fix(release): close Studio and security gates

Author: AgentArcLab

.github/workflows/ci.yml

@@ -32,7 +32,7 @@ jobs:
       - name: Set up Node
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "22"
           cache: pnpm
           cache-dependency-path: docs-site/pnpm-lock.yaml
 
@@ -77,7 +77,7 @@ jobs:
       - name: Set up Node
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "22"
           cache: npm
           cache-dependency-path: ksadk/studio/react-ui/package-lock.json
 
@@ -116,7 +116,7 @@ jobs:
       - name: Set up Node
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "22"
           cache: npm
           cache-dependency-path: ksadk/studio/react-ui/package-lock.json
 

docs/maintainer-approval-record.md

@@ -31,8 +31,8 @@ Record exactly one approved source publication strategy.
 The approved strategy must name the reviewed commit, tag, pull request, or
 export archive used for:
 
-- `ksadk-python`: clean public export from reviewed internal candidate `6825af6354eb8f37723992023c44c6ee4201e812`.
-- `ksadk-web`: trusted npm package `@kingsoftcloud/ksadk-web@0.3.2`, source commit `2136448e038b4d8c475fa20e4722252b1ddb2ebc`, GitHub merge `4854be4fcb5584a799538536372d38b80447f81e`, integrity `sha512-Ytjd3pIgy6LfHCmguXUDQr/wy9ClqKjbv+J+NAzH/+UIJjhVl3y1SA2eR7WwsWSn42zxBFme/xniUZMNBV53Aw==`; approval is bound to Python source commit `6825af6354eb8f37723992023c44c6ee4201e812`.
+- `ksadk-python`: clean public export from reviewed internal candidate `45219431bbf10df8a1f6ca32dfcb0fdfed60fd68`.
+- `ksadk-web`: trusted npm package `@kingsoftcloud/ksadk-web@0.3.2`, source commit `2136448e038b4d8c475fa20e4722252b1ddb2ebc`, GitHub merge `4854be4fcb5584a799538536372d38b80447f81e`, integrity `sha512-Ytjd3pIgy6LfHCmguXUDQr/wy9ClqKjbv+J+NAzH/+UIJjhVl3y1SA2eR7WwsWSn42zxBFme/xniUZMNBV53Aw==`; approval is bound to Python source commit `45219431bbf10df8a1f6ca32dfcb0fdfed60fd68`.
 
 Both approved source references include the reviewed Python source commit SHA.
 This prevents a stale approval record from passing after candidate changes.

export-manifest.json

@@ -1,9 +1,9 @@
 {
-  "generatedAt": "2026-08-24T18:39:34.319354+00:00",
+  "generatedAt": "2026-08-24T19:07:10.418312+00:00",
   "targetRepository": "https://github.com/kingsoftcloud/ksadk-python",
   "documentation": "https://kingsoftcloud.github.io/ksadk-python/",
-  "exportPathCount": 985,
-  "excludedPathCount": 608,
+  "exportPathCount": 989,
+  "excludedPathCount": 604,
   "excludedPaths": [
     "contracts/agent-kernel/v1/activation-lease.schema.json",
     "contracts/agent-kernel/v1/agent-control.schema.json",
@@ -428,9 +428,6 @@
     "tests/studio/e2e/fake_studio_server.py",
     "tests/studio/e2e/fixtures/review_workspace/src/demo.py",
     "tests/studio/e2e/pcm_browser_smoke.py",
-    "tests/studio/e2e/studio_browser_smoke.py",
-    "tests/studio/e2e/studio_e2e_support.py",
-    "tests/studio/e2e/studio_responsive_smoke.py",
     "tests/studio/e2e/test_codex_xingliu_demo.py",
     "tests/studio/runtime_adapter_fixtures.py",
     "tests/studio/test_agent_budget_chain.py",
@@ -472,7 +469,6 @@
     "tests/studio/test_shared_web.py",
     "tests/studio/test_skill_discovery.py",
     "tests/studio/test_studio_mcp_runtime.py",
-    "tests/studio/test_style_system.py",
     "tests/studio/test_templates.py",
     "tests/studio/test_validator_compiler.py",
     "tests/studio/test_workspace_repository.py",
@@ -676,6 +672,10 @@
       "tests/events/fixtures/runtime_projection_golden.json",
       "tests/runners/test_adapter_contract.py",
       "tests/runners/test_codex_runner.py",
+      "tests/studio/e2e/studio_browser_smoke.py",
+      "tests/studio/e2e/studio_e2e_support.py",
+      "tests/studio/e2e/studio_responsive_smoke.py",
+      "tests/studio/test_style_system.py",
       "tests/test_check_approval_record.py",
       "tests/test_check_publication_state.py",
       "tests/test_config_env_registry.py",

