@mrrisega/dsh-remote 0.7.4 → 0.7.5

package/clients/dsh-remote/test/e2ee-session-store.test.mjs

@@ -0,0 +1,254 @@
+#!/usr/bin/env node
+/**
+ * E2EE 会话库（加密落盘 / 重启恢复 / 失效路径）回归（2026-10-23）。
+ *
+ * 生产事故（手机反复撞死票，主因链 #2）：
+ *   e2ee-client.mjs 的 sessions 只是内存 Map（24h 滑动 TTL）。bridge 重启/崩一次，
+ *   手机端保存的 sessId 就全成死票：HTTP 502 unknown_session、数据 WS 1008
+ *   e2ee_session_locked，用户必须回设备列表重新解锁（实测某设备 3964 次）。
+ *
+ * 方案（本文件锁住）：
+ *   ① 会话材料用 MK 派生的 storeKey 做 AES-256-GCM 加密后落 relay 数据目录
+ *      `.e2ee-sessions.enc`（0600、原子写）；文件里**没有** MK/SHK 明文/密码；
+ *   ② bridge 重启后恢复会话（含 verified 与 ctrl 防重放计数），手机旧票继续可用；
+ *   ③ 解不开（改密/MK 变）/文件损坏/参数变化 → 丢弃文件并清空内存，返回 discarded 原因
+ *      （上层据此给手机 retryable=rehandshake 信号，而不是让手机反复撞）；
+ *   ④ 24h 滑动 TTL 仍生效：过期会话不恢复。
+ */
+import assert from "node:assert/strict";
+import { existsSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import {
+  E2eeService,
+  E2eeSession,
+  SESSION_STORE_FILE,
+  SESSION_STORE_VERSION,
+  SESSION_TTL_MS,
+  clearSessionStore,
+  decryptSessionStore,
+  deriveSessionStoreKey,
+  deriveShk,
+  loadSessionStore,
+  newSessId,
+  randomB64,
+  saveSessionStore,
+  sessionStorePath
+} from "../e2ee-client.mjs";
+
+const DIRS = [];
+function tmpDir() {
+  const d = mkdtempSync(path.join(os.tmpdir(), "dsh-e2ee-store-"));
+  DIRS.push(d);
+  return d;
+}
+test.after(() => {
+  for (const d of DIRS) { try { rmSync(d, { recursive: true, force: true }); } catch { /* 忽略 */ } }
+});
+
+const MK = Buffer.alloc(32, 9);
+const SALT = "salt-store-test";
+const PROFILE = "pbkdf2-sha256-600k";
+const mkSvc = () => new E2eeService({ enabled: true, mk: MK, profile: PROFILE, salt: SALT, epoch: 1 });
+
+/** 建一个"已解锁且探测通过"的会话（手机侧也留一份，便于断言加解密仍可用）。 */
+function unlock(svc) {
+  const sessId = newSessId();
+  const a = randomB64(32);
+  const { session, ack } = svc.handleHello({ v: 2, type: "e2ee-hello", role: "phone", s: sessId, a: a, salt: SALT, profile: PROFILE });
+  const { shk, saltH } = deriveShk(MK, a, ack.b);
+  const client = new E2eeSession({ sessId, shk, saltH, profile: PROFILE, epoch: 1 });
+  const probe = client.seal({ kind: "ctrl", dir: "p2b", counter: 0, data: JSON.stringify({ p: "dsh-e2ee-probe-v1", t: 1, c: 0 }) });
+  svc.handleProbe(sessId, probe);
+  assert.equal(session.verified, true);
+  return { sessId, client, session };
+}
+
+test("① 加密落盘：文件里没有 MK/SHK/salt 明文，权限 0600，格式可自描述", () => {
+  const dir = tmpDir();
+  const svc = mkSvc();
+  const { sessId } = unlock(svc);
+  svc.attachStore(dir, { flushMs: 0 }); // unlock 时已即时落盘；attach 再恢复一次（空目录）
+  const r = svc.flushStore();
+  assert.equal(r.ok, true, "落盘应成功");
+  const file = sessionStorePath(dir);
+  assert.equal(path.basename(file), SESSION_STORE_FILE);
+  assert.ok(existsSync(file), "会话库文件应存在");
