AskaEth/SenSu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
64 Commits 2 Branches 1 Tag
fcac02d920141aec3fd9c802ef12b8e11e0c82ed
Commit Graph

14 Commits

Author SHA1 Message Date
qinglong fcac02d920 security: P2 生产深度加固 — 路径/鉴权/脱敏/校验/持久化/过期 
4.3 文件管理器路径收紧:
- 默认移除 Path('/') 全文件系统访问
- 仅允许项目目录 + data/ + 环境变量 SENSU_FILE_ROOTS 指定路径

3.4 插件路由鉴权修复:
- _check_plugin_auth 增加 panel_token 用户身份验证
- 先验证用户登录, 再检查插件权限

4.2 错误脱敏:
- security middleware 捕获异常 → 通用 'Internal server error'
- 堆栈详情仅写入日志, 不暴露给客户端

4.4 命令参数校验:
- POST /api/command 拒绝 shell 元字符 (;&|`$(){}!#~<>)
- 防止命令注入

4.5 Session 持久化:
- 登录/退出时保存到 SenSuDB.config_kv
- 框架重启后自动恢复已持久化会话

4.6 Token 过期: 24h → 2h

Co-Authored-By: Claude <noreply@anthropic.com>
 2026-06-13 13:50:51 +08:00
qinglong 2f9063d6d4 fix: 登录频率限制 bug — lock_until=0 导致计数被清零 
根因: 初始 lock_until=0 时 now >= 0 + 60 恒为真, 每次请求都清除计数
修复: lock_until 改用 None 表示未锁定, 仅非 None 时做过期判断

Co-Authored-By: Claude <noreply@anthropic.com>
 2026-06-13 13:46:29 +08:00
qinglong d5388057d9 feat(v0.2.2): 插件热重载 — watchdog 监听 plugins/ 自动重载 
- PluginService.start() 中启动 watchdog Observer
- 监听 plugins/ 下 .py/.yaml/.yml 文件变更
- 1秒防抖，避免重复触发
- 变更后自动卸载→重新加载对应插件
- 插件重载后自动重连网络路由
- PluginService.stop() 清理 observer
- 配置项 hot_reload: true/false 控制

Co-Authored-By: Claude <noreply@anthropic.com>
 2026-06-13 11:01:00 +08:00
qinglong 9de094ea54 fix: 移除遗留fmfuncs目录创建 + 清理init_service无用导入 + 文件管理器SVG图标 + 示例插件MD3改造 
- init_service: 删除_load_fmfuncs方法和fmfuncs目录创建(已迁移到sdk/)
- init_service: 清理未使用的importlib.util和sys导入
- 文件管理器: 全部emoji替换为MD3 SVG矢量图标(文件夹/文件类型/右键菜单)
- 示例插件: dashboard.html改为MD3风格 CSS变量自动适配日夜主题
- 面包屑: 加底色+模糊+左右外边距
- CSS: .btn::after加pointer-events:none
- 插件开发指南: 更新2.6节MD3主题同步和完善的CSS变量/组件类参考表

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-12 19:00:19 +08:00
qinglong 99c3e3e853 feat: hash路由 + 插件页面内联加载 + 侧边栏插件面板展开项 
- Hash路由: #/dashboard #/files #/plugins/xxx 支持刷新保持/前进后退
- 登录过期保留hash,登录后自动跳回原页面
- 插件WebUI页面内联加载到page-container(不再弹新窗)
- 插件页面HTML自动处理: style提取/body剥离/script执行/padding归零
- 侧边栏新增「插件面板」可折叠项,展开列出所有已注册插件页面
- 内存卡片显示 已用/总容量(百分比右侧)
- 插件开发指南新增 2.6 WebUI页面开发章节

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-11 20:56:39 +08:00
qinglong fd715eac2b feat: 文件管理器 + Windows兼容 + SVG主题适配 (v0.6.0) 
新增:
- services/web_panel/routes/files.py — 全功能文件管理后端API (11个端点)
- pages/files.html + files.js — 文件管理前端 (浏览/编辑/上传/删除/右键菜单)
- 插件Picker API: window.open+postMessage唤出文件选择器
- 符号链接目录双层面包屑 (逻辑路径+物理路径)
- 文件系统全访问+跨平台 (Linux/Windows/macOS)
- permission_rules.yaml新增4个filemanager.*权限

修复:
- SVG fill=currentColor 日夜模式自适应
- 特殊目录容错 (/dev/fd损坏符号链接/proc)
- 面包屑每层级独立可点击+可编辑路径跳转
- ..行返回上级+data-is-dir补全
- rmlint→lstat回退 损坏符号链接不炸页面

