@mrrisega/dsh-remote 0.7.3 → 0.7.4

package/clients/dsh-remote/test/bridge-file-transfer.test.mjs

@@ -0,0 +1,281 @@
+#!/usr/bin/env node
+/**
+ * bridge-file-transfer.test.mjs — 文件上传/下载/预览这条线的 bridge 侧契约(2026-10-23):
+ *
+ *   A. 上传健壮性(B):
+ *      - `requestBodyBytes`:http 帧 base64 / 旧协议文本的字节数(日志与 502 回包用);
+ *      - `classifyUpstreamError`:超时 / 连不上 / 其它三类 code(生产 502 里 24 字节的
+ *        `{"error":"fetch failed"}` 退化成用户看不懂的"上传失败"的根因之一);
+ *      - 502 回包改成可读 `{error:{code,message,...}}`(保留 error 键与顶层 code/message);
+ *      - 上传成功日志必须含**上行字节 + 耗时**(客服排查"上传失败"的三要素之一);
+ *      - 隧道 `maxPayload` 与 relay-router 的 WS_MAX_PAYLOAD(256MB) 对齐,且真的传给
+ *        `new WebSocket`(否则 100MiB 默认值会被大上传帧 1009 打断 → 连续 502 device_offline)。
+ *
+ *   B. 下载(C):
+ *      - `/api/file` 的**导航**响应补 `Content-Disposition: attachment; filename*=UTF-8''…`;
+ *      - 图片/子资源(sec-fetch-dest=image)、非导航、上游已有该头、非 /api/file 一律不动;
+ *      - 走真实 handleHttpFrame → doHttp → 本地上游全链路,body 不被改动。
+ *
+ * 用法: node --test test/bridge-file-transfer.test.mjs
+ */
+import assert from "node:assert/strict";
+import { createServer } from "node:http";
+import { mkdtempSync, rmSync, readFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test, { after } from "node:test";
+
+const BRIDGE_SRC = path.join(path.dirname(new URL(import.meta.url).pathname), "..", "dsh-bridge.mjs");
+
+/** 假上游:dsh web 的最小替身。 */
+const PDF_BYTES = Buffer.from("%PDF-1.4\n% test pdf body " + "x".repeat(2048) + "\n%%EOF\n", "utf8");
+const upstream = createServer((req, res) => {
+  const u = new URL(req.url, "http://127.0.0.1");
+  if (u.pathname === "/api/file") {
+    if (u.searchParams.get("miss") === "1") {
+      res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+      res.end("not found");
+      return;
+    }
+    if (u.searchParams.get("withcd") === "1") {
+      res.writeHead(200, { "content-type": "application/pdf", "content-disposition": 'inline; filename="upstream.pdf"' });
+      res.end(PDF_BYTES);
+      return;
+    }
+    res.writeHead(200, { "content-type": "application/pdf", "cache-control": "private, no-store" });
+    res.end(PDF_BYTES);
+    return;
+  }
+  if (u.pathname === "/api/session/uploadFileBinary") {
+    let n = 0;
+    req.on("data", (c) => { n += c.length; });
+    req.on("end", () => {
+      res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
+      res.end(JSON.stringify({ ok: true, value: { receiptId: "r1", file: { attachmentId: "sha256:x", name: u.searchParams.get("name") || "", bytes: n } } }));
+    });
+    return;
+  }
+  if (u.pathname === "/api/boom") {
+    // 模拟上游连接被重置(用户关掉 dsh web / Electron 退出)
+    try { req.socket.destroy(); } catch { /* ignore */ }
+    return;
+  }
+  res.writeHead(200, { "content-type": "text/plain; charset=utf-8" });
+  res.end("ok");
+});
+
+const tmpDir = mkdtempSync(path.join(os.tmpdir(), "dsh-bridge-filetransfer-"));
+process.env.DSH_BRIDGE_DEVICE_ID = "dev-filetrf00001";
+process.env.DSH_BRIDGE_CONFIG = path.join(tmpDir, "config.json");
+
+const bridge = await new Promise((resolve, reject) => {
+  upstream.listen(0, "127.0.0.1", () => {
