dsh-ris-yds 0.0.0-stage → 1.0.0

package/test/ide-proxy.test.mjs

@@ -0,0 +1,194 @@
+// Tests for the borrowed proxy engine: rule generation, discovery order, and the
+// fallback decision when dsh-ris-ide is not installed.
+import assert from 'node:assert/strict'
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import test from 'node:test'
+
+import {
+  YDS_RULE_SOURCE, applyGitProxy, ensureBorrowedProxy, gitHostOf, ideProxyCandidates,
+  isIpv4Literal, isPrivateIpv4, loadIdeProxy, privateSegmentsOf, proxyRulesFromTargets,
+  shadowTargetsFromTargets,
+  toProcessPattern, yoncodeRules,
+} from '../lib/ide-proxy.js'
+
+test('only a dotted-quad IPv4 literal counts as bindable', () => {
+  assert.equal(isIpv4Literal('172.20.235.80'), true)
+  assert.equal(isIpv4Literal('172.20.235.*'), false, 'a wildcard cannot be pre-bound')
+  assert.equal(isIpv4Literal('srmdev.hanslaser.com'), false)
+  assert.equal(isIpv4Literal(''), false)
+})
+
+test('rules name real programs: java for the internal segment, git for its remote', () => {
+  const rules = proxyRulesFromTargets([
+    { host: '172.20.235.80', port: 1521 },
+    { host: '172.20.235.81', port: 6890, isRedis: true },
+    { host: '172.20.235.81', port: 6880 },
+    // duplicates collapse, garbage is dropped
+    { host: '172.20.235.81', port: 6880 },
+    { host: 'srmdev.hanslaser.com', port: 443 },
+    { host: '', port: 1 },
+    { host: '10.0.0.1', port: 0 },
+    { host: '10.0.0.1', port: 70000 },
+  ], '/w', { gitHost: 'gitlab.hanslaser.com', java: true })
+  // Endpoints are NOT rows: two rules, both naming a real process.
+  // Every axis is explicit: "any port" is spelled `*`, because a blank port no
+  // longer makes a rule apply (the dialog rejects half-written rows).
+  assert.deepEqual(rules.map((rule) => `${rule.program}|${rule.hosts}|${rule.ports}`), [
+    'java|172.20.235.*|*',
+    'git|gitlab.hanslaser.com|*',
+  ])
+  assert.equal(rules.every((rule) => rule.source === YDS_RULE_SOURCE), true)
+  assert.equal(rules.every((rule) => rule.program !== 'jdbc'), true, 'jdbc is not a process name')
+  assert.equal(rules.every((rule) => rule.shadow === false), true, 'the table holds intent only; no mapping rows')
+  assert.equal(rules[0].id, 'yds-java-172-20-235', 'one rule per internal segment, stable id')
+  assert.equal(rules[1].id, 'yds-git')
+  // Without a git URL there is no git rule to write.
+  const noGit = proxyRulesFromTargets([{ host: '172.20.235.80', port: 1521 }], '/w', { gitHost: '', java: true })
+  assert.equal(noGit.some((rule) => rule.program === 'git'), false)
+})
+
+test('the no-root fallback is a separate listener list, not rules', () => {
+  const targets = [
+    { host: '172.20.235.80', port: 1521 },
+    { host: '172.20.235.81', port: 6890 },
+    { host: '172.20.235.81', port: 6890 },
+    { host: 'srmdev.hanslaser.com', port: 443 },
+    { host: '10.0.0.1', port: 70000 },
+  ]
+  assert.deepEqual(shadowTargetsFromTargets(targets), [
+    { host: '172.20.235.80', port: 1521 },
+    { host: '172.20.235.81', port: 6890 },
+  ], 'one listener per literal IPv4 endpoint, duplicates collapsed, hostnames skipped')
+  assert.deepEqual(shadowTargetsFromTargets([null, undefined, {}]), [])
+})
+
+
+test('the git host comes from the clone URL, never from a guess', () => {
+  assert.equal(gitHostOf({ git: { url: 'https://gitlab.hanslaser.com/hans-dev/hans-asset/yonasset.git' } }), 'gitlab.hanslaser.com')
+  assert.equal(gitHostOf({ git: { url: 'not a url' } }), '')
+  assert.equal(gitHostOf({ git: null }), '')
+})
+
+test('candidate locations cover the profile link, a workspace install and a sibling checkout', () => {
+  const list = ideProxyCandidates({ workspace: '/w' })
+  assert.ok(list.some((path) => path === '/w/node_modules/dsh-ris-ide/lib/proxy.js'))
+  assert.ok(list.some((path) => path === '/w/work/dsh-ris-ide/lib/proxy.js'))
+  // join() normalizes, so the sibling checkout resolves next to the workspace.
