dsh-app-updater 1.3.0 → 1.3.2

package/test/render.mjs

@@ -359,7 +359,61 @@ tree = rt.render();
 group("设置面板与列宽手柄");
 ok(byClass(tree, "appupd-panel").length === 1, "渲染出插件设置面板");
 const switches = byClass(tree, "appupd-switch");
-ok(switches.length === 7, "渲染出 7 个设置开关（新增自动提权）", switches.length);
+ok(switches.length === 7, "渲染出 7 个设置开关（Windows：不含 macOS 专属项）", switches.length);
+
+group("设置面板按平台显示开关");
+{
+  const macState = baseState({
+    platform: "darwin",
+    env: { family: "macos", platform: "darwin", osName: "macOS 15（Sequoia）", archLabel: "Apple Silicon（ARM64）" },
+    envSummary: "macOS 15（Sequoia） · Apple Silicon（ARM64）",
+    engine: { id: "homebrew", available: true, version: "4.5.0" },
+  });
+  statePayload = macState;
+  rt.reset();
+  await tick();
+  tree = rt.render();
+  await tick();
+  tree = rt.render();
+  const macSwitches = byClass(tree, "appupd-switch");
+  ok(macSwitches.length === 5, "macOS 显示 5 个开关（跨平台 3 + macOS 专属 2）", macSwitches.length);
+  const labels = byClass(tree, "appupd-field-label").map(textOf);
+  ok(!labels.includes("自动提权安装"), "macOS 不显示「自动提权安装」", labels);
+  ok(!labels.includes("下载失败时回退 winget"), "macOS 不显示「下载失败时回退 winget」", labels);
+  ok(labels.includes("包含非 Homebrew 应用"), "macOS 显示「包含非 Homebrew 应用」", labels);
+  ok(labels.includes("包含 App Store 应用"), "macOS 显示「包含 App Store 应用」", labels);
+  ok(labels.includes("演练模式") && labels.includes("保留安装包"), "跨平台开关仍然显示", labels);
+}
+statePayload = baseState();
+rt.reset();
+await tick();
+tree = rt.render();
+await tick();
+tree = rt.render();
+
+group("macOS 空状态文案");
+{
+  const emptyMac = baseState({
+    platform: "darwin",
+    env: { family: "macos", platform: "darwin" },
+    apps: { scannedAt: Date.now(), stats: { total: 0, upgradable: 0, unsupported: 0 }, items: [] },
+  });
+  statePayload = emptyMac;
+  rt.reset();
+  await tick();
+  tree = rt.render();
+  await tick();
+  tree = rt.render();
+  const emptyText = textOf(byClass(tree, "appupd-empty")[0] || tree);
+  ok(emptyText.includes("应用目录") || emptyText.includes("运行日志"), "macOS 空列表给出可执行的下一步，而不是只说「未检测到」", emptyText.slice(0, 120));
+  ok(!emptyText.includes("未检测到任何已安装应用"), "macOS 不再显示会产生误解的那句话");
+}
+statePayload = baseState();
+rt.reset();
+await tick();
+tree = rt.render();
+await tick();
+tree = rt.render();
 ok(byClass(tree, "appupd-grip").length === 4, "渲染出 4 个列宽拖拽手柄", byClass(tree, "appupd-grip").length);
 const ths = walk(tree).filter((n) => n.type === "th");
 ok(ths.length === 6, "表头 6 列", ths.length);
@@ -394,6 +448,26 @@ await tick();
 tree = rt.render();
 ok(byClass(tree, "appupd-banner").length === 0, "关闭演练模式后警示条消失（宿主回读 state）");
 
+group("兼容模式（仅回环放行）警示条");
+statePayload = baseState({ admission: { mode: "loopback-legacy-optin", service: false, allowLegacyLoopback: true, warning: null } });
+rt.reset();
+await tick();
+tree = rt.render();
+await tick();
+tree = rt.render();
