chore: 保存 Agent 安全优化前基线

test/components/AiTerminalPanel.test.tsx

@@ -92,7 +92,9 @@ describe('terminal Agent CLI panel', () => {
     })
     fireEvent.click(screen.getByRole('button', { name: '发送' }))
 
-    await waitFor(() => expect(mockDesktopApi.sshExec).toHaveBeenCalledWith('ssh-active-1', 'uptime'))
+    await waitFor(() =>
+      expect(mockDesktopApi.sshExec).toHaveBeenCalledWith('ssh-active-1', 'uptime', { fromAgent: true })
+    )
     expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
     expect(await screen.findByText('load average: 0.01')).toBeVisible()
     expect(await screen.findByText('负载正常，任务完成。')).toBeVisible()
@@ -102,7 +104,12 @@ describe('terminal Agent CLI panel', () => {
 
   it('asks for confirmation for high-risk commands in the default relaxed mode', async () => {
     vi.mocked(mockDesktopApi.aiComplete)
-      .mockResolvedValueOnce({ success: true, text: '```bash\nsystemctl restart nginx\n```', model: 'test', redactedCount: 0 })
+      .mockResolvedValueOnce({
+        success: true,
+        text: '```bash\nsystemctl restart nginx\n```',
+        model: 'test',
+        redactedCount: 0,
+      })
       .mockResolvedValueOnce({ success: true, text: 'FINAL: nginx 已重启。', model: 'test', redactedCount: 0 })
     vi.mocked(mockDesktopApi.sshExec).mockResolvedValueOnce({ success: true, result: 'ok', exitCode: 0 })
 
@@ -129,8 +136,18 @@ describe('terminal Agent CLI panel', () => {
 
   it('Always skips confirmation for the same command shape in the current panel session', async () => {
     vi.mocked(mockDesktopApi.aiComplete)
-      .mockResolvedValueOnce({ success: true, text: '```bash\nrm /tmp/tmp.AAA111\n```', model: 'test', redactedCount: 0 })
-      .mockResolvedValueOnce({ success: true, text: '```bash\nrm /tmp/tmp.BBB222\n```', model: 'test', redactedCount: 0 })
+      .mockResolvedValueOnce({
+        success: true,
+        text: '```bash\nrm /tmp/tmp.AAA111\n```',
+        model: 'test',
+        redactedCount: 0,
+      })
+      .mockResolvedValueOnce({
+        success: true,
+        text: '```bash\nrm /tmp/tmp.BBB222\n```',
+        model: 'test',
+        redactedCount: 0,
+      })
       .mockResolvedValueOnce({ success: true, text: 'FINAL: 清理完成。', model: 'test', redactedCount: 0 })
     vi.mocked(mockDesktopApi.sshExec)
       .mockResolvedValueOnce({ success: true, result: 'ok', exitCode: 0 })
@@ -151,8 +168,12 @@ describe('terminal Agent CLI panel', () => {
 
     const dialog = await screen.findByRole('dialog')
     fireEvent.click(within(dialog).getByRole('button', { name: 'Always' }))
-    await waitFor(() => expect(mockDesktopApi.sshExec).toHaveBeenCalledWith('ssh-active-1', 'rm /tmp/tmp.AAA111'))
-    await waitFor(() => expect(mockDesktopApi.sshExec).toHaveBeenCalledWith('ssh-active-1', 'rm /tmp/tmp.BBB222'))
+    await waitFor(() =>
+      expect(mockDesktopApi.sshExec).toHaveBeenCalledWith('ssh-active-1', 'rm /tmp/tmp.AAA111', { fromAgent: true })
+    )
+    await waitFor(() =>
+      expect(mockDesktopApi.sshExec).toHaveBeenCalledWith('ssh-active-1', 'rm /tmp/tmp.BBB222', { fromAgent: true })
+    )
     expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
     expect(await screen.findByText('清理完成。')).toBeVisible()
   })
@@ -356,7 +377,9 @@ describe('terminal Agent CLI panel', () => {
     fireEvent.change(screen.getByPlaceholderText(PLACEHOLDER), { target: { value: '查看时间' } })
     fireEvent.click(screen.getByRole('button', { name: '发送' }))
 
