dsh-lan-peers 0.8.0 → 0.8.1

package/README.md

@@ -76,7 +76,7 @@ dsh plugin --profile web add dsh-lan-peers
     workspace: ~/.dsh/lan-peers/workspace   # 远端派单会话的工作目录
     allowRemotePrompts: false     # 默认关；打开后才接受别人的派单
     requireEncryption: true       # 默认开；旧版本对端会被拒绝
-    trustedCidrs: ["192.168.5.0/24"]  # 可选，限制来源网段
+    trustedCidrs: ["192.168.1.0/24"]  # 可选，限制来源网段
     agentPreset: standard
 ```
 
@@ -98,13 +98,13 @@ dsh plugin --profile web add dsh-lan-peers
 
 ## 配对
 
-**界面**：左下角 🔗 伙伴 → 「生成配对码」，把 6 位码给对方；对方在「添加伙伴」里填本机地址（如 `192.168.5.51:7788`）+ 码。两个方向各配一次，双方都能主动派单。
+**界面**：左下角 🔗 伙伴 → 「生成配对码」，把 6 位码给对方；对方在「添加伙伴」里填本机地址（如 `192.168.1.10:7788`）+ 码。两个方向各配一次，双方都能主动派单。
 
 **命令行**：
 
 ```bash
 npx dsh-lan-peers code  --state-dir ~/.dsh/lan-peers
-npx dsh-lan-peers pair  --url http://192.168.5.51:7788 --code 123456 --name my-nas
+npx dsh-lan-peers pair  --url http://192.168.1.10:7788 --code 123456 --name my-nas
 npx dsh-lan-peers peers --probe
 ```
 
@@ -112,12 +112,12 @@ npx dsh-lan-peers peers --probe
 
 模型侧（会话里直接说）：
 
-> 用 lan_peer_ask 问 fn-302：`/vol5/main` 下 `pwd` 输出什么？
+> 用 lan_peer_ask 问 my-nas：`/data/project` 下 `pwd` 输出什么？
 
 命令行：
 
 ```bash
-npx dsh-lan-peers ask --peer fn-302 "在 /vol5/main 执行 pwd" --timeout 120
+npx dsh-lan-peers ask --peer my-nas "在 /data/project 执行 pwd" --timeout 120
 ```
 
 对端会在自己的 `workspace` 里建真实会话、由对端模型执行，然后把最终回复加密回传。

package/client/cli-group.test.mjs

@@ -185,10 +185,10 @@ test('group join --name 只改自己；两个同名节点在 state / history 里
   const dirB = memberStateDir(t, { baseUrl: hub.baseUrl, hubInstanceId: hubId, identity: peerB });
 
   // 两台机器的默认主机名相同（真机现场就是这个现象）
-  const joinedA = await runAsync(['group', 'join', '--name', 'PW-NEW22G6LR3', '--peer', 'hub', '--state-dir', dirA]);
+  const joinedA = await runAsync(['group', 'join', '--name', 'desk-alpha', '--peer', 'hub', '--state-dir', dirA]);
   assert.equal(joinedA.status, 0, joinedA.stderr);
-  assert.match(joinedA.stdout, /显示名=PW-NEW22G6LR3/);
-  const joinedB = await runAsync(['group', 'join', '--name', 'PW-NEW22G6LR3', '--peer', 'hub', '--state-dir', dirB]);
+  assert.match(joinedA.stdout, /显示名=desk-alpha/);
+  const joinedB = await runAsync(['group', 'join', '--name', 'desk-alpha', '--peer', 'hub', '--state-dir', dirB]);
   assert.equal(joinedB.status, 0, joinedB.stderr);
 
   // 不传 --name 再 join 不会把名字抹掉
@@ -197,20 +197,20 @@ test('group join --name 只改自己；两个同名节点在 state / history 里
 
   const state = await runAsync(['group', 'state', '--peer', 'hub', '--state-dir', dirA]);
   assert.equal(state.status, 0, state.stderr);
-  assert.match(state.stdout, /PW-NEW22G6LR3 \(peer-cli\)/, '同名成员要带短 id 后缀');
-  assert.match(state.stdout, /PW-NEW22G6LR3 \(bbbbbbbb\)/);
+  assert.match(state.stdout, /desk-alpha \(peer-cli\)/, '同名成员要带短 id 后缀');
+  assert.match(state.stdout, /desk-alpha \(bbbbbbbb\)/);
 
   await runAsync(['group', 'post', '--text', 'A 说的', '--peer', 'hub', '--state-dir', dirA]);
   await runAsync(['group', 'post', '--text', 'B 说的', '--peer', 'hub', '--state-dir', dirB]);
   const history = await runAsync(['group', 'history', '--peer', 'hub', '--state-dir', dirA]);
   assert.equal(history.status, 0, history.stderr);
-  assert.match(history.stdout, /PW-NEW22G6LR3 \(peer-cli\) \[chat\] A 说的/, 'history 的 from.name 也要能区分');
-  assert.match(history.stdout, /PW-NEW22G6LR3 \(bbbbbbbb\) \[chat\] B 说的/);
+  assert.match(history.stdout, /desk-alpha \(peer-cli\) \[chat\] A 说的/, 'history 的 from.name 也要能区分');
+  assert.match(history.stdout, /desk-alpha \(bbbbbbbb\) \[chat\] B 说的/);
 
   // hub 侧存的仍是原始 name（渲染层才加后缀）
