@mrrisega/dsh-remote 0.6.7-beta.3 → 0.6.7

package/packages/dsh-remote-web/test/account-switch-device.test.mjs

@@ -0,0 +1,307 @@
+/**
+ * 「切换账号后设备没登记到新账号」回归（0.6.7-beta.4 新增）。
+ *
+ * 现场（2026-09-19 用户实测，本机复现）：
+ *   23:55 装好插件 → 00:03 登录账号 A → bridge 用 A 的凭据登记（dev-xxxx 进 A 的设备列表）
+ *   → 00:29 退出 A、登录账号 B（配置已改、device_id 已清）
+ *   → **B 的设备列表里永远看不到这台 Mac**，而 A 那边它还在线。
+ *
+ * 三个缺陷叠加（本文件逐个锁死）：
+ *   ① bridge 的账号/密码是**进程启动时**从环境变量固化的；`dsh-setup run` 每 10s 重读配置，
+ *      但只在子进程**已退出**时才重新拉起它 → 换了账号，进程不换凭据。
+ *   ② 切换账号时那次"重启 bridge"其实失败了：插件只认 `gui/<uid>` 域，而安装器按 macOS 26 的
+ *      修复把作业装在 `user/<uid>` 域 → `Could not find service ... in user gui: 501`，
+ *      而面板**不看 bridgeRestart 的返回值** → 静默失败。
+ *   ③ 旧账号留下的 `.dsh-bridge-state.json`（phase=online + 旧 device_id）没被清理，
+ *      面板据此谎报「已连接」，自愈（只判"有没有进程在跑"）也就永远不会去纠正。
+ *
+ * ⚠️ 隔离：unset 隔离开关的用例必须同时伪造 HOME 与 PATH（否则会碰真实 HOME 下的 launchd）。
+ */
+import assert from "node:assert/strict";
+import http from "node:http";
+import { chmod, mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { existsSync, readFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+import { apply } from "../lib/index.js";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const SETUP_SRC = readFileSync(path.join(HERE, "..", "..", "..", "dsh-setup.mjs"), "utf8");
+const CLIENT_SRC = readFileSync(path.join(HERE, "..", "lib", "client.js"), "utf8");
+const INDEX_SRC = readFileSync(path.join(HERE, "..", "lib", "index.js"), "utf8");
+
+/** 假 launchctl：user 域报告 running、gui 域报告不存在（复刻 macOS 26 + 安装器实际形态）。 */
+const FAKE_LAUNCHCTL = `#!/bin/sh
+printf '%s\\n' "$*" >> "$DSH_TEST_LAUNCH_LOG"
+if [ "$1" = print ]; then
+  case "$2" in
+    user/*) printf 'state = running\\npid = 4242\\nruns = 3\\n'; exit 0 ;;
+    gui/*) echo "Could not find service in domain for user gui" >&2; exit 1 ;;
+  esac
+fi
+exit 0
+`;
+
+async function makeEnv({ fakeLaunchd = true } = {}) {
+  const root = await mkdtemp(path.join(os.tmpdir(), "dsh-acct-dev-"));
+  const fakeHome = path.join(root, "home");
+  const fakeBin = path.join(root, "bin");
+  const relayDir = path.join(root, "relay");
+  await mkdir(fakeHome, { recursive: true });
+  await mkdir(fakeBin, { recursive: true });
+  await mkdir(relayDir, { recursive: true });
+  if (fakeLaunchd) {
+    await writeFile(path.join(fakeBin, "launchctl"), FAKE_LAUNCHCTL);
+    await chmod(path.join(fakeBin, "launchctl"), 0o755);
+  }
+  const saved = {};
+  for (const k of ["HOME", "PATH", "DSH_TEST_LAUNCH_LOG", "DSH_RELAY_SKIP_SERVICE", "DSH_REMOTE_TELEMETRY"]) {
+    saved[k] = process.env[k];
+  }
+  process.env.HOME = fakeHome;
+  if (fakeLaunchd) process.env.PATH = `${fakeBin}:${saved.PATH}`;
+  process.env.DSH_TEST_LAUNCH_LOG = path.join(root, "launchctl.log");
+  process.env.DSH_REMOTE_TELEMETRY = "0";
+  process.env.DSH_RELAY_SKIP_SERVICE = "1"; // 默认隔离：用例按需 unset
+  return {
+    root, relayDir, fakeHome, launchLog: path.join(root, "launchctl.log"),
+    async restore() {
+      for (const [k, v] of Object.entries(saved)) { if (v === undefined) delete process.env[k]; else process.env[k] = v; }
