEncodeReq(req));
+  const bWc = wc.wcEncodeHttpRequestPlain(req);
+  assert.deepEqual(Buffer.from(bWc), bNode, "请求明文 JSON 应逐字节一致");
+  const decWc = wc.wcDecodeHttpRequestPlain(bWc);
+  const decNode = nodeDecodeReq(bNode);
+  assert.equal(decWc.method, decNode.method);
+  assert.equal(decWc.path, decNode.path);
+  assert.deepEqual(decWc.headers, decNode.headers);
+  assert.equal(decWc.bodyB64, decNode.bodyB64);
+
+  const respNode = nodeEncodeResp({ status: 200, headers: { "content-type": "application/json", "content-encoding": "gzip" }, bodyBuffer: Buffer.from("aGk=", "base64") });
+  const respWc = wc.wcEncodeHttpResponsePlain({ status: 200, headers: { "content-type": "application/json", "content-encoding": "gzip" }, bodyB64: "aGk=" });
+  assert.deepEqual(Buffer.from(respWc), Buffer.from(respNode));
+  const dResp = wc.wcDecodeHttpResponsePlain(respWc);
+  assert.equal(dResp.enc, "gzip");
+  assert.equal(dResp.bodyB64, "aGk=");
+
+  const path = `/api/events.mux?a=1&e2ee=${sessId}&w=0011223344556677`;
+  assert.deepEqual(wc.wcParseWsE2eeParams(path), parseWsE2eeParams(path));
+  assert.equal(wc.wcParseWsE2eeParams("/api/events.mux"), null);
+});
+
+test("随机化往返:wc 自洽(seal→open)与 node 交叉 20 轮", async () => {
+  for (let i = 0; i < 20; i++) {
+    const { nodeS, wcS } = await twinSessions();
+    const wsLabel = `/stream?w=${wc.wcRandomHex(8)}`;
+    const msg = "round-" + i + "-你好-" + wc.wcRandomHex(6);
+    const envW = await wcS.seal({ kind: "w", dir: "p2b", counter: i, data: msg, wsLabel });
+    const opened = nodeS.open({ kind: "w", dir: "p2b", env: envW, counter: i, wsLabel });
+    assert.equal(Buffer.from(opened.data).toString("utf8"), msg);
+    const envN = nodeS.seal({ kind: "w", dir: "b2p", counter: i, data: Buffer.from([i, i + 1, i + 2]), t: 1, wsLabel });
+    const back = await wcS.open({ kind: "w", dir: "b2p", env: envN, counter: i, wsLabel });
+    assert.deepEqual(Buffer.from(back.data), Buffer.from([i, i + 1, i + 2]));
+  }
+});