   const raw = JSON.parse(fs.readFileSync(path.join(hub.stateDir, 'group.json'), 'utf8'));
-  assert.equal(raw.members[MEMBER.peerId].name, 'PW-NEW22G6LR3');
-  assert.equal(raw.members[peerB.peerId].name, 'PW-NEW22G6LR3');
+  assert.equal(raw.members[MEMBER.peerId].name, 'desk-alpha');
+  assert.equal(raw.members[peerB.peerId].name, 'desk-alpha');
 
   // 空 --name 直接拒绝
   const empty = await runAsync(['group', 'join', '--name', '', '--peer', 'hub', '--state-dir', dirA]);

package/client/pairing-baseurl.test.mjs

@@ -46,7 +46,7 @@ const runCli = (args) => new Promise((resolve) => {
 test('v0.8.0 缺陷2：ECDH 配对把发起方的 baseUrl 存进接收方 peers.json', async (t) => {
   const host = await startHost(t);
   const { code } = host.server.issuePairingCode();
-  const selfBaseUrl = 'http://192.168.5.77:7788';
+  const selfBaseUrl = 'http://192.168.1.77:7788';
 
   const paired = await pairPeer({
     url: host.baseUrl,
@@ -66,7 +66,7 @@ test('v0.8.0 缺陷2：ECDH 配对把发起方的 baseUrl 存进接收方 peers.
 test('v0.8.0 缺陷2：旧明文配对同样带 baseUrl（0.3.1 路径不退化）', async (t) => {
   const host = await startHost(t);
   const { code } = host.server.issuePairingCode();
-  const selfBaseUrl = 'http://192.168.5.78:7788';
+  const selfBaseUrl = 'http://192.168.1.78:7788';
   const paired = await pairPeer({
     url: host.baseUrl,
     code,
@@ -103,24 +103,24 @@ test('v0.8.0 缺陷2：探测口径（私有 IPv4 优先 192.168、跳过虚拟/
     'vEthernet (WSL)': [{ family: 'IPv4', address: '172.28.0.1', internal: false }],
     'Wi-Fi': [
       { family: 'IPv6', address: 'fe80::1', internal: false },
-      { family: 'IPv4', address: '192.168.5.211', internal: false },
+      { family: 'IPv4', address: '192.168.1.211', internal: false },
     ],
     '以太网': [{ family: 'IPv4', address: '10.0.0.7', internal: false }],
     Loopback: [{ family: 'IPv4', address: '127.0.0.1', internal: true }],
     公网: [{ family: 'IPv4', address: '8.8.8.8', internal: false }],
   };
-  assert.equal(detectSelfBaseUrl({ interfaces }), 'http://192.168.5.211:7788');
-  assert.equal(detectSelfBaseUrl({ interfaces, port: 8123 }), 'http://192.168.5.211:8123');
+  assert.equal(detectSelfBaseUrl({ interfaces }), 'http://192.168.1.211:7788');
+  assert.equal(detectSelfBaseUrl({ interfaces, port: 8123 }), 'http://192.168.1.211:8123');
   // 显式值优先，且会去掉尾部斜杠；非 http(s) 一律忽略
   assert.equal(
     detectSelfBaseUrl({ interfaces, selfBaseUrl: 'http://10.9.9.9:7788/' }),
     'http://10.9.9.9:7788',
   );
-  assert.equal(detectSelfBaseUrl({ interfaces, selfBaseUrl: 'ftp://10.9.9.9' }), 'http://192.168.5.211:7788');
+  assert.equal(detectSelfBaseUrl({ interfaces, selfBaseUrl: 'ftp://10.9.9.9' }), 'http://192.168.1.211:7788');
   // 环境变量优先于探测（部署里给不出私有地址时的手动兜底）
   assert.equal(
-    detectSelfBaseUrl({ interfaces, env: { DSH_LAN_PEERS_ADVERTISE_BASE_URL: 'http://192.168.5.30:7788' } }),
-    'http://192.168.5.30:7788',
+    detectSelfBaseUrl({ interfaces, env: { DSH_LAN_PEERS_ADVERTISE_BASE_URL: 'http://192.168.1.30:7788' } }),
+    'http://192.168.1.30:7788',
   );
   // 完全没有私有地址 → 空串（调用方不会发空 baseUrl）
   assert.equal(
@@ -134,7 +134,7 @@ test('v0.8.0 缺陷2：CLI pair --base-url 走同一条路径（真进程 + 真
   const stateDir = makeTempStateDir('dsh-lan-peers-pair-cli-');
   t.after(() => fs.rmSync(stateDir, { recursive: true, force: true }));
   const { code } = host.server.issuePairingCode();
-  const selfBaseUrl = 'http://192.168.5.79:7788';
+  const selfBaseUrl = 'http://192.168.1.79:7788';
 
   const out = await runCli([
     'pair', '--url', host.baseUrl, '--code', code,

package/host/server.mjs

