feat: enhance coding harness, model security and system features

ruoyi-common/ruoyi-common-chat/pom.xml

@@ -68,6 +68,12 @@
             <artifactId>swagger-annotations</artifactId>
             <version>${swagger-annotations.version}</version>
         </dependency>
+
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-test</artifactId>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 
 </project>

ruoyi-common/ruoyi-common-chat/src/main/java/org/ruoyi/common/chat/domain/bo/chat/ChatModelBo.java

@@ -1,11 +1,16 @@
 package org.ruoyi.common.chat.domain.bo.chat;
 
+import com.fasterxml.jackson.annotation.JsonProperty;
 import io.github.linpeilie.annotations.AutoMapper;
 import jakarta.validation.constraints.NotBlank;
 import jakarta.validation.constraints.NotNull;
+import jakarta.validation.constraints.Pattern;
 import lombok.Data;
 import lombok.EqualsAndHashCode;
+import lombok.ToString;
 import org.ruoyi.common.chat.entity.chat.ChatModel;
+import org.ruoyi.common.chat.security.ChatModelCredentialPolicy;
+import org.ruoyi.common.chat.security.ChatModelSecretReference;
 import org.ruoyi.common.core.validate.AddGroup;
 import org.ruoyi.common.core.validate.EditGroup;
 import org.ruoyi.common.mybatis.core.domain.BaseEntity;
@@ -63,11 +68,21 @@ public class ChatModelBo extends BaseEntity {
     /**
      * 请求地址
      */
+    @NotBlank(message = "请求地址不能为空", groups = { AddGroup.class, EditGroup.class })
+    @Pattern(regexp = ChatModelCredentialPolicy.HTTPS_API_HOST_REGEXP,
+        message = "请求地址必须是无凭据、查询参数和片段的 HTTPS 地址",
+        groups = { AddGroup.class, EditGroup.class })
     private String apiHost;
 
     /**
      * 密钥
      */
+    @JsonProperty(access = JsonProperty.Access.WRITE_ONLY)
+    @Pattern(regexp = ChatModelSecretReference.ENV_REFERENCE_REGEXP,
+        message = "密钥必须使用受信任的环境变量引用",
+        groups = { AddGroup.class, EditGroup.class })
+    @ToString.Exclude
+    @EqualsAndHashCode.Exclude
     private String apiKey;
 
     /**

ruoyi-common/ruoyi-common-chat/src/main/java/org/ruoyi/common/chat/domain/bo/chat/ChatModelSelectQuery.java

@@ -0,0 +1,11 @@
+package org.ruoyi.common.chat.domain.bo.chat;
+
+import lombok.Data;
+
+/** Minimal, non-secret query contract for user-facing model selection. */
+@Data
+public class ChatModelSelectQuery {
+
+    /** Optional model category; defaults to chat at the controller boundary. */
+    private String category;
+}

ruoyi-common/ruoyi-common-chat/src/main/java/org/ruoyi/common/chat/domain/bo/chat/ModelBatchKeyBo.java

@@ -1,8 +1,12 @@
 package org.ruoyi.common.chat.domain.bo.chat;
 
+import com.fasterxml.jackson.annotation.JsonProperty;
 import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Pattern;
 import lombok.Data;
 import lombok.EqualsAndHashCode;
+import lombok.ToString;
+import org.ruoyi.common.chat.security.ChatModelSecretReference;
 import org.ruoyi.common.mybatis.core.domain.BaseEntity;
 
 /**
@@ -24,7 +28,12 @@ public class ModelBatchKeyBo extends BaseEntity {
     /**
      * 密钥
      */
+    @JsonProperty(access = JsonProperty.Access.WRITE_ONLY)
     @NotBlank(message = "密钥不能为空")
+    @Pattern(regexp = ChatModelSecretReference.ENV_REFERENCE_REGEXP,
+        message = "密钥必须使用受信任的环境变量引用")
+    @ToString.Exclude
+    @EqualsAndHashCode.Exclude
     private String apiKey;
 
 }

ruoyi-common/ruoyi-common-chat/src/main/java/org/ruoyi/common/chat/domain/dto/request/ChatRequest.java

@@ -75,6 +75,19 @@ public class ChatRequest {
      */
     private Boolean enableThinking = false;
 
+    /**
+     * 是否回放上下文中已经存在的模型思考内容。
+     * 仅供需要在非思考动作轮中延续 DeepSeek 工具协议的内部调用使用。
+     */
+    private Boolean replayThinking = false;
+
+    /**
+     * Doubao-Seed-Evolving 思考等级（reasoning_effort）。
+     * 取值 none/minimal/low/medium/high/xhigh/max；null 表示不发送 Doubao 专属参数。
+     * 仅在 custom_api 供应商承载 Doubao 模型时使用，其他模型忽略此字段。
+     */
+    private String reasoningEffort;
+
     /**
      * 对话模型详情
      */

ruoyi-common/ruoyi-common-chat/src/main/java/org/ruoyi/common/chat/domain/vo/chat/ChatModelSelectVo.java