+ok(byClass(tree, "appupd-banner").length === 1, "兼容模式开启时显示警示条", byClass(tree, "appupd-banner").length);
+ok(byClass(tree, "appupd-banner-warn").length === 1, "兼容模式警示条用警示样式");
+ok(textOf(byClass(tree, "appupd-banner")[0]).includes("兼容模式已开启"), "警示条文案包含「兼容模式已开启」");
+
+statePayload = baseState({ admission: { mode: "deny", service: false, allowLegacyLoopback: false, warning: null } });
+rt.reset();
+await tick();
+tree = rt.render();
+await tick();
+tree = rt.render();
+ok(byClass(tree, "appupd-banner").length === 0, "默认（未开启兼容模式）不显示任何警示条");
+statePayload = baseState();
+
 group("下载目录校验");
 calls.length = 0;
 statePayload = baseState();

package/test/unit.mjs

@@ -20,7 +20,14 @@ import {
 import { compareVersions, isNewer, looksLikeVersion, splitVersion } from "../lib/version.js";
 import { parseInstallerManifest, splitSwitchArgs, defaultSilentArgs, resolveInstallArgs, parseBrewCaskVersions, parseBrewOutdated, findBrew, isArchNotFoundError, explainInstallerExitCode, evaluateUpdateResult, findEdgeUpdate, updateHintFor } from "../lib/engine.js";
 import { psQuote, ELEVATION_CANCELLED } from "../lib/elevate.js";
-import { admissionGate, hasConnectionCredentials } from "../lib/index.js";
+import {
+  applicationDirs,
+  parseCaskCatalog,
+  pickCask,
+  normalizeAppKey,
+  buildMacosItems,
+} from "../lib/macos.js";
+import { admissionGate, hasConnectionCredentials, resolveLegacyLoopbackOptIn, LEGACY_LOOPBACK_ENV } from "../lib/index.js";
 import {
   detectEnvironment,
   describeEnvironment,
@@ -232,8 +239,11 @@ ok(envMac.family === "macos" && envMac.osName.includes("Sequoia") && envMac.arch
 
 ok(capabilitiesFor(envWinArm, false).scan === true, "有 winget 时 Windows 可扫描");
 ok(capabilitiesFor(envWinArm, false).note.includes("winget"), "缺 winget 时给出提示", capabilitiesFor(envWinArm, false).note);
-ok(capabilitiesFor(envMac, false).scan === false, "macOS 缺 Homebrew 时不可扫描");
+ok(capabilitiesFor(envMac, false).update === false, "macOS 缺 Homebrew 时不可更新");
+ok(capabilitiesFor(envMac, false).note.includes("Homebrew"), "macOS 缺 Homebrew 时提示装 Homebrew", capabilitiesFor(envMac, false).note);
 ok(capabilitiesFor(envMac, true).scan === true, "macOS 有 Homebrew 时可扫描");
+ok(capabilitiesFor(envMac, false).scan === true, "macOS 没有 Homebrew 也能扫描（只是不能更新）——「0 个应用」的真正原因不是没 Homebrew");
+ok(capabilitiesFor(envMac, false).update === false, "macOS 没有 Homebrew 时不可更新");
 ok(capabilitiesFor({ family: "other" }, false).scan === false, "其它系统不可扫描");
 
 /* ---------------- Homebrew 解析 ---------------- */
@@ -246,6 +256,124 @@ ok(outdated.get("visual-studio-code") === "1.95.0" && outdated.get("iterm2") ===
 ok(parseBrewOutdated("not json").size === 0, "坏 JSON 不抛错");
 ok(findBrew({ HOMEBREW_PREFIX: "/nonexistent-prefix-for-test" }) === null, "找不到 brew 时返回 null");
 
+/* ---------------- macOS 应用枚举（本次修复的核心） ---------------- */
+group("macOS 应用枚举");
+ok(applicationDirs("/Users/x").includes("/Applications"), "枚举 /Applications");