+  assert.ok(list.some((path) => path === '/dsh-ris-ide/lib/proxy.js'))
+  assert.ok(list.some((path) => path.endsWith('.dsh/profiles/web/node_modules/dsh-ris-ide/lib/proxy.js')))
+})
+
+test('a machine without dsh-ris-ide reports unavailable instead of throwing', async () => {
+  const dir = mkdtempSync(join(tmpdir(), 'yds-proxy-'))
+  const previous = process.env.YDS_IDE_PROXY
+  try {
+    // The documented off switch: no search at all, so the machine's real install
+    // cannot leak into the test.
+    process.env.YDS_IDE_PROXY = 'none'
+    const loaded = await loadIdeProxy({ workspace: dir })
+    assert.equal(loaded.available, false)
+    assert.match(loaded.error, /YDS_IDE_PROXY=none/)
+  } finally {
+    if (previous === undefined) delete process.env.YDS_IDE_PROXY
+    else process.env.YDS_IDE_PROXY = previous
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+test('direct mode never touches the proxy engine', async () => {
+  const dir = mkdtempSync(join(tmpdir(), 'yds-proxy-'))
+  try {
+    const result = await ensureBorrowedProxy({ workspace: dir, socks: null, proxyEngine: 'auto' }, [{ host: '10.0.0.1', port: 1521 }])
+    assert.equal(result.mode, 'none')
+    // …and the git helper refuses politely instead of writing a broken entry.
+    const git = await applyGitProxy({ workspace: dir, socks: null }, { enabled: true })
+    assert.equal(git.ok, false)
+  } finally {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+test('proxy.engine=self disables the borrow even when the engine is present', async () => {
+  const dir = mkdtempSync(join(tmpdir(), 'yds-proxy-'))
+  try {
+    const result = await ensureBorrowedProxy(
+      { workspace: dir, socks: { host: '10.3.91.121', port: 1080 }, proxyEngine: 'self' },
+      [{ host: '172.20.235.80', port: 1521 }],
+    )
+    assert.equal(result.mode, 'unavailable')
+    assert.match(result.error, /proxy\.engine=self/)
+  } finally {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+test('a broken engine module is reported, not fatal', async () => {
+  const dir = mkdtempSync(join(tmpdir(), 'yds-proxy-'))
+  const previous = process.env.YDS_IDE_PROXY
+  try {
+    mkdirSync(join(dir, 'lib'), { recursive: true })
+    writeFileSync(join(dir, 'lib', 'proxy.js'), 'export default {}\n')
+    process.env.YDS_IDE_PROXY = join(dir, 'lib', 'proxy.js')
+    const loaded = await loadIdeProxy({ workspace: dir })
+    assert.equal(loaded.available, false)
+    assert.match(loaded.error, /不完整/)
+  } finally {
+    if (previous === undefined) delete process.env.YDS_IDE_PROXY
+    else process.env.YDS_IDE_PROXY = previous
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+test('YonCode own executables get their own labelled rules', async () => {
+  const { mkdtempSync, mkdirSync, writeFileSync } = await import('node:fs')
+  const { tmpdir } = await import('node:os')
+  const home = mkdtempSync(join(tmpdir(), 'yds-yoncode-'))
+  mkdirSync(join(home, 'devkit', 'jdk21.0.7', 'bin'), { recursive: true })
+  writeFileSync(join(home, 'devkit', 'jdk21.0.7', 'bin', 'java.exe'), '')
+  const gitDir = mkdtempSync(join(tmpdir(), 'yds-git-'))
+  const gitExe = join(gitDir, 'git.exe')
+  writeFileSync(gitExe, '')
+  // A POSIX home keeps the pattern POSIX; /mnt/<drive>/ paths are rewritten to a
+  // drive letter, which is what ProxyBridge on Windows compares against.