@@ -0,0 +1,40 @@
+package org.ruoyi.common.chat.domain.vo.chat;
+
+import lombok.Data;
+
+import java.io.Serial;
+import java.io.Serializable;
+
+/**
+ * Public model option exposed to clients that can select a chat model.
+ *
+ * <p>This deliberately contains only the fields required to identify and display a model.
+ * Operational configuration, including endpoints and credentials, remains server-side.</p>
+ */
+@Data
+public class ChatModelSelectVo implements Serializable {
+
+    @Serial
+    private static final long serialVersionUID = 1L;
+
+    /** Model configuration identifier. */
+    private Long id;
+
+    /** Configured model name. */
+    private String modelName;
+
+    /** User-facing model description; clients can fall back to modelName when blank. */
+    private String modelDescribe;
+
+    /** Provider identifier used for display. */
+    private String providerCode;
+
+    public static ChatModelSelectVo from(ChatModelVo source) {
+        ChatModelSelectVo target = new ChatModelSelectVo();
+        target.setId(source.getId());
+        target.setModelName(source.getModelName());
+        target.setModelDescribe(source.getModelDescribe());
+        target.setProviderCode(source.getProviderCode());
+        return target;
+    }
+}

ruoyi-common/ruoyi-common-chat/src/main/java/org/ruoyi/common/chat/domain/vo/chat/ChatModelVo.java

@@ -3,9 +3,13 @@ package org.ruoyi.common.chat.domain.vo.chat;
 
 import cn.idev.excel.annotation.ExcelIgnoreUnannotated;
 import cn.idev.excel.annotation.ExcelProperty;
+import com.fasterxml.jackson.annotation.JsonProperty;
 import io.github.linpeilie.annotations.AutoMapper;
 import lombok.Data;
+import lombok.EqualsAndHashCode;
+import lombok.ToString;
 import org.ruoyi.common.chat.entity.chat.ChatModel;
+import org.ruoyi.common.chat.security.ChatModelCredentialPolicy;
 
 import java.io.Serial;
 import java.io.Serializable;
@@ -18,7 +22,7 @@ import java.io.Serializable;
  */
 @Data
 @ExcelIgnoreUnannotated
-@AutoMapper(target = ChatModel.class)
+@AutoMapper(target = ChatModel.class, convertGenerate = false)
 public class ChatModelVo implements Serializable {
 
     @Serial
@@ -74,11 +78,29 @@ public class ChatModelVo implements Serializable {
     private String apiHost;
 
     /**
-     * 密钥
+     * 密钥仅用于服务端模型调用和写入配置。任何读取接口、日志字符串或 Excel 导出
+     * 都不得把它带出服务端边界。
      */
-    @ExcelProperty(value = "密钥")
+    @JsonProperty(access = JsonProperty.Access.WRITE_ONLY)
+    @ToString.Exclude
+    @EqualsAndHashCode.Exclude
     private String apiKey;
 
+    /** Returns the stored configuration reference without touching the process environment. */
+    public String getApiKey() {
+        return apiKey;
+    }
+
+    /**
+     * Resolves the reference only after binding it to both the consuming provider and this row's
+     * effective provider, model and endpoint. Non-allowlisted, misrouted, or legacy rows fail
+     * closed before the environment is read.
+     */
+    public String resolveApiKeyForConfiguredEndpoint(String consumingProviderCode) {
+        return ChatModelCredentialPolicy.resolveApiKeyForUse(
+            consumingProviderCode, providerCode, modelName, apiHost, apiKey);
+    }
+
     /**
      * 备注
      */

ruoyi-common/ruoyi-common-chat/src/main/java/org/ruoyi/common/chat/entity/chat/ChatModel.java

@@ -4,6 +4,7 @@ import com.baomidou.mybatisplus.annotation.TableId;
 import com.baomidou.mybatisplus.annotation.TableName;
 import lombok.Data;
 import lombok.EqualsAndHashCode;
+import lombok.ToString;
 import org.ruoyi.common.tenant.core.TenantEntity;
 
 import java.io.Serial;
@@ -67,6 +68,8 @@ public class ChatModel extends TenantEntity {
     /**
      * 密钥
      */
+    @ToString.Exclude
+    @EqualsAndHashCode.Exclude
     private String apiKey;
 
     /**

ruoyi-common/ruoyi-common-chat/src/main/java/org/ruoyi/common/chat/security/ChatModelCredentialPolicy.java

