SenSu

AskaEth/SenSu

Fork 0

Commit Graph

Author	SHA1	Message	Date
qinglong	c1d2767f52	fix: web 命令端点 execute_command → process_command (方法名错误) Co-Authored-By: Claude <noreply@anthropic.com>	2026-06-13 13:54:37 +08:00
qinglong	fcac02d920	security: P2 生产深度加固 — 路径/鉴权/脱敏/校验/持久化/过期 4.3 文件管理器路径收紧: - 默认移除 Path('/') 全文件系统访问 - 仅允许项目目录 + data/ + 环境变量 SENSU_FILE_ROOTS 指定路径 3.4 插件路由鉴权修复: - _check_plugin_auth 增加 panel_token 用户身份验证 - 先验证用户登录, 再检查插件权限 4.2 错误脱敏: - security middleware 捕获异常 → 通用 'Internal server error' - 堆栈详情仅写入日志, 不暴露给客户端 4.4 命令参数校验: - POST /api/command 拒绝 shell 元字符 (;&\|`$(){}!#~<>) - 防止命令注入 4.5 Session 持久化: - 登录/退出时保存到 SenSuDB.config_kv - 框架重启后自动恢复已持久化会话 4.6 Token 过期: 24h → 2h Co-Authored-By: Claude <noreply@anthropic.com>	2026-06-13 13:50:51 +08:00
AskaEth	e6875f0b4b	Initial commit: SenSu Alpha 0.2.0 - 13-service async plugin framework - Textual TUI with CLI fallback - Plugin hot-reload + permission system - Web management panel (aiohttp) - Bridge-based inter-module communication - 10 regression tests Fixes applied: - PBKDF2-SHA256 auth (was plain SHA256) - Auth bypass removed (was allow-all on fail) - Bare excepts replaced with logged errors - CatFramework/DreamSu -> SenSu naming unified - ServiceManager: health checks + startup_order - Env var credentials (SENSU_ADMIN_PASSWORD etc)	2026-06-10 12:28:05 +08:00

Author

SHA1

Message

Date

qinglong

c1d2767f52

fix: web 命令端点 execute_command → process_command (方法名错误)

Co-Authored-By: Claude <noreply@anthropic.com>

2026-06-13 13:54:37 +08:00

qinglong

fcac02d920

security: P2 生产深度加固 — 路径/鉴权/脱敏/校验/持久化/过期

4.3 文件管理器路径收紧:
- 默认移除 Path('/') 全文件系统访问
- 仅允许项目目录 + data/ + 环境变量 SENSU_FILE_ROOTS 指定路径

3.4 插件路由鉴权修复:
- _check_plugin_auth 增加 panel_token 用户身份验证
- 先验证用户登录, 再检查插件权限

4.2 错误脱敏:
- security middleware 捕获异常 → 通用 'Internal server error'
- 堆栈详情仅写入日志, 不暴露给客户端

4.4 命令参数校验:
- POST /api/command 拒绝 shell 元字符 (;&|`$(){}!#~<>)
- 防止命令注入

4.5 Session 持久化:
- 登录/退出时保存到 SenSuDB.config_kv
- 框架重启后自动恢复已持久化会话

4.6 Token 过期: 24h → 2h

Co-Authored-By: Claude <noreply@anthropic.com>

2026-06-13 13:50:51 +08:00

AskaEth

e6875f0b4b

Initial commit: SenSu Alpha 0.2.0

- 13-service async plugin framework
- Textual TUI with CLI fallback
- Plugin hot-reload + permission system
- Web management panel (aiohttp)
- Bridge-based inter-module communication
- 10 regression tests

Fixes applied:
- PBKDF2-SHA256 auth (was plain SHA256)
- Auth bypass removed (was allow-all on fail)
- Bare excepts replaced with logged errors
- CatFramework/DreamSu -> SenSu naming unified
- ServiceManager: health checks + startup_order
- Env var credentials (SENSU_ADMIN_PASSWORD etc)

2026-06-10 12:28:05 +08:00

3 Commits