package/clients/dsh-remote/test/lib-e2ee-shim.mjs

@@ -0,0 +1,59 @@
+#!/usr/bin/env node
+/**
+ * lib-e2ee-shim.mjs — 测试共享:从 clients/dsh-remote/e2ee-shim-script.js 抽取
+ * 「DSH-E2EE-SHIM-CORE」纯区间(浏览器 WebCrypto + 信封 + fetch/WS 包装逻辑),
+ * 包装为 ESM 后 import(node ≥22 自带 crypto.subtle / atob / btoa / fetch / WS 所需全局)。
+ *
+ * 用途:镜像页 shim(Phase-4,注入到经隧道回传的官方 dsh web 文档)与桥端 e2ee-client.mjs、
+ * native.html WC-CORE 的字节级一致性对拍 / KAT / mock 与真实 router+bridge 互通,全部用
+ * 注入脚本里的真实代码,而不是在测试里再抄一份。
+ */
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const SHIM_SCRIPT_PATH = path.join(
+  path.dirname(fileURLToPath(import.meta.url)),
+  "..", "e2ee-shim-script.js"
+);
+
+export const SHIM_CORE_START = "/* ===DSH-E2EE-SHIM-CORE-START===";
+export const SHIM_CORE_END = "/* ===DSH-E2EE-SHIM-CORE-END===";
+
+export function readShimScript() {
+  return readFileSync(SHIM_SCRIPT_PATH, "utf8");
+}
+
+/** 从 e2ee-shim-script.js 抽出纯核心区间(文本)。 */
+export function extractShimCore(script = readShimScript()) {
+  const s = script.indexOf(SHIM_CORE_START);
+  const e = script.indexOf(SHIM_CORE_END);
+  if (s === -1 || e === -1 || e <= s) throw new Error("e2ee-shim-script.js 缺少 DSH-E2EE-SHIM-CORE 区间");
+  const bodyStart = script.indexOf("\n", s) + 1;
+  return script.slice(bodyStart, e).replace(/\n\s*$/, "");
+}
+
+/** 需要暴露给测试的核心名字(与 e2ee-shim-script.js 内声明一致)。 */
+export const SHIM_EXPORTS = [
+  "SE_CT", "SE_HDR", "SE_DIR_P2B", "SE_DIR_B2P", "SE_NONCE_BYTES", "SE_TAG_BYTES", "SE_KEY_BYTES", "SE_VERSION",
+  "DSH_E2EE_HANDOVER_KEY",
+  "seErr", "seUtf8", "seUtf8Decode", "seB64ToBytes", "seBytesToB64",
+  "seRandomBytes", "seRandomHex", "seHkdf", "SeSession", "seFailureHook", "seNotifyFail",
+  "seEncodeHttpReqPlain", "seDecodeHttpRespPlain", "seEnvelopeHeaders", "seIsEnvelopeResponse", "seGunzip",
+  "seUpstreamPathOf", "seShouldEncryptHttp", "seShouldEncryptWs", "seWsLabelParts", "seBuildWsTarget",
+  "seHandoverDecode", "seSessionOfHandover",
+  "seFetchWrapper", "SeE2eeWs", "seMakeWsCtor", "seBuildResponse", "seErrorResponse"
+];
+
+let cached = null;
+
+/** 抽取 + import(幂等缓存)。 */
+export async function loadShimCore() {
+  if (cached) return cached;
+  const core = extractShimCore();
+  const src = core + "\nexport { " + SHIM_EXPORTS.join(", ") + " };\n";
+  const b64 = Buffer.from(src, "utf8").toString("base64");
+  const mod = await import("data:text/javascript;base64," + b64);
+  cached = mod;
+  return mod;
+}

