f7b4908322
security: 公网生产环境加固 — P0/P1 全部修复
...
API 认证 (16 个未保护端点 → 全部加 panel_auth):
- 文件管理器: 11 端点 (list/mkdir/delete/upload/download/read/write/...)
- 项目管理: 6 端点 (list/run/stop/logs/stdin/page), 修复硬编码路径前缀
- 代理管理: 3 端点 (list/add/remove)
- 系统状态: 2 HTTP + 1 WS (token 校验)
- 插件页面: 3 端点 (page/sse/event)
- 内部路由: 3 端点 (plugins/commands/data)
认证系统加固:
- 密码哈希: 固定盐 → 每用户独立 secrets.token_hex(16) 随机盐
- 默认密码警告: 启动时检测并打印 critical 级别日志
- 登录频率限制: 5 次失败 / IP → 锁定 60 秒, 返回 429
基础设施:
- 安全响应头: X-Content-Type-Options/X-Frame-Options/X-XSS-Protection/Referrer-Policy
- WebSocket 鉴权: query string token 校验
Co-Authored-By: Claude <noreply@anthropic.com >
2026-06-13 13:37:14 +08:00
2d0a37ba19
feat(v0.4): TUI 系统监控面板 + 插件状态面板
...
v0.4.1 系统监控面板:
- 复用共享 SystemInfoCollector (TUI + Web面板同一数据源)
- CPU/MEM 彩色进度条 + 网络实时速率
- 2 秒刷新，set_interval 驱动
v0.4.2 插件状态面板:
- 展示已加载插件的名称/版本/命令数
- 3 秒刷新，PluginService 延迟注入
SystemInfoCollector:
- 注册为共享服务 (sys_collector)
- Web panel status.py 优先从 service_manager 获取
- 零重复数据采集
TUI 布局升级: 3行 → 4行 (monitor + log + message + input)
Co-Authored-By: Claude <noreply@anthropic.com >
2026-06-13 11:05:56 +08:00
4a989bf50f
feat: WS实时推送、网速双线图、按钮MD3修复、页面加载器修复 (v0.6.0)
...
后端:
- 新增 /api/system/ws WebSocket端点 替代HTTP轮询 (每2s推送系统+框架数据)
- 修复 uptime始终为0 (sm.start_time时间戳)
- 网络采集新增TX上行+实时网速(delta法)
- 进程内存采集 (/proc/self/status VmRSS)
- 抑制aiohttp内部WS帧日志防刷爆日志文件
前端:
- 仪表盘: HTTP轮询→WS连接+指数退避自动重连
- 实时日志: 修复onclose重连bug+批量渲染30fps+500行上限防卡死
- 网速卡片: DualLineChart双线图(下行实线/上行虚线)
- Y轴零点偏移-5% 防止零网速贴底
- 所有按钮修复MD3组合类(btn+btn-tonal+btn-sm)
- 页面加载器: 改动态script元素执行 修复onclick全局作用域问题
- emoji图标→Material Design SVG图标
- CSS去残留</style>+新增.nav-item svg约束
- 登录页输入框+标签左对齐+按钮MD3样式
- 多个版本号显示修复(去双重v前缀)
- chart.js/app.js/HTML页面统一加版本号防浏览器缓存
- .gitignore新增docs/目录
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-11 16:23:31 +08:00
dd8a31e29a
Fix: proxy API prefix, version from config, remove auth from framework/system endpoints
...
- Proxy routes now use /SenSu/api/proxy (was missing prefix)
- Projects routes use dynamic prefix
- Version reads from config/framework/base_config.yaml
- Framework/System APIs no longer require auth (public info)
- Proxy init separated from route setup (avoids frozen router error)
- Version updated to v0.6.0
2026-06-11 14:37:28 +08:00
AskaEth
e6875f0b4b
Initial commit: SenSu Alpha 0.2.0
...
- 13-service async plugin framework
- Textual TUI with CLI fallback
- Plugin hot-reload + permission system
- Web management panel (aiohttp)
- Bridge-based inter-module communication
- 10 regression tests
Fixes applied:
- PBKDF2-SHA256 auth (was plain SHA256)
- Auth bypass removed (was allow-all on fail)
- Bare excepts replaced with logged errors
- CatFramework/DreamSu -> SenSu naming unified
- ServiceManager: health checks + startup_order
- Env var credentials (SENSU_ADMIN_PASSWORD etc)
2026-06-10 12:28:05 +08:00
qinglong
AskaEth