dsh-ris-yds 0.0.0-stage → 1.1.0

package/test/browser.test.mjs

@@ -0,0 +1,442 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+
+import {
+  RDBGA_NAME,
+  CdpError,
+  classifyRdbgaCookies,
+  connectCdp,
+  cookiesOfTargets,
+  describeRdbgaCookies,
+  domainMatches,
+  hostVariants,
+  isPlausibleRdbga,
+  probeDevtoolsPorts,
+  rdbgaFromCmdline,
+  rdbgaFromRunningJvm,
+  readRdbgaCookies,
+  repairRdbgaCookie,
+  workbenchTargets,
+} from '../lib/browser.js'
+import { rdbgaValue } from '../lib/yms.js'
+
+// Generated by the same code that writes the cookie, not pasted: if the format ever
+// changes, this fixture moves with it instead of drifting away from production.
+const MODULE = 'c-ass-kk-hans'
+const WORKBENCH_HOST = 'srmdev.hanslaser.com'
+const EXPECTED = rdbgaValue({ module: MODULE, context: '/', serverBindAddress: '172.20.63.131', serverPort: 31010 })
+const HOSTS = hostVariants(WORKBENCH_HOST)
+
+/** Fake WebSocket: lets a test script the handshake and every command. */
+function fakeSocket(script) {
+  return class FakeWebSocket {
+    constructor(url) {
+      this.url = url
+      this.sent = []
+      setTimeout(() => { this.onopen?.() }, 0)
+    }
+
+    send(raw) {
+      const message = JSON.parse(raw)
+      this.sent.push(message)
+      const reply = script(message, this)
+      if (reply === null) return
+      setTimeout(() => { this.onmessage?.({ data: JSON.stringify({ id: message.id, ...reply }) }) }, 0)
+    }
+
+    close() { this.closed = true; this.onclose?.() }
+  }
+}
+
+test('the rdbga value is read out of a JVM command line, and absent lines stay empty', () => {
+  assert.equal(rdbgaFromCmdline(`java -Drdbga=${EXPECTED} -Dserver.port=31010 -cp x.jar Main`), EXPECTED)
+  assert.equal(rdbgaFromCmdline('java -Dserver.port=31010 -cp x.jar Main'), '')
+  assert.equal(rdbgaFromCmdline(''), '')
+})
+
+test('host variants cover the domain-cookie spelling, and domain matching is suffix-safe', () => {
+  assert.deepEqual(hostVariants('srmdev.hanslaser.com'), ['srmdev.hanslaser.com', '.srmdev.hanslaser.com'])
+  assert.deepEqual(hostVariants('.srmdev.hanslaser.com'), ['.srmdev.hanslaser.com', 'srmdev.hanslaser.com'])
+  assert.deepEqual(hostVariants(''), [])
+  assert.equal(domainMatches('.srmdev.hanslaser.com', HOSTS), true)
+  assert.equal(domainMatches('srmdev.hanslaser.com', HOSTS), true)
+  assert.equal(domainMatches('evil-srmdev.hanslaser.com', HOSTS), false)
+  assert.equal(domainMatches('other.com', HOSTS), false)
+  assert.equal(domainMatches('anything.com', []), true)
+})
+
+test('a value is only written when it decodes to "module,/context@ipv4:port"', () => {
+  assert.equal(isPlausibleRdbga(EXPECTED), true)
+  assert.equal(isPlausibleRdbga(''), false)
+  assert.equal(isPlausibleRdbga('null,/@null:31010'), false) // not base64
+  assert.equal(isPlausibleRdbga(Buffer.from('null,/@null:31010').toString('base64')), false)
+  assert.equal(isPlausibleRdbga(Buffer.from('c-ass-kk-hans,/@172.20.63.131:31010').toString('base64')), true)
+  assert.equal(isPlausibleRdbga('not base64 !!'), false)
+})
+
+test('an empty host-only rdbga is removed: it shadows the correct value', () => {
+  const verdict = classifyRdbgaCookies([
+    { name: RDBGA_NAME, value: '', domain: 'srmdev.hanslaser.com', path: '/' },
+    { name: RDBGA_NAME, value: EXPECTED, domain: '.srmdev.hanslaser.com', path: '/' },
+  ], EXPECTED)
+  assert.equal(verdict.keep.length, 1)
+  assert.equal(verdict.keep[0].domain, '.srmdev.hanslaser.com')
+  assert.equal(verdict.remove.length, 1)
+  assert.equal(verdict.remove[0].value, '')
+})
+
+test('only one rdbga survives: duplicates are removed even when the value matches', () => {
+  const verdict = classifyRdbgaCookies([