+      await rm(root, { recursive: true, force: true });
+    },
+  };
+}
+
+function boot(relayDir) {
+  const routes = new Map();
+  apply({
+    webServer: { register(route) { routes.set(route.path, route.handler); return () => {}; } },
+    effect(register) { return register(); },
+    logger: { info() {}, warn() {} },
+  }, { relayDir });
+  return routes;
+}
+
+async function serve(routes) {
+  const host = http.createServer((req, res) => {
+    const handler = routes.get(new URL(req.url, "http://x").pathname);
+    (handler || ((_r, rs) => { rs.writeHead(404); rs.end(); }))(req, res);
+  });
+  await new Promise((resolve) => host.listen(0, "127.0.0.1", resolve));
+  return { host, base: `http://127.0.0.1:${host.address().port}` };
+}
+
+const json = async (p, init) => {
+  const res = await fetch(p, init);
+  return { status: res.status, body: await res.json().catch(() => null) };
+};
+
+// ─────────── ① 旧账号的 bridge 不得被当成「已连接」 ───────────
+
+test("切换账号后：旧账号留下的 online 状态不得再当作注册证据", async () => {
+  const env = await makeEnv();
+  try {
+    await writeFile(path.join(env.relayDir, "dsh-setup.mjs"), "// runtime stub");
+    // 切账号后的配置：新账号、device_id 已被清空
+    await writeFile(path.join(env.relayDir, ".dsh-config.json"), JSON.stringify({
+      phone: "account-B", password: "pw", api_url: "http://127.0.0.1:1",
+    }));
+    // 旧账号 bridge 留下的状态：device_id 是旧的、还写着 online
+    await writeFile(path.join(env.relayDir, ".dsh-bridge-state.json"), JSON.stringify({
+      device_id: "dev-old", phase: "online", tunnel_registered_at: 1789747521560, account_bound_at: 1789747429422,
+    }));
+    const routes = boot(env.relayDir);
+    const { host, base } = await serve(routes);
+    const stateFile = path.join(env.relayDir, ".dsh-bridge-state.json");
+    try {
+      // ① /status 是纯读接口：必须如实报告"跑着的是上一个账号的 bridge"
+      const { body: st } = await json(`${base}/dsh-remote/status`);
+      assert.equal(st.connect.accountCurrent, false, "必须识别出「跑着的是上一个账号的 bridge」");
+      assert.equal(st.connect.registered, false, "★旧账号的注册证据必须作废（否则面板谎报已连接）");
+      assert.notEqual(st.connect.phase, "online", "★不得报 online");
+      assert.match(String(st.connect.detail), /上一个账号|重启/, "应说明正在用新账号重新登记");
+      assert.match(String(st.connect.diagnostics), /bridge 账号: ⚠️/, "诊断信息里要能一眼看出");
+      assert.equal(existsSync(stateFile), true, "纯读接口不得改动状态文件");
+
+      // ② /bridge-status 会自愈：清掉过期状态（下一轮用新账号重新登记）
+      const { body: bs } = await json(`${base}/dsh-remote/bridge-status`);
+      assert.equal(existsSync(stateFile), false, "★过期状态必须被自愈清掉（否则面板一直谎报，永不纠正）");
+      assert.equal(bs.connect.registered, false, "清掉之后也不得凭空报已连接");
+    } finally {
+      host.close();
+    }
+  } finally {
+    await env.restore();
+  }
+});
+
+test("账号一致时行为不变：同一 device_id 的 online 状态仍算已连接（回归）", async () => {
+  const env = await makeEnv();
+  try {
+    await writeFile(path.join(env.relayDir, "dsh-setup.mjs"), "// runtime stub");
+    await writeFile(path.join(env.relayDir, ".dsh-config.json"), JSON.stringify({
+      phone: "account-A", password: "pw", device_id: "dev-1", api_url: "http://127.0.0.1:1",
