@allbluecn/web-app 0.19.2 → 0.19.4

package/src/server/ai-gateway/chat-stream-builder.ts

@@ -42,7 +42,7 @@ import { selectTools } from './tools/select'
 import { deleteProject } from './tools/delete-project'
 import { pluginLifecycleTools } from './tools/plugin-lifecycle-server'
 import { buildPluginTools } from './tools/plugin-tools'
-import { isSearxngEnabled } from '@/server/serverFns/web-search'
+import { isSearxngEnabled } from '@/server/web-search'
 import { buildSkillsStack } from './skills'
 import { buildMemoryMiddleware } from './memory'
 import { buildCodeModeStack } from './code-mode'
@@ -90,14 +90,41 @@ interface BuildChatStreamParams {
      | { type: "cloud"; workspaceId: string }
   /**
    * attach 续接模式：true 时读已有沙箱 journal 而非新开 agent。
-   * 由 reaper drive 等后台消费路径设置——journal 已终态时 adapter 仅回放已存事件。
+   * 由 reaper drive 等后台消费路径设置——journal 已终态时 adapter 仅回放已存事件，
+   * 允许 adapter 传 null（后台无 adapter 可用）；非 attach 模式 adapter 必填。
    */
   attach?: boolean
 }
 
+/**
+ * runId 形状白名单（审计 2026-10-25 🟠）：runId 由客户端 body 可控，是 journal
+ * 文件名成分（@tanstack/ai-sandbox journal 落 /tmp/tanstack-runs/<encoded>.ndjson）
+ * 与 DB run 记录主键。包内 encodeRunId 已把 `/` 等转义为 _xx（无目录分隔符可存活），
+ * 这里再加一层服务端形状收窄，防垃圾 id 污染 journal/DB 命名空间并杜绝任何
+ * 编码边界下的路径成分风险。
+ */
+const RUN_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/
+
+function assertSafeRunId(runId: string): string {
+  if (!RUN_ID_RE.test(runId) || runId.includes("..")) {
+    throw new Error(
+      `非法 runId（仅允许字母数字与 . _ -，不超过 100 字符）：${JSON.stringify(runId.slice(0, 120))}`,
+    )
+  }
+  return runId
+}
+
 export async function buildChatStreamWithTools(
   params: BuildChatStreamParams,
 ): Promise<AsyncIterable<StreamChunk>> {
+  // 非 attach 模式 adapter 必填：attach（reaper journal 重放）允许 null——
+  // journal 已终态时 adapter 不会被调用。非 attach 传 null 会在真实模型调用时
+  // 空指针崩在深水区，这里在装配口给出带上下文的明确错误（审计 2026-10-25：
+  // reaper-driver `adapter: null as never` 依赖包内隐式契约，缺显式守卫）。
+  if (!params.adapter && params.attach !== true) {
+    throw new Error("buildChatStreamWithTools: 非 attach 模式必须提供 adapter")
+  }
+
   const nativeSearchTools = buildProviderWebSearchTools(
     params.providerConfigKind,
   ) as any[]
@@ -130,6 +157,8 @@ export async function buildChatStreamWithTools(
   // id：/tmp/tanstack-runs/<runId>.ndjson 需能被后继宿主重算）。harness 路由不
   // 发送 runId，故在此铸造一次并同步给 chat()——两处必须同源，否则 journal 与
   // run 记录会对不上。非沙箱请求保持原样（undefined 时由 chat 内部生成）。
+  // 客户端提供的 runId 先过形状白名单（见 assertSafeRunId）。
+  if (params.runId !== undefined) assertSafeRunId(params.runId)
   const effectiveRunId = params.runId ?? (params.sandbox ? randomUUID() : undefined)
 
   // 1.0 起 chat() 的 threadId 为必填：调用方缺省时由服务端兜底生成
@@ -191,8 +220,12 @@ export async function buildChatStreamWithTools(
   // effectiveThreadId 已兜底恒有值，沙箱装配实质收敛为 sandbox 开关（1.0 threadId 必填）。
   if (params.sandbox) {
     let policyLevel = SANDBOX_DEFAULT_POLICY_LEVEL
-    const thread = await prisma.chatThread.findUnique({
-      where: { id: effectiveThreadId },
+    // threadId 属主校验（审计 2026-10-25 🟠，与 memory/scope.ts 同一口径）：
+    // threadId 源自客户端 body，裸按 id 查会读到他人线程的沙箱策略并附着/
+    // 复用他人沙箱实例。查不到（含不属于当前用户）一律回落默认档，
+    // 不放宽也不报错（与既有「线程不存在回落默认档」行为一致）。
+    const thread = await prisma.chatThread.findFirst({
+      where: { id: effectiveThreadId, userId: params.userId },
       select: { sandboxPolicy: true },
     })
     if (isSandboxPolicyLevel(thread?.sandboxPolicy)) {

