@mrrisega/dsh-remote 0.6.0-beta.7 → 0.6.0-beta.9

package/packages/dsh-remote-web/test/access-key-sessions.test.mjs

@@ -1,5 +1,7 @@
 // 插件 node 半新增代理回归：/dsh-remote/access-key | mobile-sessions | mobile-sessions/revoke
-// （企业端 E1 契约：POST /api/auth-key、POST /api/mobile-sessions、POST /api/mobile-sessions/:id/revoke，Bearer device-login JWT）
+// | mobile-sessions/delete | mobile-sessions/purge
+// （企业端 E1 契约：POST /api/auth-key、GET /api/mobile-sessions、POST /api/mobile-sessions/:id/revoke、
+//  DELETE /api/mobile-sessions/:id、POST /api/mobile-sessions/purge，Bearer device-login JWT）
 // 覆盖：Bearer 透传、字段扁平化、未登录 401、qr 缺失容错、上游错误透传。
 import assert from "node:assert/strict";
 import http from "node:http";
@@ -41,6 +43,9 @@ function startFakeRelay(opts = {}) {
     }
     if (req.method === "POST" && url.pathname === "/api/mobile-sessions/ms_1/revoke") return send(200, { ok: true });
     if (req.method === "POST" && url.pathname === "/api/mobile-sessions/ghost/revoke") return send(404, { error: { message: "not_found" } });
+    if (req.method === "DELETE" && url.pathname === "/api/mobile-sessions/ms_1") return send(200, { ok: true });
+    if (req.method === "DELETE" && url.pathname === "/api/mobile-sessions/ghost") return send(404, { error: { message: "not_found" } });
+    if (req.method === "POST" && url.pathname === "/api/mobile-sessions/purge") return send(200, { ok: true, removed: 2 });
     send(404, { error: { code: "not_found" } });
   });
   return new Promise((resolve) => srv.listen(0, "127.0.0.1", () => resolve({ srv, seen, port: srv.address().port })));
@@ -155,7 +160,66 @@ test("mobile-sessions/revoke 路由：body {id} 转发到 /api/mobile-sessions/:
   }
 });
 
-test("未登录（无账号配置）→ 三条路由统一 401 提示登录，不请求企业端", async () => {
+test("mobile-sessions/delete 路由：DELETE body {id} 转发到企业端 DELETE /api/mobile-sessions/:id（拉黑 jti）", async () => {
+  const relay = await startFakeRelay();
+  const { host, base, tempDir } = await bootRelay(relay.port);
+  try {
+    const r = await (await fetch(`${base}/dsh-remote/mobile-sessions/delete`, {
+      method: "DELETE",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ id: "ms_1" }),
+    })).json();
+    assert.equal(r.ok, true);
+    const up = relay.seen.find((s) => s.path === "/api/mobile-sessions/ms_1" && s.method === "DELETE");
+    assert.ok(up, "应转发到企业端 DELETE /api/mobile-sessions/ms_1");
+    assert.equal(up.authorization, "Bearer jwt-abc");
+
+    // 缺 id → 400；不存在的会话 → 透传 404 文案
+    const bad = await (await fetch(`${base}/dsh-remote/mobile-sessions/delete`, {
+      method: "DELETE",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({}),
+    })).json();
+    assert.equal(bad.ok, false);
+    assert.match(String(bad.error), /id/);
+
+    const ghost = await (await fetch(`${base}/dsh-remote/mobile-sessions/delete`, {
+      method: "DELETE",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ id: "ghost" }),
+    })).json();
+    assert.equal(ghost.ok, false);
+    assert.match(String(ghost.error), /not_found/);
+  } finally {
+    host.close();
+    relay.srv.close();
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("mobile-sessions/purge 路由：POST → 企业端 POST /api/mobile-sessions/purge，removed 透传", async () => {
+  const relay = await startFakeRelay();
+  const { host, base, tempDir } = await bootRelay(relay.port);
+  try {
+    const r = await (await fetch(`${base}/dsh-remote/mobile-sessions/purge`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({}),
+    })).json();
+    assert.equal(r.ok, true);
+    assert.equal(r.removed, 2, "企业端返回的 removed 清理条数应透传");
+    const up = relay.seen.find((s) => s.path === "/api/mobile-sessions/purge");
+    assert.ok(up, "应转发到 /api/mobile-sessions/purge");
+    assert.equal(up.method, "POST");
+    assert.equal(up.authorization, "Bearer jwt-abc");
+  } finally {
+    host.close();
+    relay.srv.close();
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("未登录（无账号配置）→ 五条路由统一 401 提示登录，不请求企业端", async () => {
   const relay = await startFakeRelay();
   const tempDir = await mkdtemp(path.join(os.tmpdir(), "dsh-aks-401-"));
   await writeFile(path.join(tempDir, ".dsh-config.json"), JSON.stringify({ api_url: `http://127.0.0.1:${relay.port}` }));
@@ -179,13 +243,19 @@ test("未登录（无账号配置）→ 三条路由统一 401 提示登录，
       assert.equal((await (await fetch(`${base}${p}`, { method }))).status, 401, `${p} 应返回 401`);
       assert.match(String(r.error), /尚未登录/);
     }
-    const rev = await (await fetch(`${base}/dsh-remote/mobile-sessions/revoke`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ id: "ms_1" }),
-    })).json();
-    assert.equal(rev.ok, false);
-    assert.match(String(rev.error), /尚未登录/);
+    for (const [method, p] of [
+      ["POST", "/dsh-remote/mobile-sessions/revoke"],
+      ["DELETE", "/dsh-remote/mobile-sessions/delete"],
+      ["POST", "/dsh-remote/mobile-sessions/purge"],
+    ]) {
+      const r = await (await fetch(`${base}${p}`, {
+        method,
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ id: "ms_1" }),
+      })).json();
+      assert.equal(r.ok, false);
+      assert.match(String(r.error), /尚未登录/);
+    }
     assert.ok(!relay.seen.some((s) => s.path.startsWith("/api/auth-key") || s.path.startsWith("/api/mobile-sessions")), "未登录不应请求企业端");
   } finally {
     host.close();