文档:
- 插件开发指南新增第八章(文件管理器集成)
- 开发踩坑记录新增4条(特殊目录/双面包屑/SVG颜色/Windows)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-11 18:23:32 +08:00
qinglong 4a989bf50f feat: WS实时推送、网速双线图、按钮MD3修复、页面加载器修复 (v0.6.0) 
后端:
- 新增 /api/system/ws WebSocket端点 替代HTTP轮询 (每2s推送系统+框架数据)
- 修复 uptime始终为0 (sm.start_time时间戳)
- 网络采集新增TX上行+实时网速(delta法)
- 进程内存采集 (/proc/self/status VmRSS)
- 抑制aiohttp内部WS帧日志防刷爆日志文件

前端:
- 仪表盘: HTTP轮询→WS连接+指数退避自动重连
- 实时日志: 修复onclose重连bug+批量渲染30fps+500行上限防卡死
- 网速卡片: DualLineChart双线图(下行实线/上行虚线)
- Y轴零点偏移-5% 防止零网速贴底
- 所有按钮修复MD3组合类(btn+btn-tonal+btn-sm)
- 页面加载器: 改动态script元素执行 修复onclick全局作用域问题
- emoji图标→Material Design SVG图标
- CSS去残留</style>+新增.nav-item svg约束
- 登录页输入框+标签左对齐+按钮MD3样式
- 多个版本号显示修复(去双重v前缀)
- chart.js/app.js/HTML页面统一加版本号防浏览器缓存
- .gitignore新增docs/目录

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-11 16:23:31 +08:00
qinglong fd0a97fec5 Fix login redirect: add /SenSu/index.html route, restart picks up new app.js 
- /SenSu/index.html now serves login page (was 404 after cookie expiry)
- Fresh restart with latest page loader + inline script execution
- All routes verified: 200 OK
 2026-06-11 14:47:37 +08:00
qinglong c07cea4ff7 Fix page loader: execute inline scripts, JS module loading optional 
- innerHTML strips script tags, now extract and eval them
- External .js module: 404 = skip gracefully (no error)
- Progress bar: completes regardless of JS module
- Proxy/projects pages now render with CSS + inline JS executes
 2026-06-11 14:43:24 +08:00
qinglong dd8a31e29a Fix: proxy API prefix, version from config, remove auth from framework/system endpoints 
- Proxy routes now use /SenSu/api/proxy (was missing prefix)
- Projects routes use dynamic prefix
- Version reads from config/framework/base_config.yaml
- Framework/System APIs no longer require auth (public info)
- Proxy init separated from route setup (avoids frozen router error)
- Version updated to v0.6.0
 2026-06-11 14:37:28 +08:00
qinglong 6918ee6514 Fix headless mode: use sleep loop instead of CLI mode (prevent EOF exit) 
- Headless now keeps server alive with asyncio.sleep(1) loop
- CLI mode only for non-headless fallback
- Enables running SenSu as daemon/service
 2026-06-11 13:02:56 +08:00
AskaEth 8dbf628dd6 Phase 1: ProjectEngine + PyEnvManager + project management WebUI 
- New: services/project_engine.py (async subprocess manager)
- New: services/pyenv_manager.py (Python version + venv + git clone)
- New: services/web_panel/routes/projects.py (5 REST endpoints)
- New: static/web_panel/pages/projects.html (WebUI)
- Tests: 28/28 passing, API verified (GET /api/projects)
- Docs: Phase1_Progress.md (local)
 2026-06-10 20:41:24 +08:00
AskaEth f5800cc6c3 Debug: fix headless mode, plugin compat, psutil optional, module imports 
- headless: TUI skip now works correctly
- example_plugin: keyword args compat (plugin_name=, config=, bridge=)
- sysmon: psutil made optional (graceful degrade)
- tui_service: SysMonWidget optional
- All 22 modules import clean, 23 tests pass, integration verified
 2026-06-10 19:26:41 +08:00
AskaEth e6875f0b4b Initial commit: SenSu Alpha 0.2.0 
- 13-service async plugin framework
- Textual TUI with CLI fallback
- Plugin hot-reload + permission system
- Web management panel (aiohttp)
- Bridge-based inter-module communication
- 10 regression tests

Fixes applied:
- PBKDF2-SHA256 auth (was plain SHA256)
- Auth bypass removed (was allow-all on fail)
- Bare excepts replaced with logged errors
- CatFramework/DreamSu -> SenSu naming unified
- ServiceManager: health checks + startup_order
- Env var credentials (SENSU_ADMIN_PASSWORD etc)
 2026-06-10 12:28:05 +08:00