+    }));
+    await writeFile(path.join(env.relayDir, ".dsh-bridge-state.json"), JSON.stringify({
+      device_id: "dev-1", phase: "online", tunnel_registered_at: 1789747521560,
+    }));
+    const routes = boot(env.relayDir);
+    const { host, base } = await serve(routes);
+    try {
+      const { body } = await json(`${base}/dsh-remote/bridge-status`);
+      assert.equal(body.connect.accountCurrent, true);
+      assert.equal(body.connect.registered, true, "同一账号的注册证据仍然有效");
+      assert.match(String(body.connect.diagnostics), /bridge 账号: 当前账号/);
+    } finally {
+      host.close();
+    }
+  } finally {
+    await env.restore();
+  }
+});
+
+// ─────────── ② 切换账号要真的把旧 bridge 停掉 + 清掉过期状态 ───────────
+
+test("切换账号：停掉旧 bridge 并清除过期状态文件（否则新账号永远等不到设备）", async () => {
+  const env = await makeEnv();
+  try {
+    await writeFile(path.join(env.relayDir, "dsh-setup.mjs"), "// runtime stub");
+    await writeFile(path.join(env.relayDir, ".dsh-config.json"), JSON.stringify({
+      phone: "account-A", password: "pw", device_id: "dev-old", api_url: "http://127.0.0.1:1",
+    }));
+    await writeFile(path.join(env.relayDir, ".dsh-bridge-state.json"), JSON.stringify({
+      device_id: "dev-old", phase: "online", tunnel_registered_at: 1789747521560,
+    }));
+    const routes = boot(env.relayDir);
+    const { host, base } = await serve(routes);
+    try {
+      const { body } = await json(`${base}/dsh-remote/config`, {
+        method: "POST", headers: { "content-type": "application/json" },
+        body: JSON.stringify({ phone: "account-B", password: "pw2" }),
+      });
+      assert.equal(body.ok, true);
+      assert.ok(body.bridgeRestart, "响应必须带上重启结果（前端据此提示，不再静默）");
+      const cfg = JSON.parse(await readFile(path.join(env.relayDir, ".dsh-config.json"), "utf8"));
+      assert.equal(cfg.phone, "account-B");
+      assert.equal(cfg.device_id, undefined, "设备身份必须轮换");
+      assert.equal(existsSync(path.join(env.relayDir, ".dsh-bridge-state.json")), false,
+        "★旧账号的注册证据必须删除（否则面板一直谎报已连接，自愈永不纠正）");
+    } finally {
+      host.close();
+    }
+  } finally {
+    await env.restore();
+  }
+});
+
+test("退出登录：必须停 bridge 并作废设备身份（否则旧账号的隧道还在对外服务）", async () => {
+  const env = await makeEnv();
+  try {
+    await writeFile(path.join(env.relayDir, "dsh-setup.mjs"), "// runtime stub");
+    await writeFile(path.join(env.relayDir, ".dsh-config.json"), JSON.stringify({
+      phone: "account-A", password: "pw", device_id: "dev-1",
+      device_private_key: "pk", device_public_key: "pub", api_url: "http://127.0.0.1:1",
+    }));
+    await writeFile(path.join(env.relayDir, ".dsh-bridge-state.json"), JSON.stringify({
+      device_id: "dev-1", phase: "online", tunnel_registered_at: 1,
+    }));
+    const routes = boot(env.relayDir);
+    const { host, base } = await serve(routes);
+    try {
+      const { body } = await json(`${base}/dsh-remote/logout`, { method: "POST" });
+      assert.equal(body.ok, true);
+      const cfg = JSON.parse(await readFile(path.join(env.relayDir, ".dsh-config.json"), "utf8"));