package/packages/dsh-remote-web/test/e2ee-state.test.mjs

@@ -0,0 +1,141 @@
+// 插件 node 半 E2EE 状态读取（Phase-5）：composeStatus 读取 relayDir/.e2ee-state.json →
+// /dsh-remote/status 的 service.e2ee = {enabled, reason, profile, epoch, caps}；文件缺失/损坏=未启用明文。
+// 覆盖：readE2eeStateFile 归一化单测 + 真实 apply 路由集成（写状态文件 → status 带回；删文件 → 默认明文）。
+import assert from "node:assert/strict";
+import http from "node:http";
+import { chmod, mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { apply, readE2eeStateFile } from "../lib/index.js";
+
+const E2EE_DEFAULT = { enabled: false, reason: "no_state_file", profile: "", epoch: 0, caps: [] };
+
+test("readE2eeStateFile：缺失/损坏 → 默认明文；有效状态归一化（at 等调试字段不外泄）", async () => {
+  const tempDir = await mkdtemp(path.join(os.tmpdir(), "dsh-e2ee-read-"));
+  try {
+    // 1) 文件缺失 → 默认（未启用明文）
+    assert.deepEqual(readE2eeStateFile(tempDir), E2EE_DEFAULT);
+
+    // 2) 损坏 JSON / 非对象 → 默认
+    await writeFile(path.join(tempDir, ".e2ee-state.json"), "{oops", "utf8");
+    assert.deepEqual(readE2eeStateFile(tempDir), E2EE_DEFAULT);
+    await writeFile(path.join(tempDir, ".e2ee-state.json"), "42", "utf8");
+    assert.deepEqual(readE2eeStateFile(tempDir), E2EE_DEFAULT);
+
+    // 3) 有效状态：只透出固定展示字段，enabled/caps 等按布尔/字符串严格归一化
+    await writeFile(path.join(tempDir, ".e2ee-state.json"), JSON.stringify({
+      enabled: true,
+      reason: "ok",
+      profile: "pbkdf2-sha256-600k",
+      epoch: 3,
+      caps: ["e2ee-v2", 7, null, "e2ee-http"],
+      at: Date.now(), // 调试字段
+    }), "utf8");
+    assert.deepEqual(readE2eeStateFile(tempDir), {
+      enabled: true,
+      reason: "ok",
+      profile: "pbkdf2-sha256-600k",
+      epoch: 3,
+      caps: ["e2ee-v2", "e2ee-http"],
+    });
+
+    // 4) 畸形字段兜底：enabled 非布尔→false；reason 非字符串→空；epoch 负数/字符串→0
+    await writeFile(path.join(tempDir, ".e2ee-state.json"), JSON.stringify({
+      enabled: "yes",
+      reason: 123,
+      profile: null,
+      epoch: -1,
+      caps: "e2ee-v2",
+    }), "utf8");
+    assert.deepEqual(readE2eeStateFile(tempDir), {
+      enabled: false,
+      reason: "",
+      profile: "",
+      epoch: 0,
+      caps: [],
+    });
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+/** 假账号 API：只回 public-config（composeStatus 取 app_url 用），其余 404。 */
+function startFakeRelay() {
+  const srv = http.createServer((req, res) => {
+    const url = new URL(req.url, "http://x");
+    res.writeHead(200, { "content-type": "application/json" });
+    if (url.pathname === "/api/public-config") {
+      res.end(JSON.stringify({ app_url: "https://app.test/app/", api_url: `http://127.0.0.1:${srv.address().port}/relay-api` }));
+      return;
+    }
+    res.end(JSON.stringify({ error: { code: "not_found" } }));
+  });
+  return new Promise((resolve) => srv.listen(0, "127.0.0.1", () => resolve(srv)));
+}
+
+/** 装载插件路由 + 假 launchctl/pgrep/ps（避免触碰真实系统服务），返回 host http server 与 base。 */
+async function bootPlugin(relayDir) {
+  const fakeBin = path.join(relayDir, "fakebin");
+  await mkdir(fakeBin, { recursive: true });
+  const noop = "#!/bin/sh\nexit 0\n";
+  for (const name of ["launchctl", "pgrep", "ps"]) {
+    const p = path.join(fakeBin, name);
+    await writeFile(p, noop);
+    await chmod(p, 0o755);
+  }
+  const oldPath = process.env.PATH;
+  process.env.PATH = `${fakeBin}:${oldPath}`;
+
+  const routes = new Map();
+  apply({
+    webServer: { register(route) { routes.set(route.path, route.handler); return () => {}; } },
+    effect(register) { return register(); },
+    logger: { info() {}, warn() {} },
+  }, { relayDir });
+  const host = http.createServer((req, res) => {
+    const handler = routes.get(new URL(req.url, "http://x").pathname);
+    (handler || ((_r, rs) => { rs.writeHead(404); rs.end(); }))(req, res);
+  });
+  await new Promise((resolve) => host.listen(0, "127.0.0.1", resolve));
+  return { host, base: `http://127.0.0.1:${host.address().port}`, fakeBin, oldPath };
+}
+
+test("composeStatus：.e2ee-state.json 启用 → /dsh-remote/status 的 service.e2ee；删除 → 默认明文", async () => {
+  const relay = await startFakeRelay();
+  const tempDir = await mkdtemp(path.join(os.tmpdir(), "dsh-e2ee-status-"));
+  const stateFile = path.join(tempDir, ".e2ee-state.json");
+  await writeFile(path.join(tempDir, ".dsh-config.json"), JSON.stringify({
+    phone: "13800000000",
+    device_id: "dev-e2ee",
+    api_url: `http://127.0.0.1:${relay.address().port}/relay-api`,
+  }));
+  const boot = await bootPlugin(tempDir);
+  try {
+    // 1) bridge 已启用 E2EE（写状态文件）→ status 携带归一化 service.e2ee
+    await writeFile(stateFile, JSON.stringify({
+      enabled: true, reason: "ok", profile: "pbkdf2-sha256-600k", epoch: 2, caps: ["e2ee-v2"], at: Date.now(),
+    }));
+    let status = await (await fetch(`${boot.base}/dsh-remote/status`)).json();
+    assert.equal(status.ok, true);
+    assert.deepEqual(status.service.e2ee, {
+      enabled: true, reason: "ok", profile: "pbkdf2-sha256-600k", epoch: 2, caps: ["e2ee-v2"],
+    });
+
+    // 2) bridge 未启用（服务端关闭/不支持）→ 原样上报 reason，供面板映射可读文案
+    await writeFile(stateFile, JSON.stringify({ enabled: false, reason: "server_disabled", profile: "", epoch: 0, caps: [] }));
+    status = await (await fetch(`${boot.base}/dsh-remote/status`)).json();
+    assert.equal(status.service.e2ee.enabled, false);
+    assert.equal(status.service.e2ee.reason, "server_disabled");
+
+    // 3) 文件缺失 = 未启用明文（默认兜底）
+    await rm(stateFile, { force: true });
+    status = await (await fetch(`${boot.base}/dsh-remote/status`)).json();
+    assert.deepEqual(status.service.e2ee, E2EE_DEFAULT);
+  } finally {
+    boot.host.close();
+    relay.close();
+    process.env.PATH = boot.oldPath;
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});