package/clients/dsh-remote/test/lib-native-e2ee.mjs

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+/**
+ * lib-native-e2ee.mjs — 测试共享:从 clients/dsh-web/native.html 抽取
+ * 「DSH-E2EE-WC-CORE」纯 WebCrypto 区间,包装为 ESM 后 import(node ≥22 自带
+ * globalThis.crypto.subtle / TextEncoder / atob / btoa / DecompressionStream)。
+ *
+ * 用途:手机端(浏览器 WebCrypto)与桥端(node:crypto e2ee-client.mjs)的
+ * 字节级一致性对拍 / KAT / 端到端互通,全部用 native.html 里的真实代码,
+ * 而不是在测试里再抄一份。
+ */
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const NATIVE_HTML_PATH = path.join(
+  path.dirname(fileURLToPath(import.meta.url)),
+  "..", "..", "dsh-web", "native.html"
+);
+
+export const CORE_START = "/* ===DSH-E2EE-WC-CORE-START===";
+export const CORE_END = "/* ===DSH-E2EE-WC-CORE-END===";
+
+/** 从 native.html 抽出纯原语区间(文本)。 */
+export function extractNativeWcCore(html = readNativeHtml()) {
+  const s = html.indexOf(CORE_START);
+  const e = html.indexOf(CORE_END);
+  if (s === -1 || e === -1 || e <= s) throw new Error("native.html 缺少 DSH-E2EE-WC-CORE 区间");
+  const bodyStart = html.indexOf("\n", s) + 1;
+  return html.slice(bodyStart, e).replace(/\n\s*$/, "");
+}
+
+// ---------- Phase-4 一次性交接单(DH-CORE)抽取 ----------
+export const HANDOVER_START = "/* ===DSH-E2EE-HANDOVER-CORE-START===";
+export const HANDOVER_END = "/* ===DSH-E2EE-HANDOVER-CORE-END===";
+
+/** 从 native.html 抽出交接单纯函数区间(文本;依赖 wcBytesToB64,需与 WC-CORE 同模块)。 */
+export function extractNativeHandoverCore(html = readNativeHtml()) {
+  const s = html.indexOf(HANDOVER_START);
+  const e = html.indexOf(HANDOVER_END);
+  if (s === -1 || e === -1 || e <= s) throw new Error("native.html 缺少 DSH-E2EE-HANDOVER-CORE 区间");
+  const bodyStart = html.indexOf("\n", s) + 1;
+  return html.slice(bodyStart, e).replace(/\n\s*$/, "");
+}
+
+export function readNativeHtml() {
+  return readFileSync(NATIVE_HTML_PATH, "utf8");
+}
+
+/** 需要暴露给测试/桥端互通的浏览器端名字(与 native.html 内声明一致)。 */
+export const WC_EXPORTS = [
+  "WC_ENVELOPE_CONTENT_TYPE", "WC_ENVELOPE_HEADER", "WC_E2EE_CAP", "WC_DIR_P2B", "WC_DIR_B2P",
+  "WC_MK_BYTES", "WC_NONCE_BYTES", "WC_TAG_BYTES", "WC_E2EE_VERSION",
+  "wcNormalizePassword", "wcB64ToBytes", "wcBytesToB64", "wcUtf8", "wcUtf8Decode",
+  "wcDecodeSalt", "wcNormalizeKdf", "wcDeriveMasterKey", "wcHkdf", "wcDeriveShk",
+  "wcNewSessId", "wcRandomB64", "wcRandomHex", "wcSha256Bytes",
+  "WcE2eeSession", "wcErr",
+  "wcDecodeHttpRequestPlain", "wcEncodeHttpRequestPlain",
+  "wcDecodeHttpResponsePlain", "wcEncodeHttpResponsePlain", "wcGunzip",
+  "wcParseWsE2eeParams", "wcEnvelopeHeaders", "wcParseEnvelopeMarker", "wcHasEnvelopeMarker", "wcHeaderValueOf"
+];
+
+let cached = null;
+
+/** 抽取 + import(幂等缓存)。 */
+export async function loadNativeWcCore(html) {
+  if (cached) return cached;
+  const core = extractNativeWcCore(html);
+  const src = core + "\nexport { " + WC_EXPORTS.join(", ") + " };\n";
+  const b64 = Buffer.from(src, "utf8").toString("base64");
+  const mod = await import("data:text/javascript;base64," + b64);
+  cached = mod;
+  return mod;
+}
+
+export const HANDOVER_EXPORTS = [
+  "DSH_E2EE_HANDOVER_KEY",
+  "dshE2eeHandoverEncode",
+  "dshE2eeHandoverWrite",
+  "dshE2eeHandoverClear"
+];
+
+/** 抽取 native 交接单纯函数 + import(与 WC-CORE 同模块以复用 wcBytesToB64;幂等缓存)。 */
+export async function loadNativeHandoverCore(html) {
+  const core = extractNativeWcCore(html);
+  const handover = extractNativeHandoverCore(html);
+  const src =
+    core + "\n" + handover +
+    "\nexport { wcBytesToB64, " + HANDOVER_EXPORTS.join(", ") + " };\n";
+  const b64 = Buffer.from(src, "utf8").toString("base64");
+  const mod = await import("data:text/javascript;base64," + b64);
+  return mod;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrrisega/dsh-remote",
-  "version": "0.6.0-beta.7",
+  "version": "0.6.0-beta.8",
   "description": "手机远程控制 DeepSeek Harness · Remote control DeepSeek Harness (dsh web) from any phone browser — 100% 全功能 App 级体验：发消息、看工具执行、审批权限、改设置、管凭据，含特权操作，免内网穿透。一条命令安装 npx @mrrisega/dsh-remote。Mobile remote control for DSH, self-host or SaaS, no server needed on LAN.",
   "keywords": [
     "deepseek-harness",
@@ -52,7 +52,7 @@
     "test:router": "node --test packages/relay-router/test/native-device-selection.test.mjs packages/relay-router/test/quotas.test.mjs",
     "test:plugin": "node --test --test-concurrency=1 packages/dsh-remote-web/test/*.test.mjs",
     "test:bridge": "node --test clients/dsh-remote/test/*.test.mjs",
-    "check": "node --check clients/dsh-remote/dsh-bridge.mjs && node --check dsh-setup.mjs && node --check packages/dsh-remote-web/lib/index.js && node --check packages/dsh-remote-web/lib/client.js && bash -n deploy/install-open.sh"
+    "check": "node --check clients/dsh-remote/dsh-bridge.mjs && node --check clients/dsh-remote/e2ee-shim.mjs && node --check dsh-setup.mjs && node --check packages/dsh-remote-web/lib/index.js && node --check packages/dsh-remote-web/lib/client.js && bash -n deploy/install-open.sh"
   },
   "dependencies": {
     "ws": "^8.18.0"

