@mrrisega/dsh-remote 0.7.6-beta.1 → 0.7.6-beta.10

package/packages/dsh-remote-web/runtime/dsh-setup.mjs

@@ -1127,7 +1127,15 @@ const UPSTREAM_FILE = ".dsh-upstream";
  * 本次安装要**钉住**的上游（null = 不钉，运行时按 env → .dsh-upstream → 探测 取值）。
  * 见 desktopAppPort() 的注释：插件装进多个 profile 后，各宿主会互相覆盖 `.dsh-upstream`。
  */
-let PINNED_UPSTREAM = String(process.env.DSH_BRIDGE_UPSTREAM || "").trim().replace(/\/+$/, "") || null;
+// 🔴 2026-10-25 事故：以前把安装进程里的 DSH_BRIDGE_UPSTREAM（一个**当时的动态端口**）写进
+// launchd plist，之后 dsh 每次重启换端口，plist 里的旧端口就成了永久生效的"显式指定"，
+// 守护/桥永远连不上 → 设备掉线。现在默认**不钉**（运行时按 插件写的 .dsh-upstream → 探测 取值）；
+// 仅当部署方显式要求（DSH_BRIDGE_PIN_UPSTREAM=1）时才沿用旧行为。
+let PINNED_UPSTREAM = (() => {
+  const pinFlag = String(process.env.DSH_BRIDGE_PIN_UPSTREAM || "").trim().toLowerCase();
+  if (pinFlag !== "1" && pinFlag !== "true" && pinFlag !== "on") return null;
+  return String(process.env.DSH_BRIDGE_UPSTREAM || "").trim().replace(/\/+$/, "") || null;
+})();
 
 /**
  * 探测桌面端（Electron 应用）当前监听的**回环端口**。
@@ -1223,6 +1231,18 @@ async function upstreamReachable(url = upstreamUrl(), timeoutMs = 1200) {
  */
 async function isDshWebUp(timeoutMs = 1200) {
   if (await upstreamReachable(upstreamUrl(), timeoutMs)) return true;
+  // 🔴 2026-10-25（设备掉线实测）：Electron 每次启动可能换端口。端口文件由 dsh web 内的插件
+  //   在每次启动时重写，比进程内的 discoveredUpstream 缓存新 —— 先直接试文件，别被旧缓存挡住。
+  try {
+    const fromFile = String(fs.readFileSync(path.join(CONFIG_DIR, UPSTREAM_FILE), "utf8")).trim();
+    if (/^https?:\/\/[^\s]+$/i.test(fromFile)) {
+      const normalized = fromFile.replace(/\/+$/, "");
+      if (normalized !== upstreamUrl() && (await upstreamReachable(normalized, timeoutMs))) {
+        discoveredUpstream = normalized;
+        return true;
+      }
+    }
+  } catch { /* 没有端口文件：继续走动态发现 */ }
   const before = upstreamUrl();
   const after = await refreshUpstreamDiscovery(true);
   if (after === before) return false;
@@ -1659,7 +1679,22 @@ function releaseSpawnLock() {
 }
 
 // ---------- run：前台跑 bridge（带配置 + 自启动 watcher） ----------
+/** 以插件写入的 .dsh-upstream 为准校正进程内的旧上游环境变量（dsh 换端口后不再连旧端口）。 */
+function reconcileUpstreamEnvFromFile() {
+  try {
+    const fileUp = String(fs.readFileSync(path.join(CONFIG_DIR, UPSTREAM_FILE), "utf8")).trim().replace(/\/+$/, "");
+    const envUp = String(process.env.DSH_BRIDGE_UPSTREAM || "").trim().replace(/\/+$/, "");
+    if (envUp && /^https?:\/\/[^\s]+$/i.test(fileUp) && fileUp !== envUp) {
+      console.log(`[dsh-remote] 忽略旧的上游地址 ${envUp} → 使用插件写入的最新地址 ${fileUp}（防端口漂移掉线）`);
+      process.env.DSH_BRIDGE_UPSTREAM = fileUp;
+      discoveredUpstream = fileUp;
+    }
+  } catch { /* 无文件：保持原行为 */ }
+}
+
 async function runBridge() {
+  // 启动/每次拉起前都按插件写入的端口校正继承来的旧 env（旧 plist 可能钉着安装时的端口）
+  reconcileUpstreamEnvFromFile();
   // 去重（所有平台）：自启动服务、登录任务、插件半的脱离进程兜底都可能拉起 watcher，
   // 两个 bridge 会抢同一个设备登记 → 以 pid 文件为准。
   //
@@ -1856,9 +1891,13 @@ async function runBridge() {
     }
     warnedDuplicateBridge = false;
 