-    await waitFor(() => expect(mockDesktopApi.sshExec).toHaveBeenCalledWith('ssh-active-1', 'date'))
+    await waitFor(() =>
+      expect(mockDesktopApi.sshExec).toHaveBeenCalledWith('ssh-active-1', 'date', { fromAgent: true })
+    )
     fireEvent.click(screen.getByRole('button', { name: '停止' }))
 
     expect(mockDesktopApi.sshExecCancel).toHaveBeenCalledWith('ssh-active-1')

test/components/SessionTreeOrder.test.tsx

@@ -0,0 +1,190 @@
+import { fireEvent, render, screen, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import Sidebar from '../../src/components/layout/Sidebar'
+import { useSessionStore, type Session } from '../../src/stores/sessionStore'
+import { useTabStore } from '../../src/stores/tabStore'
+import { unlockProForTests } from '../helpers/entitlement'
+import { mockDesktopApi } from '../setup'
+
+function makeSession(overrides: Partial<Session> & Pick<Session, 'id' | 'name'>): Session {
+  return {
+    host: `${overrides.id}.example.com`,
+    port: 22,
+    username: 'root',
+    authType: 'key',
+    ...overrides,
+  }
+}
+
+function rowOf(name: string): HTMLElement {
+  const row = screen.getByText(name).closest('[data-session-row]')
+  if (!row) throw new Error(`session row not found: ${name}`)
+  return row as HTMLElement
+}
+
+function mockElementFromPoint(target: Element) {
+  const original = document.elementFromPoint
+  Object.defineProperty(document, 'elementFromPoint', {
+    configurable: true,
+    value: vi.fn(() => target),
+  })
+  return () => {
+    Object.defineProperty(document, 'elementFromPoint', {
+      configurable: true,
+      value: original,
+    })
+  }
+}
+
+/** Pointer-drag a session row onto `dropOn` (WKWebView-safe path, not HTML5 DnD). */
+function pointerDrag(fromName: string, dropOn: Element) {
+  const source = rowOf(fromName)
+  const restore = mockElementFromPoint(dropOn)
+  fireEvent.pointerDown(source, { button: 0, pointerId: 1, clientX: 10, clientY: 10 })
+  fireEvent.pointerMove(source, { pointerId: 1, clientX: 30, clientY: 40 })
+  fireEvent.pointerUp(source, { button: 0, pointerId: 1, clientX: 30, clientY: 40 })
+  restore()
+}
+
+describe('sidebar session manual order', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    unlockProForTests()
+    window.opsxApi = mockDesktopApi
+    useSessionStore.setState({ sessions: [] })
+    useTabStore.setState({
+      tabs: [{ id: 'welcome', title: '欢迎', type: 'welcome', isActive: true }],
+      activeTabId: 'welcome',
+    })
+  })
+
+  function loadSessions(sessions: Session[]) {
+    vi.mocked(mockDesktopApi.sessionGetAll).mockResolvedValueOnce({ success: true, sessions })
+  }
+
+  function renderSidebar() {
+    render(<Sidebar onNewSession={vi.fn()} onQuickConnect={vi.fn()} onEditSession={vi.fn()} />)
+  }
+
+  it('renders groups in manual order with legacy rows kept after ordered ones', async () => {
+    loadSessions([
+      makeSession({ id: 'pre-jenkins', name: 'pre-jenkins', sortOrder: 2 }),
+      makeSession({ id: 'pre-monitor', name: 'pre-monitor', sortOrder: 0 }),
+      makeSession({ id: 'legacy-host', name: 'legacy-host' }),
+    ])
+    renderSidebar()
+
+    await screen.findByText('pre-monitor')
+    const group = document.getElementById('session-group-default')!
+    const names = within(group)
+      .getAllByText(/pre-jenkins|pre-monitor|legacy-host/)
+      .map((node) => node.textContent)
+    expect(names).toEqual(['pre-monitor', 'pre-jenkins', 'legacy-host'])
+  })
+
+  it('persists a within-group drag as one batch reorder', async () => {
+    loadSessions([
+      makeSession({ id: 'a', name: 'alpha', sortOrder: 0 }),
+      makeSession({ id: 'b', name: 'bravo', sortOrder: 1 }),
+      makeSession({ id: 'c', name: 'charlie', sortOrder: 2 }),
+    ])
+    renderSidebar()
+    await screen.findByText('alpha')
+
+    // jsdom rows report a zero rect, so a drop resolves to "insert after".
+    pointerDrag('charlie', rowOf('alpha'))
+
+    await vi.waitFor(() => {