package/packages/dsh-remote-web/lib/client.js

@@ -146,6 +146,9 @@ window.__ModuleLoader__.load({
       ".dru-dev-sub{font-size:11px;color:#8c959f;margin-top:3px}",
       ".dru-dev-tag{font-size:10.5px;color:#8c959f;border:1px solid #d0d7de;border-radius:999px;padding:0 7px;flex:none;white-space:nowrap}",
       ".dru-dev-tag-off{color:#cf222e;border-color:#ffb3b6;background:#fff0f1}",
+      // Phase-5:端到端加密(E2EE)状态行 —— 启用=绿字绿点,未启用=灰字(纯文字状态行,不打扰)
+      ".dru-e2ee-line{display:flex;align-items:center;gap:7px;margin-top:6px;font-size:12px;line-height:1.5;color:#57606a}",
+      ".dru-e2ee-line.ok{color:#1a7f37}",
       // 左下角「远程访问」快捷小手机图标（安装后常驻；首次点击前带红点）
       ".dru-fab{position:fixed;left:18px;bottom:18px;z-index:2147482100;width:46px;height:46px;border-radius:50%;background:#0969da;color:#fff;border:none;display:flex;align-items:center;justify-content:center;font-size:22px;line-height:1;box-shadow:0 6px 18px rgba(0,0,0,.28);cursor:pointer;font-family:inherit;padding:0}",
       ".dru-fab:hover{background:#0860bd}",
@@ -984,6 +987,26 @@ window.__ModuleLoader__.load({
       );
     }
 
+    // ── 端到端加密（E2EE，Phase-5）：bridge 状态 → 可读文案映射 ─────────────
+    // bridge 启停时把开关结果写入 <relayDir>/.e2ee-state.json（{enabled,reason,profile,epoch,caps}，
+    // 见 clients/dsh-remote/e2ee-client.mjs），node 半随 /dsh-remote/status 以 service.e2ee 下发；
+    // 此处只做“可读文案”映射（协议 docs/e2ee-protocol.md §2.3/§7.3）。
+    var E2EE_DISABLED_COPY = {
+      server_disabled: "等待服务端开启 E2EE（灰度中，当前为加密准备）",
+      params_unreachable: "当前为普通安全连接（HTTPS）",
+      disabled_by_config: "当前为普通安全连接（HTTPS）",
+      derive_failed: "账号密码已变更，需在「🔑 账号」重新登录后恢复端到端加密（当前为普通安全连接（HTTPS））",
+    };
+    var E2EE_DISABLED_FALLBACK = "当前为普通安全连接（HTTPS）";
+    /** 把 service.e2ee 归一化为可读状态行；e2ee 缺失/旧 host 未下发 → null（不打扰）。 */
+    function describeE2ee(e2ee) {
+      if (!e2ee || typeof e2ee !== "object") return null;
+      if (e2ee.enabled === true) return { kind: "ok", text: "🔒 端到端加密已启用（手机解锁后生效）" };
+      var reason = typeof e2ee.reason === "string" && e2ee.reason ? e2ee.reason : "";
+      var text = E2EE_DISABLED_COPY[reason] || E2EE_DISABLED_FALLBACK; // reason 未知 → 兜底
+      return { kind: "off", text: text };
+    }
+
     // ── 面板主体（渲染于设置页 settings.section 栏目内） ─────────────────────
     function RemoteControlSection(props) {
 