+    reconcileUpstreamEnvFromFile(); // dsh 可能刚重启并换了端口：拉起前再以最新端口文件为准
     const alive = await checkUpstream();
     if (alive && childStopped(bridgeProc)) {
       starting = true;
+      // dsh 重启可能换端口（Electron 每次启动端口可能变）：拉起前**强制重新发现**，
+      // 否则 discoveredUpstream 缓存旧端口 → bridge 连不上上游 → 设备掉线（2026-10-25 实测）。
+      await refreshUpstreamDiscovery(true);
       console.log("[dsh-remote] dsh web 在线，启动 bridge...");
       // 清除代理环境变量（bridge 需直连 relay，不受本机代理影响）
       const childEnv = {
@@ -1900,6 +1939,17 @@ async function runBridge() {
         // 另一个 bridge 把本连接顶掉）后会以"重复实例"退出码优雅退出（见 dsh-bridge.mjs）。
         // 这种退出**绝不能**照常 10s 重拉：本机已经有另一个实例在跑，重拉只会继续乒乓互踢。
         if (code === DUPLICATE_INSTANCE_EXIT_CODE) {
+          // 🔴 2026-10-25：升级/重启后常见「上一代 bridge 变成孤儿继续占着单实例锁」，
+          //   新 bridge 因此退出 code=4。旧逻辑一律暂停 5 分钟 → 设备在线要等 5 分钟（用户实测掉线）。
+          //   现在先**清扫同运行时的孤儿 bridge**；扫到了说明冲突已解除，3 秒后立即重试；
+          //   扫不到（多半真有另一个 watcher 的活实例）才按 5 分钟退避，避免乒乓互踢。
+          let swept = [];
+          try { swept = sweepStrayBridges(); } catch { /* 清扫失败不致命 */ }
+          if (swept.length > 0) {
+            duplicateBridgeBackoffUntil = Date.now() + 3000;
+            console.log(`[dsh-remote] bridge 因同实例冲突退出（code=${code}），已清扫 ${swept.length} 个孤儿 bridge（pid ${swept.join(", ")}）→ 3 秒后重试。`);
+            return;
+          }
           duplicateBridgeBackoffUntil = Date.now() + DUPLICATE_BRIDGE_BACKOFF_MS;
           console.log(`[dsh-remote] bridge 检测到同 deviceId 的另一个实例并退出（code=${code}）——本守护暂停 ${Math.round(DUPLICATE_BRIDGE_BACKOFF_MS / 60000)} 分钟后再试，避免两个实例反复互踢。`);
           return;
@@ -1913,6 +1963,8 @@ async function runBridge() {
       setTimeout(() => { starting = false; }, 5000);
     } else if (!alive && bridgeProc && bridgeProc.exitCode === null) {
       console.log("[dsh-remote] dsh web 离线，停止 bridge...");
+      // dsh 重启后端口可能变化：清掉进程内缓存，下一轮优先用插件新写的端口文件探测
+      discoveredUpstream = "";
       await stopChildGracefully(bridgeProc); // 同上：Windows 上 kill() 跑不到退出钩子
     }
   };
@@ -2024,9 +2076,11 @@ async function setup(argv) {
       if (!PINNED_UPSTREAM && pluginTargets.some((t) => t.name === "desktop")) {
         const p = desktopAppPort();
         if (p) {
-          PINNED_UPSTREAM = `http://127.0.0.1:${p}`;
-          try { fs.writeFileSync(path.join(CONFIG_DIR, UPSTREAM_FILE), PINNED_UPSTREAM + "\n"); } catch { /* 忽略 */ }
-          console.log(`ℹ 桌面端在 127.0.0.1:${p} 监听 → 桥的上游已钉到它（避免与 Web 版互抢）`);
+          // 🔴 2026-10-25：这里只能写运行时端口文件；**不能**回填 PINNED_UPSTREAM ——
+          // 它会被写进 launchd plist 变成永久显式指定，dsh 换端口后守护/桥永远连旧端口
+          // （用户实测 upstream_unreachable）。
+          try { fs.writeFileSync(path.join(CONFIG_DIR, UPSTREAM_FILE), `http://127.0.0.1:${p}` + "\n"); } catch { /* 忽略 */ }
+          console.log(`ℹ 桌面端在 127.0.0.1:${p} 监听 → 已写入运行时上游端口（不再钉进自启动配置）`);
         }
       }
     } catch { /* 探测失败不阻断安装 */ }
@@ -2583,6 +2637,45 @@ function missingPluginFiles(dir) {
  *
  * 另外清掉上次被强杀留下的 `.staging-*` / `.backup-*`，不留垃圾。