package/packages/dsh-remote-web/test/remote-access-ui.test.mjs

@@ -22,6 +22,12 @@ function find(tree, predicate) {
   return match;
 }
 
+function findAll(tree, predicate) {
+  const out = [];
+  walk(tree, (node) => { if (predicate(node)) out.push(node); });
+  return out;
+}
+
 /** 文本子节点包含子串（用于动态拼接文案断言）。 */
 function textHas(tree, substr) {
   return !!find(tree, (node) => (node.children || []).some((c) => typeof c === "string" && c.includes(substr)));
@@ -108,11 +114,19 @@ function loadPlugin(opts = {}) {
       }
       if (path === "/dsh-remote/mobile-sessions") {
         sessionsCalls++;
-        return response(200, { ok: true, sessions: sessionsCalls === 1 ? SESSIONS_1 : [] }); // 取消配对后的刷新 → 空列表
+        // 默认：首次给列表，后续刷新给空（模拟已全部清理）；测试可传 opts.sessions 固定列表
+        const list = opts.sessions !== undefined ? opts.sessions : (sessionsCalls === 1 ? SESSIONS_1 : []);
+        return response(200, { ok: true, sessions: list });
       }
       if (path === "/dsh-remote/mobile-sessions/revoke") {
         return response(200, { ok: true });
       }
+      if (path === "/dsh-remote/mobile-sessions/delete") {
+        return response(200, { ok: true });
+      }
+      if (path === "/dsh-remote/mobile-sessions/purge") {
+        return response(200, { ok: true, removed: 1 });
+      }
       if (path === "/dsh-remote/account") return response(200, { ok: true, account: { phone: "13800000000", plan: "free", plan_source: "plan", invite_code: "ABC12345" } });
       return response(200, { ok: true });
     },
@@ -172,7 +186,7 @@ test("📱 远程访问卡：bridge 在线 → 绿点文案；登录态点「生
   assert.ok(qr && qr.props?.alt === "远程访问二维码", "应渲染服务端返回的二维码 <img>");
   // 到期倒计时/有效至文案
   assert.ok(textHas(tree, "有效至") && textHas(tree, "剩余"), "应显示「有效至 HH:MM:SS / 剩余 xx:xx」倒计时");
-  assert.ok(textHas(tree, "访问一次后失效"), "应说明一次性/30 分钟语义");
+  assert.ok(textHas(tree, "用一次即失效"), "应说明一次性/30 分钟语义（精简一句）");
 });
 
 test("已授权设备：展开列表（label/os/browser/时间）→ 取消配对二次确认 → 成功提示并刷新", async () => {
@@ -216,6 +230,76 @@ test("已授权设备：展开列表（label/os/browser/时间）→ 取消配
   assert.ok(textHas(tree, "暂无已授权设备（手机扫码后出现）"), "刷新后空态文案应出现");
 });
 
