git-ai-control 0.4.6 → 0.4.8

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 本项目的所有重要变更都会记录在此文件中。
 
+## [0.4.8] - 2026-08-12
+
+### 新增
+
+- 新增最近 24 小时过滤审计列表，按仓库和 Skill 汇总本机拦截次数、原因与最近发生时间；审计记录不保存上报正文。
+- 新增过滤服务在线状态卡片，便于确认本机细粒度过滤是否可用。
+
+### 变更
+
+- 顶部版本号调整至产品标题旁；右侧状态徽章仅展示发行版与过滤运行状态。
+
+## [0.4.7] - 2026-08-11
+
+### 修复
+
+- 修复全部“每行一条”规则输入框在最后一行按 Enter 后空行被受控状态立即清除的问题，覆盖 Skill、仓库匹配、敏感正则及 Agent / 模型治理配置。
+
 ## [0.4.6] - 2026-08-07
 
 ### 变更

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-ai-control",
-  "version": "0.4.6",
+  "version": "0.4.8",
   "description": "Git AI 本地配置与上传隐私控制面板",
   "type": "module",
   "bin": {

package/plugins/upload-filter/plugin_filter_runtime.py

@@ -8,8 +8,10 @@ import os
 import re
 import subprocess
 import sys
+import threading
 import urllib.error
 import urllib.request
+from datetime import datetime, timedelta, timezone
 from fnmatch import fnmatchcase
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
@@ -36,6 +38,10 @@ PORT = 38741
 GIT_AI_ROOT = Path(os.environ.get("GIT_AI_ROOT", Path.home() / ".git-ai")).resolve()
 POLICY_CONFIG_PATH = GIT_AI_ROOT / "filter_plugins.json"
 UPSTREAM_CONFIG_PATH = GIT_AI_ROOT / "upstream_metrics.json"
+FILTER_AUDIT_PATH = GIT_AI_ROOT / "filter_audit.jsonl"
+FILTER_AUDIT_RETENTION = timedelta(hours=24)
+FILTER_AUDIT_MAX_EVENTS = 2_000
+FILTER_AUDIT_LOCK = threading.Lock()
 OWNER_REPOSITORY_PATTERN = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+(?:\.git)?$")
 SKILL_KEYS = {"skillName", "skill", "name"}
 PATH_KEYS = {
@@ -269,6 +275,138 @@ def iter_skill_text(value):
             yield from iter_skill_text(child)
 
