功能修改

platform_web/utils/pluginBridgeHost.ts

@@ -181,6 +181,18 @@ function requiredPermissions(action: PluginBridgeAction): PluginPermission[] {
       return ["server.artifacts.read"];
     case "files.request":
       return ["server.files.read"];
+    case "remote.access.request":
+      return ["server.remote.access"];
+    case "run.distribution.request":
+      return ["server.run.distribution"];
+    case "dependencies.request":
+      return ["server.dependencies.manage"];
+    case "logs.backfill.request":
+      return ["server.logs.read"];
+    case "client-manager.request":
+      return ["server.client-manager.manage"];
+    case "plugin-lifecycle.request":
+      return ["server.lifecycle"];
     case "ai.invoke":
       return ["ai.invoke"];
     default:

platform_web/utils/safeDiagnosticText.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, it } from "vitest";
+
+import { safeDiagnosticText } from "./safeDiagnosticText";
+
+describe("safeDiagnosticText", () => {
+  it("redacts raw credentials, host internals, sockets, process ids, DSNs, and private endpoints", () => {
+    const unsafe = [
+      "Bearer live-token-value",
+      "apiKey=sk-super-secret-value",
+      "secret://providers/production",
+      "/Users/operator/private/config.json",
+      "PID=48192",
+      "unix:///var/run/platform.sock",
+      "postgres://operator:password@db.internal/platform",
+      "RCON_PASSWORD=hunter2",
+      "http://127.0.0.1:18197/run/control"
+    ].join(" | ");
+
+    const result = safeDiagnosticText(unsafe) ?? "";
+    for (const forbidden of ["live-token", "sk-super", "providers/production", "/Users/", "48192", "/var/run/", "operator:password", "hunter2", "127.0.0.1"]) {
+      expect(result).not.toContain(forbidden);
+    }
+  });
+
+  it("preserves safe operational wording instead of matching labels alone", () => {
+    const safe = "密钥状态已配置；Base URL 由平台托管；token 不会下发；RCON 数据不会投影。";
+    expect(safeDiagnosticText(safe)).toBe(safe);
+  });
+});

platform_web/utils/safeDiagnosticText.ts

@@ -0,0 +1,22 @@
+const sensitiveAssignments = /\b(api[_-]?key|token|secret|password|passwd|credential|dsn|rcon(?:[_-]?(?:password|token))?)\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;]+)/gi;
+const privateEndpoint = /\b(?:https?|wss?):\/\/(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\]|10(?:\.\d{1,3}){3}|192\.168(?:\.\d{1,3}){2}|172\.(?:1[6-9]|2\d|3[01])(?:\.\d{1,3}){2})(?::\d+)?[^\s"'<>]*/gi;
+const hostPath = /(?:[A-Za-z]:\\|\/(?:Users|home|private|var|etc|opt|root|tmp)\/)[^\s"'<>]*/g;
+
+export function safeDiagnosticText(value: string | undefined, fallback = "诊断信息已隐藏"): string | undefined {
+  if (!value) {
+    return value;
+  }
+  const sanitized = value
+    .replace(/Bearer\s+\S+/gi, "Bearer [redacted]")
+    .replace(/\b(?:sk|rk)-[A-Za-z0-9_-]{8,}\b/g, "[secret]")
+    .replace(/\bsecret:\/\/[^\s"'<>]+/gi, "secret://[redacted]")
+    .replace(/\b(?:postgres(?:ql)?|mysql|redis|mongodb(?:\+srv)?):\/\/[^\s"'<>]+/gi, "[dsn]")
+    .replace(/\b(?:unix|tcp):\/\/[^\s"'<>]+/gi, "[socket]")
+    .replace(privateEndpoint, "[private-endpoint]")
+    .replace(hostPath, "[host-path]")
+    .replace(/\bpid\s*[:=#]?\s*\d+\b/gi, "PID [redacted]")
+    .replace(sensitiveAssignments, (_match, label: string) => `${label}=[redacted]`)
+    .slice(0, 480)
+    .trim();
+  return sanitized || fallback;
+}