+      assert.equal(cfg.phone, undefined, "账号应被清除");
+      assert.equal(cfg.password, undefined);
+      assert.equal(cfg.device_id, undefined, "★设备身份必须一起作废");
+      assert.equal(existsSync(path.join(env.relayDir, ".dsh-bridge-state.json")), false, "★状态记录应清除");
+    } finally {
+      host.close();
+    }
+  } finally {
+    await env.restore();
+  }
+});
+
+// ─────────── ③ launchd 域名阶梯（事故的直接技术原因） ───────────
+
+test("launchd：作业在 user/<uid> 域时也必须被认成「运行中」（旧实现只看 gui/<uid>）", { skip: process.platform !== "darwin" }, async () => {
+  const env = await makeEnv();
+  delete process.env.DSH_RELAY_SKIP_SERVICE; // 本用例要真的去调（假）launchctl
+  try {
+    await writeFile(path.join(env.relayDir, "dsh-setup.mjs"), "// runtime stub");
+    await writeFile(path.join(env.relayDir, ".dsh-config.json"), JSON.stringify({
+      phone: "account-A", password: "pw", api_url: "http://127.0.0.1:1",
+    }));
+    const routes = boot(env.relayDir);
+    const { host, base } = await serve(routes);
+    try {
+      const { body } = await json(`${base}/dsh-remote/status`);
+      assert.equal(body.service.launchd.running, true,
+        "★安装器把作业装在 user/<uid>：插件必须查到这个域，否则会误判「未运行」并反复重复启动");
+      assert.equal(body.service.launchd.pid, 4242);
+      const log = existsSync(env.launchLog) ? readFileSync(env.launchLog, "utf8") : "";
+      assert.match(log, new RegExp(`print user/${process.getuid()}/com\\.dshremote\\.bridge`), "应先查 user 域");
+    } finally {
+      host.close();
+    }
+  } finally {
+    await env.restore();
+  }
+});
+
+test("源码契约：启动/停止都要覆盖两个 launchd 域（只认 gui 就是本次事故）", () => {
+  assert.ok(/function launchDomains\(\)/.test(INDEX_SRC), "应有统一的域阶梯");
+  const startFn = INDEX_SRC.slice(INDEX_SRC.indexOf("function startBridge(relayDir)"), INDEX_SRC.indexOf("function scheduleRuntime("));
+  assert.ok(/for \(const domain of launchDomains\(\)\)/.test(startFn), "启动必须遍历域阶梯（user 优先）");
+  assert.ok(/com\.dshremote\.bridge`\)\}/.test(startFn) || /launchDomains\(\)/.test(startFn));
+  const stopFn = INDEX_SRC.slice(INDEX_SRC.indexOf("/** 停止 bridge"), INDEX_SRC.indexOf("function uninstallRuntime("));
+  assert.ok(/launchTargets\(\)/.test(stopFn), "停止必须覆盖两个域（作业可能在 user 域）");
+  assert.ok(/resetBridgeForAccountChange/.test(INDEX_SRC), "应有「账号变更 → 停旧 bridge + 清过期状态」的统一入口");
+  // 自愈必须判账号归属，而不是只看"有没有进程在跑"
+  const ensureFn = INDEX_SRC.slice(INDEX_SRC.indexOf("function ensureConnection("), INDEX_SRC.indexOf("// ---------- 匿名装机"));
+  assert.ok(/bridgeMatchesCurrentAccount\(relayDir, cfg\)/.test(ensureFn), "自愈必须判账号归属");
+  assert.ok(/action: "restart"/.test(ensureFn), "账号不符时应重启而不是返回 none");
+});
+
+test("源码契约：watcher（dsh-setup run）也要能发现账号变化并重启子进程", () => {
+  assert.ok(/function accountFingerprint\(/.test(SETUP_SRC), "应有账号指纹");
+  assert.ok(/let bridgeAccountFp = ""/.test(SETUP_SRC), "应记录当前子进程用的凭据");
+  assert.ok(/bridgeAccountFp !== fp/.test(SETUP_SRC), "配置里的账号一变就要重启 bridge 子进程");
+  assert.ok(/账号配置已变化 → 重启 bridge/.test(SETUP_SRC), "应打日志说明为什么重启");
+  // pid 文件与去重护栏不再只服务 Windows（脱离进程兜底在 POSIX 上也用）
