@mrrisega/dsh-remote 0.6.9 → 0.6.10-beta.2

package/clients/dsh-remote/test/lifecycle.test.mjs

@@ -1,7 +1,122 @@
 import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { mkdtemp, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
 import test from "node:test";
-import { childStopped } from "../src/lifecycle.mjs";
+import { fileURLToPath } from "node:url";
+import { childStopped, stopChildGracefully } from "../src/lifecycle.mjs";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const SETUP_SRC = readFileSync(path.join(HERE, "..", "..", "..", "dsh-setup.mjs"), "utf8");
+const BRIDGE_SRC = readFileSync(path.join(HERE, "..", "dsh-bridge.mjs"), "utf8");
 
 test("被信号终止的 bridge 子进程可以重新拉起", () => {
   assert.equal(childStopped({ exitCode: null, signalCode: "SIGTERM" }), true);
 });
+
+// ───────── 优雅停机：Windows 上 kill() 跑不到退出钩子，必须靠 IPC 请退 ─────────
+
+/** 假子进程：可控地「收到消息后自己退出」/「赖着不退」/「没有 IPC 通道」。 */
+function fakeChild({ connected = true, exitAfterMs = null, sendThrows = false, stopped = false } = {}) {
+  const calls = { sent: [], killed: 0 };
+  const child = {
+    exitCode: stopped ? 0 : null,
+    signalCode: null,
+    connected,
+    send(m) {
+      if (sendThrows) throw new Error("channel closed");
+      calls.sent.push(m);
+      if (exitAfterMs !== null) setTimeout(() => { child.exitCode = 0; }, exitAfterMs);
+    },
+    kill() { calls.killed += 1; child.exitCode = 0; },
+  };
+  return { child, calls };
+}
+
+test("优雅停机：有 IPC 通道时先请退，子进程自己退了就不强杀", async () => {
+  const { child, calls } = fakeChild({ exitAfterMs: 10 });
+  const how = await stopChildGracefully(child, { timeoutMs: 1000, intervalMs: 5 });
+  assert.equal(how, "graceful", "子进程自己退出应报 graceful");
+  assert.deepEqual(calls.sent, [{ type: "shutdown" }], "必须先发约定好的 shutdown 消息");
+  assert.equal(calls.killed, 0, "已经优雅退出就绝不能再去 kill（Windows 上 kill 会跳过它的收尾）");
+});
+
+test("优雅停机：子进程赖着不退 → 超时后强杀，并如实报 killed", async () => {
+  const { child, calls } = fakeChild({ exitAfterMs: null });
+  const how = await stopChildGracefully(child, { timeoutMs: 120, intervalMs: 20 });
+  assert.equal(how, "killed", "超时必须如实报 killed（不能假装优雅）");
+  assert.deepEqual(calls.sent, [{ type: "shutdown" }], "仍应先礼后兵");
+  assert.equal(calls.killed, 1, "超时后应强杀一次");
+});
+
+test("优雅停机：没有 IPC 通道（旧进程/别的拉起方式）→ 直接强杀，不假装优雅", async () => {
+  const { child, calls } = fakeChild({ connected: false });
+  const how = await stopChildGracefully(child, { timeoutMs: 50 });
+  assert.equal(how, "killed");
+  assert.equal(calls.sent.length, 0, "没有通道就不该尝试 send");
+  assert.equal(calls.killed, 1);
+});
+
+test("优雅停机：send 抛错（通道刚断）→ 退回强杀，绝不把异常抛给调用方", async () => {
+  const { child, calls } = fakeChild({ sendThrows: true });
+  const how = await stopChildGracefully(child, { timeoutMs: 50 });
+  assert.equal(how, "killed");
+  assert.equal(calls.killed, 1, "send 失败必须退回 kill，否则子进程会变成孤儿");
+});
+
+test("优雅停机：已退出/null 不产生任何副作用", async () => {