@@ -0,0 +1,185 @@
+package org.ruoyi.common.chat.security;
+
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.util.Objects;
+import java.util.Set;
+import java.util.function.Function;
+
+/** Security policy binding model credential references to trusted provider endpoints. */
+public final class ChatModelCredentialPolicy {
+
+    public static final String HTTPS_API_HOST_REGEXP =
+        "^https://(?![^/?#]*@)[^\\s/?#]+(?::[0-9]{1,5})?(?:/[^\\s?#]*)?$";
+
+    public static final String DEEPSEEK_PROVIDER = "deepseek";
+    public static final String DEEPSEEK_API_HOST = "https://api.deepseek.com";
+    public static final String PPIO_PROVIDER = "ppio";
+    public static final String PPIO_API_HOST = "https://api.ppio.com/openai/v1";
+
+    private static final Set<String> PPIO_API_HOSTS = Set.of(
+        PPIO_API_HOST, PPIO_API_HOST + "/",
+        "https://api.ppio.com/openai", "https://api.ppio.com/openai/"
+    );
+
+    private static final Set<String> DEEPSEEK_MODELS = Set.of(
+        "deepseek-v4-flash",
+        "deepseek-v4-pro",
+        "deepseek-v4-flash-vision-exp"
+    );
+
+    private ChatModelCredentialPolicy() {
+    }
+
+    /**
+     * Resolves a provider credential only after the effective provider/model/endpoint/reference
+     * tuple passes the same allowlist used at the persistence boundary.
+     */
+    public static String resolveApiKeyForUse(String consumingProviderCode,
+                                             String providerCode,
+                                             String modelName,
+                                             String apiHost,
+                                             String apiKey) {
+        return resolveApiKeyForUse(consumingProviderCode, providerCode, modelName, apiHost,
+            apiKey, System::getenv);
+    }
+
+    static String resolveApiKeyForUse(String consumingProviderCode,
+                                      String providerCode,
+                                      String modelName,
+                                      String apiHost,
+                                      String apiKey,
+                                      Function<String, String> environment) {
+        if (!Objects.equals(consumingProviderCode, providerCode)) {
+            throw new IllegalArgumentException(
+                "Credential consumer does not match the configured provider");
+        }
+        if (CustomApiCredentialPolicy.isCustomProvider(providerCode)) {
+            CustomApiCredentialPolicy.requireConfiguration(providerCode, modelName, apiHost, apiKey, environment);
+        } else {
+            requireTrustedConfiguration(providerCode, modelName, apiHost, apiKey);
+        }
+        return ChatModelSecretReference.resolveAllowlistedReference(apiKey,
+            Objects.requireNonNull(environment, "environment"));
+    }
+
+    /** Validates the effective row which will remain after an insert or partial update. */
+    public static void requirePersistableConfiguration(String providerCode,
+                                                       String modelName,
+                                                       String apiHost,
+                                                       String apiKey) {
+        requireSecureApiHost(apiHost);
+        if (CustomApiCredentialPolicy.isCustomProvider(providerCode)) {
+            CustomApiCredentialPolicy.requireConfiguration(providerCode, modelName, apiHost, apiKey);
+            return;
+        }
+        if (PPIO_PROVIDER.equals(providerCode)) {
+            requirePpioConfiguration(providerCode, modelName, apiHost, apiKey);
+            return;
+        }
+        if (apiKey != null) {
+            ChatModelSecretReference.requirePersistableReference(apiKey);
+            if (!isDeepSeekConfiguration(providerCode, modelName)) {
+                throw new IllegalArgumentException(
+                    "Model API key reference is not allowed for this provider");
+            }
+        }
+        if (isDeepSeekConfiguration(providerCode, modelName)) {
+            requireDeepSeekConfiguration(providerCode, modelName, apiHost, apiKey);
+        }
+    }
+
+    /** Re-validates the configuration immediately before a DeepSeek provider client is built. */
+    public static void requireDeepSeekConfiguration(String providerCode,
+                                                    String modelName,
+                                                    String apiHost,
+                                                    String apiKey) {
+        if (!DEEPSEEK_PROVIDER.equals(providerCode)) {
+            throw new IllegalArgumentException("DeepSeek model provider is not trusted");
+        }
+        if (!DEEPSEEK_MODELS.contains(modelName)) {
+            throw new IllegalArgumentException("DeepSeek model is not allowlisted");
+        }
+        requireSecureApiHost(apiHost);
+        if (!DEEPSEEK_API_HOST.equals(apiHost)) {
+            throw new IllegalArgumentException("DeepSeek API host is not allowlisted");
+        }
+        if (apiKey == null) {
+            throw new IllegalArgumentException("DeepSeek API key reference is required");
+        }
+        requireProviderReference(providerCode, apiKey);
+    }
+
+    /** Binds each provider to its own environment variable, including batch credential updates. */
+    public static void requireProviderReference(String providerCode, String apiKey) {
+        if (CustomApiCredentialPolicy.isCustomProvider(providerCode)) {
+            CustomApiCredentialPolicy.requireReference(providerCode, apiKey);
+            return;
+        }
+        String expectedReference;
+        if (DEEPSEEK_PROVIDER.equals(providerCode)) {
+            expectedReference = "env:DEEPSEEK_API_KEY";
+        } else if (PPIO_PROVIDER.equals(providerCode)) {
+            expectedReference = "env:PPIO_API_KEY";
+        } else {
+            throw new IllegalArgumentException("Model credential provider is not allowlisted");
+        }
+        ChatModelSecretReference.requirePersistableReference(apiKey);
+        if (!expectedReference.equals(apiKey)) {
+            throw new IllegalArgumentException("Model API key reference does not match the provider");
+        }
+    }
+
+    /** Validates credential use without allowing another adapter to consume a provider's key. */
+    public static void requireTrustedConfiguration(String providerCode, String modelName,
+                                                   String apiHost, String apiKey) {
+        if (CustomApiCredentialPolicy.isCustomProvider(providerCode)) {
+            CustomApiCredentialPolicy.requireConfiguration(providerCode, modelName, apiHost, apiKey);
+        } else if (PPIO_PROVIDER.equals(providerCode)) {
+            requirePpioConfiguration(providerCode, modelName, apiHost, apiKey);
+        } else {
+            requireDeepSeekConfiguration(providerCode, modelName, apiHost, apiKey);
+        }
+    }
+
+    /** Validates PPIO and returns the base URL expected by the OpenAI Chat Completions client. */
+    public static String requirePpioConfiguration(String providerCode, String modelName,
+                                                  String apiHost, String apiKey) {
+        if (!PPIO_PROVIDER.equals(providerCode)) {
+            throw new IllegalArgumentException("PPIO model provider is not trusted");
+        }
+        // PPIO hosts models from multiple vendors; use the full model ID from its catalog.
+        if (modelName == null || !modelName.matches("[A-Za-z0-9][A-Za-z0-9._:/-]{0,254}")) {
+            throw new IllegalArgumentException("PPIO model ID is invalid");
+        }
+        requireSecureApiHost(apiHost);
+        if (!PPIO_API_HOSTS.contains(apiHost)) {
+            throw new IllegalArgumentException("PPIO API host is not allowlisted");
+        }
+        requireProviderReference(providerCode, apiKey);
+        return PPIO_API_HOST;
+    }
+
+    public static String requireSecureApiHost(String apiHost) {
+        if (apiHost == null || apiHost.isBlank()) {
+            throw new IllegalArgumentException("Model API host must be an absolute HTTPS URI");
+        }
+        final URI uri;
+        try {
+            uri = new URI(apiHost);
+        } catch (URISyntaxException invalid) {
+            throw new IllegalArgumentException("Model API host must be an absolute HTTPS URI");
+        }
+        if (!uri.isAbsolute() || !"https".equals(uri.getScheme()) || uri.getHost() == null
+            || uri.getUserInfo() != null || uri.getRawQuery() != null || uri.getRawFragment() != null
+            || uri.getPort() > 65535) {
+            throw new IllegalArgumentException(
+                "Model API host must be HTTPS without userinfo, query, or fragment");
+        }
+        return apiHost;
+    }
+
+    public static boolean isDeepSeekConfiguration(String providerCode, String modelName) {
+        return DEEPSEEK_PROVIDER.equals(providerCode) || DEEPSEEK_MODELS.contains(modelName);
+    }
+}