 
+def audit_timestamp() -> str:
+    return datetime.now(timezone.utc).isoformat(timespec="seconds").replace("+00:00", "Z")
+
+
+def parse_audit_timestamp(value) -> datetime | None:
+    if not isinstance(value, str):
+        return None
+    try:
+        timestamp = datetime.fromisoformat(value.replace("Z", "+00:00"))
+    except ValueError:
+        return None
+    if timestamp.tzinfo is None:
+        timestamp = timestamp.replace(tzinfo=timezone.utc)
+    return timestamp.astimezone(timezone.utc)
+
+
+def audit_text(value, maximum: int = 240) -> str:
+    return str(value).strip()[:maximum]
+
+
+def audit_repository_label(value) -> str:
+    label = audit_text(value)
+    label = re.sub(r"([a-z][a-z0-9+.-]*://)[^/\s]*@", r"\1", label, flags=re.IGNORECASE)
+    label = re.sub(r"^[^@/\s]+@", "", label)
+    return label.split("?", 1)[0].split("#", 1)[0]
+
+
+def read_filter_audit_events(
+    *, now: datetime | None = None, path: Path | None = None
+) -> list[dict]:
+    now = now or datetime.now(timezone.utc)
+    if now.tzinfo is None:
+        now = now.replace(tzinfo=timezone.utc)
+    cutoff = now.astimezone(timezone.utc) - FILTER_AUDIT_RETENTION
+    path = path or FILTER_AUDIT_PATH
+    try:
+        lines = path.read_text(encoding="utf-8").splitlines()
+    except OSError:
+        return []
+
+    events = []
+    for line in lines:
+        try:
+            event = json.loads(line)
+        except json.JSONDecodeError:
+            continue
+        if not isinstance(event, dict):
+            continue
+        timestamp = parse_audit_timestamp(event.get("timestamp"))
+        if timestamp is None or timestamp < cutoff:
+            continue
+        repositories = sorted(
+            {
+                label
+                for value in event.get("repositories", [])
+                if isinstance(value, str)
+                if (label := audit_repository_label(value))
+            }
+        )[:10]
+        skills = sorted(
+            {
+                label
+                for value in event.get("skills", [])
+                if isinstance(value, str)
+                if (label := audit_text(value, 160))
+            }
+        )[:10]
+        events.append(
+            {
+                "timestamp": timestamp.isoformat(timespec="seconds").replace("+00:00", "Z"),
+                "eventType": audit_text(event.get("eventType", ""), 80),
+                "reason": audit_text(event.get("reason", ""), 160),
+                "plugin": audit_text(event.get("plugin", ""), 80) or None,
+                "repositories": repositories,
+                "skills": skills,
+            }
+        )
+    return sorted(events, key=lambda event: event["timestamp"], reverse=True)[:FILTER_AUDIT_MAX_EVENTS]
+
+
+def write_filter_audit_events(events: list[dict], *, path: Path | None = None) -> None:
+    path = path or FILTER_AUDIT_PATH
+    temporary = None
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        temporary = path.with_name(f".{path.name}.{os.getpid()}.tmp")
+        temporary.write_text(
+            "".join(json.dumps(event, ensure_ascii=False, separators=(",", ":")) + "\n" for event in events),
+            encoding="utf-8",
+        )
+        if os.name != "nt":
+            os.chmod(temporary, 0o600)
+        os.replace(temporary, path)
+    except OSError:
+        if temporary:
+            try:
+                temporary.unlink(missing_ok=True)
+            except OSError:
+                pass
+
+
+def record_filter_event(
+    endpoint_path: str, payload, reason: str, plugin: str | None = None
+) -> None:
+    event = {
+        "timestamp": audit_timestamp(),
+        "eventType": EVENT_TYPES.get(endpoint_path, ""),
+        "reason": reason,
+        "plugin": plugin,
+        "repositories": sorted(
+            {
+                label
+                for value in iter_repository_text(payload)
+                if (label := audit_repository_label(value))
+            }
+        )[:10],
+        "skills": sorted(
+            {
+                label
+                for value in iter_skill_text(payload)
+                if (label := audit_text(value, 160))
+            }
+        )[:10],
+    }
+    with FILTER_AUDIT_LOCK:
+        events = read_filter_audit_events()
+        events.append(event)
+        write_filter_audit_events(
+            sorted(events, key=lambda item: item["timestamp"], reverse=True)[:FILTER_AUDIT_MAX_EVENTS]
+        )
+
+
 def iter_path_text(value):
     if isinstance(value, dict):
         for key, child in value.items():
@@ -714,12 +852,17 @@ class Handler(BaseHTTPRequestHandler):
         try:
             payload = json.loads(body.decode("utf-8") or "{}")
         except json.JSONDecodeError:
-            self.send_filtered(endpoint_path, "invalid_json")
+            self.send_filtered(endpoint_path, "invalid_json", payload={})
             return
 
         decision = evaluate_request(endpoint_path, payload, body)
         if decision["blocked"]:
-            self.send_filtered(endpoint_path, decision["reason"], decision.get("plugin"))
+            self.send_filtered(
+                endpoint_path,
+                decision["reason"],
+                decision.get("plugin"),
+                payload,
+            )
             return
 
         upstreams, upstream_error = load_upstreams()
@@ -769,7 +912,14 @@ class Handler(BaseHTTPRequestHandler):
         except Exception as error:
             self.send_json(502, {"code": -1, "data": None, "message": str(error)})
 
