security: 配置文件模板化 — base_config.yaml 不再入库

- base_config.yaml → .gitignore (含真实密码不入库)
- 新增 base_config.yaml.example 模板 (password: CHANGE_ME)
- InitService: 检测缺失时自动从模板复制
- 首次启动自动创建配置文件

Co-Authored-By: Claude <noreply@anthropic.com>

.gitignore

@@ -12,3 +12,5 @@ _patches_applied/
 .DS_Store
 docs/
 data/
+config/framework/base_config.yaml
+!config/framework/base_config.yaml.example

config/framework/base_config.yaml.example

@@ -1,7 +1,7 @@
 framework:
   debug: true
   name: SenSu
-  version: v0.6.0
+  version: v0.7.0
 logging:
   debug_level_file: true
   level: DEBUG
@@ -22,19 +22,18 @@ auto_start_scripts:
   #   enabled: true
   #   args: []
   #   cwd: ~
+# API Keys — 服务器间通信凭证 (在 WebUI 设置页管理)
+# api_keys: []
 # TUI配置
 tui:
   enabled: true
   refresh_rate: 30
-  # TUI布局配置
   layout:
-    grid_rows: "4fr 5fr 1fr"  # 三行布局：日志区域、消息区域、输入区域的比例
-  # TUI样式配置
+    grid_rows: "4fr 5fr 1fr"
   styles:
     log_area: "border: solid green; overflow-y: auto;"
-    message_area: "border: solid yellow; overflow-y: auto;" 
+    message_area: "border: solid yellow; overflow-y: auto;"
     input_area: "border: solid red;"
-  # TUI日志显示配置
   log_display:
     max_lines: 200
 # 互联网服务配置
@@ -42,15 +41,11 @@ internet:
   websocket:
     host: "0.0.0.0"
     port: 4240
-    # 其他websocket配置...
   http:
-    host: "0.0.0.0" 
+    host: "0.0.0.0"
     port: 4200
-    # 其他http配置...
 panel:
   entrance:
     path: "/SenSu"
     username: "admin"
-    password: "admin"
-    
-    
+    password: "CHANGE_ME"  # 首次启动请修改!

config/permissions/pending_requests.json

@@ -20,5 +20,27 @@
       "framework.command.execute"
     ],
     "timestamp": 16793.53933677
+  },
+  "0262acd7": {
+    "plugin_name": "sentinel",
+    "permissions": [
+      "plugin.sentinel.read",
+      "plugin.sentinel.write",
+      "plugin.network.access",
+      "framework.event.subscribe",
+      "framework.command.execute"
+    ],
+    "timestamp": 17027.386824076
+  },
+  "900e1365": {
+    "plugin_name": "sentinel",
+    "permissions": [
+      "plugin.sentinel.read",
+      "plugin.sentinel.write",
+      "plugin.network.access",
+      "framework.event.subscribe",
+      "framework.command.execute"
+    ],
+    "timestamp": 17177.106703342
   }
 }

config/plugins/commands.yaml

@@ -93,7 +93,7 @@ commands:
     permissions:
     - framework.command.test
     source: internal
-last_updated: 16793.516549165
+last_updated: 17177.060053342
 plugin_commands:
   sentinel:
     sentinel: *id001

config/services/network_routes.yaml

@@ -1,5 +1,5 @@
 http_port: 4200
-last_updated: 16793.540021822
+last_updated: 17177.1104973
 plugin_routes:
   sentinel:
   - methods:

services/init_service.py

@@ -119,9 +119,18 @@ class InitService:
                     self.configs['base'] = yaml.safe_load(f)
                 logger.debug("基础配置加载成功")
             else:
-                logger.warning("基础配置文件不存在，使用默认配置")
-                self.configs['base'] = self._get_default_base_config()
-                self._save_config(base_config_file, self.configs['base'])
+                # 从模板复制
+                template = self.config_path / "base_config.yaml.example"
+                if template.exists():
+                    import shutil
+                    shutil.copy(template, base_config_file)
+                    logger.info(f"📋 从模板创建配置文件: {base_config_file}")
+                    with open(base_config_file, 'r', encoding='utf-8') as f:
+                        self.configs['base'] = yaml.safe_load(f)
+                else:
+                    logger.warning("基础配置文件不存在，使用默认配置")
+                    self.configs['base'] = self._get_default_base_config()
+                    self._save_config(base_config_file, self.configs['base'])
             
             # 加载权限规则
             permission_file = self.config_path / "permission_rules.yaml"