@@ -110,7 +110,7 @@ import { parseArgs } from 'node:util';
 // ---------------------------------------------------------------------------
 
 /** 插件版本，用于 /v1/health.version */
-export const PLUGIN_VERSION = '0.8.0';
+export const PLUGIN_VERSION = '0.8.1';
 
 /** §4.1 允许的时钟偏移 */
 export const CLOCK_SKEW_MS = 60_000;
@@ -2779,7 +2779,7 @@ export function createPeerServer(overrides = {}) {
   }
 
   /**
-   * 展示用名字：**同名成员加短 id 后缀**（"PW-NEW22G6LR3 (3c389892)"）。
+   * 展示用名字：**同名成员加短 id 后缀**（"desk-alpha (3c389892)"）。
    *
    * 为什么在渲染层做而不是写回 group.json：一台机器上跑两个 CLI 节点、或两台同型号
    * 机器都会上报同一个 hostname；读的时候统一加后缀，历史消息也能一并纠正，
@@ -3690,14 +3690,26 @@ export function createPeerServer(overrides = {}) {
       if (!state?.groupId || !state?.groupKey) return { ok: false, reason: 'group-state-incomplete' };
       const existing = readGroupKeyFile(config.stateDir) ?? { members: {} };
       const keyVersion = Number(state.keyVersion) || Number(state.epoch) || 0;
-      const members = { ...(existing.members ?? {}) };
+      // v0.8.1：换钥顺带拿到权威成员表 —— 整体替换（并集会让人数虚高、quorum 永不可达）
+      const previous = existing.members ?? {};
+      const members = {};
+      for (const member of Array.isArray(state.members) ? state.members : []) {
+        const peerId = String(member?.peerId ?? '');
+        if (peerId === '') continue;
+        members[peerId] = {
+          name: String(member?.name ?? '') || String(previous[peerId]?.name ?? ''),
+          baseUrl: String(member?.baseUrl ?? '') || String(previous[peerId]?.baseUrl ?? ''),
+        };
+      }
+      if (Object.keys(members).length === 0) Object.assign(members, previous);
       if (!members[store.instanceId]) members[store.instanceId] = { name: config.name, baseUrl: '' };
+      rememberAuthoritativeMembers(Object.keys(members), 'state');
       writeGroupKeyFile(config.stateDir, {
         ...existing,
         groupId: String(state.groupId),
         key: String(state.groupKey),
-        // epoch 只增不减：轮换后这里跟着 keyVersion 走，角色初始化再用 max() 兜一次
-        epoch: Math.max(Number(existing.epoch) || 0, keyVersion),
+        // 只增不减：轮换后这里跟着 keyVersion 走，角色初始化再用 max() 兜一次
+        keyVersion: Math.max(Number(existing.keyVersion) || 0, keyVersion),
         leaderPeerId: String(existing.leaderPeerId ?? ''),
         name: config.name,
         // 换钥顺带刷新权威群名（hub 改名后成员侧也能跟上）
@@ -4132,10 +4144,65 @@ export function createPeerServer(overrides = {}) {
    * 于是自投即当选（2026-10-27 真机事故：桌面节点在两节点群里 epoch=2 自立为 leader）。
    * 地址只决定「提案/拉票发给谁」，不决定多数派的分母（契约 §3：N = 成员总数含自己）。
    */
-  function quorumMembers() {
+  /**
+   * 最近一次**权威**成员快照（v0.8.1）：hub 的 state/pull/grant 说了算。
+   * quorum 分母必须用它，而不是「本机表 ∪ 自愈补进来的」那份 —— 后者正是真机上
+   * 「移除的人还在表里 → 分母虚高 → 成员当 leader 永远选不出」的来源。
+   */
+  let authoritativeMemberIds = new Set();
+  let lastAuthoritativeAt = 0;
+  let lastQuorumLogKey = '';
+
+  function rememberAuthoritativeMembers(ids, source = 'state') {
+    const next = new Set();
+    for (const raw of Array.isArray(ids) ? ids : []) {
+      const id = String(raw ?? '');
+      if (id !== '') next.add(id);
+    }
+    next.add(store.instanceId);
+    const changed = next.size !== authoritativeMemberIds.size
+      || [...next].some((id) => !authoritativeMemberIds.has(id));
+    authoritativeMemberIds = next;
+    lastAuthoritativeAt = config.now();
+    if (changed && config.logger) {
+      config.logger(
+        '[group] members authoritative n=' + next.size + ' source=' + source,
+      );
+    }
+    logQuorumIfChanged();
+    return next;
+  }
+
+  /** quorum 分母的来源：hub 的 group.json 恒权威；成员用最近一次权威快照；都没有才退回本机表 */