+  const rules = yoncodeRules({ workspace: '/w' }, {
+    homes: [home],
+    gitPaths: [gitExe],
+    gitHost: 'gitlab.example.com',
+    hosts: ['172.20.235.*', '172.20.63.*'],
+  })
+  assert.deepEqual(rules.map((rule) => rule.id), ['yds-yoncode-java', 'yds-yoncode-git'])
+  assert.deepEqual(rules.map((rule) => rule.label), ['YonCode java', 'YonCode git'])
+  // `jdk*\bin\*.exe`: scoped to the JDK trees (devkit also holds maven/node) and
+  // covering java.exe/javaw.exe, so a JDK upgrade does not invalidate the rule.
+  assert.equal(rules[0].program, join(home, 'devkit', 'jdk*', 'bin', '*.exe'))
+  // The range comes from the endpoints we resolved, never from a hardcoded vendor range.
+  assert.equal(rules[0].hosts, '172.20.235.*,172.20.63.*')
+  assert.equal(rules[0].ports, '*')
+  assert.equal(rules[0].shadow, false)
+  assert.equal(rules[1].program, gitExe)
+  assert.equal(rules[1].hosts, 'gitlab.example.com')
+  assert.equal(rules.every((rule) => rule.source === 'yds'), true)
+  // No YonCode install and no git: no rows invented.
+  assert.deepEqual(yoncodeRules({}, { homes: [home], gitPaths: [], gitHost: 'x', hosts: ['10.0.0.*'] }).map((r) => r.id), ['yds-yoncode-java'])
+  // No resolved endpoint range = no java row invented (a row with an empty host list
+  // would match nothing, and a guessed range would redirect the wrong traffic).
+  assert.deepEqual(yoncodeRules({}, { homes: [home], gitPaths: [], gitHost: 'x' }), [])
+  assert.deepEqual(yoncodeRules({}, { homes: [], gitPaths: [], gitHost: 'x' }), [])
+})
+
+test('executable rows inherit the private ranges of the resolved endpoints', () => {
+  const segments = privateSegmentsOf(
+    [{ host: '172.20.235.80', port: 1521 }, { host: '172.20.235.81', port: 6890 }, { host: 'gitlab.example.com', port: 443 }],
+    ['172.20.63.131'],
+  )
+  assert.deepEqual(segments, ['172.20.235.*', '172.20.63.*'])
+  assert.deepEqual(privateSegmentsOf([], []), [])
+})
+
+test('a mounted YonCode path becomes a drive-letter pattern', () => {
+  assert.equal(toProcessPattern('/mnt/d/Program Files/YonCode/devkit/x/bin/java.exe'), 'D:\\Program Files\\YonCode\\devkit\\x\\bin\\java.exe')
+  assert.equal(toProcessPattern('C:\\Program Files\\YonCode\\x\\java.exe'), 'C:\\Program Files\\YonCode\\x\\java.exe')
+  assert.equal(toProcessPattern('/opt/YonCode/devkit/x/bin/java'), '/opt/YonCode/devkit/x/bin/java')
+})

package/test/ide-watch.test.mjs

@@ -0,0 +1,79 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync, existsSync } from 'node:fs'
+import { readFileSync as readFile } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { listWatched, reconcileOnce, registerWorkspace, unregisterWorkspace, watchWorkspace } from '../lib/ide-watch.js'
+
+function sandbox() {
+  return mkdtempSync(join(tmpdir(), 'yds-watch-'))
+}
+
+test('registration survives in the state file and remove takes it out', () => {
+  const home = sandbox()
+  const ws = sandbox()
+  assert.deepEqual(listWatched(home), [])
+  const added = registerWorkspace(ws, home)
+  assert.equal(added.ok, true)
+  assert.deepEqual(added.workspaces, [ws])
