@mrrisega/dsh-remote 0.7.9 → 0.7.10-beta.10

package/clients/dsh-remote/test/mobile-adapter-runtime.test.mjs

@@ -74,6 +74,15 @@ class El {
   prepend() {} focus() {} blur() {}
   hasAttribute(n) { return n in this.attrs; }
   appendChild(c) { c.parent = this; this.children.push(c); return c; }
+  /* 真实 DOM 里 removeChild/parentNode 是基本能力：适配层的「字号提示」用它把自己摘掉。
+     假 DOM 缺了它 → 提示永远摘不掉 → 用例会把一个正确的实现判成错误（假红）。 */
+  removeChild(c) {
+    const i = this.children.indexOf(c);
+    if (i >= 0) this.children.splice(i, 1);
+    if (c) c.parent = null;
+    return c;
+  }
+  get parentNode() { return this.parent || null; }
   addEventListener(t, fn) { (this._listeners.get(t) || this._listeners.set(t, []).get(t)).push(fn); }
   removeEventListener() {}
   dispatch(t, ev = {}) { for (const fn of this._listeners.get(t) || []) fn({ stopPropagation() {}, preventDefault() {}, ...ev }); }
@@ -106,7 +115,9 @@ class El {
  * 折叠时**没有拖拽把手**——这正是 2026-09-19 线上"整屏遮罩"的现场结构。
  */
 function harness({ collapsedAttr = undefined, detailsAttr = undefined, sidebarRect = null, width = 390, withToggle = true,
-  variant = "rc1", rightbarAttr = undefined, overlayRect = null, rightbarRect = null, fetchImpl = null } = {}) {
+  variant = "rc1", rightbarAttr = undefined, overlayRect = null, rightbarRect = null, fetchImpl = null,
+  /* 2026-10-2x：给"输入框可用性小修补"用例提供一个官方 Lexical 输入区（默认不提供，旧用例现场不变）。 */
+  withComposer = false } = {}) {
   const html = new El("html");
   // HOSTISH 门禁会读 documentElement.outerHTML 找官方特征（__ModuleLoader__ / DeepSeek Harness）
   html.outerHTML = '<html><head><script>window.__ModuleLoader__ = { mode: "queue" }</script>'
@@ -134,6 +145,9 @@ function harness({ collapsedAttr = undefined, detailsAttr = undefined, sidebarRe
   }
   const toggle = new El("button");
   toggle.setAttribute("aria-label", "打开侧边栏");
+  const composer = new El("div", {
+    contenteditable: "true", "data-composer-input": "true", role: "textbox", "aria-multiline": "true",
+  });
 
   const pickByClass = (sel) => {
     // 只支持本用例需要的极少数选择器（脚本里 querySelector 的用法就这些）
@@ -156,9 +170,28 @@ function harness({ collapsedAttr = undefined, detailsAttr = undefined, sidebarRe
       if (s2.includes("aria-label=")) return withToggle ? toggle : null;
       if (s2.includes(".hHd-Xa_toggle")) return withToggle ? toggle : null;
       if (s2.includes("hHd-Xa")) return sidebar; // 子列识别用（真实页面里这是侧栏）
+      if (s2.includes("data-composer-input")) return withComposer ? composer : null;
       return pickByClass(s2);
     },
-    querySelectorAll() { return []; },
+    /* 只额外支持 `img`：适配层的「图片按需加载」要扫 document.querySelectorAll("img")。
+       其它选择器仍按旧行为返回 []（不改变既有用例的现场）。 */
+    querySelectorAll(sel) {
+      if (String(sel) !== "img") return [];
+      const out = [];
+      const seen = new Set();
+      const walk = (el) => {
+        if (!el || seen.has(el)) return;
+        seen.add(el);
+        for (const c of el.children || []) {
+          if (String(c.tagName) === "IMG") out.push(c);
+          walk(c);
+        }
+      };
+      /* 这套假 DOM 里 body 不一定挂在 documentElement 下（旧用例不需要），所以两个根都走一遍。 */
+      walk(doc);
+      walk(doc.body);
+      return out;
+    },
     createElement: (t) => new El(t),
     createTextNode: (t) => ({ nodeValue: t }),
     getElementById: () => null,
@@ -179,7 +212,9 @@ function harness({ collapsedAttr = undefined, detailsAttr = undefined, sidebarRe
     fetch: fetchImpl || undefined,
     // unref：同上 —— 适配层的 4 分钟兜底计时器会让测试进程空等到期（本来 240s，只剩 0.2s）。
     // 用例里的 `_pendingTimers` 仍会被 runAdapter() 主动跑一轮，行为不变。