+  const raw = readFileSync(file, "utf8");
+  const shkB64 = svc.sessions.get(sessId).shk.toString("base64url");
+  assert.ok(!raw.includes(shkB64), "★ 文件里不得出现 SHK 明文");
+  assert.ok(!raw.includes(MK.toString("base64url")), "★ 文件里不得出现 MK 明文");
+  assert.ok(!raw.includes(SALT), "文件里不该有 salt 明文");
+  const blob = JSON.parse(raw);
+  assert.equal(blob.v, SESSION_STORE_VERSION);
+  assert.equal(blob.alg, "aes-256-gcm");
+  assert.ok(blob.iv && blob.tag && blob.ct, "iv/tag/ct 三件套齐全");
+  if (process.platform !== "win32") {
+    assert.equal(statSync(file).mode & 0o777, 0o600, "文件权限必须是 0600");
+  }
+  // 解密得回 payload（密钥只由 MK 派生）
+  const payload = decryptSessionStore(MK, blob);
+  assert.equal(payload.salt, SALT);
+  assert.equal(payload.sessions.length, 1);
+  assert.equal(payload.sessions[0].s, sessId);
+  // 用错误 MK 解密必须失败（信任边界：拿到文件也解不开）
+  assert.throws(() => decryptSessionStore(Buffer.alloc(32, 1), blob), /store_auth_failed|无法解密/);
+  svc.disposeStore();
+});
+
+test("② 重启恢复：新 E2eeService 只凭 MK + 目录恢复 verified 会话 + ctrl 计数，旧票可直接用", () => {
+  const dir = tmpDir();
+  const svc1 = mkSvc();
+  const { sessId, client } = unlock(svc1);
+  svc1.attachStore(dir, { flushMs: 0 });
+  svc1.ctrlCounters.get(sessId).p2b.last = 3; // 模拟解锁后又跑过探测
+  svc1.flushStore();
+  svc1.disposeStore();
+
+  // "重启"：全新服务实例，只凭 MK + 同一目录恢复
+  const svc2 = mkSvc();
+  const restored = svc2.attachStore(dir, { flushMs: 0 });
+  assert.equal(restored.restored, 1);
+  assert.equal(restored.discarded, "", "没有作废");
+  const session = svc2.sessionOf(sessId);
+  assert.ok(session, "★ 旧 sessId 必须仍可用（这正是持久化的目的）");
+  assert.equal(session.verified, true, "verified 也要恢复（否则数据 WS 仍被判 locked）");
+  assert.equal(svc2.ctrlCounters.get(sessId).p2b.last, 3, "ctrl 防重放计数必须恢复（重启不能重置）");
+  // 恢复的会话密钥仍能正确解密手机端的信封（HTTP 请求）
+  const plain = Buffer.from(JSON.stringify({ m: "GET", p: "/x", h: {}, b: "" }), "utf8");
+  const env = client.seal({ kind: "http", dir: "p2b", counter: 1, data: plain });
+  assert.doesNotThrow(() => svc2.guardHttpRequest(sessId, env), "恢复后的会话必须能过 guardHttpRequest");
+  const opened = session.open({ kind: "http", dir: "p2b", env, counter: env.c });
+  assert.equal(JSON.parse(opened.data.toString("utf8")).p, "/x");
+  svc2.disposeStore();
+});
+
+test("③ 失效路径：MK 变了（改密）→ 丢弃文件 + 清空内存 + 返回 key_mismatch", () => {
+  const dir = tmpDir();
+  const svc1 = mkSvc();
+  unlock(svc1);
+  svc1.attachStore(dir, { flushMs: 0 });
+  svc1.flushStore();
+  svc1.disposeStore();
+
+  const svc2 = new E2eeService({ enabled: true, mk: Buffer.alloc(32, 1), profile: PROFILE, salt: SALT, epoch: 1 });
+  const r = svc2.attachStore(dir, { flushMs: 0 });
+  assert.equal(r.restored, 0);
+  assert.equal(r.discarded, "key_mismatch", "必须报告失效原因（上层据此给手机 rehandshake 信号）");