+    process.env.DSH_BRIDGE_UPSTREAM = `http://127.0.0.1:${upstream.address().port}`;
+    import("../dsh-bridge.mjs").then(resolve, reject);
+  });
+});
+const { handleHttpFrame, requestBodyBytes, classifyUpstreamError, downloadDispositionOf, downloadFilenameOf, TUNNEL_WS_OPTIONS, TUNNEL_WS_MAX_PAYLOAD } = bridge;
+
+after(() => {
+  try { upstream.close(); } catch { /* ignore */ }
+  try { rmSync(tmpDir, { recursive: true, force: true }); } catch { /* ignore */ }
+});
+
+/** 发一帧并取回 reply(与 bridge-gzip 用例同构)。 */
+async function request(frame) {
+  let reply;
+  const sender = (obj) => { reply = obj; return true; };
+  await handleHttpFrame(sender, { type: "http", ...frame });
+  return reply;
+}
+
+// ============================================================
+// A. 上传健壮性(B)
+// ============================================================
+
+test("requestBodyBytes:base64 / 文本 / 空体", () => {
+  assert.equal(requestBodyBytes(undefined, true), 0);
+  assert.equal(requestBodyBytes("", true), 0);
+  // 1MB 字节 → base64 后按 3/4 反推回 1MB
+  const oneMb = Buffer.alloc(1024 * 1024, 7);
+  assert.equal(requestBodyBytes(oneMb.toString("base64"), true), oneMb.length);
+  // 带 padding 的短样本
+  assert.equal(requestBodyBytes(Buffer.from("abc").toString("base64"), true), 3);   // YWJj
+  assert.equal(requestBodyBytes(Buffer.from("ab").toString("base64"), true), 2);    // YWI=
+  assert.equal(requestBodyBytes(Buffer.from("a").toString("base64"), true), 1);     // YQ==
+  // 旧协议:原始文本按 UTF-8
+  assert.equal(requestBodyBytes("你好", false), 6);
+});
+
+test("classifyUpstreamError:超时 / 连不上 / 其它 → 稳定 code + 可读 message", () => {
+  const timeout = Object.assign(new Error("The operation was aborted due to timeout"), { name: "TimeoutError" });
+  const t = classifyUpstreamError(timeout);
+  assert.equal(t.code, "upstream_timeout");
+  assert.match(t.message, /没有响应|稍后重试/);
+
+  const refused = Object.assign(new TypeError("fetch failed"), { cause: { code: "ECONNREFUSED" } });
+  const r = classifyUpstreamError(refused);
+  assert.equal(r.code, "upstream_unreachable");
+  assert.match(r.message, /连不上电脑端|重新发现/);
+  assert.equal(r.detail, "ECONNREFUSED");
+
+  const socketErr = Object.assign(new TypeError("terminated"), { cause: { code: "UND_ERR_SOCKET" } });
+  assert.equal(classifyUpstreamError(socketErr).code, "upstream_unreachable");
+
+  const other = new Error("boom");
+  const o = classifyUpstreamError(other);
+  assert.equal(o.code, "upstream_error");
+  assert.match(o.message, /boom/);
+});
+
+test("★ 上游 502 回包:可读 {error:{code,message}},不再是 {\"error\":\"fetch failed\"}", async () => {
+  const reply = await request({ id: "boom1", method: "GET", path: "/api/boom", headers: {} });
+  assert.equal(reply.status, 502);
+  assert.match(String(reply.headers["content-type"]), /application\/json/);
+  const body = JSON.parse(Buffer.from(reply.body, "base64").toString("utf8"));
+  assert.equal(typeof body.error, "object", "error 必须是对象(可读 code/message),不能是裸字符串");
+  assert.equal(typeof body.error.code, "string");
+  assert.ok(body.error.code.length > 0);
+  assert.equal(typeof body.error.message, "string");