+  function quorumSnapshot() {
+    if (groupStore) {
+      const ids = new Set(Object.keys(groupStore.state().members));
+      ids.add(store.instanceId);
+      return { ids, source: 'authoritative' };
+    }
+    if (authoritativeMemberIds.size > 0) {
+      return { ids: new Set(authoritativeMemberIds), source: 'authoritative' };
+    }
     const ids = new Set(groupMemberIds());
     ids.add(store.instanceId);
-    return [...ids];
+    return { ids, source: 'stale' };
+  }
+
+  function quorumMembers() {
+    return [...quorumSnapshot().ids];
+  }
+
+  /** 只在数量/门槛/来源变化时打一行（心跳 3s 一次，不能刷屏） */
+  function logQuorumIfChanged() {
+    if (!config.logger) return;
+    const snapshot = quorumSnapshot();
+    const need = quorumSize(snapshot.ids.size, quorumMode);
+    const key = snapshot.ids.size + ':' + need + ':' + snapshot.source;
+    if (key === lastQuorumLogKey) return;
+    lastQuorumLogKey = key;
+    config.logger(
+      '[group] quorum members=' + snapshot.ids.size + ' need=' + need + ' source=' + snapshot.source,
+    );
   }
 
   /** 提案目标 = 除自己以外、地址已知（含 peers.json 兜底）的成员；地址缺失只影响投递 */
@@ -4658,6 +4725,8 @@ export function createPeerServer(overrides = {}) {
 
   /** 租约检查：非 leader 且租约过期 → 进入候选并发起选举（抖动在 runElection 里） */
   async function roleTick() {
+    // 每轮顺手对一下 quorum 口径（只在实际变化时打一行，心跳 3s 一次也不刷屏）
+    logQuorumIfChanged();
     const st = ensureRole();
     if (!st || st.role === 'leader') return { ok: false, reason: 'leader-or-off' };
     if (electionInFlight) return { ok: false, reason: 'election-in-flight' };
@@ -5304,28 +5373,45 @@ export function createPeerServer(overrides = {}) {
   }
 
   /**
-   * 刷新成员侧成员表。**只增不减**：一份过早/不完整的快照（成员在 bootstrap 之后才加入）
-   * 不该把仍在群的成员从本机表里抹掉 —— 真机上这会让该成员的心跳/投票被 401 not-a-member 挡在门外。
-   * 移除成员的权威在 hub 侧 group.json（本机表里多出来的条目只会让多数派更保守）。
+   * **权威替换**成员侧成员表（v0.8.1）。
+   *
+   * v0.7.x 为了修「401 not-a-member 死锁」把这里改成了并集（只增不减）。并集解决了
+   * 「快照不完整时误删」，代价是**权威移除永远传不到成员**：removed 的人留在本机表里，
+   * quorum 分母虚高（真机：NAS 侧 2 人、桌面侧 12 秒后仍是 4 人 → 桌面当 leader 时
+   * 以为需要 3 票，而实际只有 2 台能投票，于是永远选不出、永远写不进去）。
+   *
+   * 现在区分两种写入语义：
+   *   · 权威快照（hub 的 /v1/group/state、pull 的 memberIds、grant）→ 整体替换（本函数）；
+   *   · 自愈入表（对端用 election/heartbeat 证明自己握着群密钥）→ upsertGroupMember 并集。
+   *
+   * 名字与地址仍尽量沿用本地已知值（快照里通常没有），但**条目本身以权威快照为准**。
    */
-  function saveGroupMembers(members, names = {}) {
+  function replaceGroupMembers(members, names = {}) {
     const existing = readGroupKeyFile(config.stateDir);
-    if (!existing) return;
-    const next = { ...existing.members };
+    if (!existing) return null;
+    const previous = existing.members ?? {};
+    const next = {};
     for (const peerId of members) {
       const id = String(peerId ?? '');
       if (id === '') continue;
-      // S3：baseUrl 是承诺集合的依据，刷新成员表时不能抹掉（学到的优先，其次文件里原有的）
-      const baseUrl = knownMemberAddress(id) || String(existing.members[id]?.baseUrl ?? '');
+      if (next[id]) continue;
+      // baseUrl 是承诺集合的依据：学到的优先，其次文件里原有的（快照里一般没有地址）
+      const baseUrl = knownMemberAddress(id) || String(previous[id]?.baseUrl ?? '');
       next[id] = {
-        name: String(names[id]?.name ?? existing.members[id]?.name ?? ''),
+        name: String(names[id]?.name ?? previous[id]?.name ?? ''),
         baseUrl,
       };
     }
+    if (Object.keys(next).length === 0) return null;
     if (!next[store.instanceId]) {
-      next[store.instanceId] = { name: config.name, baseUrl: localAdvertiseBaseUrl() };
+      next[store.instanceId] = {
+        name: config.name,
