MetonaTeam/metona-ai-desktop
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

feat: 升级至 v0.3.0 — 安全增强、死循环检测、六轮全面审计修复

Browse Source 
大版本迭代，新增安全增强、Agent Loop 增强、UI/UX 增强，经六轮全面审计修复所有问题。

新增功能：
- OutputValidator 事实一致性检查 + 幻觉检测
- PromptInjectionDefender 语义级检测（指令性动词密度、角色边界、分隔符嵌套）
- DeadLoopError 死循环检测（连续3轮相同工具调用自动终止）
- PolicyEngine maxFrequency 滑动窗口频率限制
- MemoryManager TF-IDF 语义检索 + IDF 缓存原子替换
- 斜杠命令（/tool /memory /clear /export）+ 快捷键（Ctrl+B/J/Shift+F/N/[/]）
- 专注模式（Ctrl+Shift+F）带面板状态快照保存/恢复

六轮审计修复（共修复 3 CRITICAL + 8 HIGH + 13 MEDIUM + 11 LOW）：

CRITICAL:
- main.ts 传入 createAdapter 而非 reloadAdapter，导致 Provider 切换完全失效
- Ctrl+N/Ctrl+[/Ctrl+] 不同步 agent-store，导致消息发到错误会话
- engine.ts emit('error') 无监听器导致 DONE 事件丢失、前端卡死

HIGH:
- 死循环检测在工具执行之后（移入 PARSING 后 EXECUTING 前）
- deadLoop 事件前端未处理
- ConfirmationHook.clearPending 从未调用导致定时器泄漏
- engine.ts retry abort listener 未移除导致监听器堆积
- MCPManager JSON.parse 无 try-catch 导致初始化崩溃
- sendMessage 自动创建会话不同步 session-store
- setCurrentSession 竞态导致旧请求覆盖新会话数据

MEDIUM:
- toggleFocusMode 覆盖用户原有面板状态
- 正则检测可被常见词绕过
- 频率限制内存泄漏 + customPolicies 覆盖
- LIKE 回退转义未包含反斜杠
- OutputValidator 新功能未传入 toolResults/context
- MemoryConsolidator LLM 调用无超时保护
- AuditService 每次 log 都查询数据库
- browser-window-manager 超时后未停止页面加载
- output-validator URL 比较大小写敏感
- FileReader 无 onerror 导致 Promise 永久挂起
- /clear /export 不关闭斜杠菜单
- 专注模式下 toggleSidebar/toggleDetail 未恢复另一面板快照