+ok(applicationDirs("/Users/x").includes("/Users/x/Applications"), "枚举 ~/Applications");
+ok(applicationDirs("/Users/x").includes("/System/Applications/Utilities"), "枚举系统工具目录");
+
+const catalogList = [
+  {
+    token: "visual-studio-code",
+    version: "1.144.0",
+    name: ["Microsoft Visual Studio Code"],
+    artifacts: [{ app: ["Visual Studio Code.app"], target: "/Applications/Visual Studio Code.app" }],
+  },
+  {
+    token: "iterm2",
+    version: "3.5.14",
+    name: ["iTerm2"],
+    artifacts: [{ app: ["iTerm.app"] }],
+  },
+  {
+    token: "raycast",
+    version: "1.99.0",
+    name: ["Raycast"],
+    artifacts: [{ app: ["Raycast.app"] }],
+  },
+];
+const catalog = parseCaskCatalog(catalogList);
+ok(catalog.byToken.get("iterm2").version === "3.5.14", "目录按 token 建索引");
+ok(catalog.byApp.get("iterm.app")[0].token === "iterm2", "目录按 .app 文件名建索引（大小写无关）");
+
+const macApps = [
+  // 通过 Homebrew 装、且有新版
+  { path: "/Applications/Visual Studio Code.app", bundleName: "Visual Studio Code.app", name: "Visual Studio Code", version: "1.140.0", bundleId: "com.microsoft.VSCode", appStore: false, system: false },
+  // 通过 Homebrew 装、已是最新
+  { path: "/Applications/iTerm.app", bundleName: "iTerm.app", name: "iTerm2", version: "3.5.14", bundleId: "com.googlecode.iterm2", appStore: false, system: false },
+  // 拖 DMG 装的，Homebrew 不管
+  { path: "/Applications/Raycast.app", bundleName: "Raycast.app", name: "Raycast", version: "1.99.0", bundleId: "com.raycast.macos", appStore: false, system: false },
+  // App Store 装的
+  { path: "/Applications/Xcode.app", bundleName: "Xcode.app", name: "Xcode", version: "16.0", bundleId: "com.apple.dt.Xcode", appStore: true, system: false },
+];
+const brews = new Map([["visual-studio-code", "1.140.0"], ["iterm2", "3.5.14"]]);
+const macBuilt = buildMacosItems({ apps: macApps, brews, outdated: new Map(), catalog, settings: { includeStoreApps: true, includeUnmanagedApps: true } });
+
+ok(macBuilt.items.length === 4, "4 个 .app 全部列出（旧实现只会有 2 个）", macBuilt.items.map((i) => i.name));
+const vsc = macBuilt.items.find((i) => i.name === "Visual Studio Code");
+ok(vsc && vsc.hasUpdate && vsc.available === "1.144.0", "Homebrew 管理 + 有新版本 → 可更新并给出目标版本", vsc);
+ok(vsc && vsc.updateSupported === true && vsc.id === "brew:visual-studio-code", "可更新的应用带上 brew: token", vsc && vsc.id);
+const iterm = macBuilt.items.find((i) => i.name === "iTerm2");
+ok(iterm && iterm.hasUpdate === false && iterm.reason === null, "Homebrew 管理且已最新 → 不可更新但没有「不支持」理由", iterm);
+const ray = macBuilt.items.find((i) => i.name === "Raycast");
+ok(ray && ray.hasUpdate === false && ray.reason === "not-managed", "非 Homebrew 应用：列出但标注「非 Homebrew 管理」", ray);
+ok(ray && ray.updateSupported === false, "非 Homebrew 应用不会被标成可更新");
+const xcode = macBuilt.items.find((i) => i.name === "Xcode");
+ok(xcode && xcode.reason === "store-managed" && xcode.source === "appstore", "App Store 应用标注由商店管理", xcode);