-    setTimeout: (fn, ms) => { const id = setTimeout(fn, ms); try { id.unref?.(); } catch { /* 忽略 */ } timers.set(id, fn); return id; },
+    // 2026-10-2x：额外把 (fn, ms) 记进 timers，便于 `flushTimers(env, maxMs)` 手动推进
+    // 「延迟才做」的首屏后优化（字号提示 1200ms、图片懒加载 600ms），不必真等。
+    setTimeout: (fn, ms) => { const id = setTimeout(fn, ms); try { id.unref?.(); } catch { /* 忽略 */ } timers.set(id, { fn, ms }); return id; },
     clearTimeout: (id) => clearTimeout(id),
     MutationObserver: class { observe() {} disconnect() {} },
     ResizeObserver: class { observe() {} disconnect() {} },
@@ -203,7 +238,7 @@ function harness({ collapsedAttr = undefined, detailsAttr = undefined, sidebarRe
   ctx.console = dbgConsole;
   ctx.globalThis = ctx;
   ctx.self = win;
-  return { ctx, html, body, frame, sidebar, rightbar, overlay, toggle, win };
+  return { ctx, html, body, frame, sidebar, rightbar, overlay, toggle, composer, win, timers };
 }
 
 const ADAPTER_DEBUG = process.env.DSH_ADAPTER_DEBUG === "1";
@@ -221,6 +256,16 @@ function runAdapter(env) {
   return env;
 }
 
+/** 手动推进"延迟才做"的定时器（≤ maxMs），模拟时间流逝（不必真等 1.2 秒）。 */
+function flushTimers(env, maxMs = 2000) {
+  for (const [, rec] of [...(env.timers || new Map())]) {
+    if (!rec || typeof rec.fn !== "function") continue;
+    if (rec.ms <= maxMs) {
+      try { rec.fn(); } catch { /* 用例里吞掉：被测代码自己的兜底由它自己保证 */ }
+    }
+  }
+}
+
 const findScrim = (env) => env.body.children.find((c) => c._cls.has("dsh-ma-scrim"));
 const findHamburger = (env) => env.body.children.find((c) => c._cls.has("dsh-ma-hamburger"));
 
@@ -625,3 +670,142 @@ test("网络延迟：无样本 / 失败请求绝不显示 0ms（显示「测速
   const menu = findMenu(env);
   assert.match(menu.innerHTML, /测速中…/, "空态文案必须是「测速中…」");
 });
+
+// ══════════════════════════════════════════════════════════════════════════════
+// 首屏性能 & 移动端体验（2026-10-2x）
+//
+// 用户原声：「字体太小，因此不用」（字号档位其实早就有，藏在悬浮菜单里，没人知道）；
+// 生产遥测 n=8903：首屏 p50 3.9s / p90 21.6s、20.2% ≥12s。
+// 这里锁住适配层**自己**能控制的那部分：
+//   ① 首启字号提示：一次性、挂在 FAB 内部（不新增 body 级浮层）、点它直接打开菜单、
+//      延迟 1.2 秒才出现（绝不掺和首屏）、用户调过字号就不再提示；
+//   ② 图片按需加载：只给「视口外且没在加载」的图片打 loading=lazy + decoding=async，
+//      首屏附近的图一个字节都不动（该立刻出现的必须立刻出现）；
+//   ③ 输入体验：输入框字号跟着档位放大但永不低于 16px（防 iOS 聚焦缩放）、只打属性不改结构；
+//   ④ 性能可测量：__dshMaDiag.perf 里有首屏里程碑 / 适配层自身 boot 耗时 / 懒加载计数，
+//      且**不新增遥测事件名**（服务端只认白名单）。
+// ══════════════════════════════════════════════════════════════════════════════
+
+test("首启字号提示：1.2s 后出现、挂在 FAB 内部、点它直接打开字号菜单、且只提示一次", () => {
+  const env = harness({ width: 390 });
+  runAdapter(env);
+  const fab = findFab(env);
+  assert.ok(fab, "前提：悬浮按钮存在");
+  assert.equal(fab.querySelector(".dsh-ma-fs-tip"), null,
+    "首屏阶段绝不能出现提示 —— 延迟 1.2 秒就是为了不跟首屏抢主线程/抢视线");
+  const bodyKids = env.body.children.length;
+
+  flushTimers(env, 1200);   // 推进「首屏之后」的延迟定时器（不必真等 1.2 秒）
+
+  const tip = fab.querySelector(".dsh-ma-fs-tip");
+  assert.ok(tip, "1.2 秒后应出现「字太小？」提示（字号档位就藏在这颗按钮里）");
+  assert.equal(env.body.children.length, bodyKids,
+    "★ 提示必须挂在 FAB 内部：body 下不得多出任何浮层（适配层曾经用全屏层干过这事）");
+  assert.match(String(tip.innerHTML), /点这里调字号/, "文案必须直接告诉用户该点哪里");
+  assert.match(String(tip.innerHTML), /✕/, "必须可关闭（✕）");
+  assert.equal(env.win.localStorage.getItem("dsh-ma-fs-tip-v1"), "1",
+    "显示即记「已提示过」：同一浏览器只提示一次（localStorage）");
+  assert.equal(env.win.__dshMaDiag.perf.tipShown, true, "诊断里要能看到提示是否展示过");
+
+  // 点气泡 = 直接打开字号菜单（不用先学会点按钮），并收起提示
+  const menu = findMenu(env);
+  assert.equal(menu.hidden, true, "前提：菜单默认收起");
+  tip.dispatch("click");
+  assert.equal(menu.hidden, false, "★ 点提示必须打开远程控制菜单（里面就是字号滑块）");