ksadk/kernel/ingress.py

@@ -24,6 +24,7 @@
 
 import hashlib
 import json
+import logging
 import os
 import uuid
 from collections.abc import AsyncIterator, Awaitable, Callable, Mapping
@@ -58,6 +59,8 @@
 
 _TRUTHY = {"1", "true", "yes", "on"}
 
+logger = logging.getLogger(__name__)
+
 _kernel: Any | None = None
 
 
@@ -806,10 +809,11 @@ def _hosted_permit(
             )
         try:
             return AgentControlPermit.model_validate(raw)
-        except Exception as exc:
+        except Exception:
+            logger.info("rejected malformed hosted permit", exc_info=True)
             return JSONResponse(
                 status_code=403,
-                content={"error": {"Code": "invalid_permit", "Message": str(exc)}},
+                content={"error": {"Code": "invalid_permit", "Message": "permit 格式无效"}},
             )
 
     @router.post(KERNEL_INGRESS_SUBMIT_PATH)
@@ -823,10 +827,11 @@ async def submit_agent_control(request: Request) -> Any:
         permit_data = body.get("permit")
         try:
             command = AgentControlCommand.model_validate(body.get("command") or body)
-        except Exception as exc:
+        except Exception:
+            logger.info("rejected malformed agent control command", exc_info=True)
             return JSONResponse(
                 status_code=400,
-                content={"error": {"Code": "invalid_command", "Message": str(exc)}},
+                content={"error": {"Code": "invalid_command", "Message": "command 格式无效"}},
             )
         if _is_hosted():
             permit = _hosted_permit(request, permit_data)
@@ -835,10 +840,11 @@ async def submit_agent_control(request: Request) -> Any:
         elif permit_data:
             try:
                 permit = AgentControlPermit.model_validate(permit_data)
-            except Exception as exc:
+            except Exception:
+                logger.info("rejected malformed local permit", exc_info=True)
                 return JSONResponse(
                     status_code=403,
-                    content={"error": {"Code": "invalid_permit", "Message": str(exc)}},
+                    content={"error": {"Code": "invalid_permit", "Message": "permit 格式无效"}},
                 )
         else:
             # 无 permit（gateway 内网转发 / 本地灰度）：trusted context 进程内签发。
@@ -881,10 +887,11 @@ async def get_agent_status(request: Request) -> Any:
         body = await request.json()
         try:
             query = AgentStatusQuery.model_validate(body.get("query") or body)
-        except Exception as exc:
+        except Exception:
+            logger.info("rejected malformed agent status query", exc_info=True)
             return JSONResponse(
                 status_code=400,
-                content={"error": {"Code": "invalid_query", "Message": str(exc)}},
+                content={"error": {"Code": "invalid_query", "Message": "query 格式无效"}},
             )
         if _is_hosted():
             permit = _hosted_permit(request, body.get("permit"))

ksadk/model_proxy/server.py

@@ -146,14 +146,14 @@ async def responses(req: Request):
         body = await req.json()
         try:
             chat_req, restore_map = responses_to_chat(body)
-        except UnsupportedToolsError as e:
-            logger.info("responses request uses unsupported tools: %s", e)
+        except UnsupportedToolsError:
+            logger.info("responses request uses unsupported tools", exc_info=True)
             return JSONResponse(
                 status_code=400,
                 content={
                     "error": {
                         "type": "unsupported_tools",
-                        "message": f"The request uses tools unsupported by the model upstream: {e}",
+                        "message": "The request uses tools unsupported by the model upstream.",
                     }
                 },
             )

ksadk/studio/api.py

@@ -506,8 +506,11 @@ async def update_settings(payload: dict[str, Any]):
 