+ok(macBuilt.items.filter((i) => i.hasUpdate).length === 1, "只有 1 个可更新");
+
+// --greedy 能强制升级的 cask（自更新应用）也要露出可用版本
+const greedy = buildMacosItems({ apps: macApps, brews, outdated: new Map([["iterm2", "3.5.15"]]), catalog, settings: {} });
+ok(greedy.items.find((i) => i.name === "iTerm2").available === "3.5.15", "brew outdated --greedy 报告的版本优先", greedy.items.find((i) => i.name === "iTerm2"));
+
+// 关掉「包含非 Homebrew 应用」后只剩 Homebrew 管理的
+const onlyBrew = buildMacosItems({ apps: macApps, brews, outdated: new Map(), catalog, settings: { includeUnmanagedApps: false } });
+ok(onlyBrew.items.length === 2 && onlyBrew.items.every((i) => i.source === "homebrew"), "关闭开关后只显示 Homebrew 应用", onlyBrew.items.map((i) => i.name));
+
+// 关掉「包含 App Store 应用」
+const noStore = buildMacosItems({ apps: macApps, brews, outdated: new Map(), catalog, settings: { includeStoreApps: false } });
+ok(!noStore.items.some((i) => i.name === "Xcode"), "关闭 App Store 开关后不显示 Xcode");
+
+// 没有 cask 目录时降级：仍然列出应用，只是都不认为可更新
+const noCatalog = buildMacosItems({ apps: macApps, brews, outdated: new Map(), catalog: null, settings: {} });
+ok(noCatalog.items.length === 4 && noCatalog.items.every((i) => !i.hasUpdate), "没有 cask 目录也照样列出应用", noCatalog.items.length);
+ok(noCatalog.warnings.some((w) => w.includes("cask 目录")), "没有 cask 目录时给出警告");
+
+// Homebrew 装了但 .app 不在标准目录（字体 / 命令行 cask）
+const brewOnly = buildMacosItems({
+  apps: [],
+  brews: new Map([["font-jetbrains-mono", "2.304"]]),
+  outdated: new Map(),
+  catalog: parseCaskCatalog([{ token: "font-jetbrains-mono", version: "2.304", name: ["JetBrains Mono"], artifacts: [] }]),
+  settings: {},
+});
+ok(brewOnly.items.length === 1 && brewOnly.items[0].id === "brew:font-jetbrains-mono", "没有 .app 的 cask 也能列出", brewOnly.items);
+
+/* ---------------- macOS 目录解析 ---------------- */
+group("cask 目录解析");
+const parsedCatalog = parseCaskCatalog([
+  { token: "raycast", version: "1.99.0", name: ["Raycast"], artifacts: [{ app: ["Raycast.app"] }] },
+  { token: "bad-no-artifacts", version: "1.0" },
+  null,
+  { version: "9.9" },
+]);
+ok(parsedCatalog.byToken.size === 2, "跳过没有 token 的条目", parsedCatalog.byToken.size);
+ok(!parsedCatalog.byApp.has("bad-no-artifacts"), "artifacts 里没有 app 的不建 byApp 索引");
+ok(normalizeAppKey("Visual Studio Code.app") === "visualstudiocode", "应用名归一化去掉 .app 与空格");
+ok(normalizeAppKey("VS Code") === "vscode", "应用名归一化保留字母数字");
+
+group("同名 .app 的多个 cask：挑对那一个");
+// 真实目录里 iterm2 与 iterm2@nightly 都声明 iTerm.app
+const dupCatalog = parseCaskCatalog([
+  { token: "iterm2@nightly", version: "3.6.0", name: ["iTerm2 Nightly"], artifacts: [{ app: ["iTerm.app"] }] },
+  { token: "iterm2", version: "3.7.6", name: ["iTerm2"], artifacts: [{ app: ["iTerm.app"] }] },
+]);
+ok(dupCatalog.byApp.get("iterm.app").length === 2, "两个 cask 都留在候选里", dupCatalog.byApp.get("iterm.app").length);
+ok(
+  pickCask(dupCatalog.byApp.get("iterm.app"), { appName: "iTerm2", bundleName: "iTerm.app", brews: new Map() }).token === "iterm2",
