chore: tighten maintenance and import safeguards

Author: bx33661

.gitignore

@@ -1,6 +1,5 @@
 # Python
 __pycache__/
-.trae/
 *.py[cod]
 *$py.class
 *.so
@@ -51,29 +50,16 @@ config\\keys*.toml
 temp/
 tmp/
 *.tmp
+*.bak
+*.mdbak
 output/
 results/
 
-
 # OS
 projects/
 .DS_Store
 Thumbs.db
-.projects/CVE-2025-46725/
-.projects/CVE-2025-47789/
-.projects/CVE-2025-48683/
-.projects/CVE-2025-54381/
-.projects/CVE-2021-21985/
-.projects/CVE-2021-21985/
-projects/CVE-2021-21985/
-projects/CVE-2024-7099/
-projects/CVE-2025-54802/
-projects/CVE-2022-22817/
-projects/CVE-2024-10940/
-projects/CVE-2025-47789/
-projects/CVE-2025-46725/
-projects/CVE-2024-8412/
-projects/CVE*
+.projects/
 *.zip
 projects/*.zip
 projects/C_Qi

api/README.md

@@ -34,7 +34,7 @@
 uvicorn api.server:app --host 127.0.0.1 --port 8000 --reload
 ```
 
-默认情况下，API 只绑定 `127.0.0.1`，项目导入只允许 `imports/` 目录下的源路径，并拒绝请求体中的构建命令。需要开放远程访问或构建命令时，请显式设置对应的 `API_*` 环境变量，并建议同时设置 `API_AUTH_TOKEN`。
+默认情况下，API 只绑定 `127.0.0.1`，项目导入只允许 `imports/` 目录下的源路径，并拒绝请求体中的构建命令。需要开放远程访问或构建命令时，请显式设置对应的 `API_*` 环境变量，并建议同时设置 `API_AUTH_TOKEN`。API 运行配置中，`API_*` 环境变量优先于 `config/keys.toml` 的 `[settings]` 默认值。
 
 ### API文档
 
@@ -106,8 +106,11 @@ eventSource.onmessage = (event) => {
 ## 测试
 
 ```bash
-# 测试SSE流式输出
-python test/test_sse_stream.py
+# 手工测试SSE流式输出（需要先启动 API 服务和可分析案例）
+python scripts/smoke_sse_stream.py
+
+# 手工测试 CodeQL LSP 语法检查（需要本机 CodeQL/LSP 环境）
+python scripts/smoke_lsp_syntax.py
 
 # 使用curl测试
 curl -N http://localhost:8000/api/analysis/{task_id}/stream

api/config.py

@@ -2,7 +2,6 @@
 
 from __future__ import annotations
 
-import os
 from pathlib import Path
 from typing import List
 
@@ -110,22 +109,23 @@ def _load_keys_toml_settings() -> dict:
 
 
 def _create_config() -> APIConfig:
-    """创建配置实例，优先从 keys.toml 读取"""
-    # 1. 从 keys.toml 读取 settings
+    """创建配置实例，API_* 环境变量优先，keys.toml 作为默认补充。"""
     toml_settings = _load_keys_toml_settings()
-    
-    # 2. 构建配置字典（keys.toml 优先，环境变量次之）
-    config_dict = {}
-    
-    # Docker 构建配置
-    if 'use_docker_for_cpp' in toml_settings:
-        config_dict['use_docker_for_cpp'] = toml_settings['use_docker_for_cpp']
-    
-    if 'docker_builder_image' in toml_settings:
-        config_dict['docker_builder_image'] = toml_settings['docker_builder_image']
-    
-    # 3. 创建配置实例（Pydantic 会自动处理环境变量覆盖）
-    return APIConfig(**config_dict)
+    env_config = APIConfig()
+
+    values = {}
+    for key in (
+        "prefer_local_cpp_build",
+        "local_build_prepare_timeout",
+        "use_docker_for_cpp",
+        "docker_builder_image",
+    ):
+        if key in toml_settings and key not in env_config.model_fields_set:
+            values[key] = toml_settings[key]
+
+    if not values:
+        return env_config
+    return env_config.model_copy(update=values)
 
 
 # 全局配置实例

…/refactor-package-architecture/design.md …-refactor-package-architecture/design.mdopenspec/changes/refactor-package-architecture/design.md renamed to openspec/changes/archive/2026-06-02-refactor-package-architecture/design.md openspec/changes/refactor-package-architecture/design.md renamed to openspec/changes/archive/2026-06-02-refactor-package-architecture/design.md

@@ -6,10 +6,18 @@ shared validation, and user-facing error handling.
 ## Requirements
 ### Requirement: Shared Workflow Validation
 The API SHALL use the same project import, analysis request validation, and
-error reporting rules as the CLI workflow services.
+error reporting rules as the CLI workflow services by delegating overlapping
+workflow behavior to shared application services instead of route-local helpers.
 
 #### Scenario: Unsafe import path
 - **WHEN** an API request tries to import a source path outside the configured
   import root without explicit opt-in
 - **THEN** the API rejects the request with the same policy reason used by the
   CLI/service validation layer
+
+#### Scenario: Shared analysis validation
+- **WHEN** an API request starts an analysis task for an invalid or unsafe case
+  identifier
+- **THEN** the API returns the service-layer validation error mapped to the
+  appropriate HTTP status code
+- **AND** equivalent CLI validation paths remain covered by regression tests