+      expect(mockDesktopApi.sessionReorder).toHaveBeenCalledWith([
+        { id: 'a', sortOrder: 0 },
+        { id: 'c', sortOrder: 1 },
+        { id: 'b', sortOrder: 2 },
+      ])
+    })
+    // The store keeps its element order; the persisted sortOrders define display order.
+    const order = new Map(useSessionStore.getState().sessions.map((session) => [session.id, session.sortOrder]))
+    expect(order.get('a')).toBe(0)
+    expect(order.get('c')).toBe(1)
+    expect(order.get('b')).toBe(2)
+  })
+
+  it('moves a session into another group via its header', async () => {
+    loadSessions([
+      makeSession({ id: 'a', name: 'alpha', sortOrder: 0 }),
+      makeSession({ id: 'b', name: 'bravo', sortOrder: 1, group: 'prod' }),
+    ])
+    renderSidebar()
+    await screen.findByText('alpha')
+
+    pointerDrag('alpha', screen.getByText('prod'))
+
+    await vi.waitFor(() => {
+      expect(mockDesktopApi.sessionReorder).toHaveBeenCalledWith([
+        { id: 'b', sortOrder: 0 },
+        { id: 'a', sortOrder: 1, group: 'prod' },
+      ])
+    })
+    expect(useSessionStore.getState().sessions.find((session) => session.id === 'a')?.group).toBe('prod')
+  })
+
+  it('inserts a session among hosts already in another group', async () => {
+    loadSessions([
+      makeSession({ id: 'a', name: 'alpha', sortOrder: 0 }),
+      makeSession({ id: 'b', name: 'bravo', sortOrder: 0, group: 'test' }),
+      makeSession({ id: 'c', name: 'charlie', sortOrder: 1, group: 'test' }),
+    ])
+    renderSidebar()
+    await screen.findByText('alpha')
+    fireEvent.click(screen.getByText('test'))
+    await screen.findByText('bravo')
+
+    pointerDrag('alpha', rowOf('bravo'))
+
+    await vi.waitFor(() => {
+      expect(mockDesktopApi.sessionReorder).toHaveBeenCalledWith([
+        { id: 'b', sortOrder: 0 },
+        { id: 'a', sortOrder: 1, group: 'test' },
+        { id: 'c', sortOrder: 2 },
+      ])
+    })
+    expect(useSessionStore.getState().sessions.find((session) => session.id === 'a')?.group).toBe('test')
+  })
+
+  it('sorts a group by name from the group context menu', async () => {
+    const user = userEvent.setup()
+    loadSessions([
+      makeSession({ id: 'b', name: 'bravo' }),
+      makeSession({ id: 'g', name: 'gamma' }),
+      makeSession({ id: 'a', name: 'alpha' }),
+    ])
+    renderSidebar()
+    await screen.findByText('bravo')
+
+    await user.pointer([{ keys: '[MouseRight>]', target: screen.getByText('默认分组') }, { keys: '[/MouseRight]' }])
+    await user.click(screen.getByRole('button', { name: '按名称排序' }))
+
+    await vi.waitFor(() => {
+      expect(mockDesktopApi.sessionReorder).toHaveBeenCalledWith([
+        { id: 'a', sortOrder: 0 },
+        { id: 'b', sortOrder: 1 },
+        { id: 'g', sortOrder: 2 },
+      ])
+    })
+  })
+
+  it('skips the reorder write when the drop changes nothing', async () => {
+    loadSessions([
+      makeSession({ id: 'a', name: 'alpha', sortOrder: 0 }),
+      makeSession({ id: 'b', name: 'bravo', sortOrder: 1 }),
+    ])
+    renderSidebar()
+    await screen.findByText('alpha')
+
+    // Dropping bravo after itself-equivalent position (after bravo) is a no-op.
+    pointerDrag('bravo', rowOf('bravo'))
+
+    await Promise.resolve()
+    expect(mockDesktopApi.sessionReorder).not.toHaveBeenCalled()
+  })
+})

test/components/ShellClosedOverlay.test.tsx

@@ -12,4 +12,13 @@ describe('remote shell close recovery', () => {
     fireEvent.click(screen.getByRole('button', { name: '重新打开 Shell' }))
     expect(reopen).toHaveBeenCalledTimes(1)
   })
+
+  it('local shell exit never mentions the SSH connection', () => {
+    const reopen = vi.fn()
+    render(<ShellClosedOverlay reason="本地 Shell 已退出" idleTimeout={false} isLocal onReopen={reopen} />)
+
+    expect(screen.getByText('Shell 已退出')).toBeVisible()
+    expect(screen.getByText('重新打开 Shell 即可继续使用本地终端')).toBeVisible()
+    expect(screen.queryByText(/SSH 连接仍可用/)).toBeNull()
+  })
 })