+  "没有安装记录时优先主 token（不是 @nightly）"
+);
+ok(
+  pickCask(dupCatalog.byApp.get("iterm.app"), { appName: "iTerm2", bundleName: "iTerm.app", brews: new Map([["iterm2@nightly", "3.6.0"]]) }).token === "iterm2@nightly",
+  "已装的是 nightly 时优先已装的那个"
+);
+// 弃用 / 停用的 cask 排在后面
+const depCatalog = parseCaskCatalog([
+  { token: "foo-old", version: "1.0", deprecated: true, artifacts: [{ app: ["Foo.app"] }] },
+  { token: "foo", version: "2.0", artifacts: [{ app: ["Foo.app"] }] },
+]);
+ok(pickCask(depCatalog.byApp.get("foo.app"), { appName: "Foo", bundleName: "Foo.app", brews: new Map() }).token === "foo", "弃用的 cask 不会被选中");
+
 /* ---------------- 提权与安装复核 ---------------- */
 group("提权执行（PowerShell 助手）");
 ok(psQuote("C:\\Program Files\\a.exe") === "'C:\\Program Files\\a.exe'", "psQuote 保留 Windows 路径");
@@ -300,25 +428,77 @@ function fakeReq({ loopback = true, headers = {} } = {}) {
   return { socket: { remoteAddress: loopback ? "127.0.0.1" : "10.0.0.5" }, headers };
 }
 
-group("connection 准入（市场审核要求）");
+group("connection 准入（市场审核要求：默认拒绝）");
 ok(hasConnectionCredentials({ headers: { cookie: "dsh=x" } }) === true, "识别浏览器会话 Cookie");
 ok(hasConnectionCredentials({ headers: { authorization: "Bearer x" } }) === true, "识别 API Cookie/Authorization");
 ok(hasConnectionCredentials({ headers: {} }) === false, "没有凭据时返回 false");
-ok(admissionGate(fakeReq(), fakeRes(), null) === true, "宿主没有 connection 服务时，回环请求放行");
+
+/* --- 兼容模式开关：默认关闭，必须是显式动作 --- */
+ok(resolveLegacyLoopbackOptIn(undefined, {}) === false, "没有任何显式开关 → 兼容模式关闭");
+ok(resolveLegacyLoopbackOptIn(null, {}) === false, "配置为 null → 兼容模式关闭");
+ok(resolveLegacyLoopbackOptIn({}, {}) === false, "配置里没有该字段 → 兼容模式关闭");
+ok(resolveLegacyLoopbackOptIn({ allowLegacyLoopback: false }, {}) === false, "配置显式 false → 关闭");
+ok(resolveLegacyLoopbackOptIn({ allowLegacyLoopback: true }, {}) === true, "插件配置 allowLegacyLoopback:true → 开启");
+ok(resolveLegacyLoopbackOptIn(undefined, { [LEGACY_LOOPBACK_ENV]: "1" }) === true, "环境变量 =1 → 开启");
+ok(resolveLegacyLoopbackOptIn(undefined, { [LEGACY_LOOPBACK_ENV]: "true" }) === true, "环境变量 =true → 开启");
+ok(resolveLegacyLoopbackOptIn(undefined, { [LEGACY_LOOPBACK_ENV]: "0" }) === false, "环境变量 =0 → 关闭");
+ok(resolveLegacyLoopbackOptIn(undefined, { [LEGACY_LOOPBACK_ENV]: "off" }) === false, "环境变量 =off → 关闭");
+
+/* --- 宿主没有 connection 服务：默认拒绝，只有显式开启兼容模式才放行 --- */
+{
+  const res = fakeRes();
+  ok(
+    admissionGate(fakeReq(), res, null) === false && res.statusCode === 403 && res.headers["X-DSH-Admission"] === "denied",
+    "没有 connection 服务 + 回环 + 未开兼容模式 → 403（默认拒绝）"
+  );
+}
 {
   const res = fakeRes();
   ok(admissionGate(fakeReq({ loopback: false }), res, null) === false && res.statusCode === 403, "没有 connection 服务时，非回环请求 403");
 }
+{
+  const res = fakeRes();
+  ok(
+    admissionGate(fakeReq(), res, null, { allowLegacyLoopback: true }) === true &&