ruoyi-common/ruoyi-common-chat/src/main/java/org/ruoyi/common/chat/security/ChatModelSecretReference.java

@@ -0,0 +1,71 @@
+package org.ruoyi.common.chat.security;
+
+import java.util.Objects;
+import java.util.function.Function;
+import java.util.regex.Pattern;
+
+/** Resolves an explicit {@code env:NAME} model credential without exposing it through DTO JSON. */
+public final class ChatModelSecretReference {
+
+    public static final String ENV_REFERENCE_REGEXP =
+        "^env:(?:(?:DEEPSEEK|PPIO)_API_KEY|" + CustomApiCredentialPolicy.REFERENCE_PATTERN + ")$";
+
+    private static final String ENV_PREFIX = "env:";
+    private static final Pattern ENV_REFERENCE = Pattern.compile(ENV_REFERENCE_REGEXP);
+
+    private ChatModelSecretReference() {
+    }
+
+    /**
+     * Package-private final resolution step. Callers must first bind provider, model and endpoint
+     * through {@link ChatModelCredentialPolicy}; exposing a context-free resolver would recreate a
+     * credential-confusion channel.
+     */
+    static String resolveAllowlistedReference(String configuredValue,
+                                              Function<String, String> environment) {
+        String reference = requirePersistableReference(configuredValue);
+        if (reference == null) {
+            return null;
+        }
+        String variable = reference.substring(ENV_PREFIX.length());
+        String resolved = Objects.requireNonNull(environment, "environment").apply(variable);
+        if (resolved == null || resolved.isBlank()) {
+            throw new IllegalStateException(
+                "Required model API key environment variable is not configured: " + variable);
+        }
+        return resolved;
+    }
+
+    /**
+     * Validates the only credential representation that may cross a persistence boundary.
+     * A {@code null} value means that an update did not request a credential change.
+     */
+    public static String requirePersistableReference(String configuredValue) {
+        if (configuredValue == null) {
+            return null;
+        }
+        if (!ENV_REFERENCE.matcher(configuredValue).matches()) {
+            throw new IllegalArgumentException(
+                "Invalid model API key reference; reference is not allowlisted");
+        }
+        return configuredValue;
+    }
+
+    /**
+     * Narrow compatibility hook for an in-place legacy migration. It is deliberately package
+     * private and requires an audit callback which never receives the credential value. Normal
+     * provider resolution and all persistence paths must use the strict methods above.
+     */
+    static String resolveForLegacyMigration(String configuredValue,
+                                            Function<String, String> environment,
+                                            Runnable legacyPlaintextAudit) {
+        if (configuredValue == null || configuredValue.startsWith(ENV_PREFIX)) {
+            return resolveAllowlistedReference(configuredValue, environment);
+        }
+        if (configuredValue.isBlank()) {
+            throw new IllegalArgumentException("Legacy model API key cannot be blank");
+        }
+        Objects.requireNonNull(legacyPlaintextAudit, "legacyPlaintextAudit").run();
+        return configuredValue;
+    }
+}

ruoyi-common/ruoyi-common-chat/src/main/java/org/ruoyi/common/chat/security/CustomApiCredentialPolicy.java

