0.10.1: 安全与业务逻辑加固、新品牌与部署加固

三轮审查修复(60+ 项),相对远端 main(b536672)的关键变更:
- 安全: 数据面 SSRF 拨号防护(防 DNS rebinding)/上游凭据剥离/登录防枚举
  与锁定态统一/可信代理(X-Forwarded-For)限流加固/会话版本失效机制/
  撤销即时传播/弱密钥拒绝启动/脱敏字节级重写(保签名契约)
- 业务逻辑: 裸 body 上传 panic/bootstrap 审计管线卡死/定价通配符优先级/
  全局工具可见性/调度器停机补跑/TOTP 挑战令牌消费顺序/熔断探针语义/
  >4MB 响应 token 计量/管理员重置密码作废会话 等
- 前端: 新 logo(语枢 AI 网关主题)/Provider 凭据异常警示/删除入口/
  后端错误消息透传/localStorage 敏感数据收敛
- 部署: CREDENTIAL_MASTER_KEY 持久化与弱值拒绝/Provider DELETE 接口/
  nginx 安全头/worker 内存限制
- 新增迁移 000029(key_hash 索引)/000030(usage_daily 币种维度)

internal/workbench/runtime_http.go

@@ -16,6 +16,7 @@ import (
 	"aigateway.local/core/internal/factcheck"
 	"aigateway.local/core/internal/gateway"
 	"aigateway.local/core/internal/platform/apiresponse"
+	tracepkg "aigateway.local/core/internal/trace"
 )
 
 type RuntimeHTTPHandler struct {
@@ -25,6 +26,7 @@ type RuntimeHTTPHandler struct {
 	auth      apikey.PrincipalAuthenticator
 	gateway   http.Handler
 	factCheck *factcheck.Engine
+	traces    *tracepkg.Store
 	logger    *slog.Logger
 	mux       *http.ServeMux
 	market    MarketplaceDeps
@@ -70,6 +72,11 @@ func (h *RuntimeHTTPHandler) SetLogger(logger *slog.Logger) {
 // conversations. When nil (the default) fact-checking is skipped entirely.
 func (h *RuntimeHTTPHandler) SetFactCheckEngine(engine *factcheck.Engine) { h.factCheck = engine }
 
+// SetTraceStore enables metadata-only LLM Trace recording for application and
+// digital-employee runs. Trace persistence is best effort and never changes
+// the runtime response when the database is unavailable.
+func (h *RuntimeHTTPHandler) SetTraceStore(store *tracepkg.Store) { h.traces = store }
+
 // factCheckRetriever adapts the workbench Retriever to the fact-check engine's
 // EvidenceRetriever interface, reusing the same knowledge-base search path that
 // application prompts already use.
@@ -155,11 +162,17 @@ func (h *RuntimeHTTPHandler) principal(w http.ResponseWriter, r *http.Request) (
 	return principal, true
 }
 func visible(departments []string, principal apikey.Principal, secure bool) bool {
+	// fail-closed:无 APIKeyID 的匿名主体不视为"可见一切"。
+	// 今天认证器总是返回 bootstrap 或真实 key ID,但任何未来认证路径的
+	// 变化都不应静默放开所有部门作用域资产。
 	if principal.APIKeyID == "" {
-		return true
+		return false
 	}
+	// 无部门限定的资源是全局资源:所有已认证主体可见。secure 只标记
+	// "执行敏感能力"类资源,不改变可见性规则——否则全局工具/MCP 对
+	// 所有人不可见,绑定它们的应用会在运行时失败。
 	if len(departments) == 0 {
-		return !secure
+		return true
 	}
 	if principal.TenantID == nil {
 		return false
@@ -321,13 +334,18 @@ func (h *RuntimeHTTPHandler) runApplication(w http.ResponseWriter, r *http.Reque
 	runError := ""
 	retrievalCount := 0
 	toolCount := 0
+	modelCallCount := 0
+	conversationID := strings.TrimSpace(r.Header.Get("X-Gateway-Conversation-ID"))
+	traceID := h.beginTrace(r.Context(), principal, "application", app.ID, app.Code, conversationID)
 	defer func() {
+		traceCtx := context.WithoutCancel(r.Context())
+		h.finishTrace(traceCtx, traceID, status, runError, retrievalCount, modelCallCount, toolCount)
 		runID, idErr := newUUID()
 		if idErr == nil {
-			_, _ = h.service.pool.Exec(context.WithoutCancel(r.Context()), `INSERT INTO gateway.application_runs(id,application_id,version,api_key_id,request_id,status,latency_ms,retrieval_count,tool_count,error) VALUES($1,$2,nullif($3,0),nullif($4,'')::uuid,$5,$6,$7,$8,$9,$10)`, runID, app.ID, valueOrZero(app.PublishedVersion), principal.APIKeyID, gateway.RequestID(r.Context()), status, time.Since(started).Milliseconds(), retrievalCount, toolCount, runError)
+			_, _ = h.service.pool.Exec(traceCtx, `INSERT INTO gateway.application_runs(id,application_id,version,api_key_id,trace_id,request_id,status,latency_ms,retrieval_count,tool_count,error) VALUES($1,$2,nullif($3,0),nullif($4,'')::uuid,nullif($5,'')::uuid,$6,$7,$8,$9,$10,$11)`, runID, app.ID, valueOrZero(app.PublishedVersion), principal.APIKeyID, traceID, gateway.RequestID(r.Context()), status, time.Since(started).Milliseconds(), retrievalCount, toolCount, runError)
 		}
 	}()
-	payload, toolsByCode, prepareErr := h.prepareApplication(r.Context(), app, input, principal, &retrievalCount)
+	payload, toolsByCode, prepareErr := h.prepareApplication(r.Context(), app, input, principal, &retrievalCount, traceID)
 	if prepareErr != nil {
 		runError = prepareErr.Error()
 		runtimeError(w, 400, runError)
@@ -338,7 +356,8 @@ func (h *RuntimeHTTPHandler) runApplication(w http.ResponseWriter, r *http.Reque
 	var responseHeaders http.Header
 	var statusCode int
 	for round := 0; ; round++ {
-		statusCode, responseHeaders, response, err = h.callGateway(r, payload)
+		modelCallCount++
+		statusCode, responseHeaders, response, err = h.callGatewayWithTrace(r, payload, traceID, round)
 		if err != nil {
 			runError = err.Error()
 			copyHeaders(w.Header(), responseHeaders)
@@ -367,7 +386,9 @@ func (h *RuntimeHTTPHandler) runApplication(w http.ResponseWriter, r *http.Reque
 			if json.Unmarshal([]byte(call.Arguments), &args) != nil {
 				args = map[string]any{}
 			}
-			result, executeErr := h.tools.Execute(r.Context(), tool, args, principal.APIKeyID, gateway.RequestID(r.Context()))
+			result, executeErr := h.executeToolWithTrace(r.Context(), traceID, call.Name, call.ID, round, func() (map[string]any, error) {
+				return h.tools.Execute(r.Context(), tool, args, principal.APIKeyID, gateway.RequestID(r.Context()))
+			})
 			if executeErr != nil {
 				runError = executeErr.Error()
 				runtimeError(w, 502, runError)
@@ -379,7 +400,7 @@ func (h *RuntimeHTTPHandler) runApplication(w http.ResponseWriter, r *http.Reque
 		}
 	}
 	if h.factCheck != nil {
-		h.applyFactCheck(r, input, response)
+		h.applyFactCheck(r, input, response, app.DepartmentIDs)
 	}
 	response["application"] = map[string]any{"code": app.Code, "name": app.Name, "version": valueOrZero(app.PublishedVersion), "retrieval_count": retrievalCount, "tool_calls": toolCount}
 	status = "success"
@@ -389,17 +410,22 @@ func (h *RuntimeHTTPHandler) runApplication(w http.ResponseWriter, r *http.Reque
 