+  assert.deepEqual(listWatched(home), [ws])
+  registerWorkspace(ws, home)
+  assert.equal(listWatched(home).length, 1, 'registering twice keeps one entry')
+  const removed = unregisterWorkspace(ws, home)
+  assert.deepEqual(removed.workspaces, [])
+  assert.equal(existsSync(join(home, '.dsh-ris-yds', 'ide-watch.json')), false, 'last removal drops the file')
+  rmSync(home, { recursive: true, force: true })
+  rmSync(ws, { recursive: true, force: true })
+})
+
+test('nothing happens without a config file or without a repair step', async () => {
+  const ws = sandbox()
+  let calls = 0
+  const repair = async () => { calls += 1; return { changed: true } }
+  assert.deepEqual(await reconcileOnce(ws, { repair }), { changed: false, reason: 'no-config' })
+  mkdirSync(join(ws, '.dsh-ris-ide'), { recursive: true })
+  writeFileSync(join(ws, '.dsh-ris-ide', 'config.json'), '{"programs":[]}')
+  assert.deepEqual(await reconcileOnce(ws, {}), { changed: false, reason: 'no-repair' })
+  assert.equal(calls, 0)
+  rmSync(ws, { recursive: true, force: true })
+})
+
+test('a restore that writes nothing is reported as a no-op', async () => {
+  const ws = sandbox()
+  mkdirSync(join(ws, '.dsh-ris-ide'), { recursive: true })
+  writeFileSync(join(ws, '.dsh-ris-ide', 'config.json'), '{"programs":[]}')
+  const result = await reconcileOnce(ws, { repair: async () => ({ changed: true, reason: 'unchanged' }) })
+  assert.deepEqual(result, { changed: false, reason: 'no-op' })
+  rmSync(ws, { recursive: true, force: true })
+})
+
+test('a rewrite by ris-ide triggers the repair and the row comes back', async () => {
+  const ws = sandbox()
+  mkdirSync(join(ws, '.dsh-ris-ide'), { recursive: true })
+  const configPath = join(ws, '.dsh-ris-ide', 'config.json')
+  writeFileSync(configPath, '{"programs":[]}')
+  // minimal stand-in for applyIdeConfig: put our row back
+  const repair = async () => {
+    const doc = JSON.parse(readFileSync(configPath, 'utf8'))
+    doc.programs = [{ id: 'yds:demo', name: 'demo', kind: 'spring' }]
+    writeFileSync(configPath, JSON.stringify(doc))
+    return { changed: true, reason: 'added' }
+  }
+  const stop = watchWorkspace(ws, { repair })
+  try {
+    await new Promise((resolve) => setTimeout(resolve, 200))
+    // ris-ide regenerates the file without our row
+    writeFileSync(configPath, '{"programs":[{"id":"frontend:x#start","name":"x","kind":"frontend"}]}')
+    for (let i = 0; i < 60; i += 1) {
+      await new Promise((resolve) => setTimeout(resolve, 100))
+      const rows = JSON.parse(readFileSync(configPath, 'utf8')).programs
+      if (rows.some((row) => row.id === 'yds:demo')) break
+    }
+    const rows = JSON.parse(readFile(configPath, 'utf8')).programs
+    assert.ok(rows.some((row) => row.id === 'yds:demo'), 'the launcher row is back')
+  } finally {
+    stop()
+    rmSync(ws, { recursive: true, force: true })
+  }
+})

package/test/launch-proxy.test.mjs

@@ -0,0 +1,83 @@
+/**
+ * The tunnel flags we add to .vscode/launch.json: written only while a tunnel
+ * exists, and taken back out when the proxy stops.
