Security: collapsed rule groups with 7-day counts, redaction exceptions; pin core v0.86.0

scripts/shots/core/en/status.json

@@ -1,5 +1,5 @@
 {
-  "api_version": 56,
+  "api_version": 57,
   "clients": 4,
   "config_path": "",
   "draining": 0,
@@ -16,5 +16,5 @@
     "reachable": []
   },
   "uptime_secs": 0,
-  "version": "0.85.0"
+  "version": "0.86.0"
 }

scripts/shots/core/zh/status.json

@@ -1,5 +1,5 @@
 {
-  "api_version": 56,
+  "api_version": 57,
   "clients": 4,
   "config_path": "",
   "draining": 0,
@@ -16,5 +16,5 @@
     "reachable": []
   },
   "uptime_secs": 0,
-  "version": "0.85.0"
+  "version": "0.86.0"
 }

scripts/shots/mock/core.ts

@@ -220,6 +220,22 @@ export const CORE: { [N in WebviewEndpoint]: Handler<N> } = {
     for (const e of window) by_outcome[e.action] += 1;
     return { events: clone(xs.slice(0, limit)), more: xs.length > limit, total: window.length, by_outcome };
   },
+  SecurityRuleCounts: (req) => {
+    // 各条记录的 count 加起来，按规则
+    const by = new Map<string, { rule: string; custom: boolean; count: number }>();
+    for (const e of SEC_EVENTS) {
+      if (e.guard !== req.guard || (req.since_ms != null && e.at_ms < req.since_ms)) continue;
+      const k = `${e.custom ? "c" : "b"}:${e.rule}`;
+      const x = by.get(k) ?? { rule: e.rule, custom: e.custom, count: 0 };
+      x.count += e.count;
+      by.set(k, x);
+    }
+    return [...by.values()];
+  },
+  RedactExceptions: () => ({ items: [], max: 500 }),
+  AddRedactException: refuse,
+  ExceptSecurityEvent: refuse,
+  RemoveRedactException: refuse,
   SetSecurityMode: refuse,
   ToggleBuiltinRule: refuse,
   SetBuiltinRuleAction: refuse,

scripts/shots/mock/traffic.ts

@@ -549,8 +549,11 @@ function generate() {
 // ───────────────────────────────────────── 安全日志
 
 type Detail = "direction" | "locations" | "more_locations" | "rule_snapshot" | "outcome_detail";
-type Hit = Omit<SecurityEventView, "id" | "at_ms" | "request_id" | "provider" | "client" | "model" | "client_hint" | "peer" | "key_masked" | Detail> &
-  Partial<Pick<SecurityEventView, Detail>>;
+type Hit = Omit<
+  SecurityEventView,
+  "id" | "at_ms" | "request_id" | "provider" | "client" | "model" | "client_hint" | "peer" | "key_masked" | "excepted" | "exceptable" | Detail
+> &
+  Partial<Pick<SecurityEventView, Detail | "excepted" | "exceptable">>;
 
 /**
  * 一次命中的细节，照 core 的写法补：脱敏在发出的请求里、占位符 `<<TW_SECRET_n>>`；工具调用在
@@ -609,6 +612,8 @@ function securityLog() {
       client_hint: row.client_hint ?? null,
       peer: null,
       key_masked: row.key_masked ?? null,
+      excepted: false,
+      exceptable: false,
       ...hit,
       ...detailOf(hit),
     };

src-tauri/Cargo.toml

@@ -26,12 +26,12 @@ license = "MIT"
 # twcore 二进制必须和这里编译进去的协议镜像来自同一个 core 版本 —— 打包脚本正是
 # 从 tw-api 锁到的 tag 去取二进制的（见 scripts/fetch-core.sh）。
 [workspace.dependencies]
-tw-api = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.85.0" }
-tw-types = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.85.0" }
-tw-yaml = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.85.0" }
-tw-guard = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.85.0" }
-tw-watch = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.85.0" }
-tw-link = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.85.0" }
+tw-api = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.86.0" }
+tw-types = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.86.0" }
+tw-yaml = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.86.0" }
+tw-guard = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.86.0" }
+tw-watch = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.86.0" }
+tw-link = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.86.0" }
 
 [lib]
 name = "thinkwatch_lite_lib"

src-tauri/src/call.rs

@@ -147,6 +147,7 @@ webview_endpoints![
     // 安全
     Security,
     SecurityEvents,
+    SecurityRuleCounts,
     SetSecurityMode,
     ToggleBuiltinRule,
     SetBuiltinRuleAction,
@@ -155,6 +156,10 @@ webview_endpoints![
     UpdateCustomRule,
     DeleteCustomRule,
     TestSecurity,
+    RedactExceptions,
+    AddRedactException,
+    ExceptSecurityEvent,
+    RemoveRedactException,
     // 账号登录（发起和取消是命令：要开浏览器、要记住这一次）
     ChatgptLoginStatus,
     ChatgptUsage,

src-tauri/src/notices/tests.rs

@@ -960,6 +960,7 @@ fn secrets(provider: &str, items: &[(&str, bool)]) -> tw_api::Event {
                 count: 1,
                 replaced: !*recorded,
                 source: None,
+                value_sha256: None,
                 detail: hit_detail(
                     tw_api::SecurityDirection::Request,
                     rule,
@@ -1036,6 +1037,7 @@ fn a_saved_secret_hit_names_where_it_is_saved_and_nothing_of_the_value() {
             count: 2,
             replaced: false,
             source: Some(source),
+            value_sha256: None,
             detail: hit_detail(
                 tw_api::SecurityDirection::Request,
                 "thinkwatch-saved-secret",

src/control.ts

@@ -100,6 +100,7 @@ export const WEBVIEW_ENDPOINTS = [
   "DeletePriceSheet",
   "Security",
   "SecurityEvents",
+  "SecurityRuleCounts",
   "SetSecurityMode",
   "ToggleBuiltinRule",
   "SetBuiltinRuleAction",
@@ -108,6 +109,10 @@ export const WEBVIEW_ENDPOINTS = [
   "UpdateCustomRule",
   "DeleteCustomRule",
   "TestSecurity",
+  "RedactExceptions",
+  "AddRedactException",
+  "ExceptSecurityEvent",
+  "RemoveRedactException",
   "ChatgptLoginStatus",
   "ChatgptUsage",
   "ChatgptResets",