MetonaTeam/metona-ai-desktop
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

feat: v0.5.0 审计修复版 — 类型基线重建 + 会话隔离 + SubAgent 可观测性 + 三项功能补全
CI / 类型检查 + Lint + 单元测试 (push) Failing after 5m38s
Details
CI / 产物编译验证 (push) Successful in 10m15s
Details
CI / 全量测试 (Electron ABI) (push) Failing after 5m27s
Details

Browse Source 
P0 安全与工程基线（止血）:
- .npmrc 移除硬编码 Gitea npm 凭据，改为 GITEA_NPM_AUTH 环境变量注入（已验证未设变量时 401）
- 修复 typecheck 空操作缺陷：solution-style 根 tsconfig 改为双工程真检查（node + web），
  pre-commit 与 CI 门禁恢复拦截能力
- 修复 4 处 v0.4.1 遗留类型错误：confirmation-hook.test 枚举名 FILE_SYSTEM→FILESYSTEM、
  agent.ts VALIDATION 事件 severity 类型谓词收窄、ContextMenu.tsx 导出 attachments 类型
- 补装 v0.4.1 声明但未安装的 node-html-parser 依赖

P1 逻辑缺陷修复（跨模块边界）:
- ConfirmationHook 会话隔离：rememberedDecisions 与 pendingConfirmations 按 sessionId 隔离，
  abortSession 只清本会话 pending（修复 A 会话中断误杀 B 会话确认、拒绝记忆跨会话污染）
- SubAgent 可观测性：orchestrator 六个事件此前全项目零消费者，现接入
  ① subagent:event 生命周期广播（AgentMonitor 新增 SubAgent 状态区）
  ② SubEngine 流事件独立 TRACE 录制（sessionId=taskId 的 JSONL 文件）
- main.ts 启动链路异常兜底：初始化失败时记录日志 + 系统错误对话框 + 退出（原为白屏挂起）

P2 工程强化:
- CI：typecheck 双工程真检查；electron-test 从 experimental（continue-on-error）转正为阻塞门禁；
  GITEA_NPM_AUTH secret 注入说明
- 渲染 bundle 代码分割：单 2630KB chunk 拆为 main 557KB + vendor-react/mui/markdown/icons
  （业务代码变更不再使 vendor 缓存失效）
- database 建表 mcp_servers CHECK 直接含 streamable-http（新库不再依赖迁移 6 立即重建）

P3 功能补全:
- DeepSeek 余额显示：新增 llm:getBalance IPC + LLMSettings 余额卡片（复用适配器原死代码 getBalance）
- FTS5 会话内容搜索：messages_fts 虚表 + INSERT/UPDATE/DELETE 触发器实时同步 +
  存量库 rebuild 迁移 + sessions:searchContent IPC + Sidebar 搜索框标题∪内容联合搜索
  （短语转义防 FTS 运算符注入，按会话聚合展示 snippet）
- 审计日志导出：audit:export IPC（JSONL / CSV RFC 4180 转义）+ LogsSettings 导出按钮

文档一致性大扫除:
- README：工具数统一为 28（原 26/27/30 三口径）、handlers.ts→ipc/、录制事件名更正、
  删除虚构的审计导出/归档宣称与 Schema 虚构字段、MCP 三种传输、配置 key 更正、
  项目结构树对齐实际（settings 10 文件/lib 6 文件/react-virtuoso）、clone 地址改为 Gitea、
  新增 GITEA_NPM_AUTH 配置说明、测试数 207
- 架构/构建指南/UI UX/IR 标准 4 份 HTML 设计文档同步修正（工具数、表数 10、
  磁盘文件 2 个现状注记、ipc/*.ts 路径）
- eslint.config.js 与开发规范.md 注释对齐零容忍基线与 better-sqlite3 选型

