@mrrisega/dsh-remote 0.6.7-beta.4 → 0.6.7

package/clients/dsh-remote/mobile-adapter.mjs

@@ -799,7 +799,9 @@ const SCRIPT = `(() => {
           });
           let strikes = 0;
           const noteStatus = (status) => {
-            if (status !== 401 && status !== 403) { strikes = 0; return; }
+            // 只认 401：中继对"会话失效"回 401，对"设备不属于本账号"回 403 —— 后者不是会话过期，
+            // 拿它提示"请重新登录"会把人引到错误的动作上。
+            if (status !== 401) { strikes = 0; return; }
             strikes += 1;
             if (strikes >= 2) bar.hidden = false;
           };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrrisega/dsh-remote",
-  "version": "0.6.7-beta.4",
+  "version": "0.6.7",
   "description": "手机远程控制 DeepSeek Harness · Remote control DeepSeek Harness (dsh web) from any phone browser — 100% 全功能 App 级体验：发消息、看工具执行、审批权限、改设置、管凭据，含特权操作，免内网穿透。一条命令安装 npx @mrrisega/dsh-remote。Mobile remote control for DSH, self-host or SaaS, no server needed on LAN.",
   "keywords": [
     "deepseek-harness",
@@ -39,7 +39,8 @@
     "clients/dsh-remote",
     "packages/dsh-remote-web",
     "docs/self-hosting.md",
-    "docs/telemetry.md"
+    "docs/telemetry.md",
+    "scripts/test-net-guard.cjs"
   ],
   "workspaces": [
     "packages/*",
@@ -50,10 +51,10 @@
   },
   "scripts": {
     "test": "npm run test:router && npm run test:plugin && npm run test:bridge",
-    "test:router": "node --test packages/relay-router/test/native-device-selection.test.mjs packages/relay-router/test/presence-report.test.mjs packages/relay-router/test/logger.test.mjs",
+    "test:router": "NODE_OPTIONS=\"--require $PWD/scripts/test-net-guard.cjs ${NODE_OPTIONS:-}\" node --test packages/relay-router/test/native-device-selection.test.mjs packages/relay-router/test/native-app-entry.test.mjs packages/relay-router/test/presence-report.test.mjs packages/relay-router/test/logger.test.mjs",
     "_comment:test:plugin": "DSH_RELAY_SKIP_SERVICE=1 = 测试隔离：插件加载时不做真实系统操作（npx 补装 / launchctl / 重启 harness）；需要真实分支的用例自行 unset（见 account-switch / runtime-provision / harness-restart 用例注释）",
-    "test:plugin": "DSH_REMOTE_TELEMETRY=0 DSH_RELAY_SKIP_SERVICE=1 node --test --test-concurrency=1 packages/dsh-remote-web/test/*.test.mjs",
-    "test:bridge": "node --test clients/dsh-remote/test/*.test.mjs",
+    "test:plugin": "DSH_REMOTE_TELEMETRY=0 DSH_RELAY_SKIP_SERVICE=1 NODE_OPTIONS=\"--require $PWD/scripts/test-net-guard.cjs ${NODE_OPTIONS:-}\" node --test --test-concurrency=1 packages/dsh-remote-web/test/*.test.mjs",
+    "test:bridge": "NODE_OPTIONS=\"--require $PWD/scripts/test-net-guard.cjs ${NODE_OPTIONS:-}\" node --test clients/dsh-remote/test/*.test.mjs",
     "check": "node --check clients/dsh-remote/dsh-bridge.mjs && node --check clients/dsh-remote/e2ee-shim.mjs && node --check dsh-setup.mjs && node --check packages/dsh-remote-web/lib/index.js && node --check packages/dsh-remote-web/lib/client.js && node --check packages/relay-router/src/index.mjs && node --check packages/relay-router/src/logger.mjs && bash -n deploy/install-open.sh && grep -q 'command -v setsid' deploy/install-open.sh && grep -q 'command -v ss' deploy/install-open.sh",
     "release:tarballs": "bash scripts/release-tarballs.sh"
   },