@@ -1477,11 +1500,23 @@ window.__ModuleLoader__.load({
             ? "请先登录（下方账号卡片）后启用远程访问"
             : serviceRunning ? "已连接（可远程访问）" : "等待设备连接";
         var dotCls = "dru-dot " + (loggedInSaaS && serviceRunning ? "dru-dot-on" : "dru-dot-off");
+        // Phase-5:端到端加密(E2EE)状态行 —— 未登录/旧 host 未下发 e2ee 一律不渲染
+        // （桌面宽屏与手机镜像共用同一面板：纯文字状态行、不弹层不打扰）；启用=绿点绿字，
+        // 未启用=灰字 + 原因映射（server_disabled 等待灰度开启 / 其余回退普通 HTTPS）。
+        function renderE2eeBadge() {
+          if (!loggedInSaaS) return null;
+          var e = describeE2ee(st && st.service && st.service.e2ee);
+          if (!e) return null;
+          return h("div", { className: "dru-e2ee-line" + (e.kind === "ok" ? " ok" : "") },
+            h("span", { className: "dru-dot " + (e.kind === "ok" ? "dru-dot-on" : "dru-dot-off") }),
+            h("span", null, e.text));
+        }
         return card("📱 远程访问", [
           h("div", { className: "dru-status-line" },
             h("span", { className: dotCls }),
             h("span", null, statusTxt)
           ),
+          renderE2eeBadge(),
           akeyMsg ? h("div", { className: "dru-msg dru-msg-" + akeyMsg.kind, style: { marginTop: 8 } }, akeyMsg.text) : null,
           hasKey ? h("div", null, [
             h("div", { className: "dru-url big", style: { marginTop: 8 } },
@@ -1692,7 +1727,7 @@ window.__ModuleLoader__.load({
             h("div", { className: "dru-hint", style: { marginBottom: 6 } }, "📱 远程访问：用手机或另一台电脑的浏览器，随时随地使用同一份 dsh web——人在哪都能用（免公网 IP、免内网穿透）；官方托管中继，4G/5G 即用，也可自建服务。"),
             h("div", { className: "dru-hint", style: { marginBottom: 6 } }, "🛠 电脑端一键安装：bridge 与「远程访问」面板一次到位——云端/自建切换、账号登录、bridge 启停、一次性扫码访问、已授权设备管理、意见反馈都在这里。"),
             h("div", { className: "dru-hint", style: { marginBottom: 6 } }, "🔒 安全与通道：HTTP / WebSocket 全量透传，一次性访问密钥认证，面板实时显示设备与已授权设备列表；服务端可配置流量配额。"),
-            h("div", { className: "dru-hint" }, "🛡 端到端流量保护：可选对通道做端到端加密保护，传输全程不暴露本机公网 IP（详见项目 README「安全」说明）。")
+            h("div", { className: "dru-hint" }, "🛡 端到端加密（灰度开启中）：服务端开启后，手机↔电脑之间的消息内容用「你的账号密码派生密钥」端到端加密——密钥与密码不落服务端（仅存校验值），中继只可见路径/大小/时间（详见 README「安全与隐私」）。")
           ]),
           // 版本与更新（自管理：检测新版 / 一键在线更新 / 彻底卸载）
           h(SelfManageCard, null),

package/packages/dsh-remote-web/lib/index.js

@@ -804,6 +804,31 @@ async function proxyRevokeMobileSession(relayDir, req, res) {
 
 // ---------- 综合状态 ----------
 
+/**
+ * 读取 bridge 写入的 E2EE 开关状态（<relayDir>/.e2ee-state.json，写入方见
+ * clients/dsh-remote/e2ee-client.mjs 的 writeE2eeStateFile：{enabled, reason, profile, epoch, caps, at}）。
+ * 归一化后只透出固定展示字段（enabled/reason/profile/epoch/caps），at 等调试字段不外泄；
+ * 文件缺失/损坏一律视为「未启用（明文回退）」——面板据此显示普通安全连接。
+ */
+export function readE2eeStateFile(relayDir) {
+  const none = () => ({ enabled: false, reason: "no_state_file", profile: "", epoch: 0, caps: [] });
+  try {
+    const f = join(relayDir, ".e2ee-state.json");
+    if (!existsSync(f)) return none();
+    const s = JSON.parse(readFileSync(f, "utf8"));
+    if (!s || typeof s !== "object") return none();
+    return {
+      enabled: s.enabled === true,
+      reason: typeof s.reason === "string" && s.reason ? s.reason : "",
+      profile: typeof s.profile === "string" ? s.profile : "",
+      epoch: Number.isInteger(s.epoch) && s.epoch >= 0 ? s.epoch : 0,
+      caps: Array.isArray(s.caps) ? s.caps.filter((c) => typeof c === "string") : [],
+    };
+  } catch {
+    return none();
+  }
+}
+
 async function composeStatus(relayDir) {
   const cfg = loadConfig(relayDir);
   const launchd = launchdStatus();
@@ -838,6 +863,9 @@ async function composeStatus(relayDir) {
       manual,
       running: launchd.running || manual.bridge.length > 0,
       bindError,
+      // E2EE 开关状态（bridge 写 .e2ee-state.json；文件缺失 = 未启用明文）：
+      // {enabled, reason, profile, epoch, caps}，供面板「📱 远程访问」卡展示加密状态。
+      e2ee: readE2eeStateFile(relayDir),
     },
     host: hostname(),
   };
@@ -946,7 +974,7 @@ const PLUGIN_ID = "dsh-remote-web";
 const PLUGIN_LEGACY_IDS = ["dsh-remote-ui"];
 const PLUGIN_ALL_IDS = [PLUGIN_ID, ...PLUGIN_LEGACY_IDS];
 /** 插件自身发布版本（与 dsh-remote 根包同步递增）。 */
-const PLUGIN_VERSION = "0.6.0-beta.7";
+const PLUGIN_VERSION = "0.6.0-beta.8";
 const UPDATE_LOG = ".dsh-update.log";
 const UPDATE_MARKER = ".dsh-update-running";
 