+  assert.equal(fab.querySelector(".dsh-ma-fs-tip"), null, "点过之后提示必须收起");
+});
+
+test("首启字号提示：已提示过 / 用户自己调过字号 → 都不再提示（不打扰）", () => {
+  const env = harness({ width: 390 });
+  env.win.localStorage.setItem("dsh-ma-fs-tip-v1", "1");   // 上次已经提示过
+  runAdapter(env);
+  flushTimers(env, 1200);
+  assert.equal(findFab(env).querySelector(".dsh-ma-fs-tip"), null, "已提示过 → 不得再出现");
+
+  const env2 = harness({ width: 390 });
+  env2.win.localStorage.setItem("dsh-ma-font-scale", "2");  // 用户自己调过字号
+  runAdapter(env2);
+  flushTimers(env2, 1200);
+  assert.equal(findFab(env2).querySelector(".dsh-ma-fs-tip"), null,
+    "用户已经找到并调过字号 → 不必再告知（提示的目的已达成）");
+});
+
+test("图片按需加载：视口外的图打 loading=lazy + decoding=async，首屏附近的图一个字节都不动", () => {
+  const env = harness({ width: 390 });
+  const far = new El("img");
+  far.setAttribute("src", "/assets/chat-far.png");
+  far._rect = { left: 0, top: 2000, right: 300, bottom: 2200, width: 300, height: 200 };
+  const near = new El("img");
+  near.setAttribute("src", "/assets/chat-near.png");
+  near._rect = { left: 0, top: 10, right: 300, bottom: 210, width: 300, height: 200 };
+  env.body.appendChild(far);
+  env.body.appendChild(near);
+
+  assert.equal(far.getAttribute("loading"), null, "前提：官方 <img> 本来没有 loading 属性");
+  runAdapter(env);
+  flushTimers(env, 600);   // boot 后 600ms 的「首屏之后」扫描
+
+  assert.equal(far.getAttribute("loading"), "lazy", "★ 视口外的图片必须按需加载（首屏少发请求、少抢带宽）");
+  assert.equal(far.getAttribute("decoding"), "async", "解码异步，别阻塞主线程");
+  assert.equal(near.getAttribute("loading"), null, "★ 首屏附近的图片绝不能被改成 lazy（该立刻出现的必须立刻出现）");
+  assert.equal(near.getAttribute("decoding"), null, "首屏附近的图连 decoding 也不动（保持官方原样）");
+
+  const perf = env.win.__dshMaDiag.perf;
+  assert.ok(perf.imgLazy >= 1, "诊断要能量化「省下的图片请求数」（imgLazy）");
+  assert.ok(perf.imgKept >= 1, "首屏附近未动的图片也要计数（imgKept）");
+});
+
+test("输入体验：只给官方输入框补属性（enterkeyhint/spellcheck），不动 DOM 结构", () => {
+  const env = harness({ width: 390, withComposer: true });
+  runAdapter(env);
+  flushTimers(env, 600);
+  const c = env.composer;
+  assert.equal(c.getAttribute("enterkeyhint"), "enter",
+    "回车键标注「换行」：与适配层「手机 Enter 只换行、发送交给发送按钮」的策略一致");
+  assert.equal(c.getAttribute("spellcheck"), "false", "中文会话里别画拼写红线");
+  assert.equal(c.getAttribute("contenteditable"), "true", "★ 只打属性：官方原有属性/结构一个都不能改");
+  assert.equal(c.getAttribute("data-composer-input"), "true", "★ 官方锚点属性必须原样保留");
+});
+
+test("首屏诊断：__dshMaDiag.perf 有首屏里程碑 + 适配层自身耗时，且不新增遥测事件名", () => {
+  const env = harness({ width: 390 });
+  runAdapter(env);
+  flushTimers(env, 3100);
+  const perf = env.win.__dshMaDiag && env.win.__dshMaDiag.perf;
+  assert.ok(perf, "必须在 __dshMaDiag 里暴露 perf（用户上报现场时能读）");
+  for (const k of ["startAt", "bootCalls", "bootMs", "hostishCalls", "hostishSerializations",
+    "fcp", "ttfb", "dcl", "loadEnd", "uiReadyMs", "imgLazy", "imgScanPaused", "tipShown", "vvRepositions"]) {
+    assert.ok(k in perf, "perf 缺字段: " + k);
+  }
+  assert.ok(perf.bootCalls >= 1, "boot 至少跑过一次 —— bootMs 才是「适配层自身耗时」");
+  assert.ok(perf.hostishSerializations === 0,
+    "★ 有官方结构信号时一次全量序列化都不该做（旧实现每次 boot 都先 outerHTML.slice(0,200000)）");
+  assert.equal(typeof perf.uiReadyMs, "number", "首屏可用时刻（= mirror_load 的 ms，导航开始 → 可用）");
+
+  // 纪律：不新增遥测事件名（服务端只认白名单，新名字会被丢弃）→ 唯一允许的端点仍是 mirror-load
+  const SRC = readFileSync(new URL("../mobile-adapter.mjs", import.meta.url), "utf8");
+  const endpoints = [...new Set([...SRC.matchAll(/\/dsh-remote\/telemetry\/[a-z-]+/g)].map((m) => m[0]))];
+  assert.deepEqual(endpoints, ["/dsh-remote/telemetry/mirror-load"],
+    "★ 不得新增遥测事件名（白名单只有 mirror_load；新指标只进本地 __dshMaDiag.perf）");