package/src/server/ai-gateway/code-mode/index.ts

@@ -98,7 +98,9 @@ export type CodeModeReadinessReason = "disabled" | "sandbox-unavailable" | null
 export interface CodeModeReadiness {
   enabled: boolean
   reason: CodeModeReadinessReason
-  detail?: string
+  // 不含 detail：探测失败原因（可含模块路径/Node 版本/原生编译错误等部署细节）
+  // 经 code-mode-readiness serverFn 直通客户端，属部署环境泄露面（审计 2026-10-25），
+  // 只进服务端日志（见 getCodeModeReadiness）。
 }
 
 export function isCodeModeEnvEnabled(): boolean {
@@ -216,11 +218,8 @@ export async function getCodeModeReadiness(): Promise<CodeModeReadiness> {
   }
   const sandbox = await loadSandbox()
   if (sandbox.kind === "unavailable") {
-    return {
-      enabled: false,
-      reason: "sandbox-unavailable",
-      detail: sandbox.reason,
-    }
+    console.warn(`[code-mode] readiness: sandbox-unavailable: ${sandbox.reason}`)
+    return { enabled: false, reason: "sandbox-unavailable" }
   }
   return { enabled: true, reason: null }
 }
@@ -231,4 +230,9 @@ export function resetCodeModeCacheForTest(): void {
   warnedSecrets.clear()
 }
 
-export { setSandboxLoaderForTest, setSandboxRuntimeProbeForTest } from "./sandbox"
+export {
+  CODE_MODE_UNSAFE_VM_FALLBACK_ENV_KEY,
+  isUnsafeVmFallbackAllowed,
+  setSandboxLoaderForTest,
+  setSandboxRuntimeProbeForTest,
+} from "./sandbox"

package/src/server/ai-gateway/code-mode/sandbox.ts

@@ -15,7 +15,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-import { spawnSync } from "node:child_process"
+import { spawn } from "node:child_process"
 import type { IsolateDriver } from "@tanstack/ai-code-mode"
 
 import { createVmIsolateDriver } from "./vm-driver"
@@ -68,6 +68,10 @@ function resolveDriverUrl(): string | null {
  * 用子进程的退出码/信号判定，宿主进程始终不受影响。
  *
  * 探测失败一律降级（跳过深探测、回落到普通工具调用），绝不在宿主进程内执行。
+ *
+ * 异步 spawn（审计 2026-10-25 🟠）：原 spawnSync 最坏阻塞事件循环 20s
+ * （DEEP_PROBE_TIMEOUT_MS），生产冷启动后首个请求会拖停该实例全部流量。
+ * 探测结果由 loadSandbox 的进程内单例 promise 缓存，每进程至多执行一次。
  */
 async function defaultRuntimeProbe(driverUrl: string): Promise<boolean> {
   const script = `
@@ -89,16 +93,30 @@ if (result.success && result.value === 1) process.exit(0);
 process.exit(4);
 `
   try {
-    const result = spawnSync(
-      process.execPath,
-      ["--input-type=module", "-e", script, driverUrl],
-      { timeout: DEEP_PROBE_TIMEOUT_MS, encoding: "utf8" },
-    )
-    if (result.error) return false
-    if (result.signal) {
-      return false
-    }
-    return result.status === 0
+    return await new Promise<boolean>((resolve) => {
+      // 子进程输出仅用于人工排查，不在宿主侧消费，直接丢弃
+      const child = spawn(
+        process.execPath,
+        ["--input-type=module", "-e", script, driverUrl],
+        { stdio: "ignore" },
+      )
+      let settled = false
+      const timer = setTimeout(() => {
+        child.kill("SIGKILL")
+        settle(false)
+      }, DEEP_PROBE_TIMEOUT_MS)
+      function settle(value: boolean) {
+        if (settled) return
+        settled = true
+        clearTimeout(timer)
+        resolve(value)
+      }
+      child.once("error", () => settle(false))
+      child.once("close", (code, signal) => {
+        // 与 spawnSync 语义对齐：被信号终止（含本函数超时 kill）一律判不兼容
+        settle(signal === null && code === 0)
+      })
+    })
   } catch {
     return false
   }
@@ -170,18 +188,42 @@ async function probeIsolatedVmDriver(): Promise<SandboxState> {
   }
 }
 