package/packages/dsh-remote-web/test/e2ee-state.test.mjs

@@ -0,0 +1,141 @@
+// 插件 node 半 E2EE 状态读取（Phase-5）：composeStatus 读取 relayDir/.e2ee-state.json →
+// /dsh-remote/status 的 service.e2ee = {enabled, reason, profile, epoch, caps}；文件缺失/损坏=未启用明文。
+// 覆盖：readE2eeStateFile 归一化单测 + 真实 apply 路由集成（写状态文件 → status 带回；删文件 → 默认明文）。
+import assert from "node:assert/strict";
+import http from "node:http";
+import { chmod, mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { apply, readE2eeStateFile } from "../lib/index.js";
+
+const E2EE_DEFAULT = { enabled: false, reason: "no_state_file", profile: "", epoch: 0, caps: [] };
+
+test("readE2eeStateFile：缺失/损坏 → 默认明文；有效状态归一化（at 等调试字段不外泄）", async () => {
+  const tempDir = await mkdtemp(path.join(os.tmpdir(), "dsh-e2ee-read-"));
+  try {
+    // 1) 文件缺失 → 默认（未启用明文）
+    assert.deepEqual(readE2eeStateFile(tempDir), E2EE_DEFAULT);
+
+    // 2) 损坏 JSON / 非对象 → 默认
+    await writeFile(path.join(tempDir, ".e2ee-state.json"), "{oops", "utf8");
+    assert.deepEqual(readE2eeStateFile(tempDir), E2EE_DEFAULT);
+    await writeFile(path.join(tempDir, ".e2ee-state.json"), "42", "utf8");
+    assert.deepEqual(readE2eeStateFile(tempDir), E2EE_DEFAULT);
+
+    // 3) 有效状态：只透出固定展示字段，enabled/caps 等按布尔/字符串严格归一化
+    await writeFile(path.join(tempDir, ".e2ee-state.json"), JSON.stringify({
+      enabled: true,
+      reason: "ok",
+      profile: "pbkdf2-sha256-600k",
+      epoch: 3,
+      caps: ["e2ee-v2", 7, null, "e2ee-http"],
+      at: Date.now(), // 调试字段
+    }), "utf8");
+    assert.deepEqual(readE2eeStateFile(tempDir), {
+      enabled: true,
+      reason: "ok",
+      profile: "pbkdf2-sha256-600k",
+      epoch: 3,
+      caps: ["e2ee-v2", "e2ee-http"],
+    });
+
+    // 4) 畸形字段兜底：enabled 非布尔→false；reason 非字符串→空；epoch 负数/字符串→0
+    await writeFile(path.join(tempDir, ".e2ee-state.json"), JSON.stringify({
+      enabled: "yes",
+      reason: 123,
+      profile: null,
+      epoch: -1,
+      caps: "e2ee-v2",
+    }), "utf8");
+    assert.deepEqual(readE2eeStateFile(tempDir), {
+      enabled: false,
+      reason: "",
+      profile: "",
+      epoch: 0,
+      caps: [],
+    });
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+/** 假账号 API：只回 public-config（composeStatus 取 app_url 用），其余 404。 */
+function startFakeRelay() {
+  const srv = http.createServer((req, res) => {
+    const url = new URL(req.url, "http://x");
+    res.writeHead(200, { "content-type": "application/json" });
+    if (url.pathname === "/api/public-config") {
+      res.end(JSON.stringify({ app_url: "https://app.test/app/", api_url: `http://127.0.0.1:${srv.address().port}/relay-api` }));
+      return;
+    }
+    res.end(JSON.stringify({ error: { code: "not_found" } }));
+  });
+  return new Promise((resolve) => srv.listen(0, "127.0.0.1", () => resolve(srv)));
+}
+
