feat!: pre-handshake knock on the agent TCP ports; probes get the agent certificate public key [CI]

backend/tests/MoShiro.Backend.Tests/AddressTests.cs

@@ -1,4 +1,7 @@
 using System.Net;
+using Microsoft.Extensions.DependencyInjection;
+using MoShiro.Backend.Application;
+using MoShiro.Protocol;
 using System.Text.Json.Nodes;
 using MoShiro.TestSupport;
 
@@ -87,4 +90,14 @@ public sealed class AddressTests
         await agent.HelloAsync();
         await BackendFixture.EventuallyAsync(async () => (await AgentAsync(id))["public_host"]!.GetValue<string>() == "1.0.0.1");
     }
+
+    [Fact]
+    public async Task ProbeAgentList_CarriesTheCertificatePublicKeyTheAgentReported_ForPinningAndKnocking()
+    {
+        await using AgentSimulator agent = await _backend.ConnectAgentAsync();
+        AgentService service = _backend.Services.GetRequiredService<AgentService>();
+        ProbeAgentList list = await service.ProbeAgentsAsync(_backend.DefaultProbeId, default);
+        AgentEndpoint endpoint = Assert.Single(list.Agents, a => a.AgentId == agent.NodeId);
+        Assert.Equal(Convert.ToBase64String(agent.TlsPublicKey), endpoint.PublicKey);
+    }
 }

backend/tests/MoShiro.Backend.Tests/AgentEndToEndTests.cs

@@ -95,6 +95,19 @@ public sealed class AgentEndToEndTests
         }
     }
 
+    /// <summary>读到 0 字节（对端关闭）或者连接被重置，都算「没收到任何东西」；收到数据返回字节数。</summary>
+    internal static async Task<int> ReadOrResetAsync(Stream stream, byte[] buffer)
+    {
+        try
+        {
+            return await stream.ReadAsync(buffer).AsTask().WaitAsync(TimeSpan.FromSeconds(10));
+        }
+        catch (IOException)
+        {
+            return 0;
+        }
+    }
+
     [Fact]
     public async Task TcpDataPlane_ClosesConnectionsWithoutAValidFirstFrame()
     {
@@ -106,7 +119,7 @@ public sealed class AgentEndToEndTests
             await client.ConnectAsync(System.Net.IPAddress.Loopback, agent.App.TcpPorts[0]);
             await client.GetStream().WriteAsync(new byte[TcpWire.AuthBytes]); // 全零：magic 不对
             byte[] buffer = new byte[16];
-            Assert.Equal(0, await client.GetStream().ReadAsync(buffer).AsTask().WaitAsync(TimeSpan.FromSeconds(10)));
+            Assert.Equal(0, await ReadOrResetAsync(client.GetStream(), buffer)); // 连接被关闭：没有任何字节（Windows 上可能是 RST）
             await BackendFixture.EventuallyAsync(() => Task.FromResult(agent.App.Counters.DroppedInvalid >= 1));
         }
     }
@@ -146,7 +159,7 @@ public sealed class AgentEndToEndTests
 
             // The probe process restarts: a new session with its own streams; sequence numbers start from 0 again
             await using ProbeSimulator second = first.Restarted();
-            await second.ConnectAsync("127.0.0.1", agent.App.ControlPort, agent.TlsSpki, agent.App.UdpPorts[0], agent.NodeId);
+            await second.ConnectAsync("127.0.0.1", agent.App.ControlPort, agent.TlsPublicKey, agent.App.UdpPorts[0], agent.NodeId);
             LineTaskSet set = await second.WaitForTasksAsync(s => s.Tasks.Any(t => t.Kind == "udp_echo" && t.Port == agent.App.UdpPorts[0]));
             LineTask udp2 = set.Tasks.Single(t => t.Kind == "udp_echo");
             Assert.NotEqual(udp.StreamId, udp2.StreamId);
@@ -208,11 +221,11 @@ public sealed class AgentEndToEndTests
         await using AgentHarness agent = await AgentHarness.StartAsync(_backend);
         await agent.CreateProbeAsync();
         await using var stranger = new ProbeSimulator("prb_stranger", Fleet.Identity.NodeIdentity.Generate());
-        await Assert.ThrowsAnyAsync<Exception>(() => stranger.ConnectAsync("127.0.0.1", agent.App.ControlPort, agent.TlsSpki, agent.App.UdpPorts[0], agent.NodeId));
+        await Assert.ThrowsAnyAsync<Exception>(() => stranger.ConnectAsync("127.0.0.1", agent.App.ControlPort, agent.TlsPublicKey, agent.App.UdpPorts[0], agent.NodeId));
 
-        // 证书指纹不对（中间人）也不会连上
+        // 证书公钥不对（中间人）也不会连上
         await using ProbeSimulator probe = await agent.CreateProbeAsync();
-        await Assert.ThrowsAnyAsync<Exception>(() => probe.ConnectAsync("127.0.0.1", agent.App.ControlPort, new byte[32], agent.App.UdpPorts[0], agent.NodeId));
+        await Assert.ThrowsAnyAsync<Exception>(() => probe.ConnectAsync("127.0.0.1", agent.App.ControlPort, Fleet.Identity.NodeIdentity.Generate().PublicKeySpki, agent.App.UdpPorts[0], agent.NodeId));
     }
 
     [Fact]

backend/tests/MoShiro.Backend.Tests/AgentHarness.cs

@@ -39,7 +39,7 @@ public sealed class AgentHarness : IAsyncDisposable
 
     public string DataDirectory => _directory;
 
-    public byte[] TlsSpki => Convert.FromBase64String(_identity.File.TlsSpki);
+    public byte[] TlsPublicKey => _identity.Certificate.PublicKey.ExportSubjectPublicKeyInfo();
 
     public static async Task<AgentHarness> StartAsync(BackendFixture backend, Action<AgentConfig>? configure = null, string? name = null)
     {
@@ -85,7 +85,7 @@ public sealed class AgentHarness : IAsyncDisposable
     public async Task<ProbeSimulator> ConnectProbeAsync()
     {
         ProbeSimulator probe = await CreateProbeAsync();
-        await probe.ConnectAsync("127.0.0.1", App.ControlPort, TlsSpki, App.UdpPorts[0], NodeId);
+        await probe.ConnectAsync("127.0.0.1", App.ControlPort, TlsPublicKey, App.UdpPorts[0], NodeId);
         return probe;
     }
 

backend/tests/MoShiro.Backend.Tests/ArchitectureTests.cs

@@ -104,7 +104,8 @@ public sealed class ArchitectureTests
         Assert.Equal(["Fleet.Hosting", "Fleet.Link", "MoShiro.Measurement"], probe.ProjectReferences.Order().ToArray());
 
         // 两个节点的共享库只依赖协议
-        Assert.Equal(["MoShiro.Protocol"], Get("MoShiro.Measurement").ProjectReferences.ToArray());
+        // 测量库在 TCP 数据面上做预握手敲门，所以直接引用 Fleet.Identity（节点侧库）
+        Assert.Equal(["Fleet.Identity", "MoShiro.Protocol"], Get("MoShiro.Measurement").ProjectReferences.Order().ToArray());
 
         // 节点一侧的库没有运行时依赖包，并使用节点禁用列表（不能用 HttpClient、Process、写文件；唯一的写文件豁免在 ConfigStore）
         foreach (string name in new[] { "Fleet.Link", "Fleet.Hosting", "MoShiro.Measurement", "MoShiro.Agent", "MoShiro.Probe" })