+    { name: RDBGA_NAME, value: EXPECTED, domain: '.srmdev.hanslaser.com', path: '/' },
+    { name: RDBGA_NAME, value: EXPECTED, domain: 'srmdev.hanslaser.com', path: '/' },
+    { name: 'JSESSIONID', value: 'abc', domain: '.hanslaser.com', path: '/' },
+  ], EXPECTED)
+  assert.equal(verdict.keep.length, 1)
+  assert.equal(verdict.remove.length, 1)
+  assert.ok(verdict.remove.every((cookie) => cookie.name === RDBGA_NAME))
+})
+
+test('a stale value is removed as well, and another domain is left alone', () => {
+  const verdict = classifyRdbgaCookies([
+    { name: RDBGA_NAME, value: 'b2xkLXN0YWxl', domain: 'srmdev.hanslaser.com', path: '/' },
+    { name: RDBGA_NAME, value: 'x', domain: 'elsewhere.com', path: '/' },
+  ], EXPECTED, HOSTS)
+  assert.equal(verdict.keep.length, 0)
+  assert.equal(verdict.remove.length, 1)
+  assert.equal(verdict.remove[0].domain, 'srmdev.hanslaser.com')
+})
+
+test('the devtools probe takes the first port that answers', async () => {
+  const seen = []
+  const fetchImpl = async (url) => {
+    seen.push(url)
+    if (url.includes(':9222/')) throw new Error('ECONNREFUSED')
+    return { ok: true, json: async () => ({ Browser: 'Chrome/151' }) }
+  }
+  assert.deepEqual(await probeDevtoolsPorts([9222, 9223], { fetchImpl }), { port: 9223, browser: 'Chrome/151' })
+  assert.equal(seen.length, 2)
+})
+
+test('no port answering is reported as port 0, not as an error', async () => {
+  const fetchImpl = async () => { throw new Error('ECONNREFUSED') }
+  assert.deepEqual(await probeDevtoolsPorts([9222], { fetchImpl }), { port: 0, browser: '' })
+})
+
+test('a hanging DevTools endpoint is cut off by the deadline', async () => {
+  const fetchImpl = () => new Promise(() => {})
+  const started = Date.now()
+  const found = await probeDevtoolsPorts([9222], { fetchImpl, timeout: 50 })
+  assert.deepEqual(found, { port: 0, browser: '' })
+  assert.ok(Date.now() - started < 1000)
+})
+
+test('only workbench pages are treated as targets, and a broken listing is reported', async () => {
+  const fetchImpl = async () => ({
+    ok: true,
+    json: async () => ([
+      { type: 'page', url: 'https://srmdev.hanslaser.com/', webSocketDebuggerUrl: 'ws://a' },
+      { type: 'page', url: 'https://example.com/', webSocketDebuggerUrl: 'ws://b' },
+      { type: 'service_worker', url: 'https://srmdev.hanslaser.com/sw.js', webSocketDebuggerUrl: 'ws://c' },
+    ]),
+  })
+  const listed = await workbenchTargets(9222, { fetchImpl, hosts: HOSTS })
+  assert.equal(listed.ok, true)
+  assert.equal(listed.targets.length, 1)
+  assert.equal(listed.targets[0].webSocketDebuggerUrl, 'ws://a')
+  const broken = await workbenchTargets(9222, { fetchImpl: async () => { throw new Error('down') } })
+  assert.equal(broken.ok, false)
+  assert.match(broken.error, /页签/)
+})
+
+test('repair deletes the empty cookie and sets the expected one', async () => {
+  const calls = []
+  const cookies = [
+    { name: RDBGA_NAME, value: '', domain: 'srmdev.hanslaser.com', path: '/' },
+    { name: 'JSESSIONID', value: 'abc', domain: '.hanslaser.com', path: '/' },
+  ]
+  const fetchImpl = async () => ({
+    ok: true,
+    json: async () => ([{ type: 'page', url: 'https://srmdev.hanslaser.com/home', webSocketDebuggerUrl: 'ws://a' }]),
+  })
+  const connect = async () => ({
+    send: async (method, params) => {
+      calls.push([method, params])
+      if (method === 'Network.getCookies') return { cookies }
+      return {}
+    },
+    close: () => { calls.push(['close']) },
+  })
+  const result = await repairRdbgaCookie({ port: 9222, expected: EXPECTED, fetchImpl, connect })
+  assert.deepEqual(
+    { ok: result.ok, tabs: result.tabs, removed: result.removed, wrote: result.wrote, dryRun: result.dryRun },
+    { ok: true, tabs: 1, removed: 1, wrote: 1, dryRun: false },