+  assert.equal(svc2.sessions.size, 0, "不得把解不开的旧会话当活会话");
+  assert.equal(existsSync(sessionStorePath(dir)), false, "坏文件必须删掉，别让下次继续撞");
+  svc2.disposeStore();
+});
+
+test("④ 失效路径：salt 变化 → params_changed 丢弃；磁盘损坏 → corrupt/key_mismatch 丢弃", () => {
+  const dir = tmpDir();
+  const svc1 = mkSvc();
+  unlock(svc1);
+  svc1.attachStore(dir, { flushMs: 0 });
+  svc1.flushStore();
+  svc1.disposeStore();
+
+  // salt 变了（服务端参数更换）→ 即便 MK 碰巧能解开也不能复用（MK 域不同）
+  const svc2 = new E2eeService({ enabled: true, mk: MK, profile: PROFILE, salt: "salt-CHANGED", epoch: 1 });
+  const r2 = svc2.attachStore(dir, { flushMs: 0 });
+  assert.equal(r2.discarded, "params_changed");
+  assert.equal(svc2.sessions.size, 0);
+  assert.equal(existsSync(sessionStorePath(dir)), false);
+  svc2.disposeStore();
+
+  // 损坏文件（半截写 / 手工改）：认证失败 → 丢弃
+  const dir2 = tmpDir();
+  saveSessionStore(dir2, MK, { v: SESSION_STORE_VERSION, salt: SALT, profile: PROFILE, epoch: 1, sessions: [] });
+  const file = sessionStorePath(dir2);
+  const blob = JSON.parse(readFileSync(file, "utf8"));
+  blob.ct = `${blob.ct.slice(0, 8)}${blob.ct.slice(8).replace(/[A-Za-z]/g, "Z")}`;
+  writeFileSync(file, JSON.stringify(blob));
+  const svc3 = mkSvc();
+  const r3 = svc3.attachStore(dir2, { flushMs: 0 });
+  assert.equal(r3.restored, 0);
+  assert.ok(["corrupt", "key_mismatch"].includes(r3.discarded), `损坏文件必须被丢弃（实际 ${r3.discarded}）`);
+  assert.equal(svc3.sessions.size, 0);
+  svc3.disposeStore();
+
+  // 完全不是 JSON
+  const dir3 = tmpDir();
+  writeFileSync(sessionStorePath(dir3), "not-json");
+  const svc4 = mkSvc();
+  assert.equal(svc4.attachStore(dir3, { flushMs: 0 }).discarded, "corrupt");
+  svc4.disposeStore();
+});
+
+test("⑤ 24h 滑动 TTL 仍生效：过期会话不恢复，未过期的保留", () => {
+  const dir = tmpDir();
+  const now = Date.now();
+  const row = (sessId, usedAt) => ({
+    s: sessId,
+    shk: Buffer.alloc(32, 5).toString("base64url"),
+    saltH: Buffer.alloc(32, 6).toString("base64url"),
+    profile: PROFILE,
+    epoch: 1,
+    verified: true,
+    createdAt: usedAt - 1000,
+    usedAt,
+    p2b: -1,
+    b2p: -1
+  });
+  const fresh = newSessId();
+  const stale = newSessId();
+  const nearBoundary = newSessId();
+  saveSessionStore(dir, MK, {
+    v: SESSION_STORE_VERSION,
+    salt: SALT,
+    profile: PROFILE,
+    epoch: 1,
+    at: now,
+    sessions: [row(fresh, now - 60_000), row(stale, now - SESSION_TTL_MS - 5_000), row(nearBoundary, now - SESSION_TTL_MS + 60_000)]
+  });
+  const svc = mkSvc();
+  const r = svc.attachStore(dir, { flushMs: 0 });
+  assert.equal(r.restored, 2, "过期的那条必须被丢掉");
+  assert.ok(svc.sessionOf(fresh));
+  assert.ok(svc.sessionOf(nearBoundary), "TTL 内（哪怕接近边界）都要保留");
+  assert.equal(svc.sessionOf(stale), null);
+  svc.disposeStore();
+});
+