+/** 显式放行 node:vm 兜底的开关（值 "1"/"true"）；desktop 单用户形态默认放行。 */
+export const CODE_MODE_UNSAFE_VM_FALLBACK_ENV_KEY = "CODE_MODE_ALLOW_UNSAFE_VM_FALLBACK"
+
+/**
+ * node:vm 不是安全边界（Node 官方：vm 模块不得用于运行不可信代码）：沙箱内
+ * `({}).constructor.constructor("return process")()` 即取回宿主 process，进而读全部
+ * env 密钥 / require child_process（审计 2026-10-25 🔴）。多租户服务端绝不能把它
+ * 当隔离层——只允许 desktop（单用户、代码跑在用户自己机器上）或运维显式确认的
+ * 场景回落，其余一律视为 sandbox-unavailable（code-mode 关闭，退回普通工具调用）。
+ */
+export function isUnsafeVmFallbackAllowed(): boolean {
+  if (process.env.DEPLOY_TARGET === "desktop") return true
+  const flag = process.env[CODE_MODE_UNSAFE_VM_FALLBACK_ENV_KEY]
+  return flag === "1" || flag === "true"
+}
+
 async function probeSandbox(): Promise<SandboxState> {
   const isolated = await probeIsolatedVmDriver()
   if (isolated.kind === "ready") return isolated
 
+  if (!isUnsafeVmFallbackAllowed()) {
+    console.warn(
+      `[code-mode] isolated-vm 不可用，且 node:vm 兜底已禁用（非隔离驱动，仅 desktop 或 ` +
+        `${CODE_MODE_UNSAFE_VM_FALLBACK_ENV_KEY}=true 放行）：${isolated.reason}`,
+    )
+    return {
+      kind: "unavailable",
+      reason: `isolated-vm 不可用且禁止 node:vm 兜底：${isolated.reason}`,
+    }
+  }
+
   // node:vm 兜底：isolated-vm 原生模块编译失败（托管运行时无 prebuilds）时，
-  // 用零原生依赖的 node:vm 驱动让编排模式在生产环境可用，而非整体不可用。
-  console.warn(`[code-mode] isolated-vm 不可用，回落 node:vm 驱动：${isolated.reason}`)
+  // 用零原生依赖的 node:vm 驱动让编排模式可用。仅限上方放行场景。
+  console.warn(`[code-mode] isolated-vm 不可用，回落 node:vm 驱动（非安全隔离）：${isolated.reason}`)
   try {
-    const driver = createVmIsolateDriver({
-      memoryLimit: CODE_MODE_MEMORY_LIMIT_MB,
-      timeout: CODE_MODE_TIMEOUT_MS,
-    })
+    const driver = createVmIsolateDriver({ timeout: CODE_MODE_TIMEOUT_MS })
     return { kind: "ready", driver }
   } catch (err) {
     return {

package/src/server/ai-gateway/code-mode/vm-driver.ts

@@ -28,23 +28,25 @@ import {
 } from "@tanstack/ai-code-mode"
 
 /**
- * node:vm 实现的 IsolateDriver —— 零原生依赖，生产可用。
+ * node:vm 实现的 IsolateDriver —— 零原生依赖，但**不是安全沙箱**。
  *
  * 存在原因：`@tanstack/ai-isolate-node` 依赖 isolated-vm 原生 addon，
  * isolated-vm 6.2.0 不带 prebuilds、必须源码编译；托管运行时的工具链无法保证
  * 编译成功（本机 macOS 27 实测 `fatal error: 'memory' file not found`），导致
- * 编排模式在线上恒为不可用。node:vm 是 Node 内建模块，无需编译，任何 Node
- * 运行时（Vercel / self-hosted / desktop sidecar）均可用。
+ * 编排模式恒为不可用。node:vm 是 Node 内建模块，无需编译。
  *
- * 安全边界与官方 isolated-vm driver 对齐，取舍已注明：
- * - 干净上下文：不注入 require / process / Buffer / module / setTimeout / fetch，
- *   沙箱内只有 JS 标准内建与白名单工具函数。isolated-vm isolate 同样默认无计时器。
- * - CPU 炸弹：runInContext 的运行参数 timeout 按 CPU 时间中止同步死循环。
- * - 墙钟超时：async 代码的 await 链需额外 Promise.race 兜底。
- *   等价取舍：node:vm 无法在运行中终止 vm 上下文，超时后后台代码理论上仍可继续
- *   占用 CPU；用 MAX_TOOL_CALLS_PER_RUN 限制工具调用次数作实际边界（无限 async
- *   循环必然反复调用白名单工具，超预算即抛错终止）。isolated-vm 可 terminate
- *   isolate，这是唯一实质弱化点。
+ * 安全边界如实说明（审计 2026-10-25 🔴，此前注释声称「与 isolated-vm 对齐」属误导）：
+ * - node:vm 的 contextify 不隔离原型链：`({}).constructor.constructor("return process")()`
+ *   即取回宿主 process（进而 process.env 全量密钥、process.mainModule.require）；注入的
+ *   external_* 绑定本身就是宿主 realm 的函数对象，`.constructor.constructor` 同样拿到
+ *   宿主 Function。Node 官方文档明确 vm 模块不得用于运行不可信代码。
+ * - 因此本驱动只允许在 desktop（单用户、代码跑在用户本机）或运维显式开启
+ *   CODE_MODE_ALLOW_UNSAFE_VM_FALLBACK 时装配（见 sandbox.ts isUnsafeVmFallbackAllowed），
+ *   多租户服务端一律不回落。
+ * - 不支持 memoryLimit：node:vm 上下文无内存配额，调用方不得假设存在该限制。
+ * - 墙钟超时：runInContext 的 timeout 只对同步代码生效；async 代码超时后 execute 提前
+ *   返回，但底层 continuation 不会被终止（vm 无法 terminate 上下文），纯计算型 async 循环
+ *   可持续占用 CPU；工具调用型循环由 MAX_TOOL_CALLS_PER_RUN 兜底。
  */
 