+  assert.ok(body.error.message.length > 8, "message 必须是一句人话,不是 'fetch failed'");
+  // 兼容字段:顶层 code/message 与 error.code/message 一致
+  assert.equal(body.code, body.error.code);
+  assert.equal(body.message, body.error.message);
+  // 诊断字段:method/path/bytes/durationMs(客服据此定位是哪次上传、传了多大)
+  assert.equal(body.error.method, "GET");
+  assert.equal(body.error.path, "/api/boom");
+  assert.equal(typeof body.error.bytes, "number");
+  assert.equal(typeof body.error.durationMs, "number");
+});
+
+test("★ 上传成功日志含上行字节与耗时(长请求可观测性)", async () => {
+  const bytes = Buffer.alloc(1024 * 1024, 3); // 1MB
+  const logs = [];
+  const orig = console.log;
+  console.log = (...args) => { logs.push(args.map(String).join(" ")); };
+  let reply;
+  try {
+    reply = await request({
+      id: "up1",
+      method: "POST",
+      path: "/api/session/uploadFileBinary?sessionId=session-test&name=big.bin",
+      headers: { "content-type": "application/octet-stream" },
+      body: bytes.toString("base64"),
+      bodyBase64: true
+    });
+  } finally {
+    console.log = orig;
+  }
+  assert.equal(reply.status, 200);
+  const line = logs.find((l) => l.includes("/api/session/uploadFileBinary"));
+  assert.ok(line, "上传必须留下一条日志:" + JSON.stringify(logs));
+  assert.match(line, /→ 200/);
+  assert.match(line, /上行 1\.00MB/, "日志必须含上行字节(排查 413/超时/断流都靠它):" + line);
+  assert.match(line, /\(\d+ms/, "日志必须含耗时:" + line);
+});
+
+test("★ 隧道 ws maxPayload 与 router 对齐(256MB),且真的传给 new WebSocket", () => {
+  assert.equal(TUNNEL_WS_MAX_PAYLOAD, 256 * 1024 * 1024);
+  assert.equal(TUNNEL_WS_OPTIONS.maxPayload, 256 * 1024 * 1024);
+  assert.equal(TUNNEL_WS_OPTIONS.followRedirects, false);
+  // ws 默认 100MiB 挡不住 64MiB 请求体的 base64 帧(≈89.5MB),余量仅 ~15%;
+  // 代码级断言防止以后"顺手删掉"这个选项。
+  const src = readFileSync(BRIDGE_SRC, "utf8");
+  assert.match(src, /new WebSocket\(endpoint, TUNNEL_WS_OPTIONS\)/, "隧道连接必须显式传 TUNNEL_WS_OPTIONS");
+});
+
+// ============================================================
+// B. 下载(C)
+// ============================================================
+
+test("downloadFilenameOf:取最后一段;非法/空回落 download", () => {
+  assert.equal(downloadFilenameOf("/Users/mac/TalkWithMe/incidence_test.pdf"), "incidence_test.pdf");
+  assert.equal(downloadFilenameOf("/Users/mac/TalkWithMe/预览_技术SQL表_上.png"), "预览_技术SQL表_上.png");
+  assert.equal(downloadFilenameOf("C:\\Users\\a\\b.zip"), "b.zip");
+  assert.equal(downloadFilenameOf("/a/b/"), "b");
+  assert.equal(downloadFilenameOf(""), "download");
+  assert.equal(downloadFilenameOf("/"), "download");
+});
+
+test("downloadDispositionOf:导航 → attachment(RFC 5987);图片/子资源/非导航/上游已有 → 不动", () => {
+  const nav = { "sec-fetch-dest": "document", accept: "text/html,application/xhtml+xml" };
+  const cd = downloadDispositionOf({ method: "GET", path: "/api/file?path=%2Ftmp%2F%E6%8A%A5%E5%91%8A.pdf", reqHeaders: nav, resHeaders: {} });
+  assert.ok(cd && cd.startsWith("attachment;"), "导航必须给 attachment:" + cd);
+  assert.match(cd, /filename\*=UTF-8''%E6%8A%A5%E5%91%8A\.pdf/, "中文名必须 percent-encode 进 filename*:" + cd);