+test("⑥ 未启用 / 未给目录 / 目录不可写 → 静默降级（绝不因为会话库把隧道拖挂）", () => {
+  const dir = tmpDir();
+  const disabled = new E2eeService({ enabled: false, reason: "no_password" });
+  assert.equal(disabled.attachStore(dir).skipped, "e2ee_disabled");
+  assert.equal(existsSync(sessionStorePath(dir)), false, "未启用时不得写文件");
+
+  const svc = mkSvc();
+  assert.equal(svc.attachStore("").skipped, "no_dir");
+  assert.deepEqual(svc.flushStore(), { ok: false, skipped: true });
+
+  // 目录不可写（拿一个普通文件当目录）→ flush 返回 ok:false，但绝不抛
+  const fileAsDir = path.join(tmpDir(), "not-a-dir");
+  writeFileSync(fileAsDir, "x");
+  svc.attachStore(fileAsDir, { flushMs: 0 });
+  const r = svc.flushStore();
+  assert.equal(r.ok, false, "写失败只返回失败，不抛");
+  svc.disposeStore();
+});
+
+test("⑦ 原语契约：save→load→clear 往返；版本/AAD 域隔离；storeKey 确定性", () => {
+  const dir = tmpDir();
+  const payload = { v: SESSION_STORE_VERSION, salt: SALT, profile: PROFILE, epoch: 1, sessions: [{ s: newSessId(), usedAt: Date.now() }] };
+  assert.equal(saveSessionStore(dir, MK, payload).ok, true);
+  const loaded = loadSessionStore(dir, MK);
+  assert.equal(loaded.ok, true);
+  assert.equal(loaded.payload.sessions.length, 1);
+  // 换版本号 → 解不开（旧格式不能冒名顶替）
+  const blob = JSON.parse(readFileSync(sessionStorePath(dir), "utf8"));
+  assert.throws(() => decryptSessionStore(MK, { ...blob, v: 2 }), /会话库版本|bad_store/);
+  // clear 后读回 absent
+  assert.equal(clearSessionStore(dir), true);
+  assert.equal(loadSessionStore(dir, MK).reason, "absent");
+  // storeKey：同一个 MK 确定性一致；MK 非法直接拒绝（不静默）
+  assert.deepEqual(deriveSessionStoreKey(MK), deriveSessionStoreKey(MK));
+  assert.notDeepEqual(deriveSessionStoreKey(MK), deriveSessionStoreKey(Buffer.alloc(32, 1)));
+  assert.throws(() => deriveSessionStoreKey(Buffer.alloc(16)), /MK 非法/);
+});

package/clients/dsh-remote/test/mobile-adapter-single-page.test.mjs

@@ -0,0 +1,328 @@
+#!/usr/bin/env node
+/**
+ * 手机端「同一 deviceId 只允许一个镜像页」回归（2026-10-23）。
+ *
+ * 生产现场：手机端会出现同一设备的两个镜像页并发（重复打开 / 从历史里点回来），
+ *   两边互相取消资源加载 → 都一直转圈。
+ *
+ * 注入体里的守卫（mobile-adapter 的 DSH-MA-SINGLEPAGE 段）契约：
+ *   ① 第一个页面：同步写租约（localStorage）+ BroadcastChannel claim，正常加载；
+ *   ② 第二个页面：同步读到"别人的新鲜租约"→ 立刻 blocked（window.stop + 拦 fetch/XHR/WS
+ *      + 全屏提示），**不写租约、不加载**；
+ *   ③ 「在本窗口继续」：广播 takeover → 旧页让路并释放租约 → 本页 400ms 后重载接管；
+ *   ④ 旧页关掉/失联（租约过期）→ blocked 页自动重载接管，不会永久卡在提示层；
+ *   ⑤ 非镜像页（设备列表/登录页）、老浏览器（无 localStorage/BroadcastChannel）→ 零行为。
+ *
+ * 本文件跑的是注入脚本里**真实的那一段**（vm + 假 DOM），断言的是行为不是文本。
+ */
+import assert from "node:assert/strict";
+import test from "node:test";
+import vm from "node:vm";
+import { injectMobileAdapter } from "../mobile-adapter.mjs";
+
+/** 注入脚本里取出单页守卫那一段（含结尾的调用）。 */
+function guardSource() {
+  const { html } = injectMobileAdapter("<!doctype html><html><head></head><body></body></html>");