+test("已授权设备行内操作：活跃行有 取消配对+删除记录，已取消行有 删除记录；删除记录二次确认 → DELETE delete {id}", async () => {
+  const plugin = loadPlugin({ sessions: SESSIONS_1 }); // 固定列表：操作后重拉仍保留，便于断言行内按钮
+  plugin.states[0] = { config: { phone: "13800000000", deviceId: "dev-x" }, service: { running: true } };
+  let tree = plugin.render();
+  const openBtn = find(tree, (n) => typeof n.props?.onClick === "function" && (n.children || []).some((c) => typeof c === "string" && c.includes("已授权设备")));
+  openBtn.props.onClick();
+  await flush();
+  await flush();
+  tree = plugin.render();
+
+  // 行内按钮：活跃行（ms_1）应有「取消配对」+「删除记录」；已取消行（ms_2）只应有「删除记录」
+  const delBtns = findAll(tree, (n) => typeof n.props?.onClick === "function" && (n.children || []).some((c) => typeof c === "string" && c.includes("删除记录")));
+  assert.ok(delBtns.length >= 2, "每行（含已取消/历史）都应有「删除记录」按钮");
+  assert.ok(find(tree, (n) => typeof n.props?.onClick === "function" && (n.children || []).some((c) => typeof c === "string" && c.includes("取消配对"))),
+    "活跃行应有「取消配对」按钮");
+  // 底部有「清理已解绑」入口（卡片底部）
+  assert.ok(textHas(tree, "清理已解绑"), "卡片底部应提供「清理已解绑」");
+
+  // 删除 ms_1：第一次点击进入确认态（不请求）
+  delBtns[0].props.onClick();
+  tree = plugin.render();
+  assert.ok(textHas(tree, "再点一次确认删除记录"), "删除记录需二次确认");
+  assert.ok(!plugin.requests.some((r) => r.path === "/dsh-remote/mobile-sessions/delete"), "首次点击不应发 DELETE");
+
+  // 第二次点击 → DELETE /dsh-remote/mobile-sessions/delete {id} → 提示 + 刷新列表
+  const listBefore = plugin.requests.filter((r) => r.path === "/dsh-remote/mobile-sessions").length;
+  find(tree, (n) => typeof n.props?.onClick === "function" && (n.children || []).some((c) => typeof c === "string" && c.includes("再点一次确认删除记录"))).props.onClick();
+  await flush();
+  await flush();
+  await flush();
+  const del = plugin.requests.find((r) => r.path === "/dsh-remote/mobile-sessions/delete");
+  assert.ok(del, "确认后应 DELETE /dsh-remote/mobile-sessions/delete");
+  assert.equal(del.method, "DELETE");
+  assert.deepEqual(del.body, { id: "ms_1" }, "行内删除应带上该行 session id");
+  assert.ok(plugin.requests.filter((r) => r.path === "/dsh-remote/mobile-sessions").length > listBefore, "删除后应重拉设备列表");
+  tree = plugin.render();
+  assert.ok(textHas(tree, "已删除该设备的记录"), "删除成功应有可读提示");
+});
+
+test("已授权设备：卡片底部「清理已解绑」→ 二次确认 → POST purge → 提示条数 + 刷新列表", async () => {
+  const plugin = loadPlugin({ sessions: SESSIONS_1 });
+  plugin.states[0] = { config: { phone: "13800000000", deviceId: "dev-x" }, service: { running: true } };
+  let tree = plugin.render();
+  const openBtn = find(tree, (n) => typeof n.props?.onClick === "function" && (n.children || []).some((c) => typeof c === "string" && c.includes("已授权设备")));
+  openBtn.props.onClick();
+  await flush();
+  await flush();
+  tree = plugin.render();
+
+  // 底部 purge 按钮：带 1 条已解绑计数