package/packages/dsh-remote-web/lib/index.js

@@ -2379,7 +2379,7 @@ const PLUGIN_ID = "dsh-remote-web";
 const PLUGIN_LEGACY_IDS = ["dsh-remote-ui"];
 const PLUGIN_ALL_IDS = [PLUGIN_ID, ...PLUGIN_LEGACY_IDS];
 /** 插件自身发布版本（与 dsh-remote 根包同步递增）。 */
-const PLUGIN_VERSION = "0.6.7-beta.4";
+const PLUGIN_VERSION = "0.6.7";
 const UPDATE_LOG = ".dsh-update.log";
 const UPDATE_MARKER = ".dsh-update-running";
 

package/packages/dsh-remote-web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote-web",
-  "version": "0.6.7-beta.4",
+  "version": "0.6.7",
   "description": "公网远程控制 DeepSeek Harness（dsh web）：安装即得专属加密地址，人在外面也能用手机访问电脑上的 dsh——无需同一局域网/WiFi、无需公网 IP 与内网穿透，全程加密；手机端 100% 还原电脑体验（对话/工具/审批/设置）。技术用户可选自建服务，流量走自己的服务器。Remote control DeepSeek Harness (dsh web) from anywhere over the public internet — install, get an encrypted URL, use it from your phone on any network (dual-half cordis plugin: Settings panel + same-origin /dsh-remote routes). (2026-09 由 dsh-remote-ui 更名 / renamed from dsh-remote-ui; dsh-remote 的 dsh web 插件半，不是纯 UI/皮肤插件)",
   "type": "module",
   "main": "lib/index.js",

package/packages/dsh-remote-web/test/uninstall-safety.test.mjs

@@ -87,7 +87,11 @@ async function plantProfile(home, { extraPatch = "", unmarked = false } = {}) {
   fs.writeFileSync(path.join(local, "lib", "index.js"), "export const x = 1;\n");
   fs.symlinkSync(local, path.join(profile, "node_modules", PLUGIN_ID), "dir");
   fs.mkdirSync(path.join(home, "relay"), { recursive: true });
-  fs.writeFileSync(path.join(home, "relay", ".dsh-config.json"), JSON.stringify({ phone: "13800000000", password: "pw" }));
+  // ⚠️ api_url 必须指向本地死端口：这些是**假账号**，一旦按默认地址请求生产，
+  //    /api/device-login 会带着假密码失败，而服务端登录限流是按出口 IP 计的（5 次/15 分钟）——
+  //    实测结果是把**本机真实的 bridge** 连坐进限流（2026-09-19 事故）。
+  fs.writeFileSync(path.join(home, "relay", ".dsh-config.json"),
+    JSON.stringify({ phone: "13800000000", password: "pw", api_url: "http://127.0.0.1:1" }));
   return { profile, patchFile: path.join(profile, "cordis.patch.yml") };
 }
 

package/packages/dsh-remote-web/test/windows-compat.test.mjs

@@ -460,6 +460,24 @@ test("前端：bridge-status 轮询失败不再静默（旧版让面板永久停
   assert.ok(/connFailRef\.v = 0/.test(CLIENT_SRC), "成功必须清零（一次抖动不该把面板染红）");
 });
 
