@mrrisega/dsh-remote 0.7.11-beta.3 → 0.7.12-beta.2

package/packages/dsh-remote-web/test/im-bots.test.mjs

@@ -12,7 +12,7 @@
 // 暴露给任何能打开本机 dsh web 页面的人（哪怕它只是一台共享电脑）。
 import assert from "node:assert/strict";
 import http from "node:http";
-import { mkdtemp, readFile, stat, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, readFile, stat, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import test from "node:test";
@@ -199,7 +199,7 @@ test("POST /test：桥写的状态显示已连接 → {ok:true, connected:true,
     await writeStatus(relayDir, { enabled: true, connected: true, authenticated: true, lastError: "" });
     const r = await postTest(base);   // 不传 body = 测已保存的配置
     assert.equal(r.status, 200);
-    assert.deepEqual(r.body, { ok: true, connected: true, authenticated: true, lastError: "" });
+    assert.deepEqual(r.body, { ok: true, platform: "wecom", connected: true, authenticated: true, lastError: "" });
   });
 });
 
@@ -357,3 +357,266 @@ test("PUT previewCardAt：非法值（非数字 / 0 / 负数）→ 400 invalid_p
     assert.equal(cfg.wecom.previewCardAt, 0, "非法触发值绝不能写进文件（桥会永久失效且难排查）");
   });
 });
+
+// ─────────────────── 会员档位 / 额度（2026-11-07 桥侧判定） ───────────────────
+
+test("GET：白名单透出 tier/caps/capsCount/bindingGated/messagesPerMonth/remainingMessages/usage", async () => {
+  const relayDir = await tmpRelay();
+  await withHost(relayDir, {}, async (base) => {
+    await writeStatus(relayDir, {
+      enabled: true, connected: true, tier: "free",
+      caps: ["wecom", "session_binding"], capsCount: 2, bindingGated: true,
+      messagesPerMonth: 20, remainingMessages: 7,
+      usage: { month: "2026-11", messages: 13 },
+      // 攻击面：状态文件里的内部字段/额外字段绝不能被整包吐出去
+      secret: "LEAK", capsRaw: { internal: "LEAK2" }, extra: "LEAK3",
+    });
+    const r = await json(`${base}/dsh-remote/im-bots`);
+    const st = r.body.status;
+    assert.equal(st.tier, "free");
+    assert.deepEqual(st.caps, ["wecom", "session_binding"], "caps 只取字符串数组（截断/过滤），不得透出对象");
+    assert.equal(st.capsCount, 2);
+    assert.equal(st.bindingGated, true);
+    assert.equal(st.messagesPerMonth, 20);
+    assert.equal(st.remainingMessages, 7);
+    assert.deepEqual(st.usage, { month: "2026-11", messages: 13 });
+    assert.ok(!JSON.stringify(r.body).includes("LEAK"), "★ 白名单之外的状态字段绝不能被透出");
+  });
+});
+
+test("GET：tier 只认三个枚举值；remainingMessages=null 表示不限/未知（不能被当成 0）", async () => {
+  const relayDir = await tmpRelay();
+  await withHost(relayDir, {}, async (base) => {
+    await writeStatus(relayDir, { tier: "gold", remainingMessages: null, messagesPerMonth: 0 });
+    let st = (await json(`${base}/dsh-remote/im-bots`)).body.status;
+    assert.equal(st.tier, "", "未知档位必须归一成空串（面板据此不渲染，绝不猜）");
+    assert.equal(st.remainingMessages, null, "null 必须保持 null（0 条剩余 ≠ 不限量）");
+    assert.equal(st.messagesPerMonth, 0);
+
+    await writeStatus(relayDir, { tier: "pro_max", remainingMessages: null });
+    st = (await json(`${base}/dsh-remote/im-bots`)).body.status;
+    assert.equal(st.tier, "pro_max");
+  });
+});
+
+// ─────────────────── 钉钉 / 飞书通道（2026-11-08） ───────────────────
+
+const putPlatform = (base, platform, config) => json(`${base}/dsh-remote/im-bots`, {