+  const purgeBtn = find(tree, (n) => typeof n.props?.onClick === "function" && (n.children || []).some((c) => typeof c === "string" && c.includes("清理已解绑")));
+  assert.ok(purgeBtn, "卡片底部应有「清理已解绑」按钮");
+  purgeBtn.props.onClick();
+  tree = plugin.render();
+  assert.ok(textHas(tree, "再点一次确认清理已解绑"), "清理已解绑需二次确认");
+  assert.ok(!plugin.requests.some((r) => r.path === "/dsh-remote/mobile-sessions/purge"), "首次点击不应发请求");
+
+  const listBefore = plugin.requests.filter((r) => r.path === "/dsh-remote/mobile-sessions").length;
+  find(tree, (n) => typeof n.props?.onClick === "function" && (n.children || []).some((c) => typeof c === "string" && c.includes("再点一次确认清理已解绑"))).props.onClick();
+  await flush();
+  await flush();
+  await flush();
+  const purge = plugin.requests.find((r) => r.path === "/dsh-remote/mobile-sessions/purge");
+  assert.ok(purge, "确认后应 POST /dsh-remote/mobile-sessions/purge");
+  assert.equal(purge.method, "POST");
+  assert.ok(plugin.requests.filter((r) => r.path === "/dsh-remote/mobile-sessions").length > listBefore, "清理后应重拉设备列表");
+  tree = plugin.render();
+  assert.ok(textHas(tree, "已清理 1 条已解绑记录"), "应提示清理条数（可读）");
+});
+
 test("升级/续费按钮：点击 → GET /dsh-remote/access-key → window.open(url)（带登录态打开）", async () => {
   const plugin = loadPlugin();
   plugin.states[0] = { config: { phone: "13800000000", deviceId: "dev-x" }, service: { running: true } };
@@ -250,4 +334,92 @@ test("二维码缺失容错 + 未登录引导文案（源码级约束）", () =>
   assert.match(SOURCE, /已连接（可远程访问）/);
   assert.match(SOURCE, /带登录态/);
   assert.match(SOURCE, /通过手机或另一台电脑远程使用同一份 dsh web/);
+  // 已授权设备管理（delete/purge 代理路由与按钮）
+  assert.match(SOURCE, /dsh-remote\/mobile-sessions\/delete/);
+  assert.match(SOURCE, /dsh-remote\/mobile-sessions\/purge/);
+  assert.match(SOURCE, /删除记录/);
+  assert.match(SOURCE, /清理已解绑/);
+  assert.match(SOURCE, /再点一次确认删除记录/);
+  assert.match(SOURCE, /再点一次确认清理已解绑/);
+  // 文案精简：二维码说明压成一句、右侧长段压成一句
+  assert.match(SOURCE, /扫码即进入，30 分钟有效、用一次即失效。/);
+  assert.match(SOURCE, /打开链接\/扫码进入即登录态；同设备重复扫码只更新授权，不新增设备。/);
+  assert.doesNotMatch(SOURCE, /每次生成的链接 30 分钟有效、访问一次后失效/);
+  assert.doesNotMatch(SOURCE, /手机上打开链接点「进入」即可像在本机一样使用 dsh web/);
+});
+
+// ---------- 端到端加密（E2EE，Phase-5）状态徽标 ----------
+
+const E2EE_STATE = {
+  enabled: { enabled: true, reason: "ok", profile: "pbkdf2-sha256-600k", epoch: 1, caps: ["e2ee-v2"] },
+  serverDisabled: { enabled: false, reason: "server_disabled", profile: "", epoch: 0, caps: [] },
+  paramsUnreachable: { enabled: false, reason: "params_unreachable", profile: "", epoch: 0, caps: [] },
+  localDisabled: { enabled: false, reason: "disabled_by_config", profile: "", epoch: 0, caps: [] },
+  deriveFailed: { enabled: false, reason: "derive_failed", profile: "", epoch: 0, caps: [] },
+  unknownReason: { enabled: false, reason: "brand_new_reason_x", profile: "", epoch: 0, caps: [] },
+};
+
+function stateWith(service) {
