iven
|
e10549a1b9
|
fix: 发布前审计 Batch 2 — Debug遮蔽 + unwrap + 静默吞错 + MCP锁 + 索引 + Config验证
安全:
- LlmConfig 自定义 Debug impl，api_key 显示为 "***REDACTED***"
- tsconfig.json 移除 ErrorBoundary.tsx 排除项（安全关键组件）
- billing/handlers.rs Response builder unwrap → map_err 错误传播
- classroom_commands/mod.rs db_path.parent().unwrap() → ok_or_else
静默吞错:
- approvals.rs 3处 warn→error（审批状态丢失是严重事件）
- events.rs publish() 添加 Event dropped debug 日志
- mcp_transport.rs eprintln→tracing::warn (僵尸进程风险)
- zclaw-growth sqlite.rs 4处迁移：区分 duplicate column name 与真实错误
MCP Transport:
- 合并 stdin+stdout 为单一 Mutex<TransportHandles>
- send_request write-then-read 原子化，防止并发响应错配
数据库:
- 新迁移 20260418000001: idx_rle_created_at + idx_billing_sub_plan + idx_ki_created_by
配置验证:
- SaaSConfig::load() 添加 jwt_expiration_hours>=1, max_connections>0, min<=max
|
2026-04-18 14:09:36 +08:00 |
|
iven
|
88172aa651
|
feat(classroom): add SQLite persistence + security hardening
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
M11-03: Classroom data persistence
- New persist.rs: SQLite-backed ClassroomPersistence with open/load_all/save
- Schema: classrooms (JSON blob) + classroom_chats tables
- generate.rs: auto-persist classroom after generation
- chat.rs: auto-persist chat messages after each exchange
- mod.rs: init_persistence() for app setup integration
M1-01: Gemini API key now uses x-goog-api-key header
- No longer leaks API key in URL query params or debug logs
M1-03/04: Mutex unwrap() replaced with unwrap_or_else(|e| e.into_inner())
- MemoryMiddleware and LoopGuardMiddleware recover from poison
M2-08: Agent creation input validation
- Reject empty names, out-of-range temperature (0-2), zero max_tokens
M11-06: Classroom chat message ID uses crypto.randomUUID()
|
2026-04-04 19:26:59 +08:00 |
|
iven
|
28299807b6
|
fix(desktop): DeerFlow UI — ChatArea refactor + ai-elements + dead CSS cleanup
ChatArea retry button uses setInput instead of direct sendToGateway,
fix bootstrap spinner stuck for non-logged-in users,
remove dead CSS (aurora-title/sidebar-open/quick-action-chips),
add ai components (ReasoningBlock/StreamingText/ChatMode/ModelSelector/TaskProgress),
add ClassroomPlayer + ResizableChatLayout + artifact panel
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
2026-04-02 19:24:44 +08:00 |
|