@@ -0,0 +1,80 @@
+package org.ruoyi.common.chat.security;
+
+import java.net.URI;
+import java.util.function.Function;
+import java.util.regex.Pattern;
+
+/** Binds configurable OpenAI/Anthropic endpoints to dedicated deployment credentials. */
+public final class CustomApiCredentialPolicy {
+
+    public static final String OPENAI_PROVIDER = "custom_api";
+    public static final String ANTHROPIC_PROVIDER = "custom_anthropic";
+    public static final String REFERENCE_PATTERN =
+        "CUSTOM_(?:OPENAI|ANTHROPIC)(?:_[A-Z][A-Z0-9_]{0,31})?_API_KEY";
+
+    private CustomApiCredentialPolicy() {
+    }
+
+    public static boolean isCustomProvider(String providerCode) {
+        return OPENAI_PROVIDER.equals(providerCode) || ANTHROPIC_PROVIDER.equals(providerCode);
+    }
+
+    public static void requireReference(String providerCode, String reference) {
+        String protocol;
+        if (OPENAI_PROVIDER.equals(providerCode)) {
+            protocol = "OPENAI";
+        } else if (ANTHROPIC_PROVIDER.equals(providerCode)) {
+            protocol = "ANTHROPIC";
+        } else {
+            throw new IllegalArgumentException("不支持的自定义厂商协议");
+        }
+        String pattern = "env:CUSTOM_" + protocol + "(?:_[A-Z][A-Z0-9_]{0,31})?_API_KEY";
+        if (reference == null || !Pattern.matches(pattern, reference)) {
+            throw new IllegalArgumentException("自定义厂商密钥必须使用与协议匹配的环境变量引用");
+        }
+    }
+
+    public static String requireConfiguration(String providerCode, String modelName,
+                                               String apiHost, String reference) {
+        return requireConfiguration(providerCode, modelName, apiHost, reference, System::getenv);
+    }
+
+    static String requireConfiguration(String providerCode, String modelName, String apiHost,
+                                       String reference, Function<String, String> environment) {
+        requireReference(providerCode, reference);
+        if (modelName == null || modelName.isBlank()) {
+            throw new IllegalArgumentException("自定义厂商的模型名称不能为空");
+        }
+        String baseUrl = normalizeBaseUrl(providerCode, apiHost);
+        String keyVariable = reference.substring("env:".length());
+        String hostVariable = keyVariable.substring(0, keyVariable.length() - "_API_KEY".length()) + "_BASE_URL";
+        String configuredHost = environment.apply(hostVariable);
+        if (configuredHost == null || configuredHost.isBlank()) {
+            throw new IllegalArgumentException("请先在后端配置自定义厂商地址环境变量：" + hostVariable);
+        }
+        if (!baseUrl.equals(normalizeBaseUrl(providerCode, configuredHost))) {
+            throw new IllegalArgumentException("模型请求地址与该密钥绑定的自定义厂商地址不一致");
+        }
+        return baseUrl;
+    }
+
+    /** Accepts a base URL or the selected protocol's complete chat endpoint. */
+    public static String normalizeBaseUrl(String providerCode, String apiHost) {
+        if (!isCustomProvider(providerCode)) {
+            throw new IllegalArgumentException("不支持的自定义厂商协议");
+        }
+        ChatModelCredentialPolicy.requireSecureApiHost(apiHost);
+        String normalized = apiHost.replaceAll("/+$", "");
+        String suffix = ANTHROPIC_PROVIDER.equals(providerCode) ? "/messages" : "/chat/completions";
+        String otherSuffix = ANTHROPIC_PROVIDER.equals(providerCode) ? "/chat/completions" : "/messages";
+        if (normalized.endsWith(otherSuffix)) {
+            throw new IllegalArgumentException("请求地址与所选自定义厂商协议不匹配");
+        }
+        if (normalized.endsWith(suffix)) {
+            normalized = normalized.substring(0, normalized.length() - suffix.length());
+        } else if (URI.create(normalized).getPath().isEmpty()) {
+            normalized += "/v1";
+        }
+        return normalized;
+    }
+}

ruoyi-common/ruoyi-common-chat/src/main/java/org/ruoyi/common/chat/service/chat/IChatModelService.java

@@ -49,6 +49,9 @@ public interface IChatModelService {
      */
     List<ChatModelVo> queryList(ChatModelBo bo);
 
+    /** 查询当前租户中厂商已启用的模型，供用户选择或业务调用。 */
+    List<ChatModelVo> queryAvailableList(ChatModelBo bo);
+
     /**
      * 新增模型管理
      *

ruoyi-common/ruoyi-common-log/pom.xml

@@ -27,6 +27,17 @@
             <artifactId>ruoyi-common-json</artifactId>
         </dependency>
 
+        <dependency>
+            <groupId>org.ruoyi</groupId>
+            <artifactId>ruoyi-common-web</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-test</artifactId>
+            <scope>test</scope>
+        </dependency>
+
     </dependencies>
 
 </project>

ruoyi-common/ruoyi-common-log/src/main/java/org/ruoyi/common/log/aspect/LogAspect.java

@@ -1,6 +1,5 @@
 package org.ruoyi.common.log.aspect;
 
-import cn.hutool.core.lang.Dict;
 import cn.hutool.core.map.MapUtil;
 import cn.hutool.core.util.ArrayUtil;
 import cn.hutool.core.util.ObjectUtil;
@@ -22,6 +21,7 @@ import org.ruoyi.common.log.annotation.Log;
 import org.ruoyi.common.log.enums.BusinessStatus;
 import org.ruoyi.common.log.event.OperLogEvent;
 import org.ruoyi.common.satoken.utils.LoginHelper;
+import org.ruoyi.common.web.utils.SafeRequestLogUtils;
 import org.springframework.boot.autoconfigure.AutoConfiguration;
 import org.springframework.http.HttpMethod;
 import org.springframework.validation.BindingResult;
@@ -42,7 +42,11 @@ public class LogAspect {
     /**
      * 排除敏感属性字段
      */
-    public static final String[] EXCLUDE_PROPERTIES = { "password", "oldPassword", "newPassword", "confirmPassword" };
+    public static final String[] EXCLUDE_PROPERTIES = {
+        "password", "oldPassword", "newPassword", "confirmPassword", "apiKey",
+        "clientSecret", "secret", "secretKey", "token", "tokenId", "accessToken",
+        "refreshToken", "authorization", "credential", "privateKey"
+    };
 