 const DEFAULT_TIMEOUT_MS = 30_000
@@ -189,9 +191,6 @@ class VmIsolateDriver implements IsolateDriver {
   }
 }
 
-export function createVmIsolateDriver(options?: {
-  timeout?: number
-  memoryLimit?: number
-}): IsolateDriver {
+export function createVmIsolateDriver(options?: { timeout?: number }): IsolateDriver {
   return new VmIsolateDriver(options?.timeout ?? DEFAULT_TIMEOUT_MS)
 }

package/src/server/ai-gateway/durability/pg-stream.ts

@@ -97,16 +97,17 @@ async function tailRow(runId: string): Promise<ChunkRow | null> {
 
 async function appendChunks(runId: string, chunks: DurabilityChunk[]): Promise<string[]> {
   if (chunks.length === 0) return []
-  return prisma.$transaction(async (tx) => {
-    const offsets: string[] = []
-    for (const chunk of chunks) {
-      const row = await tx.aiStreamChunk.create({
-        data: { runId, chunk: toJson(chunk) },
-      })
-      offsets.push(String(row.id))
-    }
-    return offsets
+  // 单语句批量插入（审计 2026-10-25 🟡）：替代事务内逐条 create 的 N 次 DB 往返
+  // 与长事务持锁。id 由 bigserial 按插入序单调分配，按 id 升序对齐 RETURNING 行，
+  // 保证 offsets 与输入 chunks 一一对应（resume 游标 / upsert 连续性校验依赖该顺序）。
+  const rows = await prisma.aiStreamChunk.createManyAndReturn({
+    data: chunks.map((chunk) => ({ runId, chunk: toJson(chunk) })),
+    select: { id: true },
   })
+  return rows
+    .map((row) => row.id)
+    .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))
+    .map((id) => String(id))
 }
 
 async function closeRun(runId: string): Promise<void> {

package/src/server/ai-gateway/durability/reaper-driver.ts

@@ -50,6 +50,9 @@ export function buildReaperDrive(): ReapOptions["drive"] | null {
     const overrides = await resolveOverrides(thread.userId, thread.agentId ?? undefined)
     const userMessages = [{ role: "user" as const, content: "" }]
 
+    // adapter 传 null 依赖「attach 模式且 journal 已终态时 adapter 不被调用」的
+    // 包内契约；buildChatStreamWithTools 已加显式守卫——非 attach 场景传 null
+    // 会在装配口抛带上下文的错误，而不是空指针崩在后台 reaper 深水区。
     const stream = await buildChatStreamWithTools({
       adapter: null as never,
       userId: thread.userId,

package/src/server/ai-gateway/embedding.ts

@@ -19,6 +19,7 @@ import { embed } from "@tanstack/ai"
 import { createOpenaiEmbedding } from "@tanstack/ai-openai"
 import type { OpenAIEmbeddingModel } from "@tanstack/ai-openai"
 import { envApiKey, ENV_OPENAI_API_KEY, ENV_OPENROUTER_API_KEY } from "./env-key"
+import { assertFetchableUrl, isDesktopRuntime } from "@/server/fetch-guard"
 