+ */
+import assert from 'node:assert/strict'
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { test } from 'node:test'
+
+import { LAUNCH_CONFIG, LAUNCH_ENTRY_NAME, applyLaunchConfig, ourLaunchEntry, proxyVmArgs, readLaunchConfig, stripLaunchProxy } from '../lib/ide.js'
+
+/** A project dir with a user-owned launch.json that must survive untouched. */
+function project(withEntry = false) {
+  const dir = mkdtempSync(join(tmpdir(), 'yds-launch-'))
+  mkdirSync(join(dir, '.vscode'), { recursive: true })
+  const doc = {
+    version: '0.2.0',
+    configurations: [{ type: 'java', name: 'MDFApplication', mainClass: 'x.Y', vmArgs: ['-Xmx512m'] }],
+  }
+  if (withEntry) {
+    doc.configurations.push({ type: 'java', name: LAUNCH_ENTRY_NAME, vmArgs: ['-Dyms.dev=true'] })
+  }
+  writeFileSync(join(dir, LAUNCH_CONFIG), `${JSON.stringify(doc, null, 2)}\n`)
+  return dir
+}
+
+const cfg = (dir, socks) => ({ projectDir: dir, workspace: dir, socks })
+
+test('proxy flags are derived from .env SOCKS and absent without one', () => {
+  assert.deepEqual(proxyVmArgs({ socks: { host: '10.3.91.121', port: 1080 } }), [
+    '-DsocksProxyHost=10.3.91.121',
+    '-DsocksProxyPort=1080',
+    '-Djava.net.useSystemProxies=false',
+  ])
+  assert.deepEqual(proxyVmArgs({ socks: null }), [], 'no tunnel, no flags')
+  assert.deepEqual(proxyVmArgs({}), [])
+})
+
+test('apply writes the flags for our entry and leaves other configurations alone', () => {
+  const dir = project()
+  try {
+    const result = applyLaunchConfig(cfg(dir, { host: '10.3.91.121', port: 1080 }))
+    assert.equal(result.changed, true)
+    const doc = readLaunchConfig(dir).parsed
+    const ours = doc.configurations.find((entry) => entry.name === LAUNCH_ENTRY_NAME)
+    assert.ok(ours.vmArgs.includes('-DsocksProxyHost=10.3.91.121'))
+    const user = doc.configurations.find((entry) => entry.name === 'MDFApplication')
+    assert.deepEqual(user.vmArgs, ['-Xmx512m'], 'the user configuration must be byte-identical')
+  } finally {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+test('stripping removes exactly the proxy flags and is a no-op afterwards', () => {
+  const dir = project()
+  try {
+    applyLaunchConfig(cfg(dir, { host: '10.3.91.121', port: 1080 }))
+    const first = stripLaunchProxy(cfg(dir, null))
+    assert.equal(first.changed, true)
+    assert.equal(first.action, 'stripped')
+    const ours = readLaunchConfig(dir).parsed.configurations.find((entry) => entry.name === LAUNCH_ENTRY_NAME)
+    assert.equal(ours.vmArgs.filter((value) => /socksProxy|useSystemProxies/.test(value)).length, 0)
+    assert.deepEqual(ours.vmArgs, ourLaunchEntry({}).vmArgs, 'the entry is back to its canonical (proxy-free) form')
+    assert.equal(stripLaunchProxy(cfg(dir, null)).changed, false, 'nothing left to strip')
+    // The user's configuration is still untouched by either side of the cycle.
+    assert.deepEqual(readLaunchConfig(dir).parsed.configurations.find((entry) => entry.name === 'MDFApplication').vmArgs, ['-Xmx512m'])
+  } finally {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+test('stripping a file without our entry does nothing', () => {
+  const dir = project()
+  try {
+    const result = stripLaunchProxy(cfg(dir, null))
+    assert.equal(result.changed, false)
+    assert.equal(result.action, 'not-present')
+    assert.equal(readFileSync(join(dir, LAUNCH_CONFIG), 'utf8').includes(LAUNCH_ENTRY_NAME), false)
+  } finally {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})

package/test/mode-separation.test.mjs

@@ -0,0 +1,147 @@
+/**
+ * The two launch modes must never be mixed:
+ *   - proxy  : YonCode's JVM carries -DsocksProxyHost/Port and reads
+ *              yms-home/config (rewritten to 127.0.0.1).
+ *   - direct : no proxy flag at all; when dsh still tunnels, YonCode reads the
+ *              untouched copy in yms-home/config-direct.
+ * These tests pin the boundaries: flags, config dirs, mode switching, and the
+ * default derived from .env `ide.launch`.