+  const m = /<script id="[^"]*-js"[^>]*>([\s\S]*?)<\/script>/.exec(html);
+  assert.ok(m, "应能取出注入脚本");
+  const js = m[1];
+  const start = "/* ===DSH-MA-SINGLEPAGE-START===";
+  const end = "/* ===DSH-MA-SINGLEPAGE-END=== */";
+  const a = js.indexOf(start);
+  const b = js.indexOf(end);
+  assert.ok(a > 0 && b > a, "找不到单页守卫的段落标记（脚本结构变了，请同步更新本用例）");
+  return js.slice(a, b + end.length);
+}
+
+const SRC = guardSource();
+
+// ── 假环境（同一"浏览器"的多个页面共享 storage 与 BroadcastChannel 总线）──────────
+
+const NOW0 = 1_700_000_000_000;
+
+function makeGroup() {
+  return {
+    store: new Map(),
+    channels: new Set(),
+    messages: [],
+    clock: { now: NOW0 }
+  };
+}
+
+function makeStorage(group) {
+  return {
+    getItem(k) { return group.store.has(k) ? group.store.get(k) : null; },
+    setItem(k, v) { group.store.set(k, String(v)); },
+    removeItem(k) { group.store.delete(k); }
+  };
+}
+
+class FakeBC {
+  constructor(group, name) {
+    this.group = group;
+    this.name = name;
+    this.onmessage = null;
+    group.channels.add(this);
+  }
+  postMessage(msg) {
+    this.group.messages.push(msg);
+    // 浏览器里是异步投递；用例里同步投递（同源多页面），断言更直接
+    for (const peer of this.group.channels) {
+      if (peer === this) continue;
+      if (typeof peer.onmessage === "function") peer.onmessage({ data: msg });
+    }
+  }
+  close() { this.group.channels.delete(this); }
+}
+
+/** 极简假 DOM：只支持守卫用到的那点能力（createElement/body.appendChild/getElementById）。 */
+function makeDoc() {
+  const appended = [];
+  const buttons = new Map();
+  const makeEl = (tag) => {
+    const el = {
+      tagName: String(tag).toUpperCase(),
+      id: "",
+      attrs: {},
+      style: { cssText: "" },
+      innerHTML: "",
+      children: [],
+      _listeners: new Map(),
+      setAttribute(n, v) { this.attrs[n] = String(v); },
+      getAttribute(n) { return n in this.attrs ? this.attrs[n] : null; },
+      addEventListener(type, fn) { (this._listeners.get(type) || this._listeners.set(type, []).get(type)).push(fn); },
+      appendChild(c) { this.children.push(c); return c; }
+    };
+    return el;
+  };
+  const body = makeEl("body");
+  const doc = {
+    body,
+    _appended: appended,
+    createElement: makeEl,
+    addEventListener() {},
+    getElementById(id) {
+      const found = appended.find((el) => el.id === id || el.attrs.id === id);
+      if (found) return found;
+      // 提示层里的「在本窗口继续」按钮：innerHTML 里定义了 id，按需造一个可点击元素
+      const overlay = appended.find((el) => el.id === "dsh-ma-singlepage");
+      if (overlay && overlay.innerHTML.includes(`id="${id}"`)) {
+        if (!buttons.has(id)) {
+          const btn = makeEl("button");
+          btn.id = id;
+          buttons.set(id, btn);
+        }
+        return buttons.get(id);