 export const EMBEDDING_MODEL = "text-embedding-3-small" as const
 
@@ -40,6 +41,13 @@ export async function generateEmbedding(
   }
   const baseURL =
     opts?.baseUrl ?? (envApiKey(ENV_OPENAI_API_KEY) ? undefined : OPENROUTER_BASE_URL)
+  // SEC-08：opts.baseUrl 来自用户 provider 配置（knowledge-index-utils
+  // resolveAiConfig 返回 cfg.baseUrl，与 adapter.ts 同一 SSRF 面），进 adapter
+  // 前统一出口校验；OPENROUTER_BASE_URL 为内置常量、env 路径为运维配置，均无需校验。
+  // 桌面端单机形态放行本地 embedding 服务。
+  if (opts?.baseUrl) {
+    assertFetchableUrl(opts.baseUrl, { allowPrivate: isDesktopRuntime() })
+  }
   const model = (
     baseURL ? `openai/${EMBEDDING_MODEL}` : EMBEDDING_MODEL
   ) as OpenAIEmbeddingModel
@@ -54,8 +62,15 @@ export async function generateEmbedding(
   return vector
 }
 
+// 分句正则：终止符含中英文句读（。！？）；第二分支兜住结尾无终止符的尾段。
+// 两个分支并集覆盖全部字符——任何非空输入都不会被静默丢弃（审计 2026-10-25：
+// 旧正则 /[^.!?]+[.!?]+/g 只捕获以终止符结尾的片段，"Intro. body without final
+// period" 的尾段不入向量库，检索永远召回不到；中文句读不在终止符类中，纯中文
+// 长文会整篇成单 chunk 使 chunkSize 失效）。
+const SENTENCE_RE = /[^.!?。！？]*[.!?。！？]+|[^.!?。！？]+/g
+
 export function chunkText(text: string, chunkSize = 500): string[] {
-  const sentences = text.match(/[^.!?]+[.!?]+/g) || [text]
+  const sentences = text.match(SENTENCE_RE) || [text]
   const chunks: string[] = []
   let current = ""
   for (const s of sentences) {
@@ -63,9 +78,14 @@ export function chunkText(text: string, chunkSize = 500): string[] {
       chunks.push(current.trim())
       current = s
     } else {
-      current += " " + s
+      // 分句 token 自带句间空白（正则前导段消费空白字符），直接拼接即可
+      // 无损还原原文，不再额外插空格（中文文本插空格属噪声）。
+      current += s
     }
   }
   if (current.trim()) chunks.push(current.trim())
   return chunks
+  // 维度/模型契约不变（1536，text-embedding-3-small），本函数只改分块。
+  // ⚠ 存量索引按旧分块落库，新分块仅影响增量索引——新旧 chunk 边界不一致
+  // 属预期；对检索质量有疑虑的库走既有重索引链路全量重建。
 }

package/src/server/ai-gateway/label-suggest.ts

@@ -17,6 +17,7 @@
 
 import { z } from "zod"
 import { resolveSystemPrompt } from "./prompts/registry"
+import { fenceLlmData } from "./llm-fence"
 
 export interface LabelSuggestionInput {
   name: string
@@ -32,6 +33,10 @@ export interface LabelSuggestionResult {
 const MAX_TOTAL = 5
 const MAX_NEW_NAME_CHARS = 4
 const MAX_DESCRIPTION_CHARS = 2000
+// 需求名 / 标签名同为用户可控自由文本：长度截断 + fence（审计 2026-10-25：
+// description 有截断而 name / 标签名列表裸拼，可携带超长内容或提示词注入）
+const MAX_NAME_CHARS = 200
+const MAX_LABEL_NAMES = 30
 
 /** 元素级保持 unknown 宽容（既有非 string 项 continue 跳过语义），仅校验对象形状 */
 const labelSuggestionSchema = z
@@ -44,8 +49,13 @@ const labelSuggestionSchema = z
 export async function buildLabelSuggestSystemPrompt(
   availableLabels: string[],
 ): Promise<string[]> {
+  // 标签名过围栏后再拼进系统提示词（防换行/伪指令形态的提示词注入），
+  // 与 user message 侧 currentLabels 的防护口径一致
+  const joined = availableLabels.length > 0
+    ? fenceLlmData("available_labels", availableLabels.slice(0, MAX_LABEL_NAMES).join("、"))
+    : "（暂无）"
   return resolveSystemPrompt("story.label-suggest", {
-    availableLabels: availableLabels.length > 0 ? availableLabels.join("、") : "（暂无）",
+    availableLabels: joined,
   })
 }
 