  */
+// ── 桌面端「暫存安装」：应用运行中不能改写它的 profile（会把它弄退出/重启），
+// 但用户点「一键更新」必须能装到桌面端。做法：先整份拷到 ~/.dsh-remote/pending-plugin/ 并写 marker，
+// 由常驻的 bridge 在检测到应用退出后自动原子替换 profile 内的插件目录（见 dsh-bridge.mjs）。
+const PENDING_PLUGIN_MARKER = path.join(CONFIG_DIR, ".plugin-update-pending.json");
+const PENDING_PLUGIN_DIR = path.join(CONFIG_DIR, "pending-plugin");
+
+/** 暂存一份插件更新（供 bridge 在应用退出后安装）。返回 marker 对象。 */
+function stagePluginUpdateForProfile(profileDir, pluginDir) {
+  fs.rmSync(PENDING_PLUGIN_DIR, { recursive: true, force: true });
+  fs.mkdirSync(PENDING_PLUGIN_DIR, { recursive: true });
+  const cpOpts = {
+    recursive: true,
+    filter: (src) => {
+      if (src === pluginDir) return true;
+      const rel = String(path.relative(pluginDir, src));
+      const segs = rel.split(path.sep);
+      if (segs.some((seg) => seg === ".git" || seg === ".DS_Store")) return false;
+      const inBundledRuntime = segs[0] === "runtime";
+      if (!inBundledRuntime && segs.some((seg) => seg === "node_modules")) return false;
+      return true;
+    }
+  };
+  fs.cpSync(pluginDir, PENDING_PLUGIN_DIR, cpOpts);
+  for (const rel of PLUGIN_REQUIRED_FILES) {
+    const f = path.join(PENDING_PLUGIN_DIR, rel);
+    if (!fs.existsSync(f)) throw new Error(`暂存校验失败：缺少 ${rel}`);
+  }
+  const version = JSON.parse(fs.readFileSync(path.join(pluginDir, "package.json"), "utf8")).version;
+  const marker = {
+    version,
+    profileDir,
+    pluginDirName: PLUGIN_LOCAL_DIR,
+    stageDir: PENDING_PLUGIN_DIR,
+    stagedAt: Date.now()
+  };
+  fs.writeFileSync(PENDING_PLUGIN_MARKER, JSON.stringify(marker, null, 2) + "\n");
+  return marker;
+}
+
 function copyPluginIntoProfile(profileDir, pluginDir) {
   // 清理历史名残留目录（≤0.4.9 的 dsh-remote-ui-plugin），避免与新版并存
   for (const id of PLUGIN_LEGACY_IDS) {
@@ -3031,16 +3124,21 @@ async function pluginCmd(argv) {
   let last = null;
   let ok = 0;
   let skippedRunning = 0;
+  let stagedRunning = 0;
   const force = hasFlag(argv, "--force");
   for (const t of targets) {
     // ⚠️ 桌面应用在运行时**绝不改写它的 profile**：应用会因此退出/重启（2026-10-11 实测故障）
     if (t.name === "desktop" && !force && dshDesktopAppRunning()) {
-      console.log(`⚠️ 跳过 desktop：DeepSeek Harness 应用正在运行。`);
-      console.log(`   应用独占该 profile，运行中改写会让应用自己退出/重启。请任选其一：`);
-      console.log(`     · 完全退出应用后重跑本命令；或`);
-      console.log(`     · 在应用内「插件」页安装/更新 dsh-remote-web（官方路径，装完即热加载）。`);
-      console.log(`   （确实要强行写入：加 --force）`);
-      skippedRunning += 1;
+      console.log(`⚠️ DeepSeek Harness 应用正在运行 → 不直接改写它的 profile（会把它弄退出/重启）。`);
+      try {
+        const staged = stagePluginUpdateForProfile(t.dir, path.join(THIS_DIR, "packages", PLUGIN_ID));
+        stagedRunning += 1;
+        console.log(`   ✅ 新版本 ${staged.version} 已暂存：**退出 DeepSeek Harness 后会自动安装**，重新打开应用即生效（无需终端）。`);
+      } catch (e) {
+        console.log(`   ⚠️ 暂存失败：${e && e.message ? e.message : e}`);
+        console.log(`   请完全退出应用后重跑本命令，或在应用内「插件」页安装/更新 dsh-remote-web。`);