+      }
+      return null;
+    }
+  };
+  body.appendChild = (el) => { appended.push(el); return el; };
+  return doc;
+}
+
+function makeEnv(group, { pathname = "/remote/dev-A/", withBC = true, withStorage = true } = {}) {
+  const timers = { intervals: new Map(), timeouts: new Map(), seq: 0 };
+  const doc = makeDoc();
+  const storage = withStorage ? makeStorage(group) : null;
+  const state = { stops: 0, reloads: 0, messages: [] };
+  const loc = {
+    pathname,
+    href: `https://relay.example${pathname}`,
+    reload() { state.reloads += 1; }
+  };
+  const FakeDate = class extends Date {
+    static now() { return group.clock.now; }
+  };
+  const win = {
+    localStorage: storage,
+    // 真实 window.navigator 有 locks 就用（老 Safari 没有）；这里默认不给，测租约路径
+    navigator: {},
+    location: loc,
+    addEventListener(type, fn) { state.messages.push(type); (win._ls || (win._ls = [])).push({ type, fn }); },
+    _ls: [],
+    stop() { state.stops += 1; },
+    fetch: () => Promise.resolve({ ok: true }),
+    XMLHttpRequest: class { send() {} abort() {} },
+    WebSocket: class { constructor() { this.readyState = 1; } },
+    console
+  };
+  if (withBC) win.BroadcastChannel = class extends FakeBC { constructor(name) { super(group, name); } };
+  const sandbox = {
+    window: win,
+    document: doc,
+    location: loc,
+    localStorage: storage,
+    console,
+    Promise,
+    Date: FakeDate,
+    Math,
+    JSON,
+    Object,
+    Array,
+    String,
+    Number,
+    Boolean,
+    RegExp,
+    Error,
+    decodeURIComponent,
+    isNaN,
+    parseInt,
+    parseFloat,
+    setInterval: (fn, ms) => { const id = ++timers.seq; timers.intervals.set(id, { fn, ms, ticks: 0 }); return id; },
+    clearInterval: (id) => { timers.intervals.delete(id); },
+    setTimeout: (fn, ms) => { const id = ++timers.seq; timers.timeouts.set(id, { fn, ms }); return id; },
+    clearTimeout: (id) => { timers.timeouts.delete(id); }
+  };
+  vm.runInNewContext(SRC, sandbox, { filename: "mobile-adapter#singlepage" });
+  const api = {
+    win,
+    doc,
+    loc,
+    sandbox,
+    timers,
+    state,
+    get appState() { return win.__dshSinglePage ? win.__dshSinglePage.state : ""; },
+    /** 跑一轮 2s 轮询（blocked 页的租约复查）。 */
+    tickPoll() {
+      for (const t of timers.intervals.values()) { if (t.ms === 2000) t.fn(); }
+    },
+    runTimeouts() {
+      for (const [id, t] of [...timers.timeouts]) { timers.timeouts.delete(id); t.fn(); }
+    },
+    clickTakeover() {
+      const btn = doc.getElementById("dsh-ma-singlepage-takeover");
+      assert.ok(btn, "提示层里必须有「在本窗口继续」按钮");
+      const fns = btn._listeners.get("click") || [];
+      assert.ok(fns.length > 0, "按钮必须绑定了点击处理");
+      for (const fn of fns) fn({ type: "click" });
