# 审计 — 2026-06-04 Code Review P1/P2 批次 3

## Step 3 规则扫描

| H | 规则 | 结论 |
|---|------|------|
| H1 | 脚本并行 AsyncSession | FIXED script_service 预加载 server_map |
| H2 | Settings 敏感项泄露 | FIXED value="" + value_set |
| H3 | 空 PUT 清空 token | FIXED 敏感项空值 no-op |
| H4 | Agent unknown server + global | FIXED 必须存在 server；无 key 才 legacy global |
| H5 | WS 关闭码混用 | FIXED 无效 JWT 4401 |
| H6 | FE Telegram token 明文进表单 | FIXED draft + reveal |

## Closure

| H | 判定 | 依据 |
|---|------|------|
| H1 | FIXED | `_dispatch_to_servers` / `_attach_remote_logs` 并行前 `server_map` |
| H2 | FIXED | `_format_setting_response` SENSITIVE_KEYS |
| H3 | FIXED | `set_setting` 337-342 行空值分支 |
| H4 | FIXED | `_verify_server_api_key` server 不存在 return False |
| H5 | FIXED | websocket.py / webssh.py 4401 |
| H6 | FIXED | SettingsPage.vue telegramTokenDraft + reveal-token |

## 改动文件清单

- `server/application/services/script_service.py`
- `server/api/settings.py`
- `server/api/agent.py`
- `server/api/websocket.py`
- `server/api/webssh.py`
- `frontend/src/pages/SettingsPage.vue`
- `frontend/src/types/api.ts`

## DoD

- [x] ruff 零错误（批次 3 文件）
- [x] import server.main
- [x] pytest 28 passed
- [x] vue-tsc 通过
- [x] changelog ≥10 行