+        skippedRunning += 1;
+      }
       continue;
     }
     if (multi) console.log(`\n── profile: ${t.name}（${t.dir}）`);
@@ -3050,6 +3148,7 @@ async function pluginCmd(argv) {
     if (r !== undefined && r !== null) last = r;
   }
   if (ok === 0 && skippedRunning === 0) process.exit(1);
+  if (stagedRunning > 0) console.log(`ℹ 桌面端插件已暂存（${stagedRunning} 个）：退出 DeepSeek Harness 后由后台服务自动安装，重开应用生效。`);
   if (skippedRunning > 0) console.log(`ℹ 本次跳过了 ${skippedRunning} 个 profile（应用在运行）；桥与运行环境不受影响。`);
   return last;
 }

package/packages/dsh-remote-web/test/community-invite-proxy.test.mjs

@@ -0,0 +1,343 @@
+// 🎉 企微交流群引导（使用满 2 小时弹一次）—— **宿主半边**（lib/index.js）代理路由回归。
+//
+// 背景（业主 2026-10-23 需求）：用户实际使用满 2 小时后要「加入企业微信群」引导，
+// 每用户全局只弹一次；手机 Web 端已实现，桌面端插件面板复用**同一套企业端接口**：
+//   GET  /api/community-invite/status → { ok, show, reason, used_seconds, required_seconds, qr_url }
+//   POST /api/community-invite/shown  → { ok:true }（幂等）
+//
+// 桌面端浏览器半没有企业端用户 token 直连，所以本文件锁 node 半两条代理路由的契约：
+//   GET  /dsh-remote/community-invite/status → 上游 GET  {api}/api/community-invite/status
+//   POST /dsh-remote/community-invite/shown  → 上游 POST {api}/api/community-invite/shown
+//
+// 最要紧的四件（都是"写错就出事故"的点）：
+//   ① 身份只认本机 device-login token，**不透传浏览器带来的 Authorization**；
+//   ② 判定/记账全在服务端：show/reason/时长字段原样透传，node 半**不自己算**；
+//   ③ qr_url 归一化成企业端绝对地址（相对路径在 dsh web 源上会解析到 127.0.0.1），
+//      非 http(s)/站内路径一律丢弃（前端降级），绝不把 data:/javascript: 交给 <img src>；
+//   ④ 一切失败软着陆：未登录/自建 → 200 + ok:false（面板静默）；上游 4xx/5xx 透传；
+//      不可达 → 502 JSON，**绝不抛回 webServer**（否则面板会看到 500 堆栈）。
+import assert from "node:assert/strict";
+import http from "node:http";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { apply } from "../lib/index.js";
+
+/** 假 relay：device-login 发 token；community-invite 两个端点按 opts 返回（并记录收到的请求）。 */
+async function startFakeRelay(opts = {}) {
+  const seen = [];
+  const srv = http.createServer((req, res) => {
+    let raw = "";
+    req.on("data", (c) => { raw += c; });
+    req.on("end", () => {
+      const entry = { method: req.method, url: req.url, headers: req.headers, body: raw };
+      seen.push(entry);
+      const send = (code, obj) => {
+        res.writeHead(code, { "content-type": "application/json" });
+        res.end(JSON.stringify(obj));
+      };
+      const url = new URL(req.url, "http://x");
+      // 模拟"token 拿到了、但企业端 community-invite 端点不可达"：直接掐连接（fetch 端表现为 status 0）
+      if (opts.killCommunity && url.pathname.startsWith("/api/community-invite")) {
+        try { req.socket.destroy(); } catch { /* 忽略 */ }
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/api/device-login") {
+        // device-login 失败场景：返回 401（插件 node 半应静默降级成 not_logged_in）
+        if (opts.loginStatus && opts.loginStatus !== 200) return send(opts.loginStatus, { error: { code: "bad_credentials", message: "密码错误" } });
+        return send(200, { token: "jwt-abc" });
+      }
+      if (url.pathname === "/api/community-invite/status") {