+  const { child, calls } = fakeChild({ stopped: true });
+  assert.equal(await stopChildGracefully(child), "already-stopped");
+  assert.equal(calls.killed, 0);
+  assert.equal(calls.sent.length, 0);
+  assert.equal(await stopChildGracefully(null), "none");
+  assert.equal(await stopChildGracefully(undefined), "none");
+});
+
+test("契约：watcher 必须给 bridge 开 IPC 通道，且不能再裸 kill()", () => {
+  // 这两条是本修复的**接线**：少了任何一条，Windows 上的 notifystop 又会静默失效。
+  assert.match(SETUP_SRC, /stdio: \["inherit", "inherit", "inherit", "ipc"\]/,
+    "watcher 生成 bridge 时必须带 IPC 通道（第 4 个 fd），否则请退消息发不出去");
+  assert.ok(!/bridgeProc\.kill\(\)/.test(SETUP_SRC),
+    "watcher 不得再直接 bridgeProc.kill()（Windows 上会跳过 bridge 的退出钩子）");
+  assert.match(SETUP_SRC, /await stopChildGracefully\(bridgeProc\)/,
+    "停止 bridge 必须走优雅停机");
+  assert.match(BRIDGE_SRC, /process\.on\("message"/,
+    "bridge 必须监听 IPC 消息，否则 watcher 请退没人应答");
+  assert.match(BRIDGE_SRC, /m\.type === "shutdown"[\s\S]{0,40}shutdown\(/,
+    "bridge 收到 shutdown 消息必须走与信号相同的优雅退出逻辑");
+});
+
+test("真实子进程：IPC 请退能跑完异步收尾再退出（不是假对象里的空转）", async () => {
+  // 上面几条用的是假 child，只能证明"逻辑分支对"。这条起一个**真 node 子进程**，
+  // 证明「IPC 通道 + 请退消息 + 子进程跑完异步收尾后退出」这条链路真的成立 ——
+  // 而这正是 Windows 上 notifystop 唯一的执行机会。
+  const dir = await mkdtemp(path.join(os.tmpdir(), "dsh-lifecycle-"));
+  const mark = path.join(dir, "flushed.txt");
+  const script = `
+    const fs = require("node:fs");
+    process.on("message", async (m) => {
+      if (!m || m.type !== "shutdown") return;
+      await new Promise((r) => setTimeout(r, 50));  // 模拟 notifystop 这类异步收尾
+      fs.writeFileSync(process.env.DSH_MARK, "flushed");
+      process.exit(0);
+    });
+    setInterval(() => {}, 1000);                    // 保持存活等消息
+  `;
+  const child = spawn(process.execPath, ["-e", script], {
+    env: { ...process.env, DSH_MARK: mark },
+    stdio: ["ignore", "ignore", "ignore", "ipc"],
+  });
+  try {
+    if (!child.pid) await new Promise((r) => child.on("spawn", r));
+    const how = await stopChildGracefully(child, { timeoutMs: 3000, intervalMs: 20 });
+    assert.equal(how, "graceful", "真实子进程应在收到 shutdown 后自己退出");
+    assert.equal(readFileSync(mark, "utf8"), "flushed",
+      "异步收尾必须真的跑完 —— 少了 IPC 通道这一步在 Windows 上就永远做不到");
+  } finally {
+    try { child.kill(); } catch { /* 已退出 */ }
+    await rm(dir, { recursive: true, force: true });
+  }
+});

package/clients/dsh-remote/test/machine-fingerprint.test.mjs

@@ -0,0 +1,148 @@
+/**
+ * Windows 机器指纹回归。
+ *
+ * 背景：machineUniqueId() 原本只有 darwin(ioreg) 与 linux(machine-id) 两条分支，
+ * Windows 上恒返回 ""，于是 machineFingerprint() 退化成 `${hostname}|${platform}` 的哈希 ——
+ * 用户**改一次主机名就被服务端当成一台新设备**：旧设备记录不会被顶替，
+ * 设备列表里堆出幽灵条目，面板上"这台机器"也会对不上。
+ *
+ * 这些分支在 macOS 开发机上跑不到，所以这里把函数从源码里抠出来，
+ * 注入假 process / 假 execSync / 假 spawnSync / 假 fs，把 win32 分支**真正执行一遍**，
+ * 而不是只看源码长得像不像。
+ */