+ */
+import assert from 'node:assert/strict'
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { test } from 'node:test'
+
+import { adaptAndWriteConfig } from '../lib/confcenter.js'
+import { resolveConfig } from '../lib/config.js'
+import { LAUNCH_ENTRY_NAME, applyLaunchConfig, launchModeVmArgs, ourLaunchEntry, readLaunchConfig } from '../lib/ide.js'
+
+const SOCKS = { host: '10.3.91.121', port: 1080 }
+
+function workspace(env = '') {
+  const dir = mkdtempSync(join(tmpdir(), 'yds-modes-'))
+  if (env !== '') writeFileSync(join(dir, '.env'), env, 'utf8')
+  return dir
+}
+
+function launchProject() {
+  const dir = mkdtempSync(join(tmpdir(), 'yds-launch-mode-'))
+  mkdirSync(join(dir, '.vscode'), { recursive: true })
+  writeFileSync(join(dir, '.vscode', 'launch.json'), `${JSON.stringify({ version: '0.2.0', configurations: [] }, null, 2)}\n`)
+  return dir
+}
+
+const entryVmArgs = (dir) => readLaunchConfig(dir).parsed.configurations.find((c) => c.name === LAUNCH_ENTRY_NAME).vmArgs
+
+test('proxy mode: socks flags, no local_conf_path', () => {
+  const flags = launchModeVmArgs({ launchMode: 'proxy', socks: SOCKS })
+  assert.deepEqual(flags, [
+    '-DsocksProxyHost=10.3.91.121',
+    '-DsocksProxyPort=1080',
+    '-Djava.net.useSystemProxies=false',
+  ])
+  const entry = ourLaunchEntry({ launchMode: 'proxy', socks: SOCKS })
+  assert.ok(entry.vmArgs.includes('-DsocksProxyHost=10.3.91.121'))
+  assert.ok(!entry.vmArgs.some((v) => String(v).startsWith('-Dlocal_conf_path=')), 'proxy mode must not read config-direct')
+})
+
+test('direct mode on a tunneled machine: local_conf_path only, never socks flags', () => {
+  const flags = launchModeVmArgs({ launchMode: 'direct', socks: SOCKS })
+  assert.equal(flags.length, 2)
+  assert.ok(flags[0].startsWith('-Dlocal_conf_path=') && flags[0].endsWith('/config-direct/'), `unexpected: ${flags[0]}`)
+  assert.equal(flags[1], '-Dyms_use_local_conf=true')
+  const entry = ourLaunchEntry({ launchMode: 'direct', socks: SOCKS })
+  assert.ok(!entry.vmArgs.some((v) => /^-DsocksProxy/.test(String(v))), 'direct mode must never carry proxy flags')
+  assert.ok(!entry.vmArgs.includes('-Djava.net.useSystemProxies=false'))
+})
+
+test('direct mode without SOCKS needs no override at all', () => {
+  assert.deepEqual(launchModeVmArgs({ launchMode: 'direct', socks: null }), [])
+  assert.deepEqual(launchModeVmArgs({ launchMode: 'proxy', socks: null }), [])
+})
+
+test('switching modes rewrites the entry with no residue from the other mode', () => {
+  const dir = launchProject()
+  try {
+    const proxyCfg = { projectDir: dir, workspace: dir, launchMode: 'proxy', socks: SOCKS }
+    applyLaunchConfig(proxyCfg)
+    assert.ok(entryVmArgs(dir).includes('-DsocksProxyHost=10.3.91.121'))
+
+    const directCfg = { ...proxyCfg, launchMode: 'direct' }
+    applyLaunchConfig(directCfg)
+    const direct = entryVmArgs(dir)
+    assert.ok(!direct.some((v) => /^-DsocksProxy/.test(String(v))))
+    assert.ok(direct.some((v) => String(v).startsWith('-Dlocal_conf_path=')))
+
+    applyLaunchConfig(proxyCfg)
+    const back = entryVmArgs(dir)
+    assert.ok(back.includes('-DsocksProxyHost=10.3.91.121'))
+    assert.ok(!back.some((v) => String(v).startsWith('-Dlocal_conf_path=')), 'stale direct override after switching back')
+  } finally {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+test('config-direct keeps the real endpoints while config/ stays adapted', () => {
+  const dir = workspace()
+  try {
+    const cfg = {