+        if (opts.statusCode && opts.statusCode !== 200) {
+          return send(opts.statusCode, { error: { code: "boom", message: "服务端炸了" } });
+        }
+        return send(200, opts.statusBody || {
+          ok: true,
+          show: true,
+          reason: "ok",
+          used_seconds: 7205,
+          required_seconds: 7200,
+          qr_url: "/qr/group-qr.png"
+        });
+      }
+      if (req.method === "POST" && url.pathname === "/api/community-invite/shown") {
+        return send(200, { ok: true });
+      }
+      send(404, { error: { code: "not_found" } });
+    });
+  });
+  await new Promise((r) => srv.listen(0, "127.0.0.1", r));
+  return { srv, seen, base: `http://127.0.0.1:${srv.address().port}` };
+}
+
+function boot(relayDir) {
+  const routes = new Map();
+  apply({
+    webServer: { register(rt) { routes.set(rt.path, rt.handler); return () => {}; } },
+    effect(reg) { return reg(); },
+    logger: { info() {}, warn() {} },
+  }, { relayDir });
+  const host = http.createServer((req, res) => {
+    const url = new URL(req.url, "http://x");
+    // 与 announcements-proxy.test.mjs 对齐：注册对象只有 {kind,path,handler}，
+    // prefix 路由的 handler 自己判别子路径（没有 route.prefix 字段）。
+    const handler = routes.get(url.pathname) || routes.get("/dsh-remote/community-invite");
+    (handler || ((_r, rs) => { rs.writeHead(404); rs.end(); }))(req, res);
+  });
+  return host;
+}
+
+const writeCfg = (relayDir, apiUrl, extra = {}) => writeFile(path.join(relayDir, ".dsh-config.json"), JSON.stringify({
+  device_id: "dev-ci-1", api_url: apiUrl, phone: "13800000000", password: "pw", ...extra,
+}));
+
+/** 只挑 community-invite 的上游请求（插件装载时还会打 public-config / device-login 等旁路请求）。 */
+const ciReqs = (up) => up.seen.filter((e) => String(e.url || "").startsWith("/api/community-invite"));
+
+async function withPlugin(fn) {
+  const relayDir = await mkdtemp(path.join(os.tmpdir(), "dsh-ci-"));
+  process.env.DSH_RELAY_SKIP_SERVICE = "1"; // 套件级隔离：绝不真的去后台装运行环境
+  let host = null;
+  try {
+    return await fn({ relayDir, startHost: () => { host = boot(relayDir); return host; } });
+  } finally {
+    try { if (host) host.close(); } catch { /* 忽略 */ }
+    process.env.DSH_RELAY_SKIP_SERVICE = "1"; // 恢复（不要 delete：套件本来就靠它隔离）
+    await rm(relayDir, { recursive: true, force: true });
+  }
+}
+
+async function listen(host) {
+  await new Promise((r) => host.listen(0, "127.0.0.1", r));
+  return `http://127.0.0.1:${host.address().port}`;
+}
+
+test("GET status：device-login token 打企业端，show/qr_url 原样透传（qr_url 归一化成绝对地址）", async () => {
+  const up = await startFakeRelay();
+  try {
+    await withPlugin(async ({ relayDir, startHost }) => {
+      await writeCfg(relayDir, up.base);
+      const base = await listen(startHost());
+      const r = await (await fetch(`${base}/dsh-remote/community-invite/status`)).json();
+      assert.equal(r.ok, true);
+      assert.equal(r.show, true);
+      assert.equal(r.reason, "ok");
