代码审查修复·签名长度校验·网关单例·审计日志·错误处理

Agent-Logs-Url: https://github.com/qinfendebingshuo/guanghulab/sessions/b2f66e1f-c766-4d03-b9a0-ac8940d005d9

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>

src/membrane/audit-trail.js

@@ -98,8 +98,8 @@ function persist(entry) {
     const filePath = path.join(AUDIT_DIR, `${dateStr}.jsonl`);
     fs.appendFileSync(filePath, JSON.stringify(entry) + '\n', 'utf8');
   } catch (err) {
-    // 审计系统自身不能阻塞请求流，静默记录错误
+    // 审计系统自身不能阻塞请求流，记录到 stderr
-    console.error('[AUDIT] persist error:', err.message);
+    process.stderr.write(`[AUDIT] persist error: ${err.message}\n`);
   }
 }
 

src/membrane/bingshuo-module.js

@@ -100,6 +100,16 @@ function verify(params) {
     .update(payload)
     .digest('hex');
 
+  // 长度检查（防止 timingSafeEqual 抛异常）
+  if (signature.length !== expectedSig.length) {
+    recordImpersonation('invalid-signature-length');
+    return {
+      verified: false,
+      reason: 'signature-mismatch',
+      state: bingshuoModule.state,
+    };
+  }
+
   if (!crypto.timingSafeEqual(
     Buffer.from(signature, 'hex'),
     Buffer.from(expectedSig, 'hex')

src/membrane/gateway.js

@@ -48,10 +48,14 @@ function createGateway(options) {
   const extraPaths = opts.passthroughPaths || [];
   const allPassthrough = PASSTHROUGH_PATHS.concat(extraPaths);
 
-  // 定期清理过期权限（每60秒）
+  // 定期清理过期权限（每60秒）· 单例模式防止重复
-  setInterval(() => {
+  if (!createGateway._cleanupStarted) {
+    createGateway._cleanupStarted = true;
+    const interval = setInterval(() => {
       permissionEngine.cleanup();
     }, 60 * 1000);
+    interval.unref();
+  }
 
   return function languageMembrane(req, res, next) {
     const startTime = Date.now();

src/membrane/module-protocol/module-registry.js

@@ -49,7 +49,8 @@ function loadRegistry() {
 
   try {
     return JSON.parse(fs.readFileSync(REGISTRY_PATH, 'utf8'));
-  } catch (_) {
+  } catch (err) {
+    process.stderr.write(`[MODULE-REGISTRY] parse error: ${err.message}\n`);
     return { modules: [], updated_at: new Date().toISOString() };
   }
 }

src/membrane/persona-room/room-manager.js

@@ -111,8 +111,8 @@ function queryExperience(personaId, category, limit) {
     try {
       const data = JSON.parse(fs.readFileSync(path.join(catDir, file), 'utf8'));
       results.push(data);
-    } catch (_) {
+    } catch (err) {
-      // skip corrupt files
+      process.stderr.write(`[ROOM] corrupt file skipped: ${file} (${err.message})\n`);
     }
   }