+  method: "PUT", headers: { "content-type": "application/json" }, body: JSON.stringify({ platform, config }),
+});
+const postPlatformTest = (base, platform, config) => json(`${base}/dsh-remote/im-bots/test`, {
+  method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(config ? { platform, config } : { platform }),
+});
+const getDeps = async (base) => (await json(`${base}/dsh-remote/im-deps`)).body;
+const post = (base, url) => json(url, { method: "POST", headers: { "content-type": "application/json" }, body: "{}" });
+
+test("GET：dingtalk / feishu 两段都只回脱敏视图（有 hasSecret，绝无 clientSecret/appSecret 值）", async () => {
+  const relayDir = await tmpRelay();
+  await withHost(relayDir, {}, async (base) => {
+    await putPlatform(base, "dingtalk", { clientId: "ding-id", clientSecret: "DING-SECRET", robotCode: "ding-robot" });
+    await putPlatform(base, "feishu", { appId: "cli_1", appSecret: "FS-SECRET", receiveId: "ou_1", receiveIdType: "open_id" });
+    const r = await json(`${base}/dsh-remote/im-bots`);
+    assert.equal(r.body.dingtalk.clientId, "ding-id");
+    assert.equal(r.body.dingtalk.robotCode, "ding-robot");
+    assert.equal(r.body.dingtalk.hasSecret, true);
+    assert.equal(r.body.feishu.appId, "cli_1");
+    assert.equal(r.body.feishu.receiveIdType, "open_id");
+    assert.equal(r.body.feishu.hasSecret, true);
+    const raw = JSON.stringify(r.body);
+    assert.ok(!raw.includes("DING-SECRET"), "★ 钉钉 secret 绝不能出现");
+    assert.ok(!raw.includes("FS-SECRET"), "★ 飞书 secret 绝不能出现");
+    assert.ok(!raw.includes("clientSecret") && !raw.includes("appSecret"), "连字段名都不出现");
+  });
+});
+
+test("PUT：保存钉钉配置（0600 原子写 + 保留未知字段 + 空 secret 不覆盖）；缺字段给人话错误", async () => {
+  const relayDir = await tmpRelay();
+  await withHost(relayDir, {}, async (base) => {
+    // 先写一份带未知字段的旧文件：插件不认识，但不能删掉
+    await writeFile(path.join(relayDir, "im-bots.json"), JSON.stringify({ version: 1, future: { keep: 1 } }));
+    let r = await putPlatform(base, "dingtalk", { clientId: "id1", clientSecret: "sec1", robotCode: "rc1" });
+    assert.equal(r.status, 200);
+    let cfg = JSON.parse(await readFile(path.join(relayDir, "im-bots.json"), "utf8"));
+    assert.equal(cfg.dingtalk.clientId, "id1");
+    assert.equal(cfg.dingtalk.clientSecret, "sec1");
+    assert.equal(cfg.dingtalk.robotCode, "rc1");
+    assert.equal(cfg.dingtalk.enabled, true, "首次保存凭据 = 想让它生效");
+    assert.deepEqual(cfg.future, { keep: 1 }, "未知字段必须保留");
+    const mode = (await stat(path.join(relayDir, "im-bots.json"))).mode & 0o777;
+    assert.equal(mode, 0o600, "配置文件必须 0600");
+
+    // 空 secret = 不修改
+    r = await putPlatform(base, "dingtalk", { clientId: "id2", clientSecret: "", robotCode: "rc2" });
+    assert.equal(r.status, 200);
+    cfg = JSON.parse(await readFile(path.join(relayDir, "im-bots.json"), "utf8"));
+    assert.equal(cfg.dingtalk.clientId, "id2");
+    assert.equal(cfg.dingtalk.clientSecret, "sec1", "空 secret 表示不修改");
+    assert.equal(cfg.dingtalk.robotCode, "rc2");
+
+    // 缺字段
+    r = await putPlatform(base, "dingtalk", { clientId: "id3", clientSecret: "sec3", robotCode: "" });
+    assert.equal(r.status, 400);