+  assert.match(cd, /filename="download\.pdf"/, "非 ASCII 名的 ASCII 回退用 download.<ext>(别丢扩展名):" + cd);
+
+  // 子资源:pic 的 <img src> 加载,不能变成下载
+  for (const dest of ["image", "empty", "iframe", "audio", "video"]) {
+    assert.equal(downloadDispositionOf({ method: "GET", path: "/api/file?path=%2Ftmp%2Fa.png", reqHeaders: { "sec-fetch-dest": dest }, resHeaders: {} }), null, dest);
+  }
+  // 老浏览器(无 sec-fetch-dest):靠 Accept 判导航
+  assert.ok(downloadDispositionOf({ method: "GET", path: "/api/file?path=%2Ftmp%2Fa.pdf", reqHeaders: { accept: "text/html,application/xhtml+xml,*/*" }, resHeaders: {} }));
+  assert.equal(downloadDispositionOf({ method: "GET", path: "/api/file?path=%2Ftmp%2Fa.png", reqHeaders: { accept: "image/avif,image/webp,*/*" }, resHeaders: {} }), null);
+  // 上游已经给了(attachment 或 inline)→ 一律不覆盖
+  assert.equal(downloadDispositionOf({ method: "GET", path: "/api/file?path=%2Ftmp%2Fa.pdf", reqHeaders: nav, resHeaders: { "content-disposition": 'inline; filename="x.pdf"' } }), null);
+  assert.equal(downloadDispositionOf({ method: "GET", path: "/api/file?path=%2Ftmp%2Fa.pdf", reqHeaders: nav, resHeaders: { "Content-Disposition": 'attachment; filename="x.pdf"' } }), null);
+  // 非 /api/file、非 GET → 不动
+  assert.equal(downloadDispositionOf({ method: "GET", path: "/api/workspaceFiles/readBytes", reqHeaders: nav, resHeaders: {} }), null);
+  assert.equal(downloadDispositionOf({ method: "POST", path: "/api/file?path=%2Ftmp%2Fa.pdf", reqHeaders: nav, resHeaders: {} }), null);
+  // 显式 ?download=1 强制(即使 Accept 是图片),?download=0 强制不加
+  assert.ok(downloadDispositionOf({ method: "GET", path: "/api/file?path=%2Ftmp%2Fa.png&download=1", reqHeaders: { "sec-fetch-dest": "image" }, resHeaders: {} }));
+  assert.equal(downloadDispositionOf({ method: "GET", path: "/api/file?path=%2Ftmp%2Fa.pdf&download=0", reqHeaders: nav, resHeaders: {} }), null);
+});
+
+test("集成:/api/file 导航请求 → 补 Content-Disposition,body 与上游逐字节一致", async () => {
+  const reply = await request({
+    id: "dl1",
+    method: "GET",
+    path: "/api/file?path=%2FUsers%2Fmac%2FTalkWithMe%2Fincidence_test.pdf",
+    headers: { "sec-fetch-dest": "document", accept: "text/html,application/xhtml+xml", "user-agent": "iPhone" }
+  });
+  assert.equal(reply.status, 200);
+  const cd = reply.headers["content-disposition"];
+  assert.ok(cd, "导航下载必须带 content-disposition:" + JSON.stringify(reply.headers));
+  assert.match(cd, /^attachment;/);
+  assert.match(cd, /filename\*=UTF-8''incidence_test\.pdf/);
+  assert.deepEqual(Buffer.from(reply.body, "base64"), PDF_BYTES, "attachment 不能改动响应体");
+});
+
+test("集成:图片子资源请求 → 不加 Content-Disposition(聊天里 <img src=/api/file> 不受影响)", async () => {
+  const reply = await request({
+    id: "dl2",
+    method: "GET",
+    path: "/api/file?path=%2FUsers%2Fmac%2FTalkWithMe%2Fa.png",
+    headers: { "sec-fetch-dest": "image", accept: "image/avif,image/webp,image/png" }
+  });
+  assert.equal(reply.status, 200);
+  assert.equal(reply.headers["content-disposition"], undefined);
+});
+
+test("集成:上游已给 Content-Disposition → 保留上游值(不覆盖)", async () => {
+  const reply = await request({
+    id: "dl3",
+    method: "GET",