+  )
+  assert.equal(calls[0][0], 'Network.enable')
+  const deletes = calls.filter(([method]) => method === 'Network.deleteCookies')
+  assert.equal(deletes.length, 1)
+  assert.equal(deletes[0][1].domain, 'srmdev.hanslaser.com')
+  const sets = calls.filter(([method]) => method === 'Network.setCookie')
+  assert.equal(sets.length, 1)
+  assert.equal(sets[0][1].value, EXPECTED)
+  assert.equal(sets[0][1].url, 'https://srmdev.hanslaser.com/')
+})
+
+test('repair deletes with the cookie own domain/path, not the tab host', async () => {
+  const calls = []
+  const fetchImpl = async () => ({
+    ok: true,
+    json: async () => ([{ type: 'page', url: 'https://srmdev.hanslaser.com/', webSocketDebuggerUrl: 'ws://a' }]),
+  })
+  const connect = async () => ({
+    send: async (method, params) => {
+      calls.push([method, params])
+      if (method === 'Network.getCookies') {
+        return { cookies: [{ name: RDBGA_NAME, value: '', domain: '.srmdev.hanslaser.com', path: '/foo' }] }
+      }
+      return {}
+    },
+    close: () => {},
+  })
+  const result = await repairRdbgaCookie({ port: 9222, expected: EXPECTED, fetchImpl, connect })
+  assert.equal(result.ok, true)
+  const [method, params] = calls.find(([name]) => name === 'Network.deleteCookies')
+  assert.equal(method, 'Network.deleteCookies')
+  assert.equal(params.domain, '.srmdev.hanslaser.com')
+  assert.equal(params.path, '/foo')
+})
+
+test('a tab that cannot be reached is a reported failure, not a silent success', async () => {
+  const fetchImpl = async () => ({
+    ok: true,
+    json: async () => ([
+      { type: 'page', url: 'https://srmdev.hanslaser.com/a', webSocketDebuggerUrl: 'ws://a' },
+      { type: 'page', url: 'https://srmdev.hanslaser.com/b', webSocketDebuggerUrl: 'ws://b' },
+    ]),
+  })
+  const connect = async (wsUrl) => {
+    if (wsUrl === 'ws://b') throw new Error('connection closed')
+    return { send: async () => ({ cookies: [] }), close: () => {} }
+  }
+  const result = await repairRdbgaCookie({ port: 9222, expected: EXPECTED, fetchImpl, connect })
+  assert.equal(result.ok, false)
+  assert.equal(result.tabs, 1)
+  assert.equal(result.failed.length, 1)
+  assert.match(result.error, /部分页签失败（成功 1 个，失败 1 个）/)
+  assert.match(result.error, /srmdev\.hanslaser\.com\/b: connection closed/)
+})
+
+test('classify and describe agree when the cookie value is not a string', () => {
+  const cookies = [{ name: RDBGA_NAME, value: '123', domain: `srmdev.hanslaser.com`, path: '/' }]
+  const verdict = classifyRdbgaCookies(cookies, 123, HOSTS)
+  assert.equal(verdict.keep.length, 1)
+  assert.equal(verdict.remove.length, 0)
+  assert.match(describeRdbgaCookies(cookies, 123, HOSTS), /→ 正确/)
+})
+
+test('repair leaves a correct cookie alone and never sets a duplicate', async () => {
+  const calls = []
+  const fetchImpl = async () => ({
+    ok: true,
+    json: async () => ([{ type: 'page', url: 'https://srmdev.hanslaser.com/', webSocketDebuggerUrl: 'ws://a' }]),
+  })
+  const connect = async () => ({
+    send: async (method, params) => {
+      calls.push([method, params])
+      if (method === 'Network.getCookies') {
+        return { cookies: [{ name: RDBGA_NAME, value: EXPECTED, domain: '.srmdev.hanslaser.com', path: '/' }] }
+      }
+      return {}
+    },
+    close: () => {},
+  })
+  const result = await repairRdbgaCookie({ port: 9222, expected: EXPECTED, fetchImpl, connect })
+  assert.equal(result.removed, 0)
+  assert.equal(result.wrote, 0)
+  assert.equal(calls.filter(([method]) => method === 'Network.setCookie').length, 0)
+})
+
+test('repair refuses to write a value it cannot verify', async () => {
+  const calls = []
+  const result = await repairRdbgaCookie({
+    port: 9222,