@@ -53,11 +63,12 @@ export function buildLabelSuggestUserMessage(input: LabelSuggestionInput): strin
   const desc = input.description
     ? input.description.slice(0, MAX_DESCRIPTION_CHARS)
     : undefined
+  const name = input.name.slice(0, MAX_NAME_CHARS)
   const current =
     input.currentLabelNames && input.currentLabelNames.length > 0
-      ? `\n当前已选标签（不要重复推荐）：${input.currentLabelNames.join("、")}`
+      ? `\n当前已选标签（不要重复推荐）：${fenceLlmData("current_labels", input.currentLabelNames.slice(0, MAX_LABEL_NAMES).join("、"))}`
       : ""
-  return `需求名称：${input.name}\n需求描述：${desc ?? "无"}${current}`
+  return `需求名称：${name}\n需求描述：${desc ?? "无"}${current}`
 }
 
 function stripCodeFence(raw: string): string {

package/src/server/ai-gateway/log-redact.ts

@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 日志脱敏（审计 2026-10-25）：provider/HTTP 层错误 message 常把完整 URL 嵌进
+// 文本（fetch failed / invalid URL），gemini 的 `?key=`、openai 的 `sk-` 随之进
+// 服务端日志，日志聚合后成为第二泄露面。规则与 ai-output-guard 同源思路，但
+// 方向相反：这里是「写日志前抹除」，命中即替换为占位符。
+
+/** 每条规则命中后替换为 `[REDACTED:<type>]` */
+const REDACT_RULES: Array<{ type: string; pattern: RegExp }> = [
+  // openai / openrouter / anthropic 形态密钥（含 URL 里的裸 key）
+  { type: "api-key", pattern: /\bsk-(?:proj-|ant-|or-)?[A-Za-z0-9_-]{16,}\b/g },
+  // gemini 官方鉴权风格 ?key=<apiKey>（connectivity-check / 探活 URL）
+  { type: "url-key-param", pattern: /([?&]key=)[^&\s'"]+/gi },
+  // Bearer token / JWT
+  { type: "bearer", pattern: /\bBearer\s+[A-Za-z0-9._-]{16,}\b/g },
+  { type: "jwt", pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]*/g },
+  // 数据库连接串（postgres://user:pass@host/...）
+  { type: "db-connection", pattern: /\b(?:postgres(?:ql)?|mysql|redis):\/\/[^\s"']+/g },
+]
+
+/**
+ * 对将写入日志的文本做密钥形态脱敏。纯函数；规则带 g flag，
+ * 每次调用前复位 lastIndex 保证结果稳定。
+ */
+export function redactSecretsForLog(input: unknown): string {
+  const text =
+    input instanceof Error
+      ? input.stack ?? `${input.name}: ${input.message}`
+      : typeof input === "string"
+        ? input
+        : (() => {
+            try {
+              return JSON.stringify(input) ?? String(input)
+            } catch {
+              return String(input)
+            }
+          })()
+  let out = text
+  for (const rule of REDACT_RULES) {
+    rule.pattern.lastIndex = 0
+    out = out.replace(rule.pattern, (match: string, prefix?: string) =>
+      prefix ? `${prefix}[REDACTED:${rule.type}]` : `[REDACTED:${rule.type}]`,
+    )
+  }
+  return out
+}

package/src/server/ai-gateway/media/adapters.ts

@@ -44,6 +44,7 @@ import { createGrokTranscription } from "@tanstack/ai-grok"
 import { createBytePlusTranscription } from "@tanstack/ai-byteplus"
 import { falTranscription } from "@tanstack/ai-fal"
 import type { AnyImageAdapter, AnyVideoAdapter, AnyTTSAdapter, AnyTranscriptionAdapter } from "@tanstack/ai"
+import { assertFetchableUrl, isDesktopRuntime } from "@/server/fetch-guard"
 
 // 单一事实源：AdapterKind 由 @allbluecn/kernel 定义。
 // 媒体生成实际只支持 kernel AdapterKind 的子集（"openai" | "gemini" | "grok" | "byteplus" | "fal"），
@@ -86,6 +87,18 @@ function isMediaAdapterKind(kind: string): kind is MediaAdapterKind {
   return MEDIA_ADAPTER_KINDS.has(kind as MediaAdapterKind)
 }
 