 // applyFactCheck verifies the assistant answer against configured knowledge
 // bases and applies the policy action. It must never fail the chat: any error
-// is logged and the answer is returned unchanged.
-func (h *RuntimeHTTPHandler) applyFactCheck(r *http.Request, input applicationRequest, response map[string]any) {
+// is logged and the answer is returned unchanged. departments 用于选择
+// department:<uuid> 作用域的策略,空列表只应用 global 策略。
+func (h *RuntimeHTTPHandler) applyFactCheck(r *http.Request, input applicationRequest, response map[string]any, departments []string) {
 	answer, _ := assistantAnswer(response)
 	lastQuestion := lastUserMessage(input.Messages)
 	if strings.TrimSpace(answer) == "" || strings.TrimSpace(lastQuestion) == "" {
 		return
 	}
+	scope := ""
+	if len(departments) > 0 {
+		scope = "department:" + departments[0]
+	}
 	verifier := func(ctx context.Context, model, system, user string, timeout time.Duration) (string, error) {
 		return h.VerifyFactCheck(ctx, r, model, system, user, timeout)
 	}
-	event, err := h.factCheck.Check(r.Context(), gateway.RequestID(r.Context()), lastQuestion, answer, factcheck.VerifierFunc(verifier))
+	event, err := h.factCheck.Check(r.Context(), gateway.RequestID(r.Context()), scope, lastQuestion, answer, factcheck.VerifierFunc(verifier))
 	if err != nil {
 		h.logger.Warn("fact-check skipped", "request_id", gateway.RequestID(r.Context()), "error", err)
 		return
@@ -446,7 +472,7 @@ func overrideAnswer(response map[string]any, content string) {
 	}
 }
 
-func (h *RuntimeHTTPHandler) prepareApplication(ctx context.Context, app Application, input applicationRequest, principal apikey.Principal, retrievalCount *int) (map[string]any, map[string]Tool, error) {
+func (h *RuntimeHTTPHandler) prepareApplication(ctx context.Context, app Application, input applicationRequest, principal apikey.Principal, retrievalCount *int, traceID string) (map[string]any, map[string]Tool, error) {
 	config := *app.PublishedConfig
 	messages := make([]map[string]any, 0, len(input.Messages)+2)
 	total := 0
@@ -490,7 +516,7 @@ func (h *RuntimeHTTPHandler) prepareApplication(ctx context.Context, app Applica
 		if err != nil || !kb.Enabled || !visible(kb.DepartmentIDs, principal, false) {
 			return nil, nil, fmt.Errorf("应用绑定的知识库 %s 当前不可用", kbID)
 		}
-		hits, searchErr := h.retriever.Search(ctx, kbID, lastQuestion, config.RetrievalTopK)
+		hits, searchErr := h.searchWithTrace(ctx, traceID, kbID, lastQuestion, config.RetrievalTopK)
 		if searchErr != nil {
 			continue
 		}
@@ -588,7 +614,9 @@ type boundedRecorder struct {
 }
 
 func newBoundedRecorder() *boundedRecorder {
-	return &boundedRecorder{code: http.StatusOK, header: make(http.Header)}
+	// code 初始为 0:WriteHeader 只在首次调用时生效,若网关从未调用
+	// WriteHeader,则 Write 时默认回退 200。
+	return &boundedRecorder{header: make(http.Header)}
 }
 
 func (r *boundedRecorder) Header() http.Header { return r.header }