+        baseUrl: String(previous[store.instanceId]?.baseUrl ?? '') || localAdvertiseBaseUrl(),
+      };
     }
+    rememberAuthoritativeMembers(Object.keys(next), 'pull');
     writeGroupKeyFile(config.stateDir, { ...existing, members: next });
+    return next;
   }
 
   /** 成员 bootstrap：用 per-peer 密钥取群状态（groupId + groupKey），失败只记一行 */
@@ -5342,16 +5428,20 @@ export function createPeerServer(overrides = {}) {
         state = await fetchGroupState({ baseUrl: hub.baseUrl, secret: hub.secret, senderId: store.instanceId, timeoutMs: 5000 });
       }
       if (!state?.groupId || !state?.groupKey) throw new Error('group-state-incomplete');
+      // v0.8.1：hub 的 state.members 是权威快照 —— 整体替换（允许删除已移除的成员）
       const members = {};
       for (const member of Array.isArray(state.members) ? state.members : []) {
-        members[String(member?.peerId ?? '')] = { name: String(member?.name ?? '') };
+        const peerId = String(member?.peerId ?? '');
+        if (peerId === '') continue;
+        members[peerId] = { name: String(member?.name ?? ''), baseUrl: String(member?.baseUrl ?? '') };
       }
-      if (!members[hub.peerId]) members[hub.peerId] = { name: hub.name };
-      if (!members[store.instanceId]) members[store.instanceId] = { name: config.name };
+      if (!members[hub.peerId]) members[hub.peerId] = { name: hub.name, baseUrl: hub.baseUrl };
+      if (!members[store.instanceId]) members[store.instanceId] = { name: config.name, baseUrl: '' };
+      rememberAuthoritativeMembers(Object.keys(members), 'state');
       writeGroupKeyFile(config.stateDir, {
         groupId: String(state.groupId),
         key: String(state.groupKey),
-        epoch: Number(state.epoch) || 0,
+        keyVersion: Number(state.keyVersion) || Number(state.epoch) || 0,
         leaderPeerId: hub.peerId,
         name: config.name,
         // hub 是群名的权威来源：bootstrap 时把真名落盘（广播/查找都靠它）
@@ -5487,7 +5577,7 @@ export function createPeerServer(overrides = {}) {
         messages: Array.isArray(page.messages) ? page.messages : [],
       });
       if (Array.isArray(page.memberIds) && page.memberIds.length > 0) {
-        saveGroupMembers(page.memberIds, ctx.members);
+        replaceGroupMembers(page.memberIds, ctx.members);
       }
       memberLastError = '';
       // hub 在 pull 响应里自报地址（X-Peer-Base 同一口径）：按名入群的节点本地没有 hub 的

package/host/test/auth.test.mjs

@@ -82,11 +82,11 @@ test('§4 GET 的 body 摘要固定是 sha256("")，签名是 base64url(HMAC-SHA
 test('§11.1 GET /v1/health 无认证 200，peers 计数正确', async (t) => {
   const stateDir = makeTempStateDir();
   seedPeers(stateDir, [peerFixture('peer-a'), peerFixture('peer-b')]);
-  const { server, baseUrl } = await startServer(t, { stateDir, name: 'fn-302' });
+  const { server, baseUrl } = await startServer(t, { stateDir, name: 'nas-box' });
 
   const health = await request(baseUrl, { path: '/v1/health', signed: false });
   assert.equal(health.status, 200);
-  assert.equal(health.json.name, 'fn-302');
+  assert.equal(health.json.name, 'nas-box');
   assert.match(health.json.instanceId, UUID_V4);
   assert.equal(health.json.instanceId, server.store.instanceId);
   // 版本号跟随实现，发版不需要改测试
@@ -112,7 +112,7 @@ test('§8 state.json 的 instanceId/createdAt 跨重启保持不变', async (t)
   const stateDir = makeTempStateDir();
   t.after(() => fs.rmSync(stateDir, { recursive: true, force: true }));
 
-  const first = createPeerServer({ stateDir, listenHost: '127.0.0.1', name: 'fn-302' });
+  const first = createPeerServer({ stateDir, listenHost: '127.0.0.1', name: 'nas-box' });
   let initial;
   try {