+});
+
+test("键盘弹出：visualViewport 变化时悬浮按钮重新贴边（按钮不能被键盘顶到看不见的地方）", async () => {
+  const env = harness({ width: 390 });
+  // 把按钮记忆在右下角：它的 top 与"可视区高度"直接相关
+  env.win.localStorage.setItem("dsh-ma-fab-pos", JSON.stringify({ h: "left", v: "bottom", dx: 10, dy: 10 }));
+  const vvListeners = new Map();
+  env.win.visualViewport = {
+    height: 800,
+    addEventListener(t, fn) { (vvListeners.get(t) || vvListeners.set(t, []).get(t)).push(fn); },
+  };
+  runAdapter(env);
+  const fab = findFab(env);
+  assert.equal(fab.style.top, String(800 - 46 - 10) + "px", "前提：先按可视区高度贴底");
+
+  env.win.visualViewport.height = 500;            // 键盘弹出：可视区矮了 300px
+  for (const fn of vvListeners.get("resize") || []) fn();
+  await new Promise((r) => setImmediate(r));      // 重算被合到一帧里（rAF）
+  assert.equal(fab.style.top, String(500 - 46 - 10) + "px",
+    "★ 键盘弹出后必须按 visualViewport 重新贴边（旧实现用 innerHeight，按钮会留在键盘后面点不到）");
+  assert.ok(env.win.__dshMaDiag.perf.vvRepositions >= 1, "重定位次数要进诊断");
+});

package/clients/dsh-remote/test/push-reporter.test.mjs

@@ -0,0 +1,380 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  createPushReporter,
+  toNotifyPayload,
+  NOTIFY_KINDS,
+  MAX_QUEUE,
+  MAX_BODY_LEN
+} from "../push-reporter.mjs";
+import { NODE_KINDS } from "../dsh-events.mjs";
+
+/** 构造一个审批节点（与 dsh-events classifyWaterfall 的形状一致）。 */
+function approvalNode(over = {}) {
+  return {
+    kind: NODE_KINDS.APPROVAL_REQUEST,
+    specNode: 1,
+    answerable: true,
+    sessionId: "s_1",
+    agentId: "a_1",
+    eventId: "evt_approval_1",
+    toolName: "Bash",
+    reason: "npm run deploy",
+    options: [
+      { value: "allowed-once", label: "允许一次" },
+      { value: "rejected", label: "拒绝" }
+    ],
+    at: 1_700_000_000_000,
+    ...over
+  };
+}
+
+function turnEndNode(over = {}) {
+  return {
+    kind: NODE_KINDS.TURN_END,
+    specNode: 4,
+    sessionId: "s_1",
+    turn: 3,
+    reason: "completed",
+    known: true,
+    seq: 42,
+    at: 1_700_000_000_000,
+    ...over
+  };
+}
+
+/** 极简 fetch 假实现：按脚本返回，记录每次调用。 */
+function makeFetch(script) {
+  const calls = [];
+  const fn = async (url, init) => {
+    calls.push({ url, init });
+    const step = script.shift();
+    if (!step) throw new Error("fetch script exhausted");
+    if (step instanceof Error) throw step;
+    const status = step.status ?? 200;
+    const body = step.body ?? { ok: true };
+    return {
+      status,
+      ok: status >= 200 && status < 300,
+      async json() { return body; }
+    };
+  };
+  fn.calls = calls;
+  return fn;
+}
+
+// ───────────────────────── 映射（事件 → 上报体） ─────────────────────────
+
+test("① 审批节点 → approval_request，event_id 稳定、带选项、正文不含完整命令（默认隐私模式）", () => {
+  const p = toNotifyPayload(approvalNode(), { deviceId: "dev-x", detail: false });
+  assert.equal(p.kind, NOTIFY_KINDS.APPROVAL_REQUEST);
+  assert.match(p.event_id, /^dev-x:approval:/);
+  assert.equal(p.approval.request_id, "evt_approval_1");
+  assert.equal(p.approval.options.length, 2);
+  assert.equal(p.session.id, "s_1");
+  // 默认模式：summary 只留动作名（工具名），绝不外发 "npm run deploy" 这种完整命令
+  assert.equal(p.approval.summary, "Bash");
+  assert.ok(!JSON.stringify(p).includes("npm run deploy"), "默认模式不得把完整命令外发");
+  assert.ok(p.body.length <= MAX_BODY_LEN);
+});
+
+test("② detail 模式才带上完整命令摘要（服务端规则引擎据此判风险）", () => {
+  const p = toNotifyPayload(approvalNode(), { deviceId: "dev-x", detail: true });
+  assert.equal(p.approval.summary, "npm run deploy");
+});
+
+test("③ 会话标题进 session.title（超长截断），正文只写一句人话", () => {