+    path: "/api/file?path=%2Ftmp%2Fa.pdf&withcd=1",
+    headers: { "sec-fetch-dest": "document", accept: "text/html" }
+  });
+  assert.equal(reply.status, 200);
+  assert.equal(reply.headers["content-disposition"], 'inline; filename="upstream.pdf"');
+});
+
+test("集成:上游 4xx/5xx 不补 attachment(否则浏览器把报错正文下载成文件)", async () => {
+  const reply = await request({
+    id: "dl4",
+    method: "GET",
+    path: "/api/file?path=%2Ftmp%2Fa.pdf&miss=1",
+    headers: { "sec-fetch-dest": "document", accept: "text/html" }
+  });
+  assert.equal(reply.status, 404);
+  assert.equal(reply.headers["content-disposition"], undefined);
+  assert.equal(Buffer.from(reply.body, "base64").toString("utf8"), "not found");
+});
+
+test("downloadDispositionOf:非 2xx 一律不附加", () => {
+  const nav = { "sec-fetch-dest": "document", accept: "text/html" };
+  for (const status of [204, 301, 401, 404, 413, 500, 502]) {
+    assert.equal(downloadDispositionOf({ method: "GET", path: "/api/file?path=%2Ftmp%2Fa.pdf", status, reqHeaders: nav, resHeaders: {} }), null, String(status));
+  }
+  assert.ok(downloadDispositionOf({ method: "GET", path: "/api/file?path=%2Ftmp%2Fa.pdf", status: 200, reqHeaders: nav, resHeaders: {} }));
+  assert.ok(downloadDispositionOf({ method: "GET", path: "/api/file?path=%2Ftmp%2Fa.pdf", status: 206, reqHeaders: nav, resHeaders: {} }));
+});

package/clients/dsh-remote/test/e2ee-shim-retry.test.mjs

@@ -0,0 +1,249 @@
+#!/usr/bin/env node
+/**
+ * e2ee-shim-retry.test.mjs — 镜像页 shim 的「网络层失败一次极短重试」(D,2026-10-23):
+ *
+ * 背景:文档预览/会话历史的数据面(`/api/workspaceFiles/*`、`/api/session/page`、
+ * `/api/officeToPdf/*`)在弱网或中继限速下经常"读到一半断"——浏览器只看到一次
+ * fetch reject 或空响应,上层直接落到"读取失败"(用户得手点「重新读取文件」)。
+ *
+ * 契约(全部用抽取出来的真实 CORE 代码 + mock 传输,不开真浏览器):
+ *   A. 白名单:只认幂等读路径(目录式前缀对齐 /api/session/page 不误伤 /api/session/pages);
+ *   B. fetch reject → 白名单读路径重试 1 次(共 2 次请求),第二次成功则用户无感;
+ *   C. 重试必须换**新 nonce 的信封**(桥端 http nonce 防重放窗口 5 分钟,复用会被判 replay);
+ *   D. 非白名单路径(fetch reject)→ 不重试,原异常原样抛出(零行为变化);
+ *   E. 已有响应体的明文 4xx/5xx → 不重试;
+ *   F. 信封响应体为空/非法(截断)→ 白名单读路径重试;
+ *   G. 调用方已 abort → 不再重试,抛 AbortError;
+ *   H. 白名单路径首次成功 → 只发 1 次(不能无脑双发)。
+ *
+ * 用法: node --test test/e2ee-shim-retry.test.mjs
+ */
+import assert from "node:assert/strict";
+import test from "node:test";
+import {
+  E2eeSession,
+  decodeHttpRequestPlain,
+  deriveMasterKey,
+  deriveShk,
+  encodeHttpResponsePlain,
+  newSessId,
+  randomB64
+} from "../e2ee-client.mjs";
+import { loadShimCore } from "./lib-e2ee-shim.mjs";
+
+const shim = await loadShimCore();
+const ORIGIN = "http://relay.local";
+
+function makeSeSession(over = {}) {
+  const mk = deriveMasterKey("shim-retry-password", "AAECAwQFBgcICQoLDA0ODw");
+  const { shk, saltH } = deriveShk(mk, randomB64(32), randomB64(32));
+  return new shim.SeSession({ sessId: newSessId(), shk: new Uint8Array(shk), saltH: new Uint8Array(saltH), ...over });
+}
+/** 桥端视角的 node 对端(同一会话材料)。 */
+function peerOf(seSess) {
+  return new E2eeSession({ sessId: seSess.sessId, shk: Buffer.from(seSess.shk), saltH: Buffer.from(seSess.saltH) });
+}
+/** 把响应明文封成信封响应(桥端在回包时做的事)。 */