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const BRIDGE_SRC = readFileSync(path.join(HERE, "..", "dsh-bridge.mjs"), "utf8");
+
+/** 真实 `reg query ... /v MachineGuid` 的输出形态：CRLF 行尾、键名与值之间是空格。 */
+const REG_OUT = "\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\r\n"
+  + "    MachineGuid    REG_SZ    9f8a1c2e-3b4d-4e5f-8a9b-0c1d2e3f4a5b\r\n\r\n";
+const GUID = "9f8a1c2e-3b4d-4e5f-8a9b-0c1d2e3f4a5b";
+
+/**
+ * 把 machineUniqueId 抠出来执行。切片锚点一旦漂移会立刻在下面第一条断言里暴露。
+ */
+function loadMachineUniqueId({
+  platform,
+  env = {},
+  reg = { status: 0, stdout: REG_OUT },
+  regThrows = false,
+  ioreg = "",
+  machineIdFiles = {},
+} = {}) {
+  const from = BRIDGE_SRC.indexOf("function machineUniqueId()");
+  const to = BRIDGE_SRC.indexOf("/** 稳定指纹:");
+  assert.ok(from > -1 && to > from, "未能从 dsh-bridge.mjs 切出 machineUniqueId（锚点已漂移）");
+  const src = BRIDGE_SRC.slice(from, to);
+  assert.ok(!/稳定指纹/.test(src), "切片不应越过 machineUniqueId 的边界");
+
+  const calls = [];
+  const execCalls = [];
+  const fakeSpawnSync = (cmd, args, opts) => {
+    calls.push({ cmd, args, opts });
+    if (regThrows) throw new Error("spawn EPERM");
+    return reg;
+  };
+  const fakeExecSync = (cmd) => { execCalls.push(String(cmd)); return ioreg; };
+  const fakeFs = {
+    readFileSync: (f) => {
+      if (f in machineIdFiles) return machineIdFiles[f];
+      throw Object.assign(new Error("ENOENT"), { code: "ENOENT" });
+    },
+  };
+  const make = new Function("process", "execSync", "spawnSync", "fs", "os",
+    `${src}\nreturn machineUniqueId;`);
+  const fn = make({ platform, env }, fakeExecSync, fakeSpawnSync, fakeFs, {});
+  return { fn, calls, execCalls };
+}
+
+test("win32：机器指纹取注册表 MachineGuid（改主机名不再被当成新设备）", () => {
+  const { fn } = loadMachineUniqueId({ platform: "win32" });
+  assert.equal(fn(), GUID, "应从 reg query 输出里解析出 MachineGuid");
+});
+
+test("win32：读注册表走 spawnSync 数组传参 + windowsHide（不经 cmd.exe、不弹窗）", () => {
+  const { fn, calls } = loadMachineUniqueId({ platform: "win32" });
+  fn();
+  assert.equal(calls.length, 1, "只应调用一次 reg");
+  const [c] = calls;
+  assert.equal(c.cmd, "reg", "应使用 reg.exe（恒定存在、约 20ms），而不是 PowerShell/WMI");
+  assert.deepEqual(c.args, ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid"],
+    "参数必须走数组（不经 cmd.exe，故没有引号/空格/中文路径的转义坑）");
+  assert.equal(c.opts.windowsHide, true, "必须 windowsHide：否则 Windows 上会闪一个黑色命令行窗口");
+  assert.ok(!c.opts.shell, "不得启用 shell");
+  assert.ok(Number.isFinite(c.opts.timeout), "必须有超时，不能把启动卡死");
+});
+
+test("win32：注册表读不到时返回空串，让上层退回宿主名指纹（不抛异常）", () => {
+  // 这三种都是真实可能的：非 Windows 上不该走到这条分支、受限账户、以及被安全软件拦截。
+  const failed = loadMachineUniqueId({ platform: "win32", reg: { status: 1, stdout: "", stderr: "拒绝访问" } });
+  assert.equal(failed.fn(), "", "reg 退出码非 0 → 空串");
+  const garbled = loadMachineUniqueId({ platform: "win32", reg: { status: 0, stdout: "乱七八糟" } });
+  assert.equal(garbled.fn(), "", "输出不可解析 → 空串");
