From 9268375d060683279aeb2bc2612e47ccc69396c6 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 1 Apr 2026 08:13:04 +0000
Subject: [PATCH] =?UTF-8?q?=E4=BB=A3=E7=A0=81=E5=AE=A1=E6=9F=A5=E4=BF=AE?=
 =?UTF-8?q?=E5=A4=8D=C2=B7=E7=AD=BE=E5=90=8D=E9=95=BF=E5=BA=A6=E6=A0=A1?=
 =?UTF-8?q?=E9=AA=8C=C2=B7=E7=BD=91=E5=85=B3=E5=8D=95=E4=BE=8B=C2=B7?=
 =?UTF-8?q?=E5=AE=A1=E8=AE=A1=E6=97=A5=E5=BF=97=C2=B7=E9=94=99=E8=AF=AF?=
 =?UTF-8?q?=E5=A4=84=E7=90=86?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Agent-Logs-Url: https://github.com/qinfendebingshuo/guanghulab/sessions/b2f66e1f-c766-4d03-b9a0-ac8940d005d9

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>
---
 src/membrane/audit-trail.js                     |  4 ++--
 src/membrane/bingshuo-module.js                 | 10 ++++++++++
 src/membrane/gateway.js                         | 12 ++++++++----
 src/membrane/module-protocol/module-registry.js |  3 ++-
 src/membrane/persona-room/room-manager.js       |  4 ++--
 5 files changed, 24 insertions(+), 9 deletions(-)

diff --git a/src/membrane/audit-trail.js b/src/membrane/audit-trail.js
index c5cce2b9..0534c267 100644
--- a/src/membrane/audit-trail.js
+++ b/src/membrane/audit-trail.js
@@ -98,8 +98,8 @@ function persist(entry) {
     const filePath = path.join(AUDIT_DIR, `${dateStr}.jsonl`);
     fs.appendFileSync(filePath, JSON.stringify(entry) + '\n', 'utf8');
   } catch (err) {
-    // 审计系统自身不能阻塞请求流，静默记录错误
-    console.error('[AUDIT] persist error:', err.message);
+    // 审计系统自身不能阻塞请求流，记录到 stderr
+    process.stderr.write(`[AUDIT] persist error: ${err.message}\n`);
   }
 }
 
diff --git a/src/membrane/bingshuo-module.js b/src/membrane/bingshuo-module.js
index d6a01ced..50eb1db1 100644
--- a/src/membrane/bingshuo-module.js
+++ b/src/membrane/bingshuo-module.js
@@ -100,6 +100,16 @@ function verify(params) {
     .update(payload)
     .digest('hex');
 
+  // 长度检查（防止 timingSafeEqual 抛异常）
+  if (signature.length !== expectedSig.length) {
+    recordImpersonation('invalid-signature-length');
+    return {
+      verified: false,
+      reason: 'signature-mismatch',
+      state: bingshuoModule.state,
+    };
+  }
+
   if (!crypto.timingSafeEqual(
     Buffer.from(signature, 'hex'),
     Buffer.from(expectedSig, 'hex')
diff --git a/src/membrane/gateway.js b/src/membrane/gateway.js
index 91c1abd5..a2722463 100644
--- a/src/membrane/gateway.js
+++ b/src/membrane/gateway.js
@@ -48,10 +48,14 @@ function createGateway(options) {
   const extraPaths = opts.passthroughPaths || [];
   const allPassthrough = PASSTHROUGH_PATHS.concat(extraPaths);
 
-  // 定期清理过期权限（每60秒）
-  setInterval(() => {
-    permissionEngine.cleanup();
-  }, 60 * 1000);
+  // 定期清理过期权限（每60秒）· 单例模式防止重复
+  if (!createGateway._cleanupStarted) {
+    createGateway._cleanupStarted = true;
+    const interval = setInterval(() => {
+      permissionEngine.cleanup();
+    }, 60 * 1000);
+    interval.unref();
+  }
 
   return function languageMembrane(req, res, next) {
     const startTime = Date.now();
diff --git a/src/membrane/module-protocol/module-registry.js b/src/membrane/module-protocol/module-registry.js
index 060c49b9..013bc155 100644
--- a/src/membrane/module-protocol/module-registry.js
+++ b/src/membrane/module-protocol/module-registry.js
@@ -49,7 +49,8 @@ function loadRegistry() {
 
   try {
     return JSON.parse(fs.readFileSync(REGISTRY_PATH, 'utf8'));
-  } catch (_) {
+  } catch (err) {
+    process.stderr.write(`[MODULE-REGISTRY] parse error: ${err.message}\n`);
     return { modules: [], updated_at: new Date().toISOString() };
   }
 }
diff --git a/src/membrane/persona-room/room-manager.js b/src/membrane/persona-room/room-manager.js
index 1ac0b588..90421015 100644
--- a/src/membrane/persona-room/room-manager.js
+++ b/src/membrane/persona-room/room-manager.js
@@ -111,8 +111,8 @@ function queryExperience(personaId, category, limit) {
     try {
       const data = JSON.parse(fs.readFileSync(path.join(catDir, file), 'utf8'));
       results.push(data);
-    } catch (_) {
-      // skip corrupt files
+    } catch (err) {
+      process.stderr.write(`[ROOM] corrupt file skipped: ${file} (${err.message})\n`);
     }
   }