+      res.headers["X-DSH-Admission"] === "loopback-legacy-optin" &&
+      res.headers["X-DSH-Admission-Warning"] === "legacy-loopback-compatibility-enabled",
+    "显式开启兼容模式 + 回环 → 放行并标注 opt-in 响应头"
+  );
+}
+{
+  const res = fakeRes();
+  ok(
+    admissionGate(fakeReq({ loopback: false }), res, null, { allowLegacyLoopback: true }) === false && res.statusCode === 403,
+    "即使开启兼容模式，非回环请求仍然 403"
+  );
+}
+
+/* --- 宿主有 connection 服务：一律以 admit() 为准 --- */
 {
   const res = fakeRes();
   const connection = { admit: () => ({ peer: { id: "peer-1" } }) };
   ok(admissionGate(fakeReq(), res, connection) === true && res.statusCode === 0, "准入通过 → 放行且不写响应");
 }
+{
+  const res = fakeRes();
+  const connection = { admit: () => undefined };
+  ok(admissionGate(fakeReq(), res, connection) === false && res.statusCode === 500, "准入返回空值 → 500（不把看不懂的结果放行）");
+}
+{
+  const res = fakeRes();
+  const connection = { admit: () => ({ rejection: "401" }) };
+  ok(admissionGate(fakeReq(), res, connection) === false && res.statusCode === 403, "准入返回非数字拒绝码 → 403（fail-closed）");
+}
 {
   const res = fakeRes();
   const connection = { admit: () => ({ rejection: 403 }) };
   ok(admissionGate(fakeReq({ loopback: false }), res, connection) === false && res.statusCode === 403, "准入拒绝 403（不可信来源）→ 403");
 }
+{
+  const res = fakeRes();
+  const connection = { admit: () => ({ rejection: 409 }) };
+  ok(admissionGate(fakeReq(), res, connection) === false && res.statusCode === 409, "准入拒绝 409（连接被占用）→ 409");
+}
 {
   const res = fakeRes();
   const connection = { admit: () => ({ rejection: 401 }) };
@@ -328,8 +508,34 @@ ok(admissionGate(fakeReq(), fakeRes(), null) === true, "宿主没有 connection
   const res = fakeRes();
   const connection = { admit: () => ({ rejection: 401 }) };
   ok(
-    admissionGate(fakeReq(), res, connection) === true && res.headers["X-DSH-Admission"] === "loopback-legacy",
-    "无凭据的回环请求退回旧规则并标注响应头"
+    admissionGate(fakeReq({ headers: { cookie: "dsh=x" } }), res, connection, { allowLegacyLoopback: true }) === false &&
+      res.statusCode === 401,
+    "带凭据未认证时，兼容模式也不放行"
+  );
+}
+{
+  const res = fakeRes();
+  const connection = { admit: () => ({ rejection: 401 }) };
+  ok(
+    admissionGate(fakeReq(), res, connection) === false && res.statusCode === 401 && res.headers["X-DSH-Admission"] === "denied",
+    "无凭据的回环请求默认拒绝（不再退回回环信任）"
+  );
+}
+{
+  const res = fakeRes();
+  const connection = { admit: () => ({ rejection: 401 }) };
+  ok(
+    admissionGate(fakeReq(), res, connection, { allowLegacyLoopback: true }) === true &&
+      res.headers["X-DSH-Admission"] === "loopback-legacy-optin",
+    "显式开启兼容模式后，无凭据的回环请求才按旧规则放行"
+  );
+}
+{
+  const res = fakeRes();
+  const connection = { admit: () => ({ rejection: 401 }) };
+  ok(
+    admissionGate(fakeReq({ loopback: false }), res, connection, { allowLegacyLoopback: true }) === false && res.statusCode === 401,
+    "兼容模式的例外只覆盖回环地址，非回环仍然 401"
   );
 }
 {