Your Name
aa65f10c52
Audit docs:
- docs/reports/audit-phase-2{a-j}-line-walk.md: per-file line walk findings
- docs/reports/audit-phase-2-findings-matrix.md: 63 findings (52 fixed, 3 partial, 7 accepted)
- docs/reports/2026-05-23-full-audit-report.md: full audit consolidation
- docs/reports/audit-full-vs-phase2-reconciliation.md: cross-reference
- docs/reports/audit-phase-2-walk-closure.md: closure sign-off
Project docs:
- docs/project/phase-2-audit-remediation.md: SSOT for all fixes
- docs/project/alert-push-policy.md: dashboard alert design decisions
- docs/project/production-verification-checklist.md: first-deploy checklist
- docs/project/script-execution.md: script platform design
- docs/project/wsl-integration-test.md: WSL code-only verification guide
- docs/project/line-walk-audit-standard.md: audit methodology
- docs/project/mysql-mcp-setup.md: MCP config guide
Changelogs: 18 entries (2026-05-22 to 2026-05-23)
Project memory: CLAUDE.md, AGENTS.md updated to reflect current state
Deploy: nginx_https.conf template updated
Co-authored-by: Cursor <cursoragent@cursor.com>
1.7 KiB
1.7 KiB
Changelog — Phase 2 汇总表修复队列（第二批）
日期: 2026-05-22
修复项
| ID | 问题 | 修复 |
|---|---|---|
| F2f-04 | 压测脚本硬编码 API Key | quick_load.py / load_test.py 改读 NEXUS_API_KEY、NEXUS_TEST_BASE 环境变量 |
| F2e-01 | servers.html category 未 esc |
${esc(s.category||'--')} |
| F2e-02 | settings.html saveSetting onclick 注入 |
data-setting-key + escAttr + 事件委托 |
| F2e-07 | scripts.html category 未 esc |
${esc(s.category||'ops')} |
| F2f-02 | Agent 空 API_KEY 不鉴权 | 启动时无 key 则 sys.exit(1)；verify_api_key 始终校验 |
| F2f-03 | Agent 默认 0.0.0.0 | 默认 127.0.0.1（agent.py、config.example.json、install.sh） |
| F2a-12 | 生成 agent key 暴露面 | API 增加 display_once/message；列表仍掩码；编辑表单不填掩码值，生成后剪贴板+待保存 |
未在本批处理（仍 OPEN）
- F2f-01：子机
/execsubprocess_shell（设计面，需文档/网络隔离） - F2a-05/18、F2e-03/04：WS URL 带 token
- F2a-10/F2d-02：全局 JWT 中间件
- F2e-05/06：localStorage JWT、CDN SRI
运维提醒
- 轮换 API Key：旧密钥曾出现在 git 历史的压测脚本中，请在生产
.env/ settings 表轮换API_KEY。 - 压测：
NEXUS_API_KEY=xxx python tests/load_test.py --concurrency 50 --duration 30 - 已有 Agent 若需中心机访问：在
config.json将server.host改为0.0.0.0并配合防火墙。
涉及文件
tests/quick_load.py,tests/load_test.pyweb/app/servers.html,settings.html,scripts.htmlweb/agent/agent.py,config.example.json,install.shserver/api/servers.py