+      assert.equal(r.used_seconds, 7205, "时长口径由服务端算，node 半只透传");
+      assert.equal(r.required_seconds, 7200);
+      assert.equal(r.qr_url, `${up.base}/qr/group-qr.png`, "相对路径必须拼成企业端绝对地址（否则图片落在 127.0.0.1 上打不开）");
+
+      const got = ciReqs(up).find((e) => e.method === "GET" && e.url === "/api/community-invite/status");
+      assert.ok(got, "必须真的打到企业端 GET /api/community-invite/status");
+      assert.equal(got.headers.authorization, "Bearer jwt-abc", "必须用 device-login 换来的 token（sub = user）");
+    });
+  } finally {
+    up.srv.close();
+  }
+});
+
+test("GET status：show=false（未满 2h / 已弹过 / 没配二维码）原样透传，node 半绝不自己算", async () => {
+  const up = await startFakeRelay({
+    statusBody: { ok: true, show: false, reason: "already_shown", used_seconds: 9000, required_seconds: 7200, qr_url: "/qr/group-qr.png" }
+  });
+  try {
+    await withPlugin(async ({ relayDir, startHost }) => {
+      await writeCfg(relayDir, up.base);
+      const base = await listen(startHost());
+      const r = await (await fetch(`${base}/dsh-remote/community-invite/status`)).json();
+      assert.equal(r.ok, true);
+      assert.equal(r.show, false, "服务端说不弹就不弹");
+      assert.equal(r.reason, "already_shown", "reason 要透传（面板/排障用）");
+      assert.equal(r.used_seconds, 9000);
+    });
+  } finally {
+    up.srv.close();
+  }
+});
+
+test("GET status：qr_url 为空 / 非法协议（data:/javascript:/协议相对）→ 下发空串（前端降级）", async () => {
+  for (const bad of ["", "  ", "data:image/png;base64,AAA", "javascript:alert(1)", "//evil.example/qr.png"]) {
+    const up = await startFakeRelay({
+      statusBody: { ok: true, show: true, reason: "ok", used_seconds: 7300, required_seconds: 7200, qr_url: bad }
+    });
+    try {
+      await withPlugin(async ({ relayDir, startHost }) => {
+        await writeCfg(relayDir, up.base);
+        const base = await listen(startHost());
+        const r = await (await fetch(`${base}/dsh-remote/community-invite/status`)).json();
+        assert.equal(r.show, true, `show 仍然透传（${JSON.stringify(bad)}）`);
+        assert.equal(r.qr_url, "", `非法/空 qr_url 必须下发空串，交给前端降级（实际 ${JSON.stringify(r.qr_url)}）`);
+      });
+    } finally {
+      up.srv.close();
+    }
+  }
+});
+
+test("POST shown：幂等上报打到企业端 POST /api/community-invite/shown（Bearer）", async () => {
+  const up = await startFakeRelay();
+  try {
+    await withPlugin(async ({ relayDir, startHost }) => {
+      await writeCfg(relayDir, up.base);
+      const base = await listen(startHost());
+      const res = await fetch(`${base}/dsh-remote/community-invite/shown`, { method: "POST" });
+      assert.equal(res.status, 200);
+      const r = await res.json();
+      assert.equal(r.ok, true);
+      const got = ciReqs(up).find((e) => e.method === "POST" && e.url === "/api/community-invite/shown");
+      assert.ok(got, "必须真的打到企业端 POST /api/community-invite/shown");
+      assert.equal(got.headers.authorization, "Bearer jwt-abc");
+      // 上报两次也必须都成功（幂等契约：展示时一次 + 关闭时一次）