+  assert.ok(!/if \(IS_WIN\) writePidFile\(BRIDGE_PID_FILE/.test(SETUP_SRC), "pid 文件应全平台写");
+  assert.ok(!/  if \(IS_WIN\) \{\n    const other = readPidFile\(WATCHER_PID_FILE\)/.test(SETUP_SRC), "去重护栏应全平台生效");
+});
+
+test("限流：429 不得被当成「密码错」，且 watcher 要退避而不是空撞", () => {
+  const bridge = readFileSync(path.join(HERE, "..", "..", "..", "clients", "dsh-remote", "dsh-bridge.mjs"), "utf8");
+  assert.ok(/r\.status === 429/.test(bridge), "bridge 必须单独处理 429");
+  assert.ok(/retry_after_ms/.test(bridge), "应读取服务端给的 retry_after_ms");
+  assert.ok(/凭据没错|无需改密码/.test(bridge), "必须明确告诉用户不是密码问题（旧文案会误导人去改密码）");
+  const rateStart = bridge.indexOf("r.status === 429");
+  const rateBlock = bridge.slice(rateStart, bridge.indexOf("process.exit(3)", rateStart)); // 只取 429 分支自身
+  assert.ok(/\.dsh-login-ratelimited/.test(rateBlock), "应落盘「最早可重试时刻」供 watcher 退避");
+  // 只看**真实打印**的行（注释里引用旧文案是可以的）
+  const emitted = rateBlock.split("\n")
+    .filter((l) => !/^\s*(\/\/|\*)/.test(l))
+    .filter((l) => /请检查 DSH_BRIDGE_EMAIL/.test(l));
+  assert.equal(emitted.length, 0, `429 分支不得再提示去检查密码：${emitted.join(" / ")}`);
+  // 登录成功要清掉退避提示（服务端成功即清零）
+  assert.ok(/rmSync\(path\.join\(path\.dirname\(CONFIG_PATH\), "\.dsh-login-ratelimited"/.test(bridge));
+  // watcher 侧：限流窗口内不反复拉起 bridge
+  assert.ok(/function loginRateLimitUntil\(/.test(SETUP_SRC), "watcher 应能读限流退避时间");
+  assert.ok(/if \(rlUntil > Date\.now\(\)\)/.test(SETUP_SRC), "窗口内应直接返回，不空撞");
+  assert.ok(/凭据无需修改/.test(SETUP_SRC), "提示要说清楚不是凭据问题");
+});
+
+test("前端：登录/注册落盘后必须检查 bridgeRestart，不再静默失败", () => {
+  assert.ok(/function applyAccountSaved\(/.test(CLIENT_SRC), "应有统一的账号落盘提示");
+  assert.ok(/br\.ok === false/.test(CLIENT_SRC), "必须检查 bridgeRestart.ok === false");
+  assert.ok(/未能自动重启/.test(CLIENT_SRC), "失败时给出可见提示");
+  // 只数**调用点**（第二个实参是字符串字面量），别把函数定义也算进去
+  const calls = CLIENT_SRC.match(/applyAccountSaved\(cfg, "/g) || [];
+  assert.equal(calls.length, 2, `登录与注册两条路径都要用它（实际 ${calls.length} 处）`);
+});

package/packages/dsh-remote-web/test/uninstall-safety.test.mjs

@@ -87,7 +87,11 @@ async function plantProfile(home, { extraPatch = "", unmarked = false } = {}) {
   fs.writeFileSync(path.join(local, "lib", "index.js"), "export const x = 1;\n");
   fs.symlinkSync(local, path.join(profile, "node_modules", PLUGIN_ID), "dir");
   fs.mkdirSync(path.join(home, "relay"), { recursive: true });
-  fs.writeFileSync(path.join(home, "relay", ".dsh-config.json"), JSON.stringify({ phone: "13800000000", password: "pw" }));
+  // ⚠️ api_url 必须指向本地死端口：这些是**假账号**，一旦按默认地址请求生产，
+  //    /api/device-login 会带着假密码失败，而服务端登录限流是按出口 IP 计的（5 次/15 分钟）——
+  //    实测结果是把**本机真实的 bridge** 连坐进限流（2026-09-19 事故）。
+  fs.writeFileSync(path.join(home, "relay", ".dsh-config.json"),
+    JSON.stringify({ phone: "13800000000", password: "pw", api_url: "http://127.0.0.1:1" }));
   return { profile, patchFile: path.join(profile, "cordis.patch.yml") };
 }
 
@@ -209,6 +213,69 @@ test("CLI 卸载（dsh-remote plugin --uninstall）：同样必须留下合法
   }
 });
 
+/** 本机是否有真正的 dsh CLI（CI 通常没有 → 该用例自动跳过）。 */
+function dshAvailable() {