+    },
+    dispatchWindow(type, extra = {}) {
+      for (const l of win._ls || []) if (l.type === type) l.fn({ type, ...extra });
+    },
+    lease() {
+      const raw = storage && storage.getItem(`dsh-remote-mirror-page:${pathname.split("/")[2]}`);
+      return raw ? JSON.parse(raw) : null;
+    },
+    storeGet(key) { return storage ? storage.getItem(key) : null; },
+    storeSet(key, val) { if (storage) storage.setItem(key, val); }
+  };
+  return api;
+}
+
+// ── 用例 ──────────────────────────────────────────────────────────────────────
+
+test("① 第一个页面：同步写租约 + 广播 claim，正常加载", () => {
+  const g = makeGroup();
+  const a = makeEnv(g);
+  assert.equal(a.appState, "active", "第一个页面必须是活跃页");
+  const lease = a.lease();
+  assert.ok(lease && typeof lease.id === "string", "必须写入租约");
+  assert.equal(lease.at, NOW0);
+  const claim = g.messages.find((m) => m.k === "claim");
+  assert.ok(claim, "必须广播 claim（让后来的页面知道有人）");
+  assert.equal(a.state.stops, 0, "活跃页不得停掉自己的加载");
+});
+
+test("② 第二个页面：同步识破别人的租约 → 立刻 blocked（stop + 拦网络 + 提示），且不写租约", async () => {
+  const g = makeGroup();
+  const first = makeEnv(g);
+  const second = makeEnv(g);
+  assert.equal(second.appState, "blocked", "第二页必须被按住");
+  assert.equal(second.state.stops, 1, "必须 window.stop()（停止后续资源加载）");
+  const overlay = second.doc.getElementById("dsh-ma-singlepage");
+  assert.ok(overlay, "必须给出可见提示（不是静默卡住）");
+  assert.equal(overlay.getAttribute("data-dsh-single-page"), "blocked");
+  assert.match(overlay.innerHTML, /另一个窗口/, "提示文案要点明「已在另一个窗口打开」");
+  assert.match(overlay.innerHTML, /在本窗口继续/, "必须给「在本窗口继续」出口");
+  // 拦网络：fetch 拒绝、WebSocket 不可用
+  await assert.rejects(() => second.win.fetch("/api/x"), /本页已停用/);
+  assert.throws(() => new second.win.WebSocket("ws://x"), /本页已停用/);
+  // 不许抢租约：租约仍属于第一页
+  assert.equal(second.lease().id, first.lease().id, "第二页绝不能覆盖第一页的租约");
+});
+
+test("③ 「在本窗口继续」：广播 takeover → 旧页让路并释放租约 → 本页重载接管", () => {
+  const g = makeGroup();
+  const first = makeEnv(g);
+  const second = makeEnv(g);
+  const firstLeaseId = first.lease().id;
+
+  second.clickTakeover();
+  // 旧页收到 takeover：立刻让路（进入 blocked、释放租约）
+  assert.equal(first.appState, "blocked", "旧页必须让路，不能两边都继续加载");
+  assert.equal(first.lease(), null, "旧页必须释放租约");
+  assert.ok(g.messages.some((m) => m.k === "takeover"), "必须广播 takeover");
+  // 本页 400ms 后重载（重载后按 takeover 标记直接接管）
+  assert.equal(second.state.reloads, 0, "还没到重载时间");
+  second.runTimeouts();
+  assert.equal(second.state.reloads, 1, "接管方必须重载一次，拿干净页面");
+  // 重载后的路径：租约可能还在 + 有 takeover 标记 → 允许接管（否则自己把自己锁死）
+  const reloaded = makeEnv(g);
+  assert.equal(reloaded.appState, "active", "takeover 标记有效期内的重载必须能接管");
+  assert.equal(reloaded.lease().id !== firstLeaseId, true, "接管后租约归属接管方");
+  // 关键：takeover 标记必须"用掉即消费"，否则有效期内第三个页面也会以为自己能接管
