From 557135c376f048eb60b26d07cfbbf4bf0e35dfb0 Mon Sep 17 00:00:00 2001
From: qinglong <qinglong@@users.noreply.github.com>
Date: Sat, 13 Jun 2026 15:20:14 +0800
Subject: [PATCH] =?UTF-8?q?security:=20=E9=85=8D=E7=BD=AE=E6=96=87?=
 =?UTF-8?q?=E4=BB=B6=E6=A8=A1=E6=9D=BF=E5=8C=96=20=E2=80=94=20base=5Fconfi?=
 =?UTF-8?q?g.yaml=20=E4=B8=8D=E5=86=8D=E5=85=A5=E5=BA=93?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- base_config.yaml → .gitignore (含真实密码不入库)
- 新增 base_config.yaml.example 模板 (password: CHANGE_ME)
- InitService: 检测缺失时自动从模板复制
- 首次启动自动创建配置文件

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .gitignore                                    |  2 ++
 ...e_config.yaml => base_config.yaml.example} | 19 ++++++----------
 config/permissions/pending_requests.json      | 22 +++++++++++++++++++
 config/plugins/commands.yaml                  |  2 +-
 config/services/network_routes.yaml           |  2 +-
 services/init_service.py                      | 15 ++++++++++---
 6 files changed, 45 insertions(+), 17 deletions(-)
 rename config/framework/{base_config.yaml => base_config.yaml.example} (69%)

diff --git a/.gitignore b/.gitignore
index 95d172c..6cb02ee 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,3 +12,5 @@ _patches_applied/
 .DS_Store
 docs/
 data/
+config/framework/base_config.yaml
+!config/framework/base_config.yaml.example
diff --git a/config/framework/base_config.yaml b/config/framework/base_config.yaml.example
similarity index 69%
rename from config/framework/base_config.yaml
rename to config/framework/base_config.yaml.example
index 2ac0282..fad04b6 100644
--- a/config/framework/base_config.yaml
+++ b/config/framework/base_config.yaml.example
@@ -1,7 +1,7 @@
 framework:
   debug: true
   name: SenSu
-  version: v0.6.0
+  version: v0.7.0
 logging:
   debug_level_file: true
   level: DEBUG
@@ -22,19 +22,18 @@ auto_start_scripts:
   #   enabled: true
   #   args: []
   #   cwd: ~
+# API Keys — 服务器间通信凭证 (在 WebUI 设置页管理)
+# api_keys: []
 # TUI配置
 tui:
   enabled: true
   refresh_rate: 30
-  # TUI布局配置
   layout:
-    grid_rows: "4fr 5fr 1fr"  # 三行布局：日志区域、消息区域、输入区域的比例
-  # TUI样式配置
+    grid_rows: "4fr 5fr 1fr"
   styles:
     log_area: "border: solid green; overflow-y: auto;"
-    message_area: "border: solid yellow; overflow-y: auto;" 
+    message_area: "border: solid yellow; overflow-y: auto;"
     input_area: "border: solid red;"
-  # TUI日志显示配置
   log_display:
     max_lines: 200
 # 互联网服务配置
@@ -42,15 +41,11 @@ internet:
   websocket:
     host: "0.0.0.0"
     port: 4240
-    # 其他websocket配置...
   http:
-    host: "0.0.0.0" 
+    host: "0.0.0.0"
     port: 4200
-    # 其他http配置...
 panel:
   entrance:
     path: "/SenSu"
     username: "admin"
-    password: "admin"
-    
-    
\ No newline at end of file
+    password: "CHANGE_ME"  # 首次启动请修改!
diff --git a/config/permissions/pending_requests.json b/config/permissions/pending_requests.json
index 0e24af5..edccd72 100644
--- a/config/permissions/pending_requests.json
+++ b/config/permissions/pending_requests.json
@@ -20,5 +20,27 @@
       "framework.command.execute"
     ],
     "timestamp": 16793.53933677
+  },
+  "0262acd7": {
+    "plugin_name": "sentinel",
+    "permissions": [
+      "plugin.sentinel.read",
+      "plugin.sentinel.write",
+      "plugin.network.access",
+      "framework.event.subscribe",
+      "framework.command.execute"
+    ],
+    "timestamp": 17027.386824076
+  },
+  "900e1365": {
+    "plugin_name": "sentinel",
+    "permissions": [
+      "plugin.sentinel.read",
+      "plugin.sentinel.write",
+      "plugin.network.access",
+      "framework.event.subscribe",
+      "framework.command.execute"
+    ],
+    "timestamp": 17177.106703342
   }
 }
\ No newline at end of file
diff --git a/config/plugins/commands.yaml b/config/plugins/commands.yaml
index 79db232..76aca92 100644
--- a/config/plugins/commands.yaml
+++ b/config/plugins/commands.yaml
@@ -93,7 +93,7 @@ commands:
     permissions:
     - framework.command.test
     source: internal
-last_updated: 16793.516549165
+last_updated: 17177.060053342
 plugin_commands:
   sentinel:
     sentinel: *id001
diff --git a/config/services/network_routes.yaml b/config/services/network_routes.yaml
index c15c4e2..fe6c6e1 100644
--- a/config/services/network_routes.yaml
+++ b/config/services/network_routes.yaml
@@ -1,5 +1,5 @@
 http_port: 4200
-last_updated: 16793.540021822
+last_updated: 17177.1104973
 plugin_routes:
   sentinel:
   - methods:
diff --git a/services/init_service.py b/services/init_service.py
index 2fd5ee2..c3bd043 100644
--- a/services/init_service.py
+++ b/services/init_service.py
@@ -119,9 +119,18 @@ class InitService:
                     self.configs['base'] = yaml.safe_load(f)
                 logger.debug("基础配置加载成功")
             else:
-                logger.warning("基础配置文件不存在，使用默认配置")
-                self.configs['base'] = self._get_default_base_config()
-                self._save_config(base_config_file, self.configs['base'])
+                # 从模板复制
+                template = self.config_path / "base_config.yaml.example"
+                if template.exists():
+                    import shutil
+                    shutil.copy(template, base_config_file)
+                    logger.info(f"📋 从模板创建配置文件: {base_config_file}")
+                    with open(base_config_file, 'r', encoding='utf-8') as f:
+                        self.configs['base'] = yaml.safe_load(f)
+                else:
+                    logger.warning("基础配置文件不存在，使用默认配置")
+                    self.configs['base'] = self._get_default_base_config()
+                    self._save_config(base_config_file, self.configs['base'])
             
             # 加载权限规则
             permission_file = self.config_path / "permission_rules.yaml"