fix(kb-control): 为控制接口增加统一鉴权 · Pull Request !137 · UBML/code-agent

Fixes #IK1A9U

## Summary

- guard every non-health knowledge control route before dispatch
- require a 32+ character `KB_CONTROL_TOKEN` for non-loopback binds
- compare Bearer credentials using fixed-length SHA-256 digests and constant-time equality
- reject untrusted browser write Origins, including tokenless-loopback DNS rebinding
- inject the internal token only from the Vite server process
- require Caddy Basic Auth before Caddy injects the internal Bearer credential
- document Compose/Caddy setup and update the task-control living spec

## Verification

- focused security/route suites: 46 pass, 0 fail
- full knowledge control suite: 141 pass, 1 pre-existing Windows path assertion failure; reproduced unchanged on the origin/main-based IK0QUQ worktree
- knowledge typecheck: 20 existing baseline errors, 0 errors in changed TypeScript files
- browser-token, literal-token, and credential-logging scans: pass
- Compose YAML parse: pass
- Docker/Caddy runtime validation was unavailable because Docker is not installed in this environment

类型	指派人员	状态
审查	Sagi 鱼鱼	进行中 (0/1人)
测试	Sagi	进行中 (0/1人)

UBML/code-agent .gitee-modal { width: 500px !important; }

搜索帮助

UBML/code-agent