+function envelopeResponse(peer, envReq, { status = 200, headers = {}, body = Buffer.from("ok") } = {}) {
+  const plain = encodeHttpResponsePlain({ status, headers, bodyBuffer: body });
+  const envResp = peer.seal({ kind: "http-resp", dir: "b2p", counter: envReq.c ?? 0, data: plain, reqNonceB64: envReq.n });
+  return new Response(JSON.stringify(envResp), {
+    status: 200,
+    headers: { "content-type": "application/vnd.dsh.e2ee-v2", "x-dsh-e2ee": `v=2;s=${peer.sessId};k=http-resp` }
+  });
+}
+
+// ============ A. 白名单 ============
+
+test("A. 白名单:幂等读路径命中;写/上传/其它路径不命中", () => {
+  const yes = [
+    "/api/workspaceFiles/readBytes",
+    "/api/workspaceFiles/stat",
+    "/api/workspaceFiles/readBytes?x=1",
+    "/api/session/page",
+    "/api/session/page?sessionId=s1&offset=0",
+    "/api/officeToPdf/render",
+    "/api/officeToPdf/whatever"
+  ];
+  for (const p of yes) assert.equal(shim.seRetryableReadPath(p), true, `应命中: ${p}`);
+  const no = [
+    "/api/session/pages",           // 不能吃掉同名兄弟路径(精确匹配)
+    "/api/session/page/extra",      // 子路径也不算(精确匹配)
+    "/api/session/pageX",
+    "/api/session/uploadFileBinary",
+    "/api/file",
+    "/api/session/list",
+    "/api/workspace",
+    "/plugins/app.js",
+    ""
+  ];
+  for (const p of no) assert.equal(shim.seRetryableReadPath(p), false, `不应命中: ${p}`);
+  assert.equal(shim.SE_RETRY_DELAY_MS, 300);
+  assert.ok(Array.isArray(shim.SE_RETRY_PATH_PREFIXES) && shim.SE_RETRY_PATH_PREFIXES.length >= 3);
+});
+
+test("A2. 白名单口径与加密策略一致:device 形态 /remote/<dev>/api/... 也要命中", () => {
+  // 客户端在 device 形态下会把路径改写成 /remote/<deviceId>/api/...
+  // (见 seUpstreamPathOf 的注释):重试白名单必须先用同一函数归一,否则这类请求漏重试。
+  const yes = [
+    "/remote/dev-x/api/workspaceFiles/readBytes",
+    "/remote/dev-x/api/workspaceFiles/stat?x=1",
+    "/remote/dev-x/api/session/page",
+    "/remote/dev-x/api/session/page?sessionId=s1",
+    "/remote/dev-x/api/officeToPdf/render"
+  ];
+  for (const p of yes) assert.equal(shim.seRetryableReadPath(p), true, `device 形态应命中: ${p}`);
+  const no = [
+    "/remote/dev-x/api/session/pages",
+    "/remote/dev-x/api/session/page/extra",
+    "/remote/dev-x/api/session/uploadFileBinary",
+    "/remote/dev-x/api/session/list"
+  ];
+  for (const p of no) assert.equal(shim.seRetryableReadPath(p), false, `device 形态不应命中: ${p}`);
+  // 与 seUpstreamPathOf 口径一致:归一后应当就是白名单里的上游路径
+  assert.equal(shim.seUpstreamPathOf("/remote/dev-x/api/workspaceFiles/readBytes"), "/api/workspaceFiles/readBytes");
+  assert.equal(shim.seUpstreamPathOf("/remote/dev-x/api/session/page?sessionId=s1&device=dev-x"), "/api/session/page?sessionId=s1");
+});
+
+// ============ B/C. fetch reject → 重试一次 + 新 nonce ============
+
+test("B/C. fetch reject(白名单读路径)→ 重试 1 次即成功;两次请求 nonce 不同(防 replay)", async () => {
+  const seS = makeSeSession();
+  const peer = peerOf(seS);
+  const nonces = [];
+  let calls = 0;
+  const transport = async (_input, init) => {
+    calls += 1;
+    const envReq = JSON.parse(init.body);
+    nonces.push(envReq.n);
+    const opened = peer.open({ kind: "http", dir: "p2b", env: envReq, counter: envReq.c ?? 0 });