LOW:
- abortPromise 事件监听器堆积
- RateLimitHook Map 内存泄漏
- memory.ts await 同步方法
- PolicyEngine 死代码清理
- Orchestrator sessionDepth 会话结束不清理
- workspace.service.ts 元数据插入边界问题
This commit is contained in:
thzxx
2026-07-12 19:46:47 +08:00
parent 3858f5ede3
commit 025f00171b
26 changed files with 1002 additions and 95 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/components/chat/ChatInput.tsx
+62 -7
View File
@@ -14,6 +14,7 @@ import { Box, Typography, IconButton, Tooltip, Stack, Button, Paper } from '@mui
import { Send, Paperclip, Square, X, FileText, Image as ImageIcon } from 'lucide-react';
import { useAgentStore } from '@renderer/stores/agent-store';
import { useSessionStore } from '@renderer/stores/session-store';
import { useUIStore } from '@renderer/stores/ui-store';
import { formatTokens, formatFileSize } from '@renderer/lib/formatters';
const SLASH_COMMANDS = [
@@ -70,17 +71,19 @@ export function ChatInput(): React.JSX.Element {
if (type === 'image') {
// 图片转 base64 data URL → 压缩（限制 1024px, JPEG 0.7）
const dataUri = await new Promise<string>((resolve) => {
const dataUri = await new Promise<string>((resolve, reject) => {
const reader = new FileReader();
reader.onload = () => resolve(reader.result as string);
reader.onerror = () => reject(new Error('图片读取失败'));
reader.readAsDataURL(file);
});
attachment.preview = await compressImage(dataUri, 1024, 0.7);
} else if (type === 'text') {
// 文本文件读取内容
attachment.textContent = await new Promise<string>((resolve) => {
attachment.textContent = await new Promise<string>((resolve, reject) => {
const reader = new FileReader();
reader.onload = () => resolve(reader.result as string);
reader.onerror = () => reject(new Error('文本文件读取失败'));
reader.readAsText(file);
});
}
@@ -97,13 +100,36 @@ export function ChatInput(): React.JSX.Element {
: fileArray.filter((f) => !IMAGE_TYPES.includes(f.type));
if (filtered.length < fileArray.length && !supportsImages) {
// TODO: 用 Toast 提示用户 "DeepSeek 不支持图片，已自动跳过 N 个图片文件"
// v0.3.0: 用 Toast 提示用户 DeepSeek 不支持图片
const skipped = fileArray.length - filtered.length;
// v0.3.0 修复：记录 Toast 加载失败错误到控制台，而非静默吞掉
import('metona-toast').then((mod) => {
mod.default.warning(`DeepSeek 不支持图片，已自动跳过 ${skipped} 个图片文件`);
}).catch((err) => {
console.error('[ChatInput] Failed to load metona-toast for DeepSeek image warning:', err);
});
}
if (filtered.length === 0) return;
const newAttachments = await Promise.all(filtered.map(processFile));
setAttachments((prev) => [...prev, ...newAttachments]);
// v0.3.0 修复: 使用 allSettled 处理部分文件读取失败，避免一个失败导致全部丢失
const results = await Promise.allSettled(filtered.map(processFile));
const successful = results.filter(
(r): r is PromiseFulfilledResult<Attachment> => r.status === 'fulfilled',
).map((r) => r.value);
if (successful.length === 0) {
import('metona-toast').then((mod) => {
mod.default.error('文件读取失败，请检查文件是否损坏或被锁定');
}).catch(() => {});
return;
}
if (successful.length < filtered.length) {
const failedCount = filtered.length - successful.length;
import('metona-toast').then((mod) => {
mod.default.warning(`${failedCount} 个文件读取失败，已跳过`);
}).catch(() => {});
}
setAttachments((prev) => [...prev, ...successful]);
}, [processFile, supportsImages]);
const removeAttachment = useCallback((id: string) => {
@@ -147,10 +173,39 @@ export function ChatInput(): React.JSX.Element {
// 处理 / 命令
if (trimmed.startsWith('/')) {
const cmd = trimmed.split(' ')[0].toLowerCase();
if (cmd === '/clear') { useAgentStore.getState().clearMessages(); setInput(''); setAttachments([]); return; }
if (cmd === '/clear') { useAgentStore.getState().clearMessages(); setInput(''); setAttachments([]); setShowSlashMenu(false); return; }