+  try { return spawnSync("dsh", ["--help"], { stdio: "ignore", timeout: 20000 }).status === 0; }
+  catch { return false; }
+}
+const HAS_DSH = dshAvailable();
+
+/**
+ * 最强的一条：把卸载结果交给**真实 dsh 解析器**判定。
+ * 报告的 Fix E 正是要求这个 —— 断言对象不是"我们写了什么"，而是"dsh 能不能 compose 出插件树"
+ *（compose 成功 ≈ dsh web 能启动）。另外附一条反例：纯注释文档必须被 dsh 拒绝，
+ * 否则这条用例就是空断言（证明它有牙齿）。
+ */
+test("（需本机装有 dsh）卸载后的 patch 必须能被真实 dsh 解析：--dump-config 成功", { skip: !HAS_DSH && "本机没有 dsh CLI" }, async () => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), "dsh-un-real-"));
+  const prevHome = process.env.HOME;
+  const prevSkip = process.env.DSH_RELAY_SKIP_SERVICE;
+  process.env.HOME = home;
+  process.env.DSH_RELAY_SKIP_SERVICE = "1";
+  const dshHome = path.join(home, "dshhome");
+  const profile = path.join(dshHome, "profiles", "web");
+  fs.mkdirSync(profile, { recursive: true });
+  fs.writeFileSync(path.join(profile, "package.json"), JSON.stringify({ name: "web", version: "0.0.0", dsh: { profile: {} } }));
+  const patchFile = path.join(profile, "cordis.patch.yml");
+  const comments = "# Your patch layer for this dsh profile, applied after every bundle layer:\n# a top-level YAML array of loader patch entries\n";
+  const runDsh = () => spawnSync("dsh", ["--profile", "web", "--dump-config"], {
+    encoding: "utf8", timeout: 60000, env: { ...process.env, DSH_HOME: dshHome },
+  });
+  try {
+    // 反例（负向对照）：纯注释 → dsh 必须报错（否则本用例没有牙齿）
+    fs.writeFileSync(patchFile, comments);
+    const negative = runDsh();
+    assert.notEqual(negative.status, 0, "纯注释文档必须被 dsh 拒绝（这就是用户遇到的启动失败）");
+    assert.match(String(negative.stderr || "") + String(negative.stdout || ""), /top-level YAML array/);
+
+    // 正向：我们的安装器写入的 patch → dsh 必须接受
+    fs.writeFileSync(patchFile, `${comments}[]\n`);
+    fs.mkdirSync(path.join(profile, "node_modules"), { recursive: true });
+    fs.writeFileSync(path.join(profile, "node_modules", "probe"), "");
+    const ok = runDsh();
+    assert.equal(ok.status, 0, `安装态 patch 应能被 dsh 接受：${ok.stderr}`);
+
+    // 关键：走一遍真实卸载（插件路由），卸载后 dsh 仍必须能 compose
+    const { patchFile: installedPatch } = await (async () => {
+      const { profile: p2, patchFile: pf } = await plantProfile(home);
+      return { patchFile: pf };
+    })();
+    const routes = boot(path.join(home, "relay"));
+    const { host, base } = await serve(routes);
+    try {
+      await (await fetch(`${base}/dsh-remote/self/uninstall`, { method: "POST" })).json();
+    } finally { host.close(); }
+    fs.copyFileSync(installedPatch, patchFile); // 把"卸载后的 patch"交给真实 dsh 判定
+    const after = runDsh();
+    assert.equal(after.status, 0, `★卸载后的 patch 必须仍能被 dsh 接受（否则 dsh web 起不来）：${after.stderr}`);
+    assert.ok(isTopLevelArrayDoc(fs.readFileSync(patchFile, "utf8")));
+  } finally {
+    if (prevSkip === undefined) delete process.env.DSH_RELAY_SKIP_SERVICE; else process.env.DSH_RELAY_SKIP_SERVICE = prevSkip;
+    process.env.HOME = prevHome;
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+});
+
 // ─────────────────────── ② 卸载顺序与阻塞（缺陷二） ───────────────────────
 
 test("源码契约：卸载必须先卸插件、再关自愈、最后才把慢活交子进程", () => {