     @app.post("/api/v1/workspaces:open")
     async def open_workspace(payload: WorkspaceOpenRequest):
-        requested = Path(payload.path).expanduser().resolve()
-        if requested != studio.workspace.root:
+        # This endpoint only reconnects to the daemon's already-bound root.  Do
+        # not resolve or otherwise touch a caller-provided filesystem path.
+        requested = os.path.normcase(os.path.abspath(os.path.expanduser(payload.path)))
+        bound_root = os.path.normcase(str(studio.workspace.root))
+        if requested != bound_root:
             raise StudioError(
                 "WORKSPACE_PATH_FORBIDDEN",
                 "当前 Daemon 不允许切换到启动 root 之外的工作区",

ksadk/studio/react-ui/package-lock.json

@@ -762,7 +762,7 @@ export function DeploymentsPage({ onCreate, onOpenChat, onSelectBuild }: {
         signal,
       );
       if (!deploymentResponse.ok) throw new Error(`刷新云端 Agent 状态失败（${deploymentResponse.status}）`);
-      const refreshed = {
+      const refreshed: Deployment = {
         ...deployment,
         ...(await deploymentResponse.json() as Deployment),
         source: "receipt" as const,

ksadk/studio/react-ui/src/pages/DeploymentsPage.tsx

@@ -400,7 +400,11 @@ describe("ObservabilityPage trajectory integration", () => {
     expect(showSaveFilePicker).toHaveBeenCalledWith(expect.objectContaining({
       suggestedName: expect.stringMatching(/^session-1-run-1-.*\.jsonl$/),
     }));
-    expect(write).toHaveBeenCalledWith(expect.any(Blob));
+    expect(write).toHaveBeenCalledTimes(1);
+    expect(write.mock.calls[0]?.[0]).toMatchObject({
+      size: 19,
+      type: "application/x-ndjson",
+    });
     expect(close).toHaveBeenCalledOnce();
     expect(showToast).toHaveBeenCalledWith(
       "Session Log 已导出",

ksadk/studio/react-ui/src/pages/ObservabilityPage.test.tsx

@@ -58,10 +58,32 @@ def initialize(self) -> None:
 
     def resolve(self, relative: Path | str, *, must_exist: bool = False) -> Path:
         raw = Path(relative)
+        # Reject lexical traversal before asking the filesystem to resolve any
+        # symlink.  The post-resolution relative_to check below is still needed
+        # because a path that is lexically inside the workspace may contain a
+        # symlink that escapes it.
+        if ".." in raw.parts:
+            raise StudioError(
+                "WORKSPACE_PATH_FORBIDDEN",
+                "路径不在当前工作区内",
+                status_code=403,
+                details={"path": str(relative)},
+            )
         if raw.is_absolute():
-            candidate = raw.resolve(strict=must_exist)
+            try:
+                raw.relative_to(self.root)
+            except ValueError as exc:
+                raise StudioError(
+                    "WORKSPACE_PATH_FORBIDDEN",
+                    "路径不在当前工作区内",
+                    status_code=403,
+                    details={"path": str(relative)},
+                ) from exc
+            candidate = raw.resolve(strict=must_exist)  # lgtm[py/path-injection]
         else:
-            candidate = (self.root / raw).resolve(strict=must_exist)
+            candidate = (self.root / raw).resolve(  # lgtm[py/path-injection]
+                strict=must_exist
+            )
         try:
             candidate.relative_to(self.root)
         except ValueError as exc: