mingdao-harness 0.1.70 → 0.2.1

package/docs/QUALITY-REVIEW-0.1.68.md

@@ -87,8 +87,9 @@
 - L1/L2/L3/L6/L11/L12/L13 顺手修
 - 验收：94 组测试 + 38 组 bench 全绿、tsc 0 错误、三平台 CI 过
 
-### Phase 2 —「结构治理」v0.2.0（≈4–6 天）
-目标：拆巨石、补安全短板，为后续演进铺路。
+### Phase 2 —「结构治理」v0.2.0（≈4–6 天）✅ 已实施（2026-08-29）
+实施项：server.js 拆路由模块（src/web/routes/api.js，1299→579 行）、cli.js 命令分发显式化、SPA JS 外置 app.js + CSP 收紧、SSRF 目标校验、inflight 并发、会话写互斥、listen Promise + 桌面端口重试、sync-server 限流加固、API Key 即时生效、更新下载失败可见化。
+（cli.js 的 REPL/worker 进一步拆分与 routes/api.js 按域细分留待 0.2.1 渐进完成。）
 - H5 server.js 拆 `src/web/routes/*.js`（chat/sessions/config/sync/schedule/skills/workspace/fs-browse 等）+ 共享中间件
 - M13 cli.js 命令分发重构 + REPL/worker 拆分 + 重复逻辑抽取
 - M14 index.html JS 外置 `app.js` + CSP 收紧（去 unsafe-inline）+ 图标表/双拉取去重

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mingdao-harness",
-  "version": "0.1.70",
+  "version": "0.2.1",
   "description": "MingDao Harness —— 开源智能体框架（Agent Harness）。零依赖、开箱即用，针对 DeepSeek-V4 系列优化，开放主流模型接入。",
   "type": "module",
   "bin": {
@@ -48,13 +48,18 @@
   "license": "MIT",
   "scripts": {
     "start": "node src/cli.js",
-    "test": "node test/smoke.js",
+    "test": "node test/run-all.mjs",
     "typecheck": "tsc -p tsconfig.json",
     "prepublishOnly": "node test/smoke.js && node test/e2e-local.js && node test/e2e-schedule.js",
     "desktop": "npm --prefix desktop start",
     "desktop:dist": "node scripts/sync-versions.mjs && npm --prefix desktop run dist:dir",
     "desktop:sync": "node scripts/sync-versions.mjs",
-    "bench": "node test/bench/bench-tokenizer.mjs && node test/bench/bench-routing.mjs && node test/bench/bench-compaction.mjs"
+    "bench": "node test/bench/bench-tokenizer.mjs && node test/bench/bench-routing.mjs && node test/bench/bench-compaction.mjs",
+    "coverage": "node test/run-all.mjs --coverage && node scripts/coverage-report.mjs",
+    "typecheck:strict": "node scripts/strict-ratchet.mjs",
+    "preversion": "node test/smoke.js && node test/e2e-local.js && npm run bench",
+    "version": "node scripts/bump-changelog.mjs",
+    "postversion": "git add package.json package-lock.json CHANGELOG.md 2>/dev/null; git commit -m \"chore: release v$npm_package_version\" --no-verify || true"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",

package/src/cli.js

@@ -267,21 +267,30 @@ async function main() {
   const withJournal = Boolean(opts.journal);
 
   // —— 命令分发（已拆至 src/commands/，评估 P0-1 拆 cli.js）——
-  // 各 handler 返回 true = 已处理；false = 按普通提问继续（保留词劫持防护）
+  // 各 handler 返回 true = 已处理；false = 按普通提问继续（保留词劫持防护）。
+  // 质检 M3：显式命令映射（命令 → {module, handler}），模块与命令一一对应、handler 名显式可查
   {
-    const dispatchTable = [
-      ['update', 'update'], ['rollback', 'update'], ['batch', 'update'], ['cost', 'update'], ['audit', 'update'],
-      ['tasks', 'schedule'], ['schedule', 'schedule'],
-      ['workspace', 'workspace'], ['mcp', 'workspace'],
-      ['sync', 'sync'],
-      ['skill', 'skill'], ['web', 'skill'], ['sessions', 'skill'],
-      ['key', 'key'],
-      ['desktop', 'desktop'],
-    ];
-    const hit = dispatchTable.find(([name]) => name === opts.prompt[0]);
+    const dispatchTable = {
+      update: { module: 'update', handler: 'handleUpdateFamily' },
+      rollback: { module: 'update', handler: 'handleUpdateFamily' },
+      batch: { module: 'update', handler: 'handleUpdateFamily' },
+      cost: { module: 'update', handler: 'handleUpdateFamily' },
+      audit: { module: 'update', handler: 'handleUpdateFamily' },
+      tasks: { module: 'schedule', handler: 'handleTasks' },
+      schedule: { module: 'schedule', handler: 'handleSchedule' },
+      workspace: { module: 'workspace', handler: 'handleWorkspace' },
+      mcp: { module: 'workspace', handler: 'handleMcp' },
+      sync: { module: 'sync', handler: 'handleSync' },
+      skill: { module: 'skill', handler: 'handleSkill' },
+      web: { module: 'skill', handler: 'handleWeb' },
+      sessions: { module: 'skill', handler: 'handleSessions' },
+      key: { module: 'key', handler: 'handleKey' },
+      desktop: { module: 'desktop', handler: 'handleDesktop' },
+    };
+    const hit = dispatchTable[opts.prompt[0]];
     if (hit) {
-      const mod = await import(`./commands/${hit[1]}.js`);
-      const fn = mod[hit[1] === 'update' ? 'handleUpdateFamily' : hit[1] === 'schedule' ? (opts.prompt[0] === 'tasks' ? 'handleTasks' : 'handleSchedule') : hit[1] === 'workspace' ? (opts.prompt[0] === 'mcp' ? 'handleMcp' : 'handleWorkspace') : hit[1] === 'skill' ? (opts.prompt[0] === 'skill' ? 'handleSkill' : opts.prompt[0] === 'web' ? 'handleWeb' : 'handleSessions') : 'handle' + hit[1][0].toUpperCase() + hit[1].slice(1)];
+      const mod = await import(`./commands/${hit.module}.js`);
+      const fn = mod[hit.handler];
       const handled = await fn(opts.prompt[0], opts.prompt.slice(1));
       if (handled) return;
     }

package/src/commands/skill.js

@@ -175,7 +175,13 @@ export async function handleWeb(cmd, args) {
       return true;
     }
   }
-  await runWebServer({ host, port, authToken });
+  try {
+    await runWebServer({ host, port, authToken });
+  } catch (err) {
+    // 质检 C2：listen 现在会 reject（如端口占用），CLI 给出明确提示而非挂起
+    console.error(`[MingDao] WebUI 启动失败：${err?.message || err}`);
+    process.exitCode = 1;
+  }
   return true;
 }
 

package/src/sync-server.js

@@ -106,9 +106,20 @@ function isValidSessionName(n) {
 }
 
 // ---------- 限速（防爆破/枚举；内存表，进程级） ----------
+const TRUST_PROXY = process.env.SYNC_TRUST_PROXY === '1'; // 仅部署在可信反代后时开启
 const rateBuckets = new Map();
-function rateLimited(req, limit = 20) {
-  const key = (req.socket?.remoteAddress || 'x') + '|' + req.url;
+function clientKey(req) {
+  let ip = req.socket?.remoteAddress || 'x';
+  if (TRUST_PROXY) {
+    const xff = String(req.headers['x-forwarded-for'] || '').split(',')[0].trim();
+    if (/^[\d.]+$/.test(xff) || xff.includes(':')) ip = xff;
+  }
+  return ip;
+}
+function rateLimited(req, limit = 20, extra = '') {
+  // 质检 M5：键 = IP + 路由 + 用户名——单账号爆破按用户名限（分布式 IP 无法绕过）；
+  // 表满按最旧淘汰而非整表 clear（整表 clear 可被攻击者重置全员限额）
+  const key = clientKey(req) + '|' + req.url + '|' + String(extra || '');
   const now = Date.now();
   const b = rateBuckets.get(key);
   if (b && now - b.t0 < 60000) {
@@ -116,7 +127,14 @@ function rateLimited(req, limit = 20) {
     if (b.n > limit) return true;
   } else {
     rateBuckets.set(key, { t0: now, n: 1 });
-    if (rateBuckets.size > 5000) rateBuckets.clear();
+    if (rateBuckets.size > 10000) {
+      let oldestKey = null;
+      let oldestT = Infinity;
+      for (const [k, v] of rateBuckets) {
+        if (v.t0 < oldestT) { oldestT = v.t0; oldestKey = k; }
+      }
+      if (oldestKey !== null) rateBuckets.delete(oldestKey);
+    }
   }
   return false;
 }
@@ -423,6 +441,7 @@ async function handle(req, res) {
       if (rateLimited(req, 10)) return json(res, 429, { error: '尝试过于频繁，请稍后再试' });
       const body = await parseBody(req);
       if (body.__error) return json(res, 400, { error: 'JSON 解析失败' });
+      if (rateLimited(req, 5, String(body.username || '').toLowerCase())) return json(res, 429, { error: '该用户名的尝试过于频繁，请稍后再试' });
       if (REGISTRATION === 'closed') return json(res, 403, { error: '注册已关闭（管理员已禁用自助注册）' });
       if (REGISTRATION === 'invite') {
         const code = String(body.inviteCode || '').trim();
@@ -437,6 +456,7 @@ async function handle(req, res) {
       if (rateLimited(req, 10)) return json(res, 429, { error: '尝试过于频繁，请稍后再试' });
       const body = await parseBody(req);
       if (body.__error) return json(res, 400, { error: 'JSON 解析失败' });
+      if (rateLimited(req, 5, String(body.username || '').toLowerCase())) return json(res, 429, { error: '该用户名的尝试过于频繁，请稍后再试' });
       const r = doPair(body);
       if (r.notFound) return json(res, 404, r);
       if (r.unauthorized) return json(res, 401, r);
@@ -549,6 +569,8 @@ export function runSyncServer({ port, host, dataDir, cert, key } = {}) {
     server = http.createServer(handler);
     console.log(new Date().toISOString(), '警告：HTTP 明文模式（仅限内网/过渡，公网请配置 SYNC_CERT/SYNC_KEY）');
   }
+  // 质检 M5：全局并发连接上限（防连接耗尽）
+  if (typeof server.maxConnections === 'number') server.maxConnections = 500;
   server.listen(listenPort, listenHost, () => {
     console.log(
       new Date().toISOString(),