+  const third = makeEnv(g);
+  assert.equal(third.appState, "blocked", "接管完成后，再开的页面仍必须被按住（不允许并发第三个）");
+});
+
+test("④ 旧页关掉/失联（租约过期）→ blocked 页自动重载接管，不会永久卡住", () => {
+  const g = makeGroup();
+  makeEnv(g); // 第一页写完租约后"关掉了"（不再心跳）
+  const second = makeEnv(g);
+  assert.equal(second.appState, "blocked");
+  // 时间前进到租约过期之后
+  g.clock.now = NOW0 + 7000;
+  second.tickPoll();
+  assert.equal(second.state.reloads, 1, "租约过期后必须自动重载接管");
+  assert.ok(second.storeGet("dsh-remote-mirror-page:dev-A:takeover"), "重载前要留 takeover 标记（避免重载后又被自己挡住）");
+});
+
+test("⑤ 活跃页 pagehide 时释放租约；bfcache 回来（pageshow persisted）重新判定", () => {
+  const g = makeGroup();
+  const a = makeEnv(g);
+  assert.ok(a.lease());
+  a.dispatchWindow("pagehide");
+  assert.equal(a.lease(), null, "pagehide 必须释放租约");
+  assert.equal(a.appState, "inactive", "pagehide 后不再是活跃页");
+  // bfcache 回来：租约已释放 → 重新判定后重新成为活跃页
+  a.dispatchWindow("pageshow", { persisted: true });
+  assert.equal(a.appState, "active", "bfcache 恢复后必须重新判定并接管");
+  assert.ok(a.lease(), "恢复后要重新写租约");
+  // 另一个页面此刻打开 → 它看到租约并被按住（不会两个页面并发加载）
+  const b = makeEnv(g);
+  assert.equal(b.appState, "blocked");
+});
+
+test("⑥ 非镜像页 / 老浏览器 → 零行为（绝不把唯一页面锁死）", () => {
+  // /app/ 设备列表页不参与单页约束
+  const g1 = makeGroup();
+  const app = makeEnv(g1, { pathname: "/app/" });
+  assert.equal(app.appState, "", "非镜像页不得介入");
+  assert.equal(g1.store.size, 0, "非镜像页不得写任何 localStorage");
+  assert.equal(app.doc._appended.length, 0, "非镜像页不得往页面塞任何节点");
+
+  // 没有 BroadcastChannel（部分老浏览器/隐私模式）→ 不启用
+  const g2 = makeGroup();
+  const noBc = makeEnv(g2, { withBC: false });
+  assert.equal(noBc.appState, "", "没有 BroadcastChannel 时不得启用（不锁）");
+  assert.equal(g2.store.size, 0);
+  assert.equal(noBc.doc._appended.length, 0);
+
+  // 没有 localStorage → 不启用
+  const g3 = makeGroup();
+  const noLs = makeEnv(g3, { withStorage: false });
+  assert.equal(noLs.appState, "", "没有 localStorage 时不得启用");
+  assert.equal(noLs.doc._appended.length, 0);
+});
+
+test("⑦ 同一时刻两个页面都从空租约启动（并发竞态）→ 后到的看到租约后被按住", () => {
+  const g = makeGroup();
+  // 用同一份 group 串行模拟"几乎同时"：第一个先写入租约（JS 单线程，真实世界也是先到先得）
+  const a = makeEnv(g);
+  const b = makeEnv(g);
+  assert.equal(a.appState, "active");
+  assert.equal(b.appState, "blocked");
+  // 两个页面不会互相写坏租约
+  assert.equal(a.lease().id, b.lease().id, "租约归属第 1 页，第 2 页不覆盖");
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrrisega/dsh-remote",
-  "version": "0.7.4",
+  "version": "0.7.5",
   "description": "手机远程控制 DeepSeek Harness · Remote control DeepSeek Harness (dsh web) from any phone browser — 100% 全功能 App 级体验：发消息、看工具执行、审批权限、改设置、管凭据，含特权操作，免内网穿透。一条命令安装 npx @mrrisega/dsh-remote。Mobile remote control for DSH, self-host or SaaS, no server needed on LAN.",
   "keywords": [
     "deepseek-harness",