+    expected: Buffer.from('null,/@null:31010').toString('base64'),
+    fetchImpl: async () => { throw new Error('must not be called') },
+    connect: async () => ({ send: async () => { calls.push('send') }, close: () => {} }),
+  })
+  assert.equal(result.ok, false)
+  assert.match(result.error, /拒绝写入/)
+  assert.equal(calls.length, 0)
+})
+
+test('no workbench tab is a reported miss, not a crash', async () => {
+  const fetchImpl = async () => ({ ok: true, json: async () => ([]) })
+  const result = await repairRdbgaCookie({ port: 9222, expected: EXPECTED, fetchImpl, connect: async () => { throw new Error('never') } })
+  assert.equal(result.ok, false)
+  assert.match(result.error, /工作台/)
+})
+
+test('a CDP error rejects the command instead of looking like success', async () => {
+  const FakeWebSocket = fakeSocket((message) => ({ error: { code: -32000, message: `no way: ${message.method}` } }))
+  const cdp = await connectCdp('ws://fake', { WebSocketImpl: FakeWebSocket, timeout: 500 })
+  await assert.rejects(() => cdp.send('Network.setCookie', {}), (error) => error instanceof CdpError && /no way/.test(error.message))
+  cdp.close()
+})
+
+test('a browser that stops answering cannot hang the caller', async () => {
+  const FakeWebSocket = fakeSocket(() => null) // accept every command, answer none
+  const cdp = await connectCdp('ws://fake', { WebSocketImpl: FakeWebSocket, timeout: 60 })
+  const started = Date.now()
+  await assert.rejects(() => cdp.send('Network.getCookies'), /超时/)
+  assert.ok(Date.now() - started < 1000)
+  cdp.close()
+})
+
+test('closing the socket fails the commands still in flight', async () => {
+  // Whatever the browser was doing, a socket that goes away must settle the command
+  // right then — waiting for the deadline would report a misleading timeout.
+  const FakeWebSocket = fakeSocket((message, socket) => {
+    setTimeout(() => { socket.onclose?.() }, 10)
+    return null
+  })
+  const cdp = await connectCdp('ws://fake', { WebSocketImpl: FakeWebSocket, timeout: 5000 })
+  await assert.rejects(() => cdp.send('Network.getCookies'), /已关闭/)
+  cdp.close()
+})
+
+test('cookies are read for every tab, without a URL filter', async () => {
+  const seen = []
+  const connect = async () => ({
+    send: async (method, params) => { seen.push([method, params]); return { cookies: [{ name: RDBGA_NAME, value: EXPECTED, domain: '.srmdev.hanslaser.com', path: '/' }] } },
+    close: () => {},
+  })
+  const cookies = await cookiesOfTargets([{ url: 'https://a/', webSocketDebuggerUrl: 'ws://a' }, { url: 'https://b/', webSocketDebuggerUrl: 'ws://b' }], { connect })
+  assert.equal(cookies.length, 2)
+  const gets = seen.filter(([method]) => method === 'Network.getCookies')
+  assert.equal(gets.length, 2)
+  assert.equal(gets[0][1], undefined) // no `urls`: a path-scoped rdbga stays visible
+})
+
+test('read reports the tab listing error instead of an empty cookie list', async () => {
+  const read = await readRdbgaCookies({ port: 9222, fetchImpl: async () => { throw new Error('down') } })
+  assert.equal(read.ok, false)
+  assert.match(read.error, /页签/)
+})
+
+test('status text names the empty cookie as the problem', () => {
+  const text = describeRdbgaCookies([
+    { name: RDBGA_NAME, value: '', domain: 'srmdev.hanslaser.com', path: '/' },
+    { name: RDBGA_NAME, value: EXPECTED, domain: '.srmdev.hanslaser.com', path: '/' },
+  ], EXPECTED)
+  assert.match(text, /空值/)
+  assert.match(text, /正确/)
+  assert.match(text, /需要清理 1 个/)
+})
+
+test('workbench targets are matched by exact host, not by substring', async () => {
+  // A URL that merely *contains* the workbench host (trailing ".evil.com" or a query
+  // string) is not the workbench: writing there would silently target another site.