+  const thrown = loadMachineUniqueId({ platform: "win32", regThrows: true });
+  assert.equal(thrown.fn(), "", "spawn 抛错必须被吞掉（机器指纹不是关键路径，不能拖垮启动）");
+});
+
+test("机器指纹：显式环境变量覆盖在所有平台优先", () => {
+  for (const platform of ["win32", "darwin", "linux"]) {
+    const { fn } = loadMachineUniqueId({ platform, env: { DSH_BRIDGE_MACHINE_FP: "override-me" } });
+    assert.equal(fn(), "override-me", `${platform} 上 DSH_BRIDGE_MACHINE_FP 应优先`);
+  }
+});
+
+test("机器指纹：darwin/linux 两条老分支没有被改坏", () => {
+  const darwin = loadMachineUniqueId({
+    platform: "darwin",
+    ioreg: '    "IOPlatformUUID" = "AAAA-BBBB-CCCC"\n',
+  });
+  assert.equal(darwin.fn(), "AAAA-BBBB-CCCC", "darwin 仍读 ioreg 的 IOPlatformUUID");
+  assert.match(darwin.execCalls[0], /^\/usr\/sbin\/ioreg /,
+    "★必须用绝对路径调 ioreg：launchd 的 plist PATH 不含 /usr/sbin，用裸名会 command not found,",
+  );
+
+  const linux = loadMachineUniqueId({
+    platform: "linux",
+    machineIdFiles: { "/etc/machine-id": "0123456789abcdef\n" },
+  });
+  assert.equal(linux.fn(), "0123456789abcdef", "linux 仍读 /etc/machine-id（并去掉换行）");
+});
+
+test("★回归：子进程一律用绝对路径优先，不赌 PATH（launchd 的 PATH 不含 /usr/sbin 的真实事故）", () => {
+  // 事故（2026-09-22 真机日志）：bridge 由 launchd 拉起，plist 给的 PATH 是
+  // /usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin —— 没有 /usr/sbin，而 ioreg 在那里。
+  // 日志里出现 `/bin/sh: ioreg: command not found`，指纹**静默**退化成 hostname 哈希：
+  // 用户改一次主机名就被服务端当成新设备。这类"PATH 假设"必须用绝对路径堵死。
+  const mac = loadMachineUniqueId({ platform: "darwin", ioreg: 'x "IOPlatformUUID" = "U1"\n' });
+  mac.fn();
+  assert.match(mac.execCalls[0], /^\/usr\/sbin\/ioreg /, "darwin：首个候选必须是 /usr/sbin/ioreg");
+
+  // 绝对路径取不到时仍要退回裸名（别把别的机型的 macOS 弄死）
+  const macFallback = loadMachineUniqueId({ platform: "darwin", ioreg: "" });
+  assert.equal(macFallback.fn(), "", "两次都拿不到 → 空串（不是抛）");
+  assert.equal(macFallback.execCalls.length, 2, "应依次尝试绝对路径与裸名");
+  assert.match(macFallback.execCalls[1], /^ioreg /, "第二个候选是裸名");
+
+  // Windows 同理：SystemRoot 可用时优先 System32 的绝对路径
+  const win = loadMachineUniqueId({ platform: "win32", env: { SystemRoot: "C:\\Windows" } });
+  win.fn();
+  assert.equal(win.calls[0].cmd, "C:\\Windows\\System32\\reg.exe", "win32：应优先 System32 下的绝对路径");
+  assert.deepEqual(win.calls[0].args, ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid"]);
+  assert.equal(win.calls[0].opts.windowsHide, true, "绝对路径候选同样必须 windowsHide");
+});
+
+test("机器指纹：拿不到机器唯一值时才退回宿主名哈希（这正是要修的退化路径）", () => {
+  // 断言 machineFingerprint 的兜底表达式仍然存在 —— 它是"改主机名 = 新设备"的直接来源，
+  // 修好 win32 分支后这条兜底只应在容器等极端环境生效。
+  const i = BRIDGE_SRC.indexOf("function machineFingerprint()");
+  assert.ok(i > -1, "应能找到 machineFingerprint");
+  const body = BRIDGE_SRC.slice(i, i + 400);
+  assert.match(body, /machineUniqueId\(\) \|\| `\$\{os\.hostname\(\)\}\|\$\{os\.platform\(\)\}`/,
+    "兜底应保持 hostname|platform 的形态（改了这里等于改了设备识别语义）");
+  assert.match(body, /sha256/, "指纹必须哈希后再用（机器唯一值原文不得外发）");
+});