+    assert.equal(r.body.error, "missing_robot_code", "三个字段都要：缺 Robot Code 要报出来");
+  });
+});
+
+test("PUT：保存飞书配置（字段锁死 + receiveIdType 校验 + 空 secret 不覆盖）", async () => {
+  const relayDir = await tmpRelay();
+  await withHost(relayDir, {}, async (base) => {
+    let r = await putPlatform(base, "feishu", { appId: "cli_a", appSecret: "fs_a", receiveId: "ou_a", receiveIdType: "chat_id" });
+    assert.equal(r.status, 200);
+    let cfg = JSON.parse(await readFile(path.join(relayDir, "im-bots.json"), "utf8"));
+    assert.equal(cfg.feishu.receiveIdType, "chat_id");
+    assert.equal(cfg.feishu.domain, "https://open.feishu.cn", "domain 默认官方");
+    r = await putPlatform(base, "feishu", { appId: "cli_b", appSecret: "", receiveId: "ou_b" });
+    cfg = JSON.parse(await readFile(path.join(relayDir, "im-bots.json"), "utf8"));
+    assert.equal(cfg.feishu.appSecret, "fs_a", "空 secret 不覆盖");
+    assert.equal(cfg.feishu.receiveIdType, "chat_id", "未传的字段 = 不修改（保留上次的 chat_id）");
+    // 非法 receiveIdType
+    r = await putPlatform(base, "feishu", { appId: "x", appSecret: "y", receiveId: "z", receiveIdType: "userid" });
+    assert.equal(r.status, 400);
+    assert.equal(r.body.error, "invalid_receive_id_type");
+  });
+});
+
+test("POST /test：platform=dingtalk / feishu 各自轮询对应状态（不再混用 wecom 状态）", async () => {
+  const relayDir = await tmpRelay();
+  await withHost(relayDir, {}, async (base) => {
+    await putPlatform(base, "dingtalk", { clientId: "i", clientSecret: "s", robotCode: "r" });
+    await putPlatform(base, "feishu", { appId: "cli_i", appSecret: "fs_s", receiveId: "ou_i" });
+    await writeStatus(relayDir, { connected: false, authenticated: false, lastError: "" }, {
+      dingtalk: { enabled: true, connected: true, authenticated: true, lastError: "" },
+      feishu: { enabled: true, connected: true, authenticated: true, lastError: "" },
+    });
+    let r = await postPlatformTest(base, "dingtalk");
+    assert.equal(r.status, 200);
+    assert.equal(r.body.platform, "dingtalk");
+    assert.equal(r.body.connected, true);
+    r = await postPlatformTest(base, "feishu");
+    assert.equal(r.body.platform, "feishu");
+    assert.equal(r.body.connected, true);
+    // 未保存 secret 的平台：给明确错误，而不是"连不上"
+    await withHost(await tmpRelay(), {}, async (base2) => {
+      const rr = await postPlatformTest(base2, "dingtalk");
+      assert.equal(rr.status, 400);
+      assert.equal(rr.body.error, "missing_secret");
+    });
+  });
+});
+
+test("GET 状态白名单：status.dingtalk / status.feishu 按契约透出（含 tier/caps/usage/state），状态文件敏感字段不外泄", async () => {
+  const relayDir = await tmpRelay();
+  await withHost(relayDir, {}, async (base) => {
+    await writeStatus(relayDir, { connected: false }, {
+      dingtalk: {
+        enabled: true, state: "connected", connected: true, authenticated: true, lastError: "", boundChatId: "chat-9",
+        tier: "pro", caps: ["dingtalk"], capsCount: 1, bindingGated: false, messagesPerMonth: 0, remainingMessages: null,
+        usage: { month: "2026-11", messages: 5 }, clientSecret: "LEAK-D", token: "LEAK-T",
+      },
+      feishu: {
+        enabled: true, state: "failed", connected: false, authenticated: false, lastError: "鉴权失败", boundChatId: "",
+        tier: "free", caps: [], capsCount: 0, bindingGated: true, messagesPerMonth: 20, remainingMessages: 19,
+        usage: { month: "2026-11", messages: 1 }, appSecret: "LEAK-F",
+      },
+    });
+    const r = await json(`${base}/dsh-remote/im-bots`);
+    const d = r.body.status.dingtalk;
+    assert.equal(d.state, "connected");
+    assert.equal(d.tier, "pro");
+    assert.deepEqual(d.caps, ["dingtalk"]);
+    assert.equal(d.remainingMessages, null, "null 必须保持 null（≠0）");
+    assert.deepEqual(d.usage, { month: "2026-11", messages: 5 });
+    const f = r.body.status.feishu;
+    assert.equal(f.state, "failed");
+    assert.equal(f.tier, "free");
+    assert.equal(f.bindingGated, true);
+    assert.equal(f.remainingMessages, 19);
+    assert.ok(!JSON.stringify(r.body).includes("LEAK"), "★ 桥写状态里的敏感字段必须被白名单挡掉");
+    // wecom 老字段仍在（向后兼容）
+    assert.equal(typeof r.body.status.connected, "boolean");
+  });
+});
+
+// 假子进程：测试注入 opts.imDepsSpawn，绝不真的联网 npm install
+function fakeSpawnChild(installed, stderrText) {
+  const handlers = {};
+  return {
+    stdout: { on() {} },
+    stderr: { on(_e, cb) { handlers.data = cb; } },
+    on(ev, cb) { handlers[ev] = cb; },
+    _finish() {
+      if (installed) handlers.installed = true;
+      setTimeout(() => {
+        if (stderrText && handlers.data) handlers.data(Buffer.from(stderrText));
+        if (handlers.exit) handlers.exit(installed ? 0 : 1);
+      }, 20);
+    }
+  };
+}
+
+test("GET /im-deps + POST /im-deps/feishu：后台安装（注入假 spawn，不联网），phase 从 downloading→done", async () => {
+  const relayDir = await tmpRelay();
+  const pkgDir = path.join(relayDir, "im-deps", "node_modules", "@larksuiteoapi", "node-sdk");
+  const spawnCalls = [];
+  const imDepsSpawn = (cmd, args) => {
+    spawnCalls.push({ cmd, args });
+    const child = fakeSpawnChild(true, "");
+    // 模拟 npm 装完后落盘（测试里直接写好 package.json）
+    setTimeout(async () => {
+      await mkdir(pkgDir, { recursive: true });
+      await writeFile(path.join(pkgDir, "package.json"), JSON.stringify({ name: "@larksuiteoapi/node-sdk", version: "1.40.0" }));
+      child._finish();
+    }, 10);
+    return child;
+  };
+  await withHost(relayDir, { imDepsSpawn }, async (base) => {
+    let deps = await getDeps(base);
+    assert.equal(deps.feishu.installed, false);
+    assert.equal(deps.feishu.phase, "idle");
+
+    const r = await post(base, `${base}/dsh-remote/im-deps/feishu`);
+    assert.equal(r.status, 200);
+    assert.equal(r.body.ok, true);
+    assert.equal(r.body.started, true);
+    assert.ok(spawnCalls.length === 1, "应触发一次 npm install");
+    assert.ok(spawnCalls[0].args.join(" ").includes("@larksuiteoapi/node-sdk@1.40.0"), "安装命令必须钉死 SDK 版本");
+
+    // 轮询 phase 直到 done
+    let phase = "";
+    for (let i = 0; i < 50; i++) {
+      deps = await getDeps(base);
+      phase = deps.feishu.phase;
+      if (phase === "done" || phase === "failed") break;
+      await new Promise((r2) => setTimeout(r2, 30));
+    }
+    deps = await getDeps(base);
+    assert.equal(deps.feishu.phase, "done", "安装完成后 phase=done，实际 " + deps.feishu.phase);
+    assert.equal(deps.feishu.installed, true);
+    assert.equal(deps.feishu.version, "1.40.0");
+    assert.ok(deps.feishu.path.includes("node-sdk"));
+  });
+});
+
+test("POST /im-deps/feishu：安装失败 → phase=failed + 人话原因（network/disk/permission/sdk_install_failed）", async () => {
+  const relayDir = await tmpRelay();
+  const imDepsSpawn = () => {
+    const child = fakeSpawnChild(false, "npm ERR! code ETIMEDOUT network registry.npmjs.org");
+    setTimeout(() => child._finish(), 10);
+    return child;
+  };
+  await withHost(relayDir, { imDepsSpawn }, async (base) => {
+    const r = await post(base, `${base}/dsh-remote/im-deps/feishu`);
+    assert.equal(r.status, 200);
+    let deps = null;
+    for (let i = 0; i < 60; i++) {
+      deps = await getDeps(base);
+      if (deps.feishu.phase === "failed") break;
+      await new Promise((r2) => setTimeout(r2, 30));
+    }
+    assert.equal(deps.feishu.phase, "failed", "失败必须落到 failed 而不是永远 downloading");
+    assert.match(deps.feishu.lastError, /网络不通/, "网络类错误要翻成人话");
+    // 已失败后重试：再次触发安装
+    const r2 = await post(base, `${base}/dsh-remote/im-deps/feishu`);
+    assert.equal(r2.body.started, true, "失败后允许重试");
+  });
+});

package/packages/dsh-remote-web/test/login-fast.test.mjs

@@ -0,0 +1,104 @@
+// 登录/首屏不再阻塞在「本机端口发现」上（2026-11-07 业主反馈：登录 7~8 秒太慢）。
+//
+// 根因定位（Lead）：登录后前端拉 /bridge-status 与 /account，服务端 composeConnect 里
+// `await discoverUpstreamSelf()`（lsof/netstat + 数百端口探测）+ launchctl/ps 全在响应路径上；
+// /config 还在响应里 `...(await composeStatus())`。
+//
+// 本文件锁三件事：
+//   ① composeConnect **不 await** 慢发现（<300ms 返回，并标记 discoveryPending）；
+//   ② POST /dsh-remote/config 立即返回（不带衍生状态，statusPending=true）；
+//   ③ shell 探测（launchctl/ps）走 10s TTL 缓存（避免每次轮询重跑）。
+import assert from "node:assert/strict";
+import http from "node:http";
+import { mkdtemp } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import {
+  apply,
+  __composeConnect as composeConnect,
+  __setUpstreamTestState as setUpstreamTestState,
+  __resetUpstreamTestState as resetUpstreamTestState,
+  __clearStatusProbeCache as clearStatusProbeCache,
+  __STATUS_PROBE_TTL_MS as STATUS_PROBE_TTL_MS,
+} from "../lib/index.js";
+
+// unref：模拟"慢发现"的定时器不能把测试进程空等到 5 秒（本套件对时长敏感）。
+const sleep = (ms) => new Promise((r) => { const t = setTimeout(r, ms); try { t.unref?.(); } catch { /* 忽略 */ } });
+const tmpRelay = () => mkdtemp(path.join(os.tmpdir(), "dsh-login-fast-"));
+
+test("composeConnect：端口发现再慢（5s）也不阻塞状态组装（<300ms），并标记 discoveryPending", async () => {
+  const relayDir = await tmpRelay();
+  setUpstreamTestState({ unsettled: true, discover: async () => { await sleep(5000); return "http://127.0.0.1:43210"; } });
+  clearStatusProbeCache();
+  try {
+    const t0 = Date.now();
+    const conn = await composeConnect(relayDir);
+    const cost = Date.now() - t0;
+    assert.ok(cost < 300, "★ composeConnect 必须 <300ms 返回（实测 " + cost + "ms）");
+    assert.equal(conn.discoveryPending, true, "端口发现还没完成时，必须如实标记 discoveryPending（面板可显示骨架）");
+    assert.ok(conn.phase, "状态阶段照常返回（不因发现未完成而缺字段）");
+  } finally {
+    resetUpstreamTestState();
+    clearStatusProbeCache();
+  }
+});
+