+  const p = toNotifyPayload(approvalNode(), {
+    deviceId: "dev-x",
+    sessionTitle: () => "重构登录模块".repeat(20)
+  });
+  assert.ok(p.session.title.length <= 60);
+});
+
+test("④ turn/end 各 reason 映射：completed→turn_done、error→turn_error、blocked→turn_blocked、未知原因如实写", () => {
+  const done = toNotifyPayload(turnEndNode(), { deviceId: "dev-x", sessionTitle: () => "重构登录模块" });
+  assert.equal(done.kind, NOTIFY_KINDS.TURN_DONE);
+  assert.match(done.body, /重构登录模块/);
+
+  const err = toNotifyPayload(turnEndNode({ reason: "error", known: true }), { deviceId: "dev-x" });
+  assert.equal(err.kind, NOTIFY_KINDS.TURN_ERROR);
+
+  const blocked = toNotifyPayload(turnEndNode({ reason: "blocked", known: true }), { deviceId: "dev-x" });
+  assert.equal(blocked.kind, NOTIFY_KINDS.TURN_BLOCKED);
+
+  const weird = toNotifyPayload(turnEndNode({ reason: "some-new-reason", known: false }), { deviceId: "dev-x" });
+  assert.equal(weird.kind, NOTIFY_KINDS.TURN_DONE);
+  assert.match(weird.body, /some-new-reason/);
+});
+
+test("⑤ gap/fault/简报等节点不上报（返回 null），缺 deviceId 也不上报", () => {
+  assert.equal(toNotifyPayload({ kind: NODE_KINDS.GAP, at: 1 }, { deviceId: "dev-x" }), null);
+  assert.equal(toNotifyPayload({ kind: NODE_KINDS.FAULT, at: 1 }, { deviceId: "dev-x" }), null);
+  assert.equal(toNotifyPayload({ kind: NODE_KINDS.DIGEST_DUE, at: 1 }, { deviceId: "dev-x" }), null);
+  assert.equal(toNotifyPayload(approvalNode(), { deviceId: "" }), null);
+  assert.equal(toNotifyPayload(null, { deviceId: "dev-x" }), null);
+});
+
+test("⑥ 审批节点没有 eventId（无法回执）时不上报", () => {
+  assert.equal(toNotifyPayload(approvalNode({ eventId: "" }), { deviceId: "dev-x" }), null);
+});
+
+// ───────────────────────── 队列与投递 ─────────────────────────
+
+test("⑦ 同一 event_id 重复入队只算一条（幂等第一道）", async () => {
+  const fetchImpl = makeFetch([{ status: 200 }]);
+  const r = createPushReporter({
+    apiBase: "https://api.example.com",
+    deviceId: "dev-x",
+    tokenProvider: () => "tok",
+    upstream: "http://127.0.0.1:3080",
+    fetchImpl
+  });
+  const p = toNotifyPayload(turnEndNode(), { deviceId: "dev-x" });
+  assert.equal(r._enqueue(p), true);
+  assert.equal(r._enqueue({ ...p }), false);
+  assert.equal(r.status().duplicates, 1);
+  await r._flush();
+  assert.equal(r.status().sent, 1);
+  await r.stop();
+});
+
+test("⑧ 队列有界：超过上限丢最旧并计数（不让内存无界增长）", async () => {
+  const fetchImpl = makeFetch([]);
+  const r = createPushReporter({
+    apiBase: "https://api.example.com",
+    deviceId: "dev-x",
+    tokenProvider: () => "tok",
+    upstream: "http://127.0.0.1:3080",
+    fetchImpl,
+    maxQueue: 3
+  });
+  for (let i = 0; i < 5; i++) {
+    r._enqueue({
+      event_id: `dev-x:turn:${i}`,
+      device_id: "dev-x",
+      kind: NOTIFY_KINDS.TURN_DONE,
+      at: 1,
+      session: { id: "s" },
+      title: "任务完成",
+      body: "x"
+    });
+  }
+  assert.equal(r.status().queued, 3);
+  assert.equal(r.status().dropped, 2);
+  await r.stop();
+});
+
+test("⑨ 投递成功：带 Bearer、POST 到 /api/notify/event、JSON body", async () => {
+  const fetchImpl = makeFetch([{ status: 200, body: { ok: true, notified: 1 } }]);
+  const r = createPushReporter({
+    apiBase: "https://api.example.com/",
+    deviceId: "dev-x",
+    tokenProvider: () => "tok-1",
+    upstream: "http://127.0.0.1:3080",
+    fetchImpl
+  });
+  r._enqueue(toNotifyPayload(turnEndNode(), { deviceId: "dev-x" }));
+  await r._flush();
+  const call = fetchImpl.calls[0];
+  assert.equal(call.url, "https://api.example.com/api/notify/event");
+  assert.equal(call.init.method, "POST");