 
     /**
@@ -91,14 +95,15 @@ public class LogAspect {
             // 请求的地址
             String ip = ServletUtils.getClientIP();
             operLog.setOperIp(ip);
-            operLog.setOperUrl(StringUtils.substring(ServletUtils.getRequest().getRequestURI(), 0, 255));
+            operLog.setOperUrl(StringUtils.substring(SafeRequestLogUtils.sanitizeUri(
+                ServletUtils.getRequest().getRequestURI()), 0, 255));
             LoginUser loginUser = LoginHelper.getLoginUser();
             operLog.setOperName(loginUser.getUsername());
             operLog.setDeptName(loginUser.getDeptName());
 
             if (e != null) {
                 operLog.setStatus(BusinessStatus.FAIL.ordinal());
-                operLog.setErrorMsg(StringUtils.substring(e.getMessage(), 0, 3800));
+                operLog.setErrorMsg("Request failed: " + e.getClass().getSimpleName());
             }
             // 设置方法名称
             String className = joinPoint.getTarget().getClass().getName();
@@ -116,7 +121,7 @@ public class LogAspect {
             SpringUtils.context().publishEvent(operLog);
         } catch (Exception exp) {
             // 记录本地异常日志
-            log.error("异常信息:{}", exp.getMessage());
+            log.error("Operation audit failed: {}", exp.getClass().getSimpleName());
         } finally {
             KEY_CACHE.remove();
         }
@@ -143,7 +148,9 @@ public class LogAspect {
         }
         // 是否需要保存response，参数和值
         if (log.isSaveResponseData() && ObjectUtil.isNotNull(jsonResult)) {
-            operLog.setJsonResult(StringUtils.substring(JsonUtils.toJsonString(jsonResult), 0, 3800));
+            String responseJson = SensitiveLogSanitizer.sanitizeJson(
+                JsonUtils.toJsonString(jsonResult), log.excludeParamNames());
+            operLog.setJsonResult(StringUtils.substring(responseJson, 0, 3800));
         }
     }
 
@@ -160,9 +167,9 @@ public class LogAspect {
             String params = argsArrayToString(joinPoint.getArgs(), excludeParamNames);
             operLog.setOperParam(StringUtils.substring(params, 0, 3800));
         } else {
-            MapUtil.removeAny(paramsMap, EXCLUDE_PROPERTIES);
-            MapUtil.removeAny(paramsMap, excludeParamNames);
-            operLog.setOperParam(StringUtils.substring(JsonUtils.toJsonString(paramsMap), 0, 3800));
+            String params = SensitiveLogSanitizer.sanitizeJson(
+                JsonUtils.toJsonString(paramsMap), ArrayUtil.addAll(excludeParamNames, EXCLUDE_PROPERTIES));
+            operLog.setOperParam(StringUtils.substring(params, 0, 3800));
         }
     }
 
@@ -177,26 +184,7 @@ public class LogAspect {
         String[] exclude = ArrayUtil.addAll(excludeParamNames, EXCLUDE_PROPERTIES);
         for (Object o : paramsArray) {
             if (ObjectUtil.isNotNull(o) && !isFilterObject(o)) {
-                String str = "";
-                if (o instanceof List<?> list) {
-                    List<Dict> list1 = new ArrayList<>();
-                    for (Object obj : list) {
-                        String str1 = JsonUtils.toJsonString(obj);
-                        Dict dict = JsonUtils.parseMap(str1);
-                        if (MapUtil.isNotEmpty(dict)) {
-                            MapUtil.removeAny(dict, exclude);
-                            list1.add(dict);
-                        }
-                    }
-                    str = JsonUtils.toJsonString(list1);
-                } else {
-                    str = JsonUtils.toJsonString(o);
-                    Dict dict = JsonUtils.parseMap(str);
-                    if (MapUtil.isNotEmpty(dict)) {
-                        MapUtil.removeAny(dict, exclude);
-                        str = JsonUtils.toJsonString(dict);
-                    }
-                }
+                String str = SensitiveLogSanitizer.sanitizeJson(JsonUtils.toJsonString(o), exclude);
                 params.add(str);
             }
         }

ruoyi-common/ruoyi-common-log/src/main/java/org/ruoyi/common/log/aspect/SensitiveLogSanitizer.java

