fix: Code Review P0/P1 batches 1-3 and single-operator risk acceptance

Apply sync/install/auth/schedule/retry/agent/settings fixes from full code review; document accepted WS and Agent legacy risks for solo ops. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-04 15:57:49 +08:00
parent a2ae74d582
commit b866e944ab
36 changed files with 1111 additions and 242 deletions
@@ -0,0 +1,60 @@
+# 审计 — 2026-06-04 Code Review 生产部署
+
+## Step 3 规则扫描
+
+| H | 规则 | 结论 |
+|---|------|------|
+| H1 | P0/P1 batch1 | FIXED — sync session、install token、源路径、refresh、schedule、primary lock |
+| H2 | P1/P2 batch2 | FIXED — webssh tv、retry/schedule lock、agent fail-closed、bing、install status |
+| H3 | P1/P2 batch3 | FIXED — script session、settings 脱敏、agent unknown server、WS 4401 |
+| H4 | 风险接受 | DOC — risk-acceptance-single-operator.md |
+
+## Closure
+
+| H | 判定 | 依据 |
+|---|------|------|
+| H1-H3 | FIXED | docs/changelog/2026-06-04-code-review-*.md |
+| H4 | ACCEPTED | 单人运维 WS ADR-011 + Agent global legacy |
+
+## 改动文件清单（Gate 7）
+
+### 后端
+- sync_engine_v2.py
+- posix_paths.py
+- install.py
+- auth_service.py
+- sync_v2.py
+- main.py
+- schedule_runner.py
+- retry_runner.py
+- agent.py
+- settings.py
+- websocket.py
+- webssh.py
+- script_service.py
+
+### 前端
+- LoginPage.vue
+- usePushProgress.ts
+- useServerList.ts
+- CommandsPage.vue
+- CredentialsPage.vue
+- DashboardPage.vue
+- ScriptsPage.vue
+- SettingsPage.vue
+- api.ts
+
+### 静态 / 测试
+- install.html
+- test_security_unit.py
+- test_retry_runner_outcome.py
+
+### 部署
+- deploy-production.sh
+
+## DoD
+
+- [x] ruff / pytest 28 passed（.venv）
+- [x] vue-tsc 通过
+- [x] changelog + audit 齐全
+- [ ] 生产 /health + /app/ 200（部署后）