测试: 199→207 用例（新增 ConfirmationHook 跨会话隔离 5 用例 + FTS5 搜索/审计导出 8 用例）
验证: lint 0 problems / typecheck 双工程 0 errors / test:electron 207 全过 / build 成功
This commit is contained in:
thzxx
2026-08-21 21:07:01 +08:00
parent 49c9b25538
commit 7e8b4882a0
32 changed files with 3031 additions and 579 deletions
Download Patch File Download Diff File Expand all files Collapse all files
electron/services/audit.service.ts
+135 -19
View File
@@ -37,10 +37,34 @@ function stableStringify(obj: unknown): string {
);
}
export type AuditEventType = 'tool_call' | 'permission_check' | 'error' | 'llm_request' | 'llm_response' | 'session_start' | 'session_end' | 'config_change';
export type AuditEventType =
| 'tool_call'
| 'permission_check'
| 'error'
| 'llm_request'
| 'llm_response'
| 'session_start'
| 'session_end'
| 'config_change';
export type AuditActor = 'agent' | 'user' | 'system';
export type AuditOutcome = 'success' | 'denied' | 'error';
/** v0.5.0: 审计日志行类型（导出/查询共用） */
interface AuditRecordRow {
id: number;
session_id: string;
iteration: number | null;
event_type: string;
actor: string;
target: string;
details: string | null;
outcome: string | null;
duration_ms: number | null;
created_at: number;
prev_hash: string | null;
current_hash: string | null;
}
export interface AuditEntry {
sessionId: string;
iteration?: number;
@@ -64,9 +88,15 @@ export class AuditService {
private computeHash(
prevHash: string,
entry: {
sessionId: string; iteration: number | null; eventType: string;
actor: string; target: string; details: string | null;
outcome: string | null; durationMs: number | null; createdAt: number;
sessionId: string;
iteration: number | null;
eventType: string;
actor: string;
target: string;
details: string | null;
outcome: string | null;
durationMs: number | null;
createdAt: number;
},
): string {
// #36 修复: 使用 stableStringify 避免分隔符碰撞且保证 key 顺序稳定
@@ -94,8 +124,11 @@ export class AuditService {
private getLastHash(): string {
if (this.cachedLastHash !== null) return this.cachedLastHash;
const db = this.getDB();
const row = db.prepare('SELECT current_hash FROM audit_logs ORDER BY id DESC LIMIT 1').get() as { current_hash: string | null } | undefined;
this.cachedLastHash = row?.current_hash ?? '0000000000000000000000000000000000000000000000000000000000000000';
const row = db.prepare('SELECT current_hash FROM audit_logs ORDER BY id DESC LIMIT 1').get() as
| { current_hash: string | null }
| undefined;
this.cachedLastHash =
row?.current_hash ?? '0000000000000000000000000000000000000000000000000000000000000000';
return this.cachedLastHash;
}
@@ -120,10 +153,12 @@ export class AuditService {
createdAt: now,
});
db.prepare(`
db.prepare(
`
INSERT INTO audit_logs (session_id, iteration, event_type, actor, target, details, outcome, duration_ms, created_at, prev_hash, current_hash)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
`).run(
`,
).run(
entry.sessionId,
entry.iteration ?? null,
entry.eventType,
@@ -257,11 +292,7 @@ export class AuditService {
/**
* 查询审计日志
*/
query(filters?: {
sessionId?: string;
eventType?: AuditEventType;
limit?: number;
}): Array<{
query(filters?: { sessionId?: string; eventType?: AuditEventType; limit?: number }): Array<{
id: number;
session_id: string;
iteration: number | null;
@@ -311,6 +342,68 @@ export class AuditService {
}>;
}
/**
* v0.5.0: 导出审计日志为 JSONL 文本（每行一条 JSON 记录）
*
* @returns JSONL 格式字符串（含全部记录，按 id 升序）
*/
exportJSONL(): string {
const db = this.getDB();
const rows = db
.prepare(
'SELECT id, session_id, iteration, event_type, actor, target, details, outcome, duration_ms, created_at, prev_hash, current_hash FROM audit_logs ORDER BY id ASC',
)
.all() as AuditRecordRow[];
return rows.map((r) => JSON.stringify(r)).join('\n') + (rows.length > 0 ? '\n' : '');
}
/**
* v0.5.0: 导出审计日志为 CSV 文本
*
* 字段含逗号/引号/换行时按 RFC 4180 转义（双引号包裹 + 内部双引号翻倍）。
*
* @returns CSV 格式字符串（含表头，按 id 升序）
*/
exportCSV(): string {
const db = this.getDB();
const rows = db
.prepare(
'SELECT id, session_id, iteration, event_type, actor, target, details, outcome, duration_ms, created_at, prev_hash, current_hash FROM audit_logs ORDER BY id ASC',
)
.all() as AuditRecordRow[];
const headers = [
'id',
'session_id',
'iteration',
'event_type',
'actor',
'target',
'details',
'outcome',
'duration_ms',
'created_at',
'prev_hash',
'current_hash',
];
const escapeCsv = (value: string | number | null): string => {
const s = value === null ? '' : String(value);
if (/[",\r\n]/.test(s)) {
return `"${s.replace(/"/g, '""')}"`;
}
return s;
};
const lines = [headers.join(',')];
for (const r of rows) {
lines.push(
headers
.map((h) => escapeCsv((r as unknown as Record<string, string | number | null>)[h]))
.join(','),
);
}
return lines.join('\n') + '\n';
}
/**
* v0.2.0: 验证链式哈希完整性
*
@@ -319,12 +412,30 @@ export class AuditService {
*
* @returns 验证结果，包括是否通过、首个篡改位置的 ID
*/
verifyChain(): { valid: boolean; totalRecords: number; verifiedRecords: number; tamperedId: number | null } {
verifyChain(): {
valid: boolean;
totalRecords: number;
verifiedRecords: number;
tamperedId: number | null;
} {
const db = this.getDB();
const rows = db.prepare('SELECT id, session_id, iteration, event_type, actor, target, details, outcome, duration_ms, created_at, prev_hash, current_hash FROM audit_logs ORDER BY id ASC').all() as Array<{
id: number; session_id: string; iteration: number | null; event_type: string; actor: string;
target: string; details: string | null; outcome: string | null; duration_ms: number | null;
created_at: number; prev_hash: string | null; current_hash: string | null;
const rows = db
.prepare(
'SELECT id, session_id, iteration, event_type, actor, target, details, outcome, duration_ms, created_at, prev_hash, current_hash FROM audit_logs ORDER BY id ASC',
)
.all() as Array<{
id: number;
session_id: string;
iteration: number | null;
event_type: string;
actor: string;
target: string;
details: string | null;
outcome: string | null;
duration_ms: number | null;
created_at: number;
prev_hash: string | null;
current_hash: string | null;
}>;
let prevHash = '0000000000000000000000000000000000000000000000000000000000000000';
@@ -369,7 +480,12 @@ export class AuditService {
prevHash = row.current_hash;
continue;
}
return { valid: false, totalRecords: rows.length, verifiedRecords: verified, tamperedId: row.id };
return {
valid: false,
totalRecords: rows.length,
verifiedRecords: verified,
tamperedId: row.id,
};
}
prevHash = row.current_hash;