+      const again = await (await fetch(`${base}/dsh-remote/community-invite/shown`, { method: "POST" })).json();
+      assert.equal(again.ok, true);
+      assert.equal(ciReqs(up).filter((e) => e.method === "POST").length, 2, "两次上报都要转发（服务端幂等）");
+    });
+  } finally {
+    up.srv.close();
+  }
+});
+
+test("鉴权：没配账号 → 200 + ok:false/not_logged_in，且完全不碰企业端（不白跑 device-login）", async () => {
+  const up = await startFakeRelay();
+  try {
+    await withPlugin(async ({ relayDir, startHost }) => {
+      await writeCfg(relayDir, up.base, { phone: "", password: "" });
+      const base = await listen(startHost());
+      const r = await (await fetch(`${base}/dsh-remote/community-invite/status`)).json();
+      assert.equal(r.ok, false);
+      assert.equal(r.show, false, "未登录绝不能让面板弹引导");
+      assert.equal(r.reason, "not_logged_in");
+      assert.equal(ciReqs(up).length, 0, "不得向企业端发任何 community-invite 请求");
+      assert.equal(up.seen.filter((e) => e.url === "/api/device-login").length, 0, "没凭据就不该尝试 device-login");
+    });
+  } finally {
+    up.srv.close();
+  }
+});
+
+test("鉴权：自建（local_key）没有企业端账号体系 → local_mode，不发请求", async () => {
+  const up = await startFakeRelay();
+  try {
+    await withPlugin(async ({ relayDir, startHost }) => {
+      await writeCfg(relayDir, up.base, { phone: "", password: "", local_key: "selfhost-key" });
+      const base = await listen(startHost());
+      const r = await (await fetch(`${base}/dsh-remote/community-invite/status`)).json();
+      assert.equal(r.ok, false);
+      assert.equal(r.show, false);
+      assert.equal(r.reason, "local_mode");
+      assert.equal(ciReqs(up).length, 0, "自建模式不得请求企业端");
+    });
+  } finally {
+    up.srv.close();
+  }
+});
+
+test("鉴权：device-login 换 token 失败 → 静默 not_logged_in（面板不弹、不报错）", async () => {
+  const up = await startFakeRelay({ loginStatus: 401 });
+  try {
+    await withPlugin(async ({ relayDir, startHost }) => {
+      await writeCfg(relayDir, up.base);
+      const base = await listen(startHost());
+      const res = await fetch(`${base}/dsh-remote/community-invite/status`);
+      assert.equal(res.status, 200, "对面板而言是静默降级，不是 500");
+      const r = await res.json();
+      assert.equal(r.ok, false);
+      assert.equal(r.show, false);
+      assert.equal(r.reason, "not_logged_in");
+    });
+  } finally {
+    up.srv.close();
+  }
+});
+
+test("错误语义：企业端 401/500 → 状态码透传 + ok:false + 可读 error（面板依旧静默）", async () => {
+  for (const code of [401, 500]) {
+    const up = await startFakeRelay({ statusCode: code });
+    try {
+      await withPlugin(async ({ relayDir, startHost }) => {
+        await writeCfg(relayDir, up.base);
+        const base = await listen(startHost());
+        const res = await fetch(`${base}/dsh-remote/community-invite/status`);
+        assert.equal(res.status, code, "上游状态码透传（排障能看见，不伪装成 200）");
+        const r = await res.json();
+        assert.equal(r.ok, false);
+        assert.equal(r.show, false);
+        assert.equal(r.reason, "status_failed");