+    const req = decodeHttpRequestPlain(opened.data);
+    assert.equal(req.path, "/api/workspaceFiles/readBytes");
+    if (calls === 1) throw new TypeError("Load failed"); // 第一次:网络层失败
+    return envelopeResponse(peer, envReq, { status: 200, headers: { "content-type": "application/json" }, body: Buffer.from('{"ok":true,"value":"重试成功"}') });
+  };
+  const res = await shim.seFetchWrapper(transport, { sess: seS, origin: ORIGIN }, ORIGIN + "/api/workspaceFiles/readBytes", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: "{}"
+  });
+  assert.equal(calls, 2, "白名单读路径的网络层失败必须重试一次(共 2 次)");
+  assert.equal(res.status, 200);
+  assert.equal(await res.text(), '{"ok":true,"value":"重试成功"}');
+  assert.notEqual(nonces[0], nonces[1], "重试必须重新封新 nonce 的信封,复用会被桥端判 replay");
+});
+
+test("B/C. 请求体同样重发(重试的是同一个幂等读请求)", async () => {
+  const seS = makeSeSession();
+  const peer = peerOf(seS);
+  const bodies = [];
+  let calls = 0;
+  const transport = async (_input, init) => {
+    calls += 1;
+    const envReq = JSON.parse(init.body);
+    const opened = peer.open({ kind: "http", dir: "p2b", env: envReq, counter: envReq.c ?? 0 });
+    const req = decodeHttpRequestPlain(opened.data);
+    bodies.push(Buffer.from(req.bodyB64, "base64").toString("utf8"));
+    if (calls === 1) throw new TypeError("Load failed");
+    return envelopeResponse(peer, envReq, { status: 200, headers: { "content-type": "text/plain" }, body: Buffer.from("done") });
+  };
+  await shim.seFetchWrapper(transport, { sess: seS, origin: ORIGIN }, ORIGIN + "/api/session/page", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: '{"sessionId":"s1","offset":40}'
+  });
+  assert.deepEqual(bodies, ['{"sessionId":"s1","offset":40}', '{"sessionId":"s1","offset":40}']);
+});
+
+// ============ D. 非白名单:不重试 ============
+
+test("D. 非白名单路径 fetch reject → 不重试,原异常抛出(零行为变化)", async () => {
+  const seS = makeSeSession();
+  let calls = 0;
+  const boom = new TypeError("Load failed");
+  const transport = async () => { calls += 1; throw boom; };
+  await assert.rejects(
+    () => shim.seFetchWrapper(transport, { sess: seS, origin: ORIGIN }, ORIGIN + "/api/session/uploadFileBinary?sessionId=s", { method: "POST", body: "x" }),
+    (e) => e === boom,
+    "非白名单必须原样抛原异常(不能换成别的错误)"
+  );
+  assert.equal(calls, 1);
+});
+
+// ============ E. 已有响应体的明文错误页:不重试 ============
+
+test("E. 明文 4xx/5xx(有响应体)→ 不重试,原样透传", async () => {
+  const seS = makeSeSession();
+  let calls = 0;
+  const transport = async () => {
+    calls += 1;
+    return new Response('{"error":{"code":"upstream","message":"boom"}}', { status: 502, headers: { "content-type": "application/json" } });
+  };
+  const res = await shim.seFetchWrapper(transport, { sess: seS, origin: ORIGIN }, ORIGIN + "/api/workspaceFiles/readBytes", { method: "POST", body: "{}" });
+  assert.equal(calls, 1, "已经有响应体(哪怕是 5xx)不重试");
+  assert.equal(res.status, 502);
+  assert.match(await res.text(), /boom/);
+});
+
+// ============ F. 信封响应为空/截断 → 重试 ============
+
+test("F. 信封响应体为空(截断)→ 白名单读路径重试;第二次正常则成功", async () => {
+  const seS = makeSeSession();
+  const peer = peerOf(seS);