+  return { config: { phone: "13800000000", deviceId: "dev-x", mode: "saas" }, service, remoteUrl: "https://app.test/" };
+}
+
+function e2eeLine(tree) {
+  return find(tree, (n) => n.props && typeof n.props.className === "string" && n.props.className.indexOf("dru-e2ee-line") === 0);
+}
+
+test("E2EE 徽标：已启用 → “🔒 端到端加密已启用（手机解锁后生效）”（service.e2ee 字段驱动）", () => {
+  const plugin = loadPlugin();
+  plugin.states[0] = stateWith({ running: true, e2ee: E2EE_STATE.enabled });
+  const tree = plugin.render();
+  const line = e2eeLine(tree);
+  assert.ok(line, "启用态应在「📱 远程访问」卡渲染加密状态行");
+  assert.match(String(line.props.className), /ok/, "启用态状态行应为绿色（ok）标记");
+  assert.ok(textHas(tree, "🔒 端到端加密已启用"), "应显示“端到端加密已启用”徽标文案");
+  assert.ok(textHas(tree, "手机解锁后生效"), "应提示“手机解锁后生效”（bridge 就绪、手机解锁后方生效）");
+});
+
+test("E2EE 徽标：未启用原因映射可读文案（服务端关闭 / 参数不可达 / 本地关闭 / 改密 / 未知兜底）", () => {
+  const cases = [
+    [E2EE_STATE.serverDisabled, "端到端加密暂不可用（当前为普通安全连接 HTTPS）"],
+    [E2EE_STATE.paramsUnreachable, "当前为普通安全连接（HTTPS）"],
+    [E2EE_STATE.localDisabled, "当前为普通安全连接（HTTPS）"],
+    [E2EE_STATE.deriveFailed, "账号密码已变更"],
+    [E2EE_STATE.unknownReason, "当前为普通安全连接（HTTPS）"], // 未知 reason → 兜底
+  ];
+  for (const [e2ee, text] of cases) {
+    const plugin = loadPlugin();
+    plugin.states[0] = stateWith({ running: true, e2ee });
+    const tree = plugin.render();
+    assert.ok(textHas(tree, text), `reason=${e2ee.reason} 应映射为可读文案: ${text}`);
+    const line = e2eeLine(tree);
+    assert.ok(line && !/ ok/.test(String(line.props.className)), `reason=${e2ee.reason} 非启用态不应带 ok 标记`);
+  }
+});
+
+test("E2EE 徽标：未登录 / host 未下发 e2ee → 不打扰（不渲染状态行）", () => {
+  // 未登录（config 无 phone）即便 bridge 上报 enabled 也不打扰
+  const anon = loadPlugin();
+  anon.states[0] = { config: { deviceId: "dev-x", mode: "saas" }, service: { running: true, e2ee: E2EE_STATE.enabled } };
+  assert.equal(e2eeLine(anon.render()), undefined, "未登录不应渲染 E2EE 状态行");
+  assert.ok(!textHas(anon.render(), "手机解锁后生效"), "未登录不应出现加密徽标文案");
+
+  // 已登录但 service 无 e2ee（旧 host / 未下发）→ 不渲染
+  const oldHost = loadPlugin();
+  oldHost.states[0] = stateWith({ running: true });
+  assert.equal(e2eeLine(oldHost.render()), undefined, "未下发 service.e2ee 时不应渲染状态行");
+});
+
+test("E2EE 徽标（源码级约束）：client 含徽标字段/文案与 reason 映射表", () => {
+  assert.match(SOURCE, /service\.e2ee/);
+  assert.match(SOURCE, /\.e2ee-state\.json/);
+  assert.match(SOURCE, /🔒 端到端加密已启用（手机解锁后生效）/);
+  assert.match(SOURCE, /端到端加密暂不可用（当前为普通安全连接 HTTPS）/);
+  assert.doesNotMatch(SOURCE, /等待服务端开启 E2EE/);   // 已正式开启，不再出现“灰度等待”措辞
+  assert.match(SOURCE, /当前为普通安全连接（HTTPS）/);
+  assert.match(SOURCE, /server_disabled/);
+  assert.match(SOURCE, /params_unreachable/);
+  assert.match(SOURCE, /disabled_by_config/);
+  assert.match(SOURCE, /derive_failed/);
+  assert.match(SOURCE, /describeE2ee/);
+  assert.match(SOURCE, /dru-e2ee-line/);
 });