+/** 装载插件路由 + 假 launchctl/pgrep/ps（避免触碰真实系统服务），返回 host http server 与 base。 */
+async function bootPlugin(relayDir) {
+  const fakeBin = path.join(relayDir, "fakebin");
+  await mkdir(fakeBin, { recursive: true });
+  const noop = "#!/bin/sh\nexit 0\n";
+  for (const name of ["launchctl", "pgrep", "ps"]) {
+    const p = path.join(fakeBin, name);
+    await writeFile(p, noop);
+    await chmod(p, 0o755);
+  }
+  const oldPath = process.env.PATH;
+  process.env.PATH = `${fakeBin}:${oldPath}`;
+
+  const routes = new Map();
+  apply({
+    webServer: { register(route) { routes.set(route.path, route.handler); return () => {}; } },
+    effect(register) { return register(); },
+    logger: { info() {}, warn() {} },
+  }, { relayDir });
+  const host = http.createServer((req, res) => {
+    const handler = routes.get(new URL(req.url, "http://x").pathname);
+    (handler || ((_r, rs) => { rs.writeHead(404); rs.end(); }))(req, res);
+  });
+  await new Promise((resolve) => host.listen(0, "127.0.0.1", resolve));
+  return { host, base: `http://127.0.0.1:${host.address().port}`, fakeBin, oldPath };
+}
+
+test("composeStatus：.e2ee-state.json 启用 → /dsh-remote/status 的 service.e2ee；删除 → 默认明文", async () => {
+  const relay = await startFakeRelay();
+  const tempDir = await mkdtemp(path.join(os.tmpdir(), "dsh-e2ee-status-"));
+  const stateFile = path.join(tempDir, ".e2ee-state.json");
+  await writeFile(path.join(tempDir, ".dsh-config.json"), JSON.stringify({
+    phone: "13800000000",
+    device_id: "dev-e2ee",
+    api_url: `http://127.0.0.1:${relay.address().port}/relay-api`,
+  }));
+  const boot = await bootPlugin(tempDir);
+  try {
+    // 1) bridge 已启用 E2EE（写状态文件）→ status 携带归一化 service.e2ee
+    await writeFile(stateFile, JSON.stringify({
+      enabled: true, reason: "ok", profile: "pbkdf2-sha256-600k", epoch: 2, caps: ["e2ee-v2"], at: Date.now(),
+    }));
+    let status = await (await fetch(`${boot.base}/dsh-remote/status`)).json();
+    assert.equal(status.ok, true);
+    assert.deepEqual(status.service.e2ee, {
+      enabled: true, reason: "ok", profile: "pbkdf2-sha256-600k", epoch: 2, caps: ["e2ee-v2"],
+    });
+
+    // 2) bridge 未启用（服务端灰度关）→ 原样上报 reason，供面板映射可读文案
+    await writeFile(stateFile, JSON.stringify({ enabled: false, reason: "server_disabled", profile: "", epoch: 0, caps: [] }));
+    status = await (await fetch(`${boot.base}/dsh-remote/status`)).json();
+    assert.equal(status.service.e2ee.enabled, false);
+    assert.equal(status.service.e2ee.reason, "server_disabled");
+
+    // 3) 文件缺失 = 未启用明文（默认兜底）
+    await rm(stateFile, { force: true });
+    status = await (await fetch(`${boot.base}/dsh-remote/status`)).json();
+    assert.deepEqual(status.service.e2ee, E2EE_DEFAULT);
+  } finally {
+    boot.host.close();
+    relay.close();
+    process.env.PATH = boot.oldPath;
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});