@@ -0,0 +1,95 @@
+package org.ruoyi.common.log.aspect;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ArrayNode;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import com.fasterxml.jackson.databind.node.TextNode;
+import org.ruoyi.common.web.utils.SafeRequestLogUtils;
+
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Set;
+
+/** Recursively removes credential fields from operation-audit JSON. */
+final class SensitiveLogSanitizer {
+
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+    private static final Set<String> SENSITIVE_FIELDS = Set.of(
+        "password", "oldpassword", "newpassword", "confirmpassword", "passwd", "pwd",
+        "apikey", "clientsecret", "secret", "secretkey", "accesskey", "privatekey",
+        "token", "tokenid", "accesstoken", "refreshtoken", "authorization", "credential",
+        "credentials", "dbpassword"
+    );
+
+    private SensitiveLogSanitizer() {
+    }
+
+    static String sanitizeJson(String json, String... additionalSensitiveFields) {
+        if (json == null || json.isBlank()) {
+            return json;
+        }
+        try {
+            JsonNode root = MAPPER.readTree(json);
+            JsonNode safeRoot = redact(root, normalizedFields(additionalSensitiveFields));
+            return MAPPER.writeValueAsString(safeRoot);
+        } catch (Exception ignored) {
+            // Never fall back to the raw value: it may be exactly the malformed secret payload.
+            return SafeRequestLogUtils.sanitizeText(json);
+        }
+    }
+
+    private static Set<String> normalizedFields(String[] additionalSensitiveFields) {
+        Set<String> fields = new HashSet<>(SENSITIVE_FIELDS);
+        if (additionalSensitiveFields != null) {
+            Arrays.stream(additionalSensitiveFields)
+                .filter(value -> value != null && !value.isBlank())
+                .map(SensitiveLogSanitizer::normalize)
+                .forEach(fields::add);
+        }
+        return fields;
+    }
+
+    private static JsonNode redact(JsonNode node, Set<String> sensitiveFields) {
+        if (node == null) {
+            return null;
+        }
+        if (node instanceof ObjectNode object) {
+            Iterator<Map.Entry<String, JsonNode>> fields = object.fields();
+            while (fields.hasNext()) {
+                Map.Entry<String, JsonNode> field = fields.next();
+                if (sensitiveFields.contains(normalize(field.getKey()))) {
+                    fields.remove();
+                } else {
+                    JsonNode value = field.getValue();
+                    if (value != null && value.isTextual()) {
+                        object.set(field.getKey(), TextNode.valueOf(
+                            SafeRequestLogUtils.sanitizeText(value.textValue())));
+                    } else {
+                        object.set(field.getKey(), redact(value, sensitiveFields));
+                    }
+                }
+            }
+        } else if (node instanceof ArrayNode array) {
+            for (int index = 0; index < array.size(); index++) {
+                JsonNode value = array.get(index);
+                if (value != null && value.isTextual()) {
+                    array.set(index, TextNode.valueOf(
+                        SafeRequestLogUtils.sanitizeText(value.textValue())));
+                } else {
+                    array.set(index, redact(value, sensitiveFields));
+                }
+            }
+        } else if (node.isTextual()) {
+            return TextNode.valueOf(SafeRequestLogUtils.sanitizeText(node.textValue()));
+        }
+        return node;
+    }
+
+    private static String normalize(String fieldName) {
+        return fieldName.replaceAll("[^A-Za-z0-9]", "").toLowerCase(Locale.ROOT);
+    }
+}

ruoyi-common/ruoyi-common-mybatis/pom.xml

@@ -47,6 +47,12 @@
             <groupId>p6spy</groupId>
             <artifactId>p6spy</artifactId>
         </dependency>
+
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-test</artifactId>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 
 </project>

ruoyi-common/ruoyi-common-mybatis/src/main/java/org/ruoyi/common/mybatis/config/SafeP6SpyMessageFormatter.java

@@ -0,0 +1,56 @@
+package org.ruoyi.common.mybatis.config;
+
+import com.p6spy.engine.spy.appender.MessageFormattingStrategy;
+
+import java.util.regex.Pattern;
+
+/**
+ * P6Spy formatter that deliberately ignores the bound SQL argument.
+ *
+ * <p>P6Spy supplies both the JDBC prepared statement and a reconstructed statement with
+ * parameter values. The latter can contain passwords, API keys and tokens, so this formatter
+ * records only a bounded, literal-free structural form of the prepared statement.</p>
+ */
+public final class SafeP6SpyMessageFormatter implements MessageFormattingStrategy {
+
+    private static final int MAX_SQL_LENGTH = 4096;
+    private static final Pattern SQL_STRING_LITERAL = Pattern.compile("'(?:''|\\\\.|[^'\\\\])*'");
+    private static final Pattern SQL_DOLLAR_QUOTED_LITERAL = Pattern.compile(
+        "\\$[A-Za-z0-9_]*\\$.*?\\$[A-Za-z0-9_]*\\$", Pattern.DOTALL);
+    private static final Pattern SECRET_SHAPED_TOKEN = Pattern.compile(
+        "(?i)\\b(?:sk[-_][A-Za-z0-9._~+/-]{8,}|AKIA[A-Z0-9]{12,})\\b");
+    private static final Pattern SQL_LINE_COMMENT = Pattern.compile("--[^\\r\\n]*");
+    private static final Pattern SQL_BLOCK_COMMENT = Pattern.compile("/\\*.*?\\*/", Pattern.DOTALL);
+    private static final Pattern WHITESPACE = Pattern.compile("\\s+");
+
+    @Override
+    public String formatMessage(int connectionId, String now, long elapsed, String category,
+                                String prepared, String sql, String url) {
+        String statement = structuralPreparedSql(prepared);
+        return "%s | %d ms | %s | connection %d | %s".formatted(
+            safeLabel(now), elapsed, safeLabel(category), connectionId, statement);
+    }
+
+    static String structuralPreparedSql(String prepared) {
+        if (prepared == null || prepared.isBlank()) {
+            return "[prepared-sql-unavailable]";
+        }
+        String safe = SQL_BLOCK_COMMENT.matcher(prepared).replaceAll(" ");
+        safe = SQL_LINE_COMMENT.matcher(safe).replaceAll(" ");
+        safe = SQL_DOLLAR_QUOTED_LITERAL.matcher(safe).replaceAll("?");
+        safe = SQL_STRING_LITERAL.matcher(safe).replaceAll("'?'");
+        safe = SECRET_SHAPED_TOKEN.matcher(safe).replaceAll("[REDACTED]");
+        safe = WHITESPACE.matcher(safe).replaceAll(" ").trim();
+        if (safe.length() > MAX_SQL_LENGTH) {
+            return safe.substring(0, MAX_SQL_LENGTH) + "...(truncated)";
+        }
+        return safe;
+    }
+
+    private static String safeLabel(String value) {
+        if (value == null) {
+            return "";
+        }
+        return value.replaceAll("[\\r\\n|]", "_");
+    }
+}

ruoyi-common/ruoyi-common-mybatis/src/main/java/org/ruoyi/common/mybatis/handler/MybatisExceptionHandler.java