package/packages/dsh-remote-web/test/windows-compat.test.mjs

@@ -460,6 +460,24 @@ test("前端：bridge-status 轮询失败不再静默（旧版让面板永久停
   assert.ok(/connFailRef\.v = 0/.test(CLIENT_SRC), "成功必须清零（一次抖动不该把面板染红）");
 });
 
+test("测试隔离：套件不得访问任何外部地址（生产限流会被测试污染）", () => {
+  // 事故（2026-09-19）：有用例在配置里写了假账号却没覆盖 api_url → 按默认地址请求**生产中继**，
+  // 其中 /api/device-login 带假密码必然失败，而服务端登录限流按**出口 IP** 计（5 次/15 分钟）——
+  // 结果不仅污染生产审计，还让**本机自己的 bridge 被连坐**（拿不到 JWT），
+  // 真机表现成"切换账号后设备一直登记不上去"，排查方向被彻底带偏。
+  const repoRoot = path.join(HERE, "..", "..", "..");
+  const guard = path.join(repoRoot, "scripts", "test-net-guard.cjs");
+  assert.ok(existsSync(guard), "必须有测试期网络护栏脚本");
+  const pkg = JSON.parse(readFileSync(path.join(repoRoot, "package.json"), "utf8"));
+  for (const name of ["test:router", "test:plugin", "test:bridge"]) {
+    assert.match(String(pkg.scripts[name]), /test-net-guard\.cjs/, `${name} 必须注入网络护栏`);
+  }
+  // 护栏本体：只放行本地地址，其余一律阻断
+  const src = readFileSync(guard, "utf8");
+  assert.ok(/ENETUNREACH/.test(src), "护栏应阻断外部请求");
+  assert.ok(/LOCAL_HOST/.test(src), "护栏应只放行本地地址");
+});
+
 test("前端：平台文案不再默认 macOS（Windows 用户看不懂「自启动服务」）", () => {
   assert.ok(/serviceManager === "detached"/.test(CLIENT_SRC), "面板应识别 Windows 的 detached 模式");
   assert.match(CLIENT_SRC, /Windows 任务计划程序 dsh-remote-bridge/, "卸载说明要写明 Windows 侧会删掉什么");

package/scripts/test-net-guard.cjs

@@ -0,0 +1,49 @@
+/**
+ * 测试期网络护栏（NODE_OPTIONS=--require 注入，见 package.json 的 test 脚本）。
+ *
+ * 为什么必须有（2026-09-19 实测事故）：
+ *   有测试用例在 profile 配置里写了**假账号**（phone/password）却没覆盖 `api_url`，
+ *   于是插件按默认地址去请求**生产中继** `https://n.risegao.cn:…`。其中
+ *   `/api/device-login` 带着假密码必然失败，而服务端的登录限流是**按出口 IP**
+ *   统计「5 次失败 / 15 分钟」——结果是：
+ *     · 生产审计日志被测试污染；
+ *     · **本机自己的 bridge 被连坐**：限流窗口内它拿不到 JWT（429），
+ *       真机表现为「切换账号后设备一直登记不上去」，排查方向被彻底带偏。
+ *
+ * 现在的行为：测试期**一律阻断**任何非本地请求（throw ENETUNREACH），
+ * 并在进程退出时把被拦下的地址打印出来，提醒用例作者去补 `api_url`。
+ * 这既不改变用例结论（需要断网的分支照常走失败路径），又保证测试永远碰不到外部服务。
+ */
+const realFetch = globalThis.fetch;
+const blocked = new Set();
+
+const LOCAL_HOST = /^(127\.0\.0\.1|localhost|\[::1\]|0\.0\.0\.0|::1)(:\d+)?$/i;
+
+function hostOf(input) {
+  try {
+    const url = typeof input === "string" ? input : input && input.url ? input.url : String(input);
+    return new URL(url).host;
+  } catch {
+    return "";
+  }
+}
+
+globalThis.fetch = function guardedFetch(input, init) {
+  const host = hostOf(input);
+  if (host && !LOCAL_HOST.test(host)) {
+    const raw = typeof input === "string" ? input : (input && input.url) || "";
+    blocked.add(String(raw).replace(/(token|password|secret)=[^&]*/gi, "$1=***").slice(0, 160));
+    const err = new Error(`test-net-guard: 测试期禁止访问外部地址 ${host}（请在用例里把 api_url 指向本地假服务）`);
+    err.code = "ENETUNREACH";
+    return Promise.reject(err);
+  }
+  return realFetch.call(this, input, init);
+};
+
+// 子进程（安装器 / 清理助手等）继承 NODE_OPTIONS，也要能看到告警
+process.on("exit", () => {
+  if (!blocked.size) return;
+  process.stderr.write(
+    `\n[test-net-guard] ⚠️ 有 ${blocked.size} 个外部请求被拦下（用例应改用本地假服务，别打生产）：\n  `
+    + [...blocked].join("\n  ") + "\n\n");
+});