+/**
+ * SEC-08：媒体生成 adapter 的 baseURL / voiceBaseUrl 出口校验（与 connectivity-check、
+ * adapter.ts 同一口径）。两者均来自用户 provider 配置（含 byteplus 独立 voice 主机），
+ * 服务端将以该 URL 为目标 fetch 并携带 apiKey——云端严拦私网/回环/云元数据；
+ * 桌面端单机形态放行本地服务。违规抛 FetchGuardError（fail-closed），
+ * 由调用方（generate*ForUser）冒泡为生成失败。
+ */
+function assertMediaBaseUrl(url: string | undefined): void {
+  if (!url) return
+  assertFetchableUrl(url, { allowPrivate: isDesktopRuntime() })
+}
+
 /**
  * fal adapter 采用方案 B：仅支持 env `FAL_KEY`，不接受用户自定义 apiKey。
  * `@tanstack/ai-fal@0.14.1` 内部通过 `configureFalClient()` 全局态维护 key，
@@ -113,6 +126,7 @@ export function resolveImageAdapter(opts: ResolveAdapterOptions): ImageAdapterRe
   const { adapterKind, apiKey, model, baseURL } = opts
 
   if (!isMediaAdapterKind(adapterKind)) return { kind: "unavailable" }
+  assertMediaBaseUrl(baseURL)
   switch (adapterKind) {
     case "openai":
       return createOpenaiImage(model as Parameters<typeof createOpenaiImage>[0], apiKey, baseURL ? { baseURL } : undefined) as ImageAdapterResult
@@ -138,6 +152,7 @@ export function resolveVideoAdapter(opts: ResolveAdapterOptions): VideoAdapterRe
   const { adapterKind, apiKey, model, baseURL } = opts
 
   if (!isMediaAdapterKind(adapterKind)) return { kind: "unavailable" }
+  assertMediaBaseUrl(baseURL)
   switch (adapterKind) {
     case "openai":
       return createOpenaiVideo(model as Parameters<typeof createOpenaiVideo>[0], apiKey, baseURL ? { baseURL } : undefined) as VideoAdapterResult
@@ -165,6 +180,8 @@ export function resolveSpeechAdapter(opts: ResolveAdapterOptions): SpeechAdapter
   const { adapterKind, apiKey, model, baseURL, voiceBaseUrl, voiceApiKey } = opts
 
   if (!isMediaAdapterKind(adapterKind)) return { kind: "unavailable" }
+  assertMediaBaseUrl(baseURL)
+  assertMediaBaseUrl(voiceBaseUrl)
   switch (adapterKind) {
     case "openai":
       return createOpenaiSpeech(model as Parameters<typeof createOpenaiSpeech>[0], apiKey, baseURL ? { baseURL } : undefined) as SpeechAdapterResult
@@ -196,6 +213,8 @@ export function resolveTranscriptionAdapter(opts: ResolveAdapterOptions): Transc
   const { adapterKind, apiKey, model, baseURL, voiceBaseUrl, voiceApiKey } = opts
 
   if (!isMediaAdapterKind(adapterKind)) return { kind: "unavailable" }
+  assertMediaBaseUrl(baseURL)
+  assertMediaBaseUrl(voiceBaseUrl)
   switch (adapterKind) {
     case "openai":
       return createOpenaiTranscription(model as Parameters<typeof createOpenaiTranscription>[0], apiKey, baseURL ? { baseURL } : undefined) as TranscriptionAdapterResult

package/src/server/ai-gateway/media/index.ts

@@ -201,8 +201,27 @@ export async function generateSpeechForUser(opts: MediaGenOptions & { text: stri
 
 type TranscriptionArtifact = PersistedArtifactRef & { audioBlobRef?: string; content?: string }
 
+// 转写音频入参上限（与 MAX_IMAGE_BYTES 同量级）：string（data URL）/File/Blob/
+// ArrayBuffer 均先在服务端缓冲再转发 provider，无上限即可被大载荷打满内存
+// （审计 2026-10-25 🟡）。
+const MAX_TRANSCRIPTION_AUDIO_BYTES = 25 * 1024 * 1024
+
+function assertAudioSize(audio: string | File | Blob | ArrayBuffer): void {
+  const size =
+    typeof audio === "string"
+      ? Math.floor((audio.length * 3) / 4) // data URL base64 近似还原字节数
+      : audio instanceof Blob
+        ? audio.size
+        : audio.byteLength
+  if (!Number.isFinite(size) || size <= 0) throw new Error("Empty audio")
+  if (size > MAX_TRANSCRIPTION_AUDIO_BYTES) {
+    throw new Error("Audio too large")
+  }
+}
+
 export async function generateTranscriptionForUser(opts: MediaGenOptions & { audio: string | File | Blob | ArrayBuffer; language?: string; prompt?: string; audioBlobRef?: string; mimeType?: string }) {
   await requireThread(opts)
+  assertAudioSize(opts.audio)
   const adapter = resolveTranscriptionAdapter(opts)
   if (adapter.kind === "unavailable") throw new Error(`Transcription is not available for adapter kind: ${opts.adapterKind}`)
   const runId = randomUUID()