+  const fetchImpl = async () => ({
+    ok: true,
+    json: async () => ([
+      { type: 'page', url: 'https://srmdev.hanslaser.com/', webSocketDebuggerUrl: 'ws://ok' },
+      { type: 'page', url: 'https://SRMDEV.Hanslaser.com/home', webSocketDebuggerUrl: 'ws://ok2' },
+      { type: 'page', url: 'https://srmdev.hanslaser.com.evil.com/', webSocketDebuggerUrl: 'ws://evil' },
+      { type: 'page', url: 'https://evil.com/?next=https://srmdev.hanslaser.com/', webSocketDebuggerUrl: 'ws://query' },
+      { type: 'page', url: 'https://sub.srmdev.hanslaser.com/', webSocketDebuggerUrl: 'ws://sub' },
+      { type: 'page', url: 'https://srmdev.hanslaser.com/alive', webSocketDebuggerUrl: null },
+      { type: 'page', url: 'https://srmdev.hanslaser.com/no-url' },
+    ]),
+  })
+  const listed = await workbenchTargets(9222, { fetchImpl, hosts: HOSTS })
+  assert.equal(listed.ok, true)
+  assert.deepEqual(listed.targets.map((target) => target.webSocketDebuggerUrl), ['ws://ok', 'ws://ok2'])
+})
+
+test('a caller-provided target list is reused instead of listing the tabs again', async () => {
+  const fetched = []
+  const fetchImpl = async (url) => { fetched.push(url); throw new Error('must not be called') }
+  const targets = [{ url: 'https://srmdev.hanslaser.com/', webSocketDebuggerUrl: 'ws://a' }]
+  const cookies = [{ name: RDBGA_NAME, value: EXPECTED, domain: `.${WORKBENCH_HOST}`, path: '/' }]
+  const connect = async () => ({
+    send: async (method) => (method === 'Network.getCookies' ? { cookies } : {}),
+    close: () => {},
+  })
+  const read = await readRdbgaCookies({ port: 9222, targets, fetchImpl, connect, hosts: HOSTS })
+  assert.deepEqual({ ok: read.ok, cookies: read.cookies.length }, { ok: true, cookies: 1 })
+  const repaired = await repairRdbgaCookie({ port: 9222, targets, expected: EXPECTED, fetchImpl, connect, hosts: HOSTS })
+  assert.deepEqual({ ok: repaired.ok, wrote: repaired.wrote }, { ok: true, wrote: 0 })
+  assert.equal(fetched.length, 0)
+})
+
+test('the JVM query always resolves to a report instead of throwing', async () => {
+  const live = await rdbgaFromRunningJvm()
+  assert.equal(typeof live.ok, 'boolean')
+  assert.ok(Array.isArray(live.values))
+  if (live.ok === false) assert.match(live.error, /JVM|java/)
+})
+
+test('dry-run reports the plan without deleting or writing any cookie', async () => {
+  const calls = []
+  const targets = [{ url: `https://${WORKBENCH_HOST}/`, webSocketDebuggerUrl: 'ws://a' }]
+  const connectFor = (cookies) => async () => ({
+    send: async (method) => { calls.push(method); return method === 'Network.getCookies' ? { cookies } : {} },
+    close: () => {},
+  })
+  const emptyAndCorrect = [
+    { name: RDBGA_NAME, value: '', domain: WORKBENCH_HOST, path: '/' },
+    { name: RDBGA_NAME, value: EXPECTED, domain: `.${WORKBENCH_HOST}`, path: '/' },
+  ]
+  const plan = await repairRdbgaCookie({
+    port: 9222, targets, expected: EXPECTED, connect: connectFor(emptyAndCorrect), dryRun: true,
+  })
+  assert.deepEqual(
+    { ok: plan.ok, tabs: plan.tabs, removed: plan.removed, wrote: plan.wrote, dryRun: plan.dryRun },
+    { ok: true, tabs: 1, removed: 1, wrote: 0, dryRun: true },
+  )
+  assert.ok(!calls.includes('Network.deleteCookies'))
+  assert.ok(!calls.includes('Network.setCookie'))
+
+  const onlyEmpty = await repairRdbgaCookie({
+    port: 9222,
+    targets,
+    expected: EXPECTED,
+    connect: connectFor([{ name: RDBGA_NAME, value: '', domain: WORKBENCH_HOST, path: '/' }]),
+    dryRun: true,
+  })
+  assert.deepEqual({ removed: onlyEmpty.removed, wrote: onlyEmpty.wrote }, { removed: 1, wrote: 1 })
+  assert.ok(!calls.includes('Network.deleteCookies'))
+  assert.ok(!calls.includes('Network.setCookie'))
+})
+
+test('status compares as strings and tells same-prefix cookies apart', () => {
+  // The old text compared with === (a numeric cookie would look wrong) and only showed
+  // the first 12 characters, so two values sharing the prefix looked identical.