+test("composeConnect：发现已完成（缓存/hint）→ 不再触发发现、discoveryPending=false", async () => {
+  const relayDir = await tmpRelay();
+  setUpstreamTestState({ unsettled: false, discover: async () => { throw new Error("不该被调用"); } });
+  clearStatusProbeCache();
+  try {
+    const conn = await composeConnect(relayDir);
+    assert.equal(conn.discoveryPending, false, "发现已 settled 时不应标记 pending");
+  } finally {
+    resetUpstreamTestState();
+    clearStatusProbeCache();
+  }
+});
+
+test("POST /dsh-remote/config：立即返回（不 await 衍生状态），body.statusPending=true 且只回最小 config", async () => {
+  const relayDir = await tmpRelay();
+  setUpstreamTestState({ unsettled: true, discover: async () => { await sleep(5000); return "http://127.0.0.1:43210"; } });
+  const routes = [];
+  apply({
+    webServer: { register(rt) { routes.push(rt); return () => {}; } },
+    effect(reg) { return reg(); },
+    logger: { info() {}, warn() {} },
+  }, { relayDir });
+  const host = http.createServer((req, res) => {
+    const url = new URL(req.url, "http://x");
+    const rt = routes.find((r) => (r.kind === "prefix"
+      ? url.pathname === r.path || url.pathname.startsWith(r.path + "/")
+      : url.pathname === r.path));
+    (rt ? rt.handler : ((_r, rs) => { rs.writeHead(404); rs.end(); }))(req, res);
+  });
+  await new Promise((r) => host.listen(0, "127.0.0.1", r));
+  const base = `http://127.0.0.1:${host.address().port}`;
+  try {
+    const t0 = Date.now();
+    const r = await fetch(`${base}/dsh-remote/config`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ phone: "13800000000", password: "password123" }),
+    });
+    const cost = Date.now() - t0;
+    const body = await r.json();
+    assert.equal(r.status, 200);
+    assert.ok(cost < 300, "★ /config 必须 <300ms（实测 " + cost + "ms）—— 登录按钮的等待只该是登录请求本身");
+    assert.equal(body.ok, true);
+    assert.equal(body.statusPending, true, "★ 立即返回时必须声明 statusPending（前端据此异步补状态）");
+    assert.equal(typeof body.config, "object", "回最小配置回显（供 UI 立刻切换已登录态）");
+    assert.equal(body.config.hasPhone, true);
+    assert.equal("connect" in body, false, "★ 响应里不得再带衍生状态（connect/隧道/端口探测结果）");
+    assert.equal("service" in body, false, "★ 响应里不得再带 service 衍生信息");
+  } finally {
+    resetUpstreamTestState();
+    clearStatusProbeCache();
+    await new Promise((r) => host.close(r));
+  }
+});
+
+test("shell 探测 TTL：STATUS_PROBE_TTL_MS 是 10s 级短缓存（不是每次轮询都重跑 launchctl/ps）", () => {
+  assert.equal(STATUS_PROBE_TTL_MS, 10 * 1000, "缓存 TTL 必须是 10s（B1 约定）");
+});

package/packages/dsh-remote-web/test/login-selfheal-ui.test.mjs

@@ -227,7 +227,10 @@ test("未登录：不请求企业端、不出误导性红字；登录后自动
 
   assert.ok(!plugin.requests.some((r) => r.path === "/dsh-remote/access-key"), "未登录不得请求二维码接口");
   assert.ok(!plugin.requests.some((r) => r.path === "/dsh-remote/mobile-sessions"), "未登录不得请求设备列表");
-  assert.ok(textHas(tree, "登录下方「🔑 账号」卡片中的手机号账号后"), "未登录应给登录引导而非报错");
+  // IA 重做（2026-11-07）：未登录点「打开手机端/生成访问码」→ 直接弹登录弹层并说明原因；
+  // 这张卡自己的按钮文案也写明「登录并生成访问码」（不再静默失败）。
+  assert.ok(textHas(tree, "登录并生成访问码") || textHas(tree, "登录后才能用手机访问"),
+    "未登录应给明确的登录引导（不是静默失败，也不是红字报错）");
   assert.ok(!textHas(tree, "尚未登录"), "未登录也不该出现接口报错红字");
 
   tree = await plugin.login();