+        assert.ok(String(r.error || "").length > 0, "必须给可读错误");
+      });
+    } finally {
+      up.srv.close();
+    }
+  }
+});
+
+test("软着陆：整个企业端不可达（连 token 都拿不到）→ 200 + not_logged_in，面板不弹不报错", async () => {
+  await withPlugin(async ({ relayDir, startHost }) => {
+    // 指向一个一定没人监听的端口
+    await writeCfg(relayDir, "http://127.0.0.1:1");
+    const base = await listen(startHost());
+    const res = await fetch(`${base}/dsh-remote/community-invite/status`);
+    assert.equal(res.status, 200, "拿不到 token 属于'未登录'，不是服务端错误（面板静默）");
+    const r = await res.json();
+    assert.equal(r.ok, false);
+    assert.equal(r.show, false);
+    assert.equal(r.reason, "not_logged_in");
+  });
+});
+
+test("错误语义：token 拿到了但企业端 community-invite 端点不可达 → 502 JSON（路由自身绝不抛）", async () => {
+  const up = await startFakeRelay({ killCommunity: true });
+  try {
+    await withPlugin(async ({ relayDir, startHost }) => {
+      await writeCfg(relayDir, up.base);
+      const base = await listen(startHost());
+      const res = await fetch(`${base}/dsh-remote/community-invite/status`);
+      assert.equal(res.status, 502, "已确认登录、失败发生在上游请求 → 502（排障可见，不是静默 200）");
+      const r = await res.json();
+      assert.equal(r.ok, false);
+      assert.equal(r.show, false);
+      assert.equal(r.reason, "status_failed");
+      assert.ok(String(r.error || "").length > 0);
+      // 路由本身绝不能把异常抛回 webServer（那会变成 500 + 堆栈）
+      assert.notEqual(res.status, 500);
+    });
+  } finally {
+    up.srv.close();
+  }
+});
+
+test("未知子路径 / 错误方法 → 404，不代理到奇怪的上游路径", async () => {
+  const up = await startFakeRelay();
+  try {
+    await withPlugin(async ({ relayDir, startHost }) => {
+      await writeCfg(relayDir, up.base);
+      const base = await listen(startHost());
+      for (const [p, method] of [["/dsh-remote/community-invite/other", "GET"], ["/dsh-remote/community-invite/status", "POST"], ["/dsh-remote/community-invite/shown", "GET"]]) {
+        const res = await fetch(`${base}${p}`, { method });
+        assert.equal(res.status, 404, `${method} ${p} 必须 404`);
+        const r = await res.json();
+        assert.equal(r.reason, "unknown_route");
+      }
+      assert.equal(ciReqs(up).length, 0, "未知路由绝不请求企业端");
+    });
+  } finally {
+    up.srv.close();
+  }
+});
+
+test("身份纪律：浏览器带来的 Authorization **不透传**（用户级接口只认本机 node 半 token）", async () => {
+  const up = await startFakeRelay();
+  try {
+    await withPlugin(async ({ relayDir, startHost }) => {
+      await writeCfg(relayDir, up.base);
+      const base = await listen(startHost());
+      await fetch(`${base}/dsh-remote/community-invite/status`, { headers: { authorization: "Bearer browser-forged" } });
+      const got = ciReqs(up).find((e) => e.method === "GET");
+      assert.ok(got);
+      assert.equal(got.headers.authorization, "Bearer jwt-abc",
+        "身份必须是本机 device-login 换来的 token；浏览器带的 token 不能替代（否则'谁的身份'就含糊了）");
+    });
+  } finally {
+    up.srv.close();
+  }
+});