+  assert.equal(call.init.headers.authorization, "Bearer tok-1");
+  assert.equal(JSON.parse(call.init.body).device_id, "dev-x");
+  assert.equal(r.status().sent, 1);
+  await r.stop();
+});
+
+test("⑩ 401：丢弃本批（等下次登录刷新），不无限重试", async () => {
+  const fetchImpl = makeFetch([{ status: 401 }]);
+  const r = createPushReporter({
+    apiBase: "https://api.example.com",
+    deviceId: "dev-x",
+    tokenProvider: () => "expired",
+    upstream: "http://127.0.0.1:3080",
+    fetchImpl
+  });
+  r._enqueue(toNotifyPayload(turnEndNode(), { deviceId: "dev-x" }));
+  await r._flush();
+  assert.equal(r.status().queued, 0, "401 后不应把条目留在队列里反复打");
+  assert.equal(r.status().lastError, "auth_failed");
+  await r.stop();
+});
+
+test("⑪ 400 契约错误：丢弃该条（重试没意义）", async () => {
+  const fetchImpl = makeFetch([{ status: 400 }]);
+  const r = createPushReporter({
+    apiBase: "https://api.example.com",
+    deviceId: "dev-x",
+    tokenProvider: () => "tok",
+    upstream: "http://127.0.0.1:3080",
+    fetchImpl
+  });
+  r._enqueue(toNotifyPayload(turnEndNode(), { deviceId: "dev-x" }));
+  await r._flush();
+  assert.equal(r.status().queued, 0);
+  assert.match(r.status().lastError, /http_400/);
+  await r.stop();
+});
+
+test("⑫ 5xx：保留条目等待退避重试（不丢事件）", async () => {
+  const fetchImpl = makeFetch([{ status: 503 }]);
+  const r = createPushReporter({
+    apiBase: "https://api.example.com",
+    deviceId: "dev-x",
+    tokenProvider: () => "tok",
+    upstream: "http://127.0.0.1:3080",
+    fetchImpl,
+    retryDelaysMs: [1, 1, 1]
+  });
+  r._enqueue(toNotifyPayload(turnEndNode(), { deviceId: "dev-x" }));
+  await r._flush();
+  assert.equal(r.status().queued, 1, "5xx 应保留重试");
+  await r.stop();
+});
+
+test("⑬ 没有 token：不发请求、条目留在队列", async () => {
+  const fetchImpl = makeFetch([]);
+  const r = createPushReporter({
+    apiBase: "https://api.example.com",
+    deviceId: "dev-x",
+    tokenProvider: () => "",
+    upstream: "http://127.0.0.1:3080",
+    fetchImpl
+  });
+  r._enqueue(toNotifyPayload(turnEndNode(), { deviceId: "dev-x" }));
+  await r._flush();
+  assert.equal(fetchImpl.calls.length, 0);
+  assert.equal(r.status().queued, 1);
+  assert.equal(r.status().lastError, "no_token");
+  await r.stop();
+});
+
+// ───────────────────────── 启动门禁 ─────────────────────────
+
+test("⑭ start()：服务端明确关闭推送时**不启动**（默认关）", async () => {
+  const fetchImpl = makeFetch([{ status: 200, body: { ok: true, notify: { enabled: false } } }]);
+  const r = createPushReporter({
+    apiBase: "https://api.example.com",
+    deviceId: "dev-x",
+    tokenProvider: () => "tok",
+    upstream: "http://127.0.0.1:3080",
+    fetchImpl
+  });
+  const st = await r.start();
+  assert.equal(st.started, false);
+  assert.equal(st.reason, "disabled");
+  await r.stop();
+});
+
+test("⑮ start()：账号没有推送订阅时不启动（没订阅推了也没人收）", async () => {
+  const fetchImpl = makeFetch([
+    { status: 200, body: { ok: true, notify: { enabled: true } } },
+    { status: 200, body: { ok: true, enabled: true, subscribed: false } }
+  ]);
+  const r = createPushReporter({
+    apiBase: "https://api.example.com",
+    deviceId: "dev-x",
+    tokenProvider: () => "tok",
+    upstream: "http://127.0.0.1:3080",
+    fetchImpl
+  });
+  const st = await r.start();
+  assert.equal(st.started, false);
+  assert.equal(st.reason, "no_subscription");
+  await r.stop();
+});
+
+test("⑯ start()：没有 token 时不启动、不抛异常", async () => {
+  const fetchImpl = makeFetch([]);
+  const r = createPushReporter({
+    apiBase: "https://api.example.com",
+    deviceId: "dev-x",