-    def send_filtered(self, endpoint_path: str, reason: str, plugin: str | None = None):
+    def send_filtered(
+        self,
+        endpoint_path: str,
+        reason: str,
+        plugin: str | None = None,
+        payload=None,
+    ):
+        record_filter_event(endpoint_path, payload or {}, reason, plugin)
         self.send_json(
             200,
             {

package/server.py

@@ -13,6 +13,7 @@ import subprocess
 import tempfile
 import urllib.error
 import urllib.request
+from datetime import datetime, timedelta, timezone
 from functools import lru_cache
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
@@ -28,6 +29,8 @@ NATIVE_CONFIG_PATH = GIT_AI_ROOT / "config.json"
 POLICY_CONFIG_PATH = GIT_AI_ROOT / "filter_plugins.json"
 CUSTOM_METRICS_PATH = GIT_AI_ROOT / "custom_metrics.json"
 FILTER_SCRIPT_PATH = GIT_AI_ROOT / "filters" / "plugin_filter_runtime.py"
+FILTER_AUDIT_PATH = GIT_AI_ROOT / "filter_audit.jsonl"
+FILTER_AUDIT_RETENTION = timedelta(hours=24)
 FILTER_HEALTH_URL = "http://127.0.0.1:38741/health"
 FILTER_MAC_LABEL = "com.git-ai.skill-usage-filter"
 FILTER_LINUX_UNIT = "git-ai-filter.service"
@@ -590,6 +593,59 @@ def runtime_status() -> dict:
     }
 
 
+def read_filter_audit_events(now: datetime | None = None) -> tuple[str, list[dict]]:
+    now = now or datetime.now(timezone.utc)
+    if now.tzinfo is None:
+        now = now.replace(tzinfo=timezone.utc)
+    now = now.astimezone(timezone.utc)
+    cutoff = now - FILTER_AUDIT_RETENTION
+    events = []
+    try:
+        lines = FILTER_AUDIT_PATH.read_text(encoding="utf-8").splitlines()
+    except OSError:
+        lines = []
+
+    for line in lines:
+        try:
+            event = json.loads(line)
+            timestamp = datetime.fromisoformat(str(event.get("timestamp", "")).replace("Z", "+00:00"))
+        except (AttributeError, TypeError, ValueError, json.JSONDecodeError):
+            continue
+        if timestamp.tzinfo is None:
+            timestamp = timestamp.replace(tzinfo=timezone.utc)
+        timestamp = timestamp.astimezone(timezone.utc)
+        if timestamp < cutoff or not isinstance(event, dict):
+            continue
+        repositories = event.get("repositories", [])
+        skills = event.get("skills", [])
+        events.append(
+            {
+                "timestamp": timestamp.isoformat(timespec="seconds").replace("+00:00", "Z"),
+                "eventType": str(event.get("eventType", ""))[:80],
+                "reason": str(event.get("reason", ""))[:160],
+                "plugin": str(event["plugin"])[:80] if event.get("plugin") else None,
+                "repositories": [
+                    str(value)[:240]
+                    for value in repositories
+                    if isinstance(value, str) and value.strip()
+                ][:10]
+                if isinstance(repositories, list)
+                else [],
+                "skills": [
+                    str(value)[:160]
+                    for value in skills
+                    if isinstance(value, str) and value.strip()
+                ][:10]
+                if isinstance(skills, list)
+                else [],
+            }
+        )
+    return (
+        cutoff.isoformat(timespec="seconds").replace("+00:00", "Z"),
+        sorted(events, key=lambda event: event["timestamp"], reverse=True)[:2_000],
+    )
+
+
 def run_self_test() -> dict:
     checks = []
     try:
@@ -694,6 +750,10 @@ class Handler(BaseHTTPRequestHandler):
         if path == "/api/status":
             self.send_json(200, runtime_status())
             return
+        if path == "/api/filter-events":
+            since, events = read_filter_audit_events()
+            self.send_json(200, {"since": since, "events": events})
+            return
         self.serve_static(path)
 
     def do_PUT(self):