package/packages/dsh-remote-web/test/settings-entry.test.mjs

@@ -87,6 +87,7 @@ function loadPlugin(opts = {}) {
   });
 
   const allCreated = [];
+  const intervals = [];
   const doc = {
     createElement(tag) { const el = makeEl(tag); allCreated.push(el); return el; },
     head: makeEl("head"),
@@ -95,7 +96,11 @@ function loadPlugin(opts = {}) {
       const cls = sel.charAt(0) === "." ? sel.slice(1) : "";
       return allCreated.find((el) => el.className === cls) || null;
     },
-    querySelectorAll(sel) { return sel === "button" ? (opts.navCells || []) : []; },
+    querySelectorAll(sel) {
+      if (sel === "button") return opts.navCells || [];
+      if (typeof opts.navQuery === "function") return opts.navQuery(sel);
+      return [];
+    },
   };
 
   let lastObserver = null;
@@ -129,7 +134,7 @@ function loadPlugin(opts = {}) {
       return response(200, { body: { ok: true } });
     },
     navigator: { clipboard: { writeText: async () => {} } },
-    setInterval() { return 1; },
+    setInterval(cb, ms) { intervals.push({ cb, ms }); return intervals.length; },
     clearInterval() {},
     setTimeout() { return 1; },
     Set,
@@ -152,6 +157,8 @@ function loadPlugin(opts = {}) {
 
   return {
     registered, metas, injects, requests, removed, states, localStorage,
+    intervals,
+    navWindow: sandbox.window,
     lastObserver: () => lastObserver,
     renderSection() { hook = 0; return registered.get("dsh-remote")({ close() {} }); },
   };
@@ -203,7 +210,7 @@ test("登录态账号区：无「切换账号」，有「退出登录」，头
     "📱 远程访问：用手机或另一台电脑的浏览器，随时随地使用同一份 dsh web——人在哪都能用（免公网 IP、免内网穿透）；官方托管中继，4G/5G 即用，也可自建服务。",
     "🛠 电脑端一键安装：bridge 与「远程访问」面板一次到位——云端/自建切换、账号登录、bridge 启停、一次性扫码访问、已授权设备管理、意见反馈都在这里。",
     "🔒 安全与通道：HTTP / WebSocket 全量透传，一次性访问密钥认证，面板实时显示设备与已授权设备列表；服务端可配置流量配额。",
-    "🛡 端到端流量保护：可选对通道做端到端加密保护，传输全程不暴露本机公网 IP（详见项目 README「安全」说明）。",
+    "🛡 端到端加密：手机↔电脑之间的消息内容用「你的账号密码派生密钥」端到端加密——密钥与密码不落服务端（仅存校验值），中继只可见路径/大小/时间（详见 README「安全与隐私」）。",
   ];
   for (const p of points) {
     assert.ok(find(tree, (n) => n.children?.includes(p)), `说明卡片应含要点: ${p.slice(0, 12)}…`);
@@ -277,6 +284,61 @@ test("红点已看过（localStorage 有 key）时不注入，重启 DSH Web 不
   assert.equal(navCell.children.length, 0, "已看过时不应再注入红点");
 });
 
