mirror of
https://gitee.com/mateos/mateclaw.git
synced 2026-09-13 19:23:42 +08:00
91a7842393
Adversarial review of PR #464 found that classify() promoted an absent channelType to the 'authenticated' trust branch, stamping an untrusted ThreadLocal username (e.g. stale value on a reused thread, or internal tasks like SkillConsolidation/Reflection that carry no channel) with authenticated trust — contradicting the fail-closed contract the service documents. - classify(): channel==null/blank now resolves to NONE (no injection); only the explicit 'web' channel may yield authenticated. Unrecognised non-web channels downgrade to external, never authenticated. - signingKey(): replace the one-shot keyParseAttempted latch with lastAttemptedPem so a corrected/hot-reloaded PEM re-parses on the next call without an app restart. Still fail-closed when PEM is unchanged. - Tests: 4 new cases lock the regression (null+dirty-ThreadLocal->NONE, blank->NONE, novel channel->external, self-heal after config fix). - .gitignore: exclude local .codebase-memory/ agent index. MCP+identity suite: 93/93 green.
122 lines
2.0 KiB
Plaintext
122 lines
2.0 KiB
Plaintext
# 忽略匹配下列规则的Git 提交 V2.1.0
|
|
### gradle ###
|
|
.gradle
|
|
/build/
|
|
!gradle/wrapper/gradle-wrapper.jar
|
|
|
|
### STS ###
|
|
.settings/
|
|
.apt_generated
|
|
.classpath
|
|
.factorypath
|
|
.project
|
|
.settings
|
|
.springBeans
|
|
bin/
|
|
|
|
### IntelliJ IDEA ###
|
|
.idea
|
|
*.iws
|
|
*.iml
|
|
*.ipr
|
|
rebel.xml
|
|
|
|
### NetBeans ###
|
|
nbproject/private/
|
|
/build/
|
|
nbbuild/
|
|
/dist/
|
|
nbdist/
|
|
.nb-gradle/
|
|
|
|
### frontend build artifacts ###
|
|
# Vite's primary output goes to mateclaw-server/.../static; the only thing
|
|
# that lands here is rollup-plugin-visualizer's stats.html when running
|
|
# ANALYZE=1 pnpm build.
|
|
mateclaw-ui/dist/
|
|
|
|
### maven ###
|
|
target/
|
|
*.war
|
|
*.ear
|
|
*.zip
|
|
*.tar
|
|
*.tar.gz
|
|
|
|
### logs ####
|
|
/logs/
|
|
mateclaw-server/logs/
|
|
*.log
|
|
|
|
### temp ignore ###
|
|
*.cache
|
|
*.diff
|
|
*.patch
|
|
*.tmp
|
|
*.java~
|
|
*.properties~
|
|
*.xml~
|
|
|
|
### system ignore ###
|
|
.DS_Store
|
|
Thumbs.db
|
|
Servers
|
|
.metadata
|
|
upload
|
|
gen_code
|
|
|
|
### node ###
|
|
node_modules
|
|
pom.xml.versionsBackup
|
|
/server/nacos-server/data
|
|
/server/nacos-server/logs
|
|
|
|
.flattened-pom.xml
|
|
.cursor
|
|
.gstack/
|
|
|
|
# mateclaw static build output (do not commit)
|
|
mateclaw-server/src/main/resources/static/
|
|
|
|
# mateclaw local runtime data (H2 DB, logs, etc. - do not commit)
|
|
mateclaw-server/data/
|
|
/data/
|
|
|
|
# VitePress build output and cache (do not commit)
|
|
docs/.vitepress/cache/
|
|
docs/.vitepress/dist/
|
|
|
|
# Astro build cache (do not commit)
|
|
.astro/
|
|
|
|
# SSL certificates (do not commit)
|
|
deploy/nginx/ssl/*.crt
|
|
deploy/nginx/ssl/*.key
|
|
deploy/nginx/ssl/*.pem
|
|
|
|
# Deploy env
|
|
deploy/.env
|
|
|
|
# Claude Code local settings
|
|
CLAUDE.md
|
|
.claude/settings.local.json
|
|
.claude/plans/
|
|
|
|
# Codex CLI local artifacts
|
|
.codex/
|
|
|
|
# Codebase memory (local agent index / graph artifact; do not commit)
|
|
.codebase-memory/
|
|
|
|
# Sync tooling local state (generated each run; report is intentionally tracked)
|
|
scripts/.*-sync-state.json
|
|
|
|
# Sandbox / external client work that lives in this directory
|
|
# but should not ship in the repo.
|
|
outputs/
|
|
|
|
# This is a pnpm monorepo — pnpm-lock.yaml is the only lockfile we track.
|
|
# Ignore stray npm/yarn lockfiles so they are not committed by mistake.
|
|
package-lock.json
|
|
yarn.lock
|