+    tokenProvider: () => "",
+    upstream: "http://127.0.0.1:3080",
+    fetchImpl
+  });
+  const st = await r.start();
+  assert.equal(st.started, false);
+  assert.equal(st.reason, "no_token");
+  assert.equal(fetchImpl.calls.length, 0);
+  await r.stop();
+});
+
+test("⑰ 探测失败（网络异常）不抛、不启动（可选增强绝不能拖垮主链路）", async () => {
+  const fetchImpl = makeFetch([new Error("ECONNREFUSED")]);
+  const r = createPushReporter({
+    apiBase: "https://api.example.com",
+    deviceId: "dev-x",
+    tokenProvider: () => "tok",
+    upstream: "http://127.0.0.1:3080",
+    fetchImpl
+  });
+  const st = await r.start();
+  assert.equal(st.started, false);
+  assert.equal(st.reason, "ECONNREFUSED");
+  await r.stop();
+});
+
+test("⑱ 事件归一化抛错也不影响（畸形节点被忽略，不冒泡）", async () => {
+  const r = createPushReporter({
+    apiBase: "https://api.example.com",
+    deviceId: "dev-x",
+    tokenProvider: () => "tok",
+    upstream: "http://127.0.0.1:3080",
+    fetchImpl: makeFetch([])
+  });
+  // 直接喂畸形对象给映射函数：必须返回 null 而不是抛
+  assert.equal(toNotifyPayload({ kind: NODE_KINDS.APPROVAL_REQUEST, eventId: null, at: "x" }, { deviceId: "dev-x" }), null);
+  await r.stop();
+});
+
+test("⑲ 正文长度硬上限：超长标题/正文被截断", () => {
+  const p = toNotifyPayload(turnEndNode(), {
+    deviceId: "dev-x",
+    sessionTitle: () => "很长的标题".repeat(100)
+  });
+  assert.ok(p.body.length <= MAX_BODY_LEN);
+  assert.ok(p.session.title.length <= 60);
+});
+
+test("⑳ MAX_QUEUE 常量与文档一致（50）", () => {
+  assert.equal(MAX_QUEUE, 50);
+});
+
+test("㉑ event_id 必须只含 [A-Za-z0-9._:-]（服务端契约，问号/空格会被 400）", () => {
+  const p = toNotifyPayload(
+    { kind: NODE_KINDS.TURN_END, sessionId: "s/1", turn: undefined, seq: undefined, reason: "completed", at: 1 },
+    { deviceId: "dev-x" }
+  );
+  assert.ok(p, "应生成上报体");
+  assert.match(p.event_id, /^[A-Za-z0-9._:-]+$/, `event_id 含非法字符：${p.event_id}`);
+  // 会话 id 里有斜杠、turn/seq 缺失产生问号 —— 都必须被归一化成安全字符
+  const p2 = toNotifyPayload(
+    { kind: NODE_KINDS.APPROVAL_REQUEST, sessionId: "s/1", eventId: "evt 1?x", at: 1, toolName: "Bash" },
+    { deviceId: "dev-x" }
+  );
+  assert.match(p2.event_id, /^[A-Za-z0-9._:-]+$/, `event_id 含非法字符：${p2.event_id}`);
+  assert.ok(p2.event_id.length <= 128);
+});
+
+test("㉒ start()：服务端开启且已订阅时才会继续（门禁用 /api/me.notify.enabled）", async () => {
+  const fetchImpl = makeFetch([
+    { status: 200, body: { ok: true, notify: { enabled: true } } },
+    { status: 200, body: { ok: true, enabled: true, subscribed: true } }
+  ]);
+  const r = createPushReporter({
+    apiBase: "https://api.example.com",
+    deviceId: "dev-x",
+    tokenProvider: () => "tok",
+    upstream: "http://127.0.0.1:3080",
+    fetchImpl
+  });
+  const st = await r.start();
+  // 订阅器在测试环境没有真实 WS，启动可能失败；关键断言是"门禁通过了"（reason 不再是 disabled/no_subscription）
+  assert.notEqual(st.reason, "disabled");
+  assert.notEqual(st.reason, "no_subscription");
+  assert.equal(fetchImpl.calls[0].url, "https://api.example.com/api/me");
+  await r.stop();
+});

package/dsh-setup.mjs

@@ -2408,6 +2408,11 @@ async function setup(argv) {
     L.push(`   手机端: 打开 ${cfg.tunnel_url.replace(/^ws/, "https")}/app/ ，用访问密钥登录`);
   } else {
     L.push(`   远程访问地址: ${pub.app_url || DEFAULT_APP_URL}`);
+    // 【0.7.10 / W1-T1】安装引导原来停在「注册/登录手机号」—— 用户以为到此结束，
+    // 于是设备在线了、人却从没去过手机端（生产复盘：129 人 C1）。这里把**手机端下一步**一次说全，
+    // 两条路都写清楚（扫码免登录 / 直接打开地址用同一手机号登录），任一都能到同一台电脑。
+    L.push("   手机端下一步: 用手机浏览器打开上面这个地址 → 用同一手机号登录 → 在「设备列表」里选这台电脑");
+    L.push("                 （或在电脑端登录后，回到 设置 → 「远程访问」，用手机扫那里的二维码：免登录直接进入，30 分钟有效）");
   }
   L.push(svcSkipped
