Nexus Deploy
b866e944ab
Apply sync/install/auth/schedule/retry/agent/settings fixes from full code review; document accepted WS and Agent legacy risks for solo ops. Co-authored-by: Cursor <cursoragent@cursor.com>
42 lines
1.3 KiB
Markdown
42 lines
1.3 KiB
Markdown
# 审计 — 2026-06-04 Code Review P1/P2 批次 3
|
|
|
|
## Step 3 规则扫描
|
|
|
|
| H | 规则 | 结论 |
|
|
|---|------|------|
|
|
| H1 | 脚本并行 AsyncSession | FIXED script_service 预加载 server_map |
|
|
| H2 | Settings 敏感项泄露 | FIXED value="" + value_set |
|
|
| H3 | 空 PUT 清空 token | FIXED 敏感项空值 no-op |
|
|
| H4 | Agent unknown server + global | FIXED 必须存在 server；无 key 才 legacy global |
|
|
| H5 | WS 关闭码混用 | FIXED 无效 JWT 4401 |
|
|
| H6 | FE Telegram token 明文进表单 | FIXED draft + reveal |
|
|
|
|
## Closure
|
|
|
|
| H | 判定 | 依据 |
|
|
|---|------|------|
|
|
| H1 | FIXED | `_dispatch_to_servers` / `_attach_remote_logs` 并行前 `server_map` |
|
|
| H2 | FIXED | `_format_setting_response` SENSITIVE_KEYS |
|
|
| H3 | FIXED | `set_setting` 337-342 行空值分支 |
|
|
| H4 | FIXED | `_verify_server_api_key` server 不存在 return False |
|
|
| H5 | FIXED | websocket.py / webssh.py 4401 |
|
|
| H6 | FIXED | SettingsPage.vue telegramTokenDraft + reveal-token |
|
|
|
|
## 改动文件清单
|
|
|
|
- `server/application/services/script_service.py`
|
|
- `server/api/settings.py`
|
|
- `server/api/agent.py`
|
|
- `server/api/websocket.py`
|
|
- `server/api/webssh.py`
|
|
- `frontend/src/pages/SettingsPage.vue`
|
|
- `frontend/src/types/api.ts`
|
|
|
|
## DoD
|
|
|
|
- [x] ruff 零错误（批次 3 文件）
|
|
- [x] import server.main
|
|
- [x] pytest 28 passed
|
|
- [x] vue-tsc 通过
|
|
- [x] changelog ≥10 行
|