+  let calls = 0;
+  const transport = async (_input, init) => {
+    calls += 1;
+    const envReq = JSON.parse(init.body);
+    if (calls === 1) return new Response("", { status: 200, headers: { "content-type": "application/vnd.dsh.e2ee-v2", "x-dsh-e2ee": `v=2;s=${seS.sessId};k=http-resp` } });
+    return envelopeResponse(peer, envReq, { status: 200, headers: { "content-type": "text/plain" }, body: Buffer.from("第二次好了") });
+  };
+  const res = await shim.seFetchWrapper(transport, { sess: seS, origin: ORIGIN }, ORIGIN + "/api/officeToPdf/render", { method: "POST", body: "{}" });
+  assert.equal(calls, 2);
+  assert.equal(res.status, 200);
+  assert.equal(await res.text(), "第二次好了");
+});
+
+test("F2. 非白名单的空信封响应 → 不重试,仍回显式 502 bad_envelope(原行为)", async () => {
+  const seS = makeSeSession();
+  let calls = 0;
+  const transport = async () => {
+    calls += 1;
+    return new Response("", { status: 200, headers: { "content-type": "application/vnd.dsh.e2ee-v2", "x-dsh-e2ee": `v=2;s=${seS.sessId};k=http-resp` } });
+  };
+  const res = await shim.seFetchWrapper(transport, { sess: seS, origin: ORIGIN }, ORIGIN + "/api/session/list", { method: "POST", body: "{}" });
+  assert.equal(calls, 1);
+  assert.equal(res.status, 502);
+  assert.equal(res.headers.get("x-dsh-e2ee-error"), "bad_envelope");
+});
+
+// ============ G. 调用方 abort:不重试 ============
+
+test("G. 调用方已 abort → 不重试,抛 AbortError", async () => {
+  const seS = makeSeSession();
+  let calls = 0;
+  const transport = async () => { calls += 1; throw new TypeError("Load failed"); };
+  const ac = new AbortController();
+  ac.abort();
+  await assert.rejects(
+    () => shim.seFetchWrapper(transport, { sess: seS, origin: ORIGIN }, ORIGIN + "/api/workspaceFiles/readBytes", { method: "POST", body: "{}", signal: ac.signal }),
+    (e) => e && e.name === "AbortError"
+  );
+  assert.equal(calls, 1, "已 abort 的请求不应再发第二次");
+});
+
+// ============ H. 首次成功:不双发 ============
+
+test("H. 白名单路径首次成功 → 只发 1 次(不做无脑双发)", async () => {
+  const seS = makeSeSession();
+  const peer = peerOf(seS);
+  let calls = 0;
+  const transport = async (_input, init) => {
+    calls += 1;
+    const envReq = JSON.parse(init.body);
+    return envelopeResponse(peer, envReq, { status: 200, headers: { "content-type": "application/json" }, body: Buffer.from("[]") });
+  };
+  const res = await shim.seFetchWrapper(transport, { sess: seS, origin: ORIGIN }, ORIGIN + "/api/workspaceFiles/stat", { method: "POST", body: "{}" });
+  assert.equal(calls, 1);
+  assert.equal(res.status, 200);
+  assert.equal(await res.text(), "[]");
+});

package/clients/dsh-remote/test/lib-e2ee-shim.mjs

@@ -42,6 +42,7 @@ export const SHIM_EXPORTS = [
   "seEncodeHttpReqPlain", "seDecodeHttpRespPlain", "seEnvelopeHeaders", "seIsEnvelopeResponse", "seGunzip",
   "seUpstreamPathOf", "seShouldEncryptHttp", "seShouldEncryptWs", "seWsLabelParts", "seBuildWsTarget",
   "seHandoverDecode", "seSessionOfHandover",
+  "SE_RETRY_PATH_PREFIXES", "SE_RETRY_DELAY_MS", "seRetryableReadPath",
   "seFetchWrapper", "SeE2eeWs", "seMakeWsCtor", "seBuildResponse", "seErrorResponse"
 ];