package/src/server/ai-gateway/media/recorder.ts

@@ -41,7 +41,9 @@ export interface RecordGenerationRunInput {
 }
 
 function toJson(value: unknown): Prisma.InputJsonValue {
-  return value as unknown as Prisma.InputJsonValue
+  // round-trip 剥掉 undefined 字段与 class 外壳（Date/Map 等），与 media/index.ts
+  // 及 pg-stream 的落库口径一致——直通断言会把运行时校验错拖到 Prisma 层才爆。
+  return JSON.parse(JSON.stringify(value)) as Prisma.InputJsonValue
 }
 
 /** 终态写入 finishedAt（与 startedAt 同值，二者成对才有时长可算）。 */

package/src/server/ai-gateway/memory/pgvector-adapter.ts

@@ -96,11 +96,9 @@ export function createPgVectorMemoryAdapter(
     userId: string,
     limit: number,
   ): Promise<Array<StoredFactRow>> {
-    return (await prisma.$queryRawUnsafe(
-      `SELECT "id", "content", "threadId", "createdAt" FROM "memory_facts" WHERE "userId" = $1 ORDER BY "createdAt" DESC LIMIT $2`,
-      userId,
-      limit,
-    )) as Array<StoredFactRow>
+    return (await prisma.$queryRaw<Array<StoredFactRow>>`
+      SELECT "id", "content", "threadId", "createdAt" FROM "memory_facts" WHERE "userId" = ${userId} ORDER BY "createdAt" DESC LIMIT ${limit}`
+    )
   }
 
   async function searchFacts(
@@ -110,20 +108,15 @@ export function createPgVectorMemoryAdapter(
     const embedding = await generateEmbedding(query)
     if (!Array.isArray(embedding) || embedding.length === 0) return []
     const embeddingStr = formatVector(embedding)
-    return (await prisma.$queryRawUnsafe(
-      `SELECT "id", "content", "threadId", "createdAt", 1 - (embedding <=> $1::vector) AS similarity FROM "memory_facts" WHERE "userId" = $2 ORDER BY embedding <=> $3::vector LIMIT $4`,
-      embeddingStr,
-      userId,
-      embeddingStr,
-      candidateLimit,
-    )) as Array<StoredFactRow>
+    return (await prisma.$queryRaw<Array<StoredFactRow>>`
+      SELECT "id", "content", "threadId", "createdAt", 1 - (embedding <=> ${embeddingStr}::vector) AS similarity
+      FROM "memory_facts" WHERE "userId" = ${userId} ORDER BY embedding <=> ${embeddingStr}::vector LIMIT ${candidateLimit}`
+    )
   }
 
   async function countFacts(userId: string): Promise<MemoryStatsRow> {
-    const rows = (await prisma.$queryRawUnsafe(
-      `SELECT COUNT(*)::int AS "c", COALESCE(MAX("createdAt"), NOW()) AS "lastWrite" FROM "memory_facts" WHERE "userId" = $1`,
-      userId,
-    )) as Array<MemoryStatsRow>
+    const rows = await prisma.$queryRaw<Array<MemoryStatsRow>>`
+      SELECT COUNT(*)::int AS "c", COALESCE(MAX("createdAt"), NOW()) AS "lastWrite" FROM "memory_facts" WHERE "userId" = ${userId}`
     return rows[0] ?? { c: 0, lastWrite: null }
   }
 
@@ -184,14 +177,9 @@ export function createPgVectorMemoryAdapter(
           return [{ ok: false, error: "embedding returned an empty vector" }]
         }
         const id = randomUUID()
-        await prisma.$executeRawUnsafe(
-          `INSERT INTO "memory_facts" ("id", "userId", "threadId", "content", "embedding") VALUES ($1, $2, $3, $4, $5::vector)`,
-          id,
-          scope.userId,
-          scope.threadId,
-          content,
-          formatVector(embedding),
-        )
+        await prisma.$executeRaw`
+          INSERT INTO "memory_facts" ("id", "userId", "threadId", "content", "embedding")
+          VALUES (${id}, ${scope.userId}, ${scope.threadId}, ${content}, ${formatVector(embedding)}::vector)`
         return [
           {
             ok: true,