+      workspace: dir,
+      stateDir: join(dir, '.dsh-ris-yds'),
+      ymsHome: join(dir, 'yms-home'),
+      configDir: join(dir, 'yms-home', 'config'),
+      configDirectDir: join(dir, 'yms-home', 'config-direct'),
+      ymsPort: 8080,
+      socks: SOCKS,
+      dbForwardPort: 1521,
+      redisForwardPort: 6890,
+      module: 'c-ass-kk-hans',
+      context: '/',
+      serverBindAddress: '172.20.63.131',
+      serverPort: 31010,
+    }
+    mkdirSync(cfg.stateDir, { recursive: true })
+    const files = {
+      'yms_middleware.json': JSON.stringify({
+        connectionPools: { pool1: { url: 'jdbc:oracle:thin:@//10.3.91.100:31000/ris' } },
+        'redis.pools': { redis1: { host: '172.20.235.81', port: 6890 } },
+      }),
+      'module_config.json': '{"module":true}',
+      'yonbip_config.json': '{"platform":true}',
+    }
+
+    adaptAndWriteConfig(cfg, files)
+    adaptAndWriteConfig(cfg, files, { rewrite: false, dir: cfg.configDirectDir })
+
+    const adapted = readFileSync(join(cfg.configDir, 'yms_middleware.json'), 'utf8')
+    const untouched = readFileSync(join(cfg.configDirectDir, 'yms_middleware.json'), 'utf8')
+    assert.ok(adapted.includes('127.0.0.1:1521'), 'proxy config must point at the local forwarder')
+    assert.ok(adapted.includes('127.0.0.1'), 'proxy config must not keep the real DB host')
+    assert.ok(!adapted.includes('10.3.91.100:31000'))
+    assert.ok(untouched.includes('10.3.91.100:31000'), 'direct config must keep the real DB host')
+    assert.ok(!untouched.includes('127.0.0.1:1521'))
+    // the two writes did not leak into each other's directory
+    assert.ok(readFileSync(join(cfg.configDir, 'yms_middleware.json'), 'utf8').includes('127.0.0.1:1521'))
+  } finally {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+test('ide.launch selects the mode; an invalid value is reported and falls back to proxy', () => {
+  const direct = workspace('ide.launch=direct\n')
+  const bogus = workspace('ide.launch=both\n')
+  try {
+    const d = resolveConfig(direct)
+    assert.equal(d.config.launchMode, 'direct')
+    assert.ok(d.config.configDirectDir.endsWith('config-direct'))
+    assert.notEqual(d.config.configDir, d.config.configDirectDir)
+
+    const b = resolveConfig(bogus)
+    assert.equal(b.config.launchMode, 'proxy', 'unknown values must not become direct silently')
+    assert.ok(b.problems.some((p) => p.includes('ide.launch')), `missing problem: ${b.problems.join(' | ')}`)
+  } finally {
+    rmSync(direct, { recursive: true, force: true })
+    rmSync(bogus, { recursive: true, force: true })
+  }
+})

package/test/proxy-standalone.test.mjs

@@ -0,0 +1,118 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import net from 'node:net'
+
+import { run } from '../lib/cli.js'
+
+// The suite inherits the developer's shell: strip every YDS_* override, then
+// force the "dsh-ris-ide is not installed" path — the bundled SOCKS forwarder
+// is the only tunnel left, which is exactly the standalone (public plugin)
+// shape.
+for (const key of Object.keys(process.env)) {
+  if (key.startsWith('YDS_')) delete process.env[key]
+}
+process.env.YDS_IDE_PROXY = 'none'
+
+const DB_PORT = 24531
+const REDIS_PORT = 26891
+
+const MIDDLEWARE = {
+  connectionPools: {
+    pool1: { url: 'jdbc:oracle:thin:@//172.20.235.80:1521/yonbipdev' },
+  },
+  'redis.pools': {
+    redis1: { host: '172.20.235.81', port: 6890 },
+  },
+}
+
+function ok(result) {
+  // text() reports success without an exitCode; fail() sets 1.