     await first.listen(0, '127.0.0.1');
@@ -121,7 +121,7 @@ test('§8 state.json 的 instanceId/createdAt 跨重启保持不变', async (t)
     await first.close();
   }
 
-  const second = createPeerServer({ stateDir, listenHost: '127.0.0.1', name: 'fn-302' });
+  const second = createPeerServer({ stateDir, listenHost: '127.0.0.1', name: 'nas-box' });
   let reloaded;
   try {
     await second.listen(0, '127.0.0.1');
@@ -132,7 +132,7 @@ test('§8 state.json 的 instanceId/createdAt 跨重启保持不变', async (t)
 
   assert.equal(reloaded.instanceId, initial.instanceId);
   assert.equal(reloaded.createdAt, initial.createdAt);
-  assert.equal(reloaded.name, 'fn-302');
+  assert.equal(reloaded.name, 'nas-box');
   if (process.platform !== 'win32') assert.equal(fileMode(path.join(stateDir, 'state.json')), 0o600);
 });
 
@@ -341,7 +341,7 @@ test('§4 验签接受 inboundSecret；默认也兼容存量的 secret（兼容
 
 test('§3/§2 配对码：6 位数字、10 分钟、一次性；成功后写入 peers.json（0600）', async (t) => {
   const stateDir = makeTempStateDir();
-  const { server, baseUrl } = await startServer(t, { stateDir, name: 'fn-302' });
+  const { server, baseUrl } = await startServer(t, { stateDir, name: 'nas-box' });
 
   const issued = server.issuePairingCode();
   assert.match(issued.code, /^\d{6}$/);
@@ -357,12 +357,12 @@ test('§3/§2 配对码：6 位数字、10 分钟、一次性；成功后写入
     peerId: 'peer-a',
     peerName: 'A 的显示名',
     secret: 'S-created-by-A',
-    baseUrl: 'http://192.168.5.21:7788',
+    baseUrl: 'http://192.168.1.21:7788',
   };
   const paired = await request(baseUrl, { method: 'POST', path: '/v1/pair', signed: false, body: pairBody });
   assert.equal(paired.status, 200);
   assert.equal(paired.json.peerId, server.store.instanceId);
-  assert.equal(paired.json.peerName, 'fn-302');
+  assert.equal(paired.json.peerName, 'nas-box');
   assert.match(paired.json.secret, /^[A-Za-z0-9_-]{43}$/, '32 字节 base64url 应为 43 字符');
   assert.notEqual(paired.json.secret, 'S-created-by-A', '两把密钥必须不同');
 
@@ -372,7 +372,7 @@ test('§3/§2 配对码：6 位数字、10 分钟、一次性；成功后写入
   assert.equal(stored.name, 'A 的显示名');
   assert.equal(stored.secret, 'S-created-by-A');
   assert.equal(stored.inboundSecret, paired.json.secret);
-  assert.equal(stored.baseUrl, 'http://192.168.5.21:7788');
+  assert.equal(stored.baseUrl, 'http://192.168.1.21:7788');
   assert.equal(readJson(statePath).pairingCode, undefined, '配对码用后即焚');
 
   const health = await request(baseUrl, { path: '/v1/health', signed: false });
@@ -455,10 +455,10 @@ test('§3 配对 body 缺字段 → 400；码格式不对 / 没发码 → 401 in
 
 test('配对码由另一个进程（CLI）写入时，正在运行的 server 也能看到', async (t) => {
   const stateDir = makeTempStateDir();
-  const { baseUrl } = await startServer(t, { stateDir, name: 'fn-302' });
+  const { baseUrl } = await startServer(t, { stateDir, name: 'nas-box' });
 
   // 模拟 `lan-peers code` 在另一个进程里写 state.json
-  const { code } = issuePairingCode({ stateDir, name: 'fn-302' });
+  const { code } = issuePairingCode({ stateDir, name: 'nas-box' });
 
   const paired = await request(baseUrl, {
     method: 'POST',
@@ -489,7 +489,7 @@ test('§9 默认白名单允许回环/私网，拒绝公网；CIDR 解析正确'
   const health = await request(baseUrl, { path: '/v1/health', signed: false });
   assert.equal(health.status, 200, '默认应允许 127.0.0.1');
 
-  assert.equal(isAllowedRemote('192.168.5.44', null), true);
+  assert.equal(isAllowedRemote('192.168.1.44', null), true);
   assert.equal(isAllowedRemote('10.9.8.7', null), true);
   assert.equal(isAllowedRemote('127.0.0.1', null), true);
   assert.equal(isAllowedRemote('8.8.8.8', null), false, '公网必须拒绝');
@@ -498,13 +498,13 @@ test('§9 默认白名单允许回环/私网，拒绝公网；CIDR 解析正确'