+test("测试隔离：套件不得访问任何外部地址（生产限流会被测试污染）", () => {
+  // 事故（2026-09-19）：有用例在配置里写了假账号却没覆盖 api_url → 按默认地址请求**生产中继**，
+  // 其中 /api/device-login 带假密码必然失败，而服务端登录限流按**出口 IP** 计（5 次/15 分钟）——
+  // 结果不仅污染生产审计，还让**本机自己的 bridge 被连坐**（拿不到 JWT），
+  // 真机表现成"切换账号后设备一直登记不上去"，排查方向被彻底带偏。
+  const repoRoot = path.join(HERE, "..", "..", "..");
+  const guard = path.join(repoRoot, "scripts", "test-net-guard.cjs");
+  assert.ok(existsSync(guard), "必须有测试期网络护栏脚本");
+  const pkg = JSON.parse(readFileSync(path.join(repoRoot, "package.json"), "utf8"));
+  for (const name of ["test:router", "test:plugin", "test:bridge"]) {
+    assert.match(String(pkg.scripts[name]), /test-net-guard\.cjs/, `${name} 必须注入网络护栏`);
+  }
+  // 护栏本体：只放行本地地址，其余一律阻断
+  const src = readFileSync(guard, "utf8");
+  assert.ok(/ENETUNREACH/.test(src), "护栏应阻断外部请求");
+  assert.ok(/LOCAL_HOST/.test(src), "护栏应只放行本地地址");
+});
+
 test("前端：平台文案不再默认 macOS（Windows 用户看不懂「自启动服务」）", () => {
   assert.ok(/serviceManager === "detached"/.test(CLIENT_SRC), "面板应识别 Windows 的 detached 模式");
   assert.match(CLIENT_SRC, /Windows 任务计划程序 dsh-remote-bridge/, "卸载说明要写明 Windows 侧会删掉什么");

package/scripts/test-net-guard.cjs

@@ -0,0 +1,49 @@
+/**
+ * 测试期网络护栏（NODE_OPTIONS=--require 注入，见 package.json 的 test 脚本）。
+ *
+ * 为什么必须有（2026-09-19 实测事故）：
+ *   有测试用例在 profile 配置里写了**假账号**（phone/password）却没覆盖 `api_url`，
+ *   于是插件按默认地址去请求**生产中继** `https://n.risegao.cn:…`。其中
+ *   `/api/device-login` 带着假密码必然失败，而服务端的登录限流是**按出口 IP**
+ *   统计「5 次失败 / 15 分钟」——结果是：
+ *     · 生产审计日志被测试污染；
+ *     · **本机自己的 bridge 被连坐**：限流窗口内它拿不到 JWT（429），
+ *       真机表现为「切换账号后设备一直登记不上去」，排查方向被彻底带偏。
+ *
+ * 现在的行为：测试期**一律阻断**任何非本地请求（throw ENETUNREACH），
+ * 并在进程退出时把被拦下的地址打印出来，提醒用例作者去补 `api_url`。
+ * 这既不改变用例结论（需要断网的分支照常走失败路径），又保证测试永远碰不到外部服务。
+ */
+const realFetch = globalThis.fetch;
+const blocked = new Set();
+
+const LOCAL_HOST = /^(127\.0\.0\.1|localhost|\[::1\]|0\.0\.0\.0|::1)(:\d+)?$/i;
+
+function hostOf(input) {
+  try {
+    const url = typeof input === "string" ? input : input && input.url ? input.url : String(input);
+    return new URL(url).host;
+  } catch {
+    return "";
+  }
+}
+
+globalThis.fetch = function guardedFetch(input, init) {
+  const host = hostOf(input);
+  if (host && !LOCAL_HOST.test(host)) {
+    const raw = typeof input === "string" ? input : (input && input.url) || "";
+    blocked.add(String(raw).replace(/(token|password|secret)=[^&]*/gi, "$1=***").slice(0, 160));
+    const err = new Error(`test-net-guard: 测试期禁止访问外部地址 ${host}（请在用例里把 api_url 指向本地假服务）`);
+    err.code = "ENETUNREACH";
+    return Promise.reject(err);
+  }
+  return realFetch.call(this, input, init);
+};
+
+// 子进程（安装器 / 清理助手等）继承 NODE_OPTIONS，也要能看到告警
+process.on("exit", () => {
+  if (!blocked.size) return;
+  process.stderr.write(
+    `\n[test-net-guard] ⚠️ 有 ${blocked.size} 个外部请求被拦下（用例应改用本地假服务，别打生产）：\n  `
+    + [...blocked].join("\n  ") + "\n\n");
+});