Skip to content

docs: 记录 2026-11-10 Issue / 安全 / 冗余扫描 - #446

Merged
LIghtJUNction merged 1 commit into
mainfrom
cursor/bc-3d53fc41-282c-41c3-a5fd-3f6d4d959231-f445
Nov 10, 2026
Merged

docs: 记录 2026-11-10 Issue / 安全 / 冗余扫描#446
LIghtJUNction merged 1 commit into
mainfrom
cursor/bc-3d53fc41-282c-41c3-a5fd-3f6d4d959231-f445

Conversation

@cursor

@cursor cursor Bot commented Nov 10, 2026 •
edited by sourcery-ai Bot
Loading

Copy link
Copy Markdown
Contributor

日常扫描：公开仓库仍只有 #436 与 #440 开放；源码仓无开放 Issue/PR。本配方仓不能关闭这两项，也不能向 magicnet-android 推送。

Issue

漏洞

只读抽查订阅抓取、MCP 鉴权、安装/ZIP 路径与发布工作流，未发现可在本仓修复的新生产漏洞。第三方 action 仍为 40 字符 SHA；发布写权限仍限 dispatch + publish。

冗余代码

411 个 shell 函数扫描结果与既有 keepers 一致（kamfw 阶段钩子、路由规则边界、ip6tables NAT）。magicnet_prepare_singbox_nodes 包装仍不存在。主仓库 scripts 无平行死入口。

验证

  • test-check-recipes.py 4 passed
  • test-release.py 16 passed
  • test-release-plan.py 37 passed
  • recipkg check/pack/归档/完整提示词：8 包、61 Markdown；live pin 9163064b51ba59cc89ac9a807fceb24573fed725 / v1.8.5 10613
  • actionlint 1.7.12 通过

无运行时改动、无新 Release、无设备安装。

Open in Web View Automation 

Sourcery 摘要

更新配方文档，记录 2026-11-10 的问题、安全性、冗余和验证状态，不更改运行时行为，也不发布版本。

增强内容：

文档：

  • 更新验证记录，涵盖当前源码固定版本、配方和发布状态、未完成工作，以及 2026-11-10 运维扫描的验证结果。

测试：

  • 记录配方、发布、发布计划、打包、归档、提示生成和工作流 lint 验证均已成功。
Original summary in English

Sourcery 总结

更新 2026-11-10 的问题、安全性和冗余扫描相关运维文档及验证记录，不更改运行时行为，也不发布新版本。

改进：

文档：

  • 记录 2026-11-10 运维扫描的当前源代码固定版本、配方与发布状态、待办事项和验证成功结果。

测试：

  • 记录配方、发布、发布计划、打包、归档、提示生成和工作流 lint 验证均已成功。
Original summary in English

Summary by Sourcery

Refresh operational documentation and verification records for the 2026-11-10 issue, security, and redundancy scan without changing runtime behavior or releasing a new version.

Enhancements:

Documentation:

  • Record the current source pin, recipe and release state, outstanding work, and successful validation results for the 2026-11-10 operational scan.

Tests:

  • Document successful recipe, release, release-plan, packaging, archival, prompt-generation, and workflow-lint validation.

@cursoragent @LIghtJUNction
docs: record 2026-11-10 issue, security and dead-code sweep
49235f9 
Keep #436 and #440 open. Record that TUN watchdog recovery is already
pinned, remaining work is Wi-Fi association restore and a trusted NAS
source, and SUB-003 public HTTPS protections stay fail-closed.

Co-authored-by: lightjunction.me <lightjunction.me@gmail.com>
@sourcery-ai

sourcery-ai Bot commented Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown

审阅者指南

文档

记录 #436 和 #440 的当前状态，以及只读安全性和冗余扫描结果，并同步验证摘要中尚待完成的事项。

  • recipes/magicnet/ISSUE_TRIAGE_2026-11-06.md L159-194
  • recipes/magicnet/VERIFICATION.md L13

明确指出，#440 的可信 NAS/私网订阅入口尚未纳入合同，同时保留公网订阅必须采用 fail-closed 保护措施的要求。

  • recipes/magicnet-network-runtime/SUBSCRIPTION_CONTRACT.md L191-192
提示和命令

与 Sourcery 交互

  • 触发新一轮审阅： 在拉取请求中评论 @sourcery-ai review。
  • 继续讨论： 直接回复 Sourcery 的审阅评论。
  • 根据审阅评论创建 GitHub 问题： 回复审阅评论，请 Sourcery 根据该评论创建问题。也可以回复审阅评论并输入 @sourcery-ai issue，以此创建问题。
  • 生成拉取请求标题： 在拉取请求标题中的任意位置输入 @sourcery-ai，即可随时生成标题。也可以在拉取请求中评论 @sourcery-ai title，以便随时（重新）生成标题。
  • 生成拉取请求摘要： 在拉取请求正文中需要放置摘要的位置输入 @sourcery-ai summary，即可随时生成 PR 摘要。也可以在拉取请求中评论 @sourcery-ai summary，以便随时（重新）生成摘要。
  • 生成审阅者指南： 在拉取请求中评论 @sourcery-ai guide，即可随时（重新）生成审阅者指南。
  • 解决所有 Sourcery 评论： 在拉取请求中评论 @sourcery-ai resolve，即可解决所有 Sourcery 评论。如果你已处理完所有评论且不想再看到它们，这个功能会很有用。
  • 忽略所有 Sourcery 审阅： 在拉取请求中评论 @sourcery-ai dismiss，即可忽略所有现有的 Sourcery 审阅。若要重新开始新一轮审阅，这个功能尤其有用——别忘了评论 @sourcery-ai review 来触发新一轮审阅！

自定义使用体验

访问控制面板以：

  • 启用或停用审阅功能，例如 Sourcery 生成的拉取请求摘要、审阅者指南等。
  • 更改审阅语言。
  • 添加、移除或编辑自定义审阅说明。
  • 调整其他审阅设置。

获取帮助

Original review guide in English

Reviewer's Guide

Documentation

记录 #436 与 #440 的当前状态及只读安全、冗余扫描结果，并同步验证摘要中的待完成事项。

  • recipes/magicnet/ISSUE_TRIAGE_2026-11-06.md L159-194
  • recipes/magicnet/VERIFICATION.md L13

明确 #440 的可信 NAS/私网订阅入口尚未纳入合同，同时保留公网订阅的 fail-closed 保护要求。

  • recipes/magicnet-network-runtime/SUBSCRIPTION_CONTRACT.md L191-192
Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@LIghtJUNction
LIghtJUNction marked this pull request as ready for review November 10, 2026 05:18
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 10, 2026

Copy link
Copy Markdown
Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
🔒 Security Review ❌ Failed 2026-11-10T05:18:06.931164Z
We couldn’t complete this review. Comment @codex security review to try again.		 49235f9 Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 10, 2026

Copy link
Copy Markdown

The account paying for this security review has reached its Codex usage limits. The payer can check the Codex usage dashboard. For personal accounts, using credits requires enabling “Use credits for security reviews” in Code review settings. If you do not manage the paying account, contact this repository's admins.

@LIghtJUNction
LIghtJUNction merged commit 29451e6 into main Nov 10, 2026
2 checks passed
sourcery-ai[bot]
sourcery-ai Bot approved these changes Nov 10, 2026
View reviewed changes

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

你好——我已经审查了你的更改，整体看起来很棒！

Sourcery 评估

已批准。

Sourcery 为开源项目免费提供服务——如果你喜欢我们的审查，请考虑分享 ✨
Original comment in English

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Approved.

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sourcery-ai sourcery-ai[bot] sourcery-ai[bot] approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@LIghtJUNction @cursoragent