   assert.equal(isAllowedRemote('2606:4700:4700::1111', null), false);
 
   // 显式配置是严格模式：回环不在列表里就不许
-  assert.equal(isAllowedRemote('127.0.0.1', ['192.168.5.0/24']), false);
-  assert.equal(isAllowedRemote('192.168.5.4', ['192.168.5.0/24']), true);
-  assert.equal(isAllowedRemote('::ffff:192.168.5.4', ['192.168.5.0/24']), true);
+  assert.equal(isAllowedRemote('127.0.0.1', ['192.168.1.0/24']), false);
+  assert.equal(isAllowedRemote('192.168.1.4', ['192.168.1.0/24']), true);
+  assert.equal(isAllowedRemote('::ffff:192.168.1.4', ['192.168.1.0/24']), true);
   assert.equal(isAllowedRemote('10.2.3.4', ['10.0.0.0/8']), true);
   assert.equal(isAllowedRemote('11.2.3.4', ['10.0.0.0/8']), false);
 
-  assert.deepEqual(parseCidr('192.168.5.0/24')?.bits, 32);
+  assert.deepEqual(parseCidr('192.168.1.0/24')?.bits, 32);
   assert.equal(parseCidr('not-a-cidr'), null);
 });
 

package/host/test/group-auth.test.mjs

@@ -356,10 +356,10 @@ test('S1 地址探测：排除回环/虚拟网卡，192.168 优先，无私有
     docker0: [{ address: '172.17.0.1', family: 'IPv4', internal: false }],
     'VirtualBox Host-Only Network': [{ address: '192.168.56.1', family: 'IPv4', internal: false }],
     eth0: [{ address: '10.1.2.3', family: 'IPv4', internal: false }],
-    wlan0: [{ address: '192.168.5.20', family: 'IPv4', internal: false }],
+    wlan0: [{ address: '192.168.1.20', family: 'IPv4', internal: false }],
     'Tailscale': [{ address: '100.64.0.1', family: 'IPv4', internal: false }],
   };
-  assert.equal(pickPrivateIpv4(sample), '192.168.5.20');
+  assert.equal(pickPrivateIpv4(sample), '192.168.1.20');
   // 只有虚拟网卡挂着的私网地址时：一个都不选
   assert.equal(pickPrivateIpv4({
     docker0: [{ address: '172.17.0.1', family: 'IPv4', internal: false }],
@@ -407,7 +407,7 @@ test('S1 未配置 advertiseBaseUrl：探测私有 IPv4 + 实际端口；成员
   }
 
   // 成员在群级请求里带 X-Peer-Base：hub 记下「我看到的你的地址」
-  const announced = 'http://192.168.5.21:7788';
+  const announced = 'http://192.168.1.21:7788';
   const second = await groupRequest(hub.baseUrl, {
     groupKey, groupId, senderId: MEMBER.peerId,
     path: '/v1/group/probe',

package/host/test/group-members-authoritative.test.mjs

@@ -0,0 +1,119 @@
+/**
+ * v0.8.1 · 成员表「权威替换」回归（真机：移除不传播 → quorum 分母虚高）。
+ *
+ * 现场：NAS(hub/leader) 把两个测试成员 remove 掉（keyVersion 1→3），NAS 侧成员表变 2 人，
+ * 但桌面成员 12 秒后仍是 4 人 —— 因为 v0.7.x 为了修 401 死锁把成员表刷新改成了并集（只增不减）。
+ * 后果：桌面一旦当 leader 就以为 N=4、需要 3 票，而实际只有 2 台能投票 → 永远选不出 / 写不进去。
+ *
+ * 现在区分两种写入语义：
+ *   · 权威快照（hub 的 state / pull 的 memberIds / grant）→ 整体替换（允许删除）；
+ *   · 自愈入表（对端用 election/heartbeat 证明握着群密钥）→ 仍并集（upsertGroupMember）。
+ * 并且 quorum 分母以「最近一次权威快照」为准，日志里带 source=authoritative|stale。
+ */
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { applyToGroup, readGroupKeyFile, writeGroupKeyFile } from '../../lib/group-client.mjs';
+import { postAs, roleOf, startCluster, waitFor } from './group-cluster.mjs';
+
+const memberIdsOf = (node) => Object.keys(node.server.group.state().members ?? {}).sort();
+const keyMembersOf = (dir) => Object.keys(readGroupKeyFile(dir).members ?? {}).sort();
+
+/**
+ * 驱动一次「真的跑完」的 pull。
+ * 启动那轮 memberTick 可能还在飞（memberInFlight），此时 pull() 只会回 skipped —— 所以要等它 ok。
+ */
+async function pullOnce(node) {
+  const done = await waitFor(async () => {
+    const out = await node.server.group.pull();
+    return out?.ok === true ? out : null;
+  }, { timeoutMs: 8_000 });
+  assert.ok(done, 'pull 没能跑完（node=' + node.peerId + '）');
+  return done;
+}
+
+test('v0.8.1 ① 一次 pull 周期内成员表按权威快照收缩（不是并集保留）', async (t) => {
+  const cluster = await startCluster(t, { count: 4 });