+  const near = Buffer.from(`${MODULE},/@172.20.63.131:31011`).toString('base64')
+  assert.notEqual(EXPECTED.slice(-6), near.slice(-6))
+  const text = describeRdbgaCookies([
+    { name: RDBGA_NAME, value: near, domain: `.${WORKBENCH_HOST}`, path: '/' },
+    { name: RDBGA_NAME, value: EXPECTED, domain: `.${WORKBENCH_HOST}`, path: '/' },
+  ], EXPECTED)
+  assert.match(text, /1\. /)
+  assert.match(text, /2\. /)
+  assert.match(text, /值不匹配/)
+  assert.ok(text.includes(near.slice(-6)))
+  assert.ok(text.includes(EXPECTED.slice(-6)))
+  assert.match(text, /需要清理 1 个/)
+
+  const numeric = describeRdbgaCookies(
+    [{ name: RDBGA_NAME, value: '123', domain: `.${WORKBENCH_HOST}`, path: '/' }],
+    123,
+  )
+  assert.match(numeric, /正确/)
+})
+
+test('an unknown expectation is reported as unknown instead of "all wrong"', () => {
+  const text = describeRdbgaCookies(
+    [{ name: RDBGA_NAME, value: EXPECTED, domain: `.${WORKBENCH_HOST}`, path: '/' }],
+    '',
+  )
+  assert.match(text, /无法确定/)
+  assert.match(text, /值未知/)
+  assert.doesNotMatch(text, /需要清理/)
+})

package/test/cli-stop.test.mjs

@@ -0,0 +1,40 @@
+// `yds stop` must not tear the tunnel down under a YMS it could not stop, and its
+// summary must say how much of the shared rule table actually changed (review
+// D-P1-2 / D-P2-7).
+import assert from 'node:assert/strict'
+import test from 'node:test'
+
+import { stopAbortReason, withdrawnText } from '../lib/cli.js'
+
+test('stop aborts when a live YMS pid could not be stopped', () => {
+  const reason = stopAbortReason({ stopped: false, pid: 4242, reason: '停止失败：Access is denied（已保留 pidfile）' })
+  assert.match(reason, /4242/)
+  assert.match(reason, /已中止/)
+  assert.match(reason, /--force/)
+  assert.match(reason, /Access is denied/, 'the original failure is surfaced')
+})
+
+test('stop continues when nothing is running or the stop succeeded', () => {
+  assert.equal(stopAbortReason({ stopped: false, reason: '未在运行' }), '', 'no pid => nothing to protect')
+  assert.equal(stopAbortReason({ stopped: false, pid: 0 }), '')
+  assert.equal(stopAbortReason({ stopped: true, pid: 4242 }), '')
+})
+
+test('--force overrides the guard', () => {
+  assert.equal(stopAbortReason({ stopped: false, pid: 4242, reason: 'unknown' }, { force: true }), '')
+})
+
+test('the summary reports what was withdrawn instead of a blanket claim', () => {
+  assert.match(withdrawnText({ rules: 2, hosts: 3 }), /2 条规则/)
+  assert.match(withdrawnText({ rules: 2, hosts: 3 }), /3 个 host/)
+  assert.match(withdrawnText({ rules: 2, hosts: 3 }), /全局一张表，不区分 workspace/)
+  assert.doesNotMatch(withdrawnText({ rules: 2, hosts: 3 }), /其它 workspace 的规则保留/)
+})
+
+test('a stop that changed nothing says so', () => {
+  for (const withdrawn of [{ rules: 0, hosts: 0 }, undefined, {}]) {
+    const text = withdrawnText(withdrawn)
+    assert.match(text, /共享规则表里没有 yds 规则（未改动）/)
+    assert.doesNotMatch(text, /已撤掉/)
+  }
+})