+// ---------- 侧栏入口「远程访问」点击流（openRemoteSettings） ----------
+
+/** 简易导航节点：带 aria-label/text/class/role 的“按钮”，记录点击并支持 data-dru-remote 标记。 */
+function navNode({ id = "", text = "", aria = "", cls = "", role = "", tag = "button" } = {}) {
+  const node = {
+    id,
+    className: cls,
+    textContent: text,
+    tagName: tag,
+    _attrs: {},
+    _clicked: 0,
+    getAttribute(k) { return k in this._attrs ? this._attrs[k] : null; },
+    setAttribute(k, v) { this._attrs[k] = String(v); },
+    click() { this._clicked++; },
+  };
+  if (aria) node._attrs["aria-label"] = aria;
+  if (role) node._attrs.role = role;
+  return node;
+}
+
+test("侧栏入口点击流：远程栏目项已存在（navCell/aria-label，含 emoji 前缀）→ 直接命中栏目，不点注入项自身", () => {
+  const injected = navNode({ id: "dru-nav-remote", text: "📱 远程访问", cls: "navCell-clone" }); // 注入的侧栏项
+  const settingsNav = navNode({ text: "设置", cls: "navCell-set" });
+  const remoteCell = navNode({ aria: "远程访问", cls: "VOzbGW_navCell", tag: "button" }); // 纯图标+aria-label 的栏目项
+  const nodes = [injected, settingsNav, remoteCell];
+  const plugin = loadPlugin({ navQuery: () => nodes });
+  plugin.navWindow.__dshRemoteNav.open();
+  assert.equal(remoteCell._clicked, 1, "应命中「远程访问」栏目项（aria-label 亦可读）");
+  assert.equal(remoteCell.getAttribute("data-dru-remote"), "1", "命中后应打 data-dru-remote 标记（加速二次命中）");
+  assert.equal(injected._clicked, 0, "不得点击注入的侧栏项自身（防递归）");
+  assert.equal(settingsNav._clicked, 0, "栏目已存在时无需退化点「设置」");
+  assert.equal(plugin.intervals.filter((x) => x.ms === 150).length, 0, "直接命中后不应启动轮询");
+});
+
+test("侧栏入口点击流：栏目项尚未挂载 → 先点「设置」，轮询到点后再补点「远程访问」（全程不点注入项）", () => {
+  const injected = navNode({ id: "dru-nav-remote", text: "📱 远程访问", cls: "navCell-clone" });
+  const settingsNav = navNode({ text: "设置", cls: "navCell-set" });
+  const remoteCell = navNode({ text: "📱 远程访问", cls: "VOzbGW_navCell" }); // 设置页打开后才挂载
+  const nodes = [injected, settingsNav]; // 初始只有注入项 + 「设置」
+  const plugin = loadPlugin({ navQuery: () => nodes });
+  plugin.navWindow.__dshRemoteNav.open();
+
+  assert.equal(settingsNav._clicked, 1, "栏目不可达时应点「设置」进入设置页");
+  assert.equal(injected._clicked, 0, "不得点击注入的侧栏项自身");
+  const poll = plugin.intervals.find((x) => x.ms === 150);
+  assert.ok(poll, "应启动 150ms 轮询等待栏目挂载");
+
+  nodes.push(remoteCell); // 设置页已打开，栏目项挂载
+  poll.cb();
+  assert.equal(remoteCell._clicked, 1, "轮询到点后应补点「远程访问」栏目");
+  assert.equal(remoteCell.getAttribute("data-dru-remote"), "1", "栏目命中后应打标记");
+  assert.equal(settingsNav._clicked, 1, "「设置」只应点一次");
+  assert.equal(injected._clicked, 0, "轮询过程也不得点注入项自身");
+});
+
 test("源码约束：无侧边栏入口/浮动面板/切换账号；命名统一为「远程访问」；新增访问密钥/设备路由", () => {
   // 只断言“代码形态”不存在（注释里允许出现说明文字）
   assert.doesNotMatch(SOURCE, /slots\.inject\("sidebar\.footer\.action"/);
@@ -294,6 +356,13 @@ test("源码约束：无侧边栏入口/浮动面板/切换账号；命名统一
   assert.match(SOURCE, /dsh-remote\/access-key/);
   assert.match(SOURCE, /dsh-remote\/mobile-sessions/);
   assert.match(SOURCE, /order: 30/);
+  // 侧栏入口导航加固：aria-label/role 扫描、data-dru-remote 标记、排除注入项防递归、进设置后轮询
+  assert.match(SOURCE, /data-dru-remote/);
+  assert.match(SOURCE, /dru-nav-remote/);
+  assert.match(SOURCE, /aria-label/);
+  assert.match(SOURCE, /remoteSectionVisible/);
+  assert.match(SOURCE, /openRemoteSettings/);
+  assert.match(SOURCE, /__dshRemoteNav/);
   // 清理时机：退出登录成功回调内、登录账号变化时、切换自建服务时
   assert.match(SOURCE, /post\("\/dsh-remote\/logout"\)\.then\(function \(body\) \{[\s\S]*?fbClearThreads\(\);/);
   assert.match(SOURCE, /if \(prevPhone !== phone\.trim\(\)\) fbClearThreads\(\);/);