+  const [a, b, c, d] = cluster.nodes;
+  assert.equal(memberIdsOf(a).length, 4);
+
+  // 移除两台（等价于面板上踢人：key 轮换 + blocked）。
+  // 真机上被踢的机器随后就下线了，所以这里也真的关掉它们的监听 ——
+  // 否则它们的心跳仍会走「自愈入表」把条目加回来（那条路径是刻意保留的，见 ③）。
+  a.server.group.removeMember(c.peerId);
+  a.server.group.removeMember(d.peerId);
+  await cluster.makeUnreachable(c);
+  await cluster.makeUnreachable(d);
+  assert.equal(memberIdsOf(a).length, 2, 'hub 侧权威表已经是 2 人');
+
+  assert.equal(keyMembersOf(b.dir).length, 4, '前提：成员本地还留着 4 条（旧语义下的并集）');
+
+  await pullOnce(b);
+  assert.deepEqual(keyMembersOf(b.dir), [a.peerId, b.peerId].sort(), '一次 pull 后必须与 hub 一致（2 人）');
+  assert.equal(readGroupKeyFile(b.dir).members[c.peerId], undefined, '被移除的成员条目必须真的删掉');
+  const keyFile = readGroupKeyFile(b.dir);
+  assert.equal(keyFile.keyVersion, keyFile.epoch, 'keyVersion 与兼容别名 epoch 同值');
+  assert.ok(keyFile.keyVersion >= 2, '踢人会轮换密钥');
+});
+
+test('v0.8.1 ② 收缩后该成员当 leader：分母 2、需要 2 票，能选出来并写进去', async (t) => {
+  const logs = [];
+  const cluster = await startCluster(t, { count: 4, logger: (line) => logs.push(String(line)) });
+  const [a, b, c, d] = cluster.nodes;
+
+  a.server.group.removeMember(c.peerId);
+  a.server.group.removeMember(d.peerId);
+  await cluster.makeUnreachable(c);
+  await cluster.makeUnreachable(d);
+  await pullOnce(b);
+  assert.equal(keyMembersOf(b.dir).length, 2);
+
+  // b 在 epoch 最高值上接管（force claim 不受退避闸门限制）
+  const claimed = await b.server.group.claim({ epoch: Math.max(roleOf(a).epoch, roleOf(b).epoch) + 1 });
+  assert.equal(claimed.ok, true, JSON.stringify(claimed));
+  assert.equal(claimed.needed, 2, '分母是 2 人 → 只需要 2 票（旧语义下会是 3 票，永远凑不齐）');
+  assert.equal(roleOf(b).role, 'leader');
+
+  // 新 leader 写一条：a 一票 + 自己 = 2 → 201
+  const posted = await postAs(b.baseUrl, a.peerId, { kind: 'chat', text: '新 leader 的第一条' });
+  assert.equal(posted.status, 201, posted.text);
+  assert.equal(posted.json.seq, 1);
+  assert.match(logs.join('\n'), /\[group\] quorum members=2 need=2 source=authoritative/);
+});
+
+test('v0.8.1 ③ 自愈入表仍是并集：不在表里的对端发心跳仍能被补进来', async (t) => {
+  const cluster = await startCluster(t, { count: 3 });
+  const [, b, c] = cluster.nodes;
+
+  const keyFile = readGroupKeyFile(b.dir);
+  const trimmed = { ...keyFile.members };
+  delete trimmed[c.peerId];
+  writeGroupKeyFile(b.dir, { ...keyFile, members: trimmed });
+  assert.equal(keyMembersOf(b.dir).includes(c.peerId), false);
+
+  // c 用群级签名发心跳（证明它握着群密钥）→ b 必须把它补回成员表（自愈路径只增不减）
+  await c.server.group.heartbeat();
+  const healed = await waitFor(() => keyMembersOf(b.dir).includes(c.peerId), { timeoutMs: 5_000 });
+  assert.equal(healed, true, '自愈入表必须仍然有效（权威替换不能把这条路径一起砍掉）');
+});
+
+test('v0.8.1 ④ 移除后 blocked 语义不变：被移除者 post / apply 仍被拒', async (t) => {
+  const cluster = await startCluster(t, { count: 3, autoJoin: false });
+  const [a, b, c] = cluster.nodes;
+  a.server.group.removeMember(c.peerId);
+  await pullOnce(b);
+
+  assert.equal(a.server.group.isBlocked(c.peerId), true, 'hub 侧记着 blocked');
+  const posted = await postAs(a.baseUrl, c.peerId, { kind: 'chat', text: '被踢之后还想说' });
+  assert.equal(posted.status, 403, posted.text);
+  assert.equal(posted.json.error, 'not-a-member');
+
+  const applied = await applyToGroup({
+    baseUrl: b.baseUrl,
+    secret: 'sec-' + c.peerId,
+    senderId: c.peerId,
+    groupId: cluster.groupId,
+    applicant: { peerId: c.peerId, name: 'kicked', baseUrl: 'http://127.0.0.1:1' },
+  });
+  assert.deepEqual(applied, { status: 'rejected', reason: 'blocked' });
+  assert.deepEqual(a.server.group.applications(), []);
+});