+  assert.equal(result.exitCode ?? 0, 0, result.text)
+}
+
+function portOpen(port) {
+  return new Promise((resolve) => {
+    const socket = net.connect(port, '127.0.0.1')
+    socket.once('connect', () => { socket.destroy(); resolve(true) })
+    socket.once('error', () => resolve(false))
+  })
+}
+
+/** A workspace with a cached confcenter pull; `socks` adds the tunnel .env. */
+function workspace({ socks }) {
+  const dir = mkdtempSync(join(tmpdir(), 'yds-standalone-'))
+  mkdirSync(join(dir, '.dsh-ris-yds', 'confcenter'), { recursive: true })
+  writeFileSync(join(dir, '.dsh-ris-yds', 'yms-port'), '65001')
+  writeFileSync(join(dir, '.dsh-ris-yds', 'confcenter', 'yms_middleware.json'), JSON.stringify(MIDDLEWARE))
+  if (socks === true) {
+    writeFileSync(join(dir, '.env'), [
+      'socks.host = 127.0.0.1',
+      'socks.port = 1080',
+      `socks.dbPort = ${DB_PORT}`,
+      `socks.redisPort = ${REDIS_PORT}`,
+      '',
+    ].join('\n'))
+  }
+  return dir
+}
+
+test('without dsh-ris-ide a direct workspace needs no tunnel at all', async () => {
+  const dir = workspace({ socks: false })
+  try {
+    const sync = await run(['proxy', 'sync'], { cwd: dir })
+    ok(sync)
+    assert.match(sync.text, /直连模式/)
+    const status = await run(['proxy', 'status'], { cwd: dir })
+    ok(status)
+    assert.match(status.text, /代理引擎不可用/)
+    assert.match(status.text, /不适用（未配置 SOCKS，直连模式）/)
+    // No tunnel => the sibling plugin has nothing to offer, so no hint either.
+    const doctor = await run(['doctor'], { cwd: dir })
+    ok(doctor)
+    assert.doesNotMatch(doctor.text, /未检测到 dsh-ris-ide/)
+    assert.equal(await portOpen(DB_PORT), false)
+  } finally {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+test('without dsh-ris-ide the bundled forwarder replaces the borrowed engine', async () => {
+  const dir = workspace({ socks: true })
+  try {
+    const sync = await run(['proxy', 'sync'], { cwd: dir })
+    ok(sync)
+    assert.match(sync.text, /代理引擎不可用/)
+    assert.match(sync.text, /内置 socks 转发器已启动/)
+    assert.equal(await portOpen(DB_PORT), true, 'Oracle 兜底端口由内置转发器监听')
+    assert.equal(await portOpen(REDIS_PORT), true, 'Redis 兜底端口由内置转发器监听')
+
+    const status = await run(['proxy', 'status'], { cwd: dir })
+    ok(status)
+    assert.match(status.text, /内置转发器: 运行中/)
+    assert.match(status.text, /172\.20\.235\.80:1521/)
+
+    // Tunnel without the borrowed engine: recommend the sibling plugin once, as
+    // an optional upgrade — never as a broken setup.
+    const doctor = await run(['doctor'], { cwd: dir })
+    ok(doctor)
+    assert.match(doctor.text, /未检测到 dsh-ris-ide（可选）/)
+    assert.match(doctor.text, /启停本地服务/)
+
+    // Starting twice is idempotent (no duplicate process / EADDRINUSE).
+    const again = await run(['proxy', 'start'], { cwd: dir })
+    ok(again)
+    assert.match(again.text, /已在运行/)
+
+    const stop = await run(['proxy', 'stop'], { cwd: dir })
+    ok(stop)
+    assert.match(stop.text, /内置转发器已停止/)
+    assert.equal(await portOpen(DB_PORT), false)
+    assert.equal(await portOpen(REDIS_PORT), false)
+  } finally {
+    await run(['proxy', 'stop'], { cwd: dir }).catch(() => {})
+    rmSync(dir, { recursive: true, force: true })
+  }
+})