if (cmd === '/export') {
const blob = new Blob([JSON.stringify(useAgentStore.getState().messages, null, 2)], { type: 'application/json' });
const a = document.createElement('a'); a.href = URL.createObjectURL(blob); a.download = `session-${Date.now()}.json`; a.click(); setInput(''); return;
const url = URL.createObjectURL(blob);
const a = document.createElement('a');
a.href = url;
a.download = `session-${Date.now()}.json`;
a.click();
// v0.3.0 修复：释放 Blob URL，避免内存泄漏
URL.revokeObjectURL(url);
setInput(''); setShowSlashMenu(false); return;
}
// v0.3.0: /tool — 打开设置面板的工具管理 Tab
if (cmd === '/tool') {
useUIStore.getState().openSettings();
setInput(''); setAttachments([]); setShowSlashMenu(false);
return;
}
// v0.3.0: /memory — 切换到详情面板的 Memory 标签
// v0.3.0 修复：确保详情面板可见，否则切换标签用户看不到
if (cmd === '/memory') {
const uiStore = useUIStore.getState();
uiStore.setDetailTab('memory');
// v0.3.0 修复: 专注模式下先退出专注模式（恢复快照），再确保详情面板可见
if (uiStore.focusMode) {
uiStore.toggleFocusMode();
}
// 退出专注模式后再次检查详情面板可见性
if (!useUIStore.getState().detailVisible) {
uiStore.toggleDetail();
}
setInput(''); setAttachments([]); setShowSlashMenu(false);
return;
}
}
src/components/layout/DetailPanel.tsx
+21 -10
View File
@@ -2,9 +2,10 @@
* DetailPanel — 右侧详情面板
*
* 通过 Tab 切换显示 Trace / Memory / Tasks / Workspace。
*
* v0.3.0: Tab 状态提升到 ui-store，支持斜杠命令切换标签。
*/
import { useState } from 'react';
import { Box, Tabs, Tab } from '@mui/material';
import { Activity, Brain, ListChecks, FolderOpen } from 'lucide-react';
import { TraceViewer } from '@renderer/components/trace/TraceViewer';
@@ -15,11 +16,16 @@ import { TaskList } from '@renderer/components/tasks/TaskList';
import { WorkspaceViewer } from '@renderer/components/workspace/WorkspaceViewer';
import { ErrorBoundary } from '@renderer/components/common/ErrorBoundary';
import { LAYOUT } from '@renderer/lib/constants';
type DetailTab = 'trace' | 'memory' | 'tasks' | 'workspace';
import { useUIStore, type DetailTab } from '@renderer/stores/ui-store';
export function DetailPanel(): React.JSX.Element {
const [tab, setTab] = useState<DetailTab>('trace');
// v0.3.0: 从 ui-store 获取 tab 状态（支持斜杠命令切换）
const tab = useUIStore((s) => s.detailTab);
const setTab = useUIStore((s) => s.setDetailTab);
// v0.3.0 修复：验证 tab 值有效性，非预期值回退到 'trace'
const validTabs: DetailTab[] = ['trace', 'memory', 'tasks', 'workspace'];
const safeTab: DetailTab = validTabs.includes(tab) ? tab : 'trace';
return (
<Box
@@ -30,8 +36,13 @@ export function DetailPanel(): React.JSX.Element {
}}
>
<Tabs
value={tab}
onChange={(_, v) => setTab(v as DetailTab)}
value={safeTab}
onChange={(_, v) => {
// v0.3.0 修复：类型安全检查，只接受有效的 tab 值
if (typeof v === 'string' && validTabs.includes(v as DetailTab)) {
setTab(v as DetailTab);
}
}}
variant="fullWidth"
sx={{
minHeight: 32, height: 32, flexShrink: 0,
@@ -47,7 +58,7 @@ export function DetailPanel(): React.JSX.Element {
</Tabs>
<Box sx={{ p: 1.5, flex: 1, display: 'flex', flexDirection: 'column', overflow: 'hidden', minHeight: 0 }}>
{tab === 'trace' && (
{safeTab === 'trace' && (
<ErrorBoundary fallbackTitle="Trace 渲染失败">
<>
<TraceViewer />
@@ -56,17 +67,17 @@ export function DetailPanel(): React.JSX.Element {
</>
</ErrorBoundary>
)}
{tab === 'memory' && (
{safeTab === 'memory' && (
<ErrorBoundary fallbackTitle="Memory 渲染失败">
<MemoryViewer />
</ErrorBoundary>
)}
{tab === 'tasks' && (
{safeTab === 'tasks' && (
<ErrorBoundary fallbackTitle="Tasks 渲染失败">
<TaskList />
</ErrorBoundary>
)}
{tab === 'workspace' && (
{safeTab === 'workspace' && (
<ErrorBoundary fallbackTitle="Workspace 渲染失败">
<WorkspaceViewer />
</ErrorBoundary>