     ? `   自启动服务: ${svcState}，可用 \`dsh-remote run\` 手动运行 bridge`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrrisega/dsh-remote",
-  "version": "0.7.9",
+  "version": "0.7.10-beta.10",
   "description": "手机远程控制 DeepSeek Harness · Remote control DeepSeek Harness (dsh web) from any phone browser — 100% 全功能 App 级体验：发消息、看工具执行、审批权限、改设置、管凭据，含特权操作，免内网穿透。一条命令安装 npx @mrrisega/dsh-remote。Mobile remote control for DSH, self-host or SaaS, no server needed on LAN.",
   "keywords": [
     "deepseek-harness",
@@ -56,7 +56,7 @@
     "test:plugin": "DSH_PROFILE_DIR= DSH_REMOTE_TELEMETRY=0 DSH_RELAY_SKIP_SERVICE=1 DSH_RELAY_DEFAULT_API=http://127.0.0.1:1 DSH_RELAY_BUNDLED_RUNTIME=/nonexistent-dsh-bundled NODE_OPTIONS=\"--require $PWD/scripts/test-net-guard.cjs ${NODE_OPTIONS:-}\" node --test --test-concurrency=1 packages/dsh-remote-web/test/*.test.mjs",
     "_comment:test:bridge": "⚠️ 必须 --test-concurrency=1（与 test:plugin 对齐）：tunnel-auth 有一条「bridge 5 秒内必须重连」的硬期限，并行跑时新增用例抢 CPU 会把它撞破 → 偶发假红（实测单独跑 2/2 通过、并发跑偶发 0/2）。假红比慢更贵。",
     "test:bridge": "DSH_PROFILE_DIR= DSH_RELAY_DEFAULT_API=http://127.0.0.1:1 NODE_OPTIONS=\"--require $PWD/scripts/test-net-guard.cjs ${NODE_OPTIONS:-}\" node --test --test-concurrency=1 clients/dsh-remote/test/*.test.mjs",
-    "check": "node --check scripts/check-profile-activation.mjs && node --check clients/dsh-remote/dsh-bridge.mjs && node --check clients/dsh-remote/wechat-channel.mjs && node --check clients/dsh-remote/wechat-runtime.mjs && node --check clients/dsh-remote/dsh-events.mjs && node --check clients/dsh-remote/e2ee-shim.mjs && node --check dsh-setup.mjs && node --check packages/dsh-remote-web/lib/index.js && node --check packages/dsh-remote-web/lib/client.js && node --check packages/relay-router/src/index.mjs && node --check packages/relay-router/src/logger.mjs && bash -n deploy/install-open.sh && grep -q 'command -v setsid' deploy/install-open.sh && grep -q 'command -v ss' deploy/install-open.sh",
+    "check": "node --check scripts/check-profile-activation.mjs && node --check clients/dsh-remote/dsh-bridge.mjs && node --check clients/dsh-remote/wechat-channel.mjs && node --check clients/dsh-remote/wechat-runtime.mjs && node --check clients/dsh-remote/dsh-events.mjs && node --check clients/dsh-remote/agent/index.mjs && node --check clients/dsh-remote/agent/version.mjs && node --check clients/dsh-remote/agent/detect.mjs && node --check clients/dsh-remote/agent/permission-bridge.mjs && node --check clients/dsh-remote/agent/proc.mjs && node --check clients/dsh-remote/agent/events.mjs && node --check clients/dsh-remote/agent/codex.mjs && node --check clients/dsh-remote/agent/gemini.mjs && node --check clients/dsh-remote/agent/opencode.mjs && node --check clients/dsh-remote/agent/agent-e2e-codex.mjs && node --check clients/dsh-remote/agent/agent-e2e-real.mjs && node --check clients/dsh-remote/push-reporter.mjs && node --check clients/dsh-remote/decision-poller.mjs && node --check clients/dsh-remote/approval-coordinator.mjs && node --check clients/dsh-remote/e2ee-shim.mjs && node --check dsh-setup.mjs && node --check packages/dsh-remote-web/lib/index.js && node --check packages/dsh-remote-web/lib/client.js && node --check packages/relay-router/src/index.mjs && node --check packages/relay-router/src/logger.mjs && bash -n deploy/install-open.sh && grep -q 'command -v setsid' deploy/install-open.sh && grep -q 'command -v ss' deploy/install-open.sh",
     "release:tarballs": "bash scripts/release-tarballs.sh",
     "sync:local": "node scripts/sync-local.mjs"
   },