@@ -11,6 +11,8 @@ import org.springframework.dao.DuplicateKeyException;
 import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.RestControllerAdvice;
 
+import java.util.regex.Pattern;
+
 /**
  * Mybatis异常处理器
  *
@@ -20,13 +22,17 @@ import org.springframework.web.bind.annotation.RestControllerAdvice;
 @RestControllerAdvice
 public class MybatisExceptionHandler {
 
+    private static final Pattern CREDENTIAL_PATH_SEGMENT = Pattern.compile(
+        "(?i)(/(?:token(?:[-_]?id)?|access[-_]?token|refresh[-_]?token|api[-_]?key|"
+            + "monitor/online(?:/myself)?|myself)/)([^/?#;\\s]+)");
+
     /**
      * 主键或UNIQUE索引，数据重复异常
      */
     @ExceptionHandler(DuplicateKeyException.class)
     public R<Void> handleDuplicateKeyException(DuplicateKeyException e, HttpServletRequest request) {
-        String requestURI = request.getRequestURI();
-        log.error("请求地址'{}',数据库中已存在记录'{}'", requestURI, e.getMessage());
+        log.error("database_request_failed category=DUPLICATE_KEY method={} path={} exceptionType={}",
+            request.getMethod(), safePath(request), e.getClass().getName());
         return R.fail(HttpStatus.HTTP_CONFLICT, "数据库中已存在该记录，请联系管理员确认");
     }
 
@@ -35,18 +41,20 @@ public class MybatisExceptionHandler {
      */
     @ExceptionHandler(MyBatisSystemException.class)
     public R<Void> handleCannotFindDataSourceException(MyBatisSystemException e, HttpServletRequest request) {
-        String requestURI = request.getRequestURI();
         Throwable root = getRootCause(e);
         if (root instanceof NotLoginException) {
-            log.error("请求地址'{}',认证失败'{}',无法访问系统资源", requestURI, root.getMessage());
+            log.error("database_request_failed category=AUTHENTICATION method={} path={} exceptionType={}",
+                request.getMethod(), safePath(request), root.getClass().getName());
             return R.fail(HttpStatus.HTTP_UNAUTHORIZED, "认证失败，无法访问系统资源");
         }
         if (root instanceof CannotFindDataSourceException) {
-            log.error("请求地址'{}', 未找到数据源", requestURI);
+            log.error("database_request_failed category=DATA_SOURCE_NOT_FOUND method={} path={} exceptionType={}",
+                request.getMethod(), safePath(request), root.getClass().getName());
             return R.fail(HttpStatus.HTTP_INTERNAL_ERROR, "未找到数据源，请联系管理员确认");
         }
-        log.error("请求地址'{}', Mybatis系统异常", requestURI, e);
-        return R.fail(HttpStatus.HTTP_INTERNAL_ERROR, e.getMessage());
+        log.error("database_request_failed category=MYBATIS_SYSTEM method={} path={} exceptionType={} rootType={}",
+            request.getMethod(), safePath(request), e.getClass().getName(), root.getClass().getName());
+        return R.fail(HttpStatus.HTTP_INTERNAL_ERROR, "数据库访问异常，请联系管理员确认");
     }
 
     /**
@@ -86,4 +94,16 @@ public class MybatisExceptionHandler {
         return null;
     }
 
+    private static String safePath(HttpServletRequest request) {
+        String path = request.getRequestURI();
+        if (path == null) {
+            return null;
+        }
+        int queryIndex = path.indexOf('?');
+        if (queryIndex >= 0) {
+            path = path.substring(0, queryIndex);
+        }
+        return CREDENTIAL_PATH_SEGMENT.matcher(path).replaceAll("$1[REDACTED]");
+    }
+
 }

ruoyi-common/ruoyi-common-mybatis/src/main/resources/spy.properties

@@ -1,11 +1,9 @@
 # p6spy 性能分析插件配置文件
-modulelist=com.baomidou.mybatisplus.extension.p6spy.MybatisPlusLogFactory,com.p6spy.engine.outage.P6OutageFactory
+modulelist=com.baomidou.mybatisplus.extension.p6spy.MybatisPlusLogFactory
 # 自定义日志打印
-logMessageFormat=com.baomidou.mybatisplus.extension.p6spy.P6SpyLogger
-#日志输出到控制台
-appender=com.baomidou.mybatisplus.extension.p6spy.StdoutLogger
-# 使用日志系统记录 sql
-#appender=com.p6spy.engine.spy.appender.Slf4JLogger
+logMessageFormat=org.ruoyi.common.mybatis.config.SafeP6SpyMessageFormatter
+# 使用日志系统记录脱敏后的 prepared SQL 结构；formatter 永不消费 bound SQL 参数。
+appender=com.p6spy.engine.spy.appender.Slf4JLogger
 # 取消JDBC URL前缀
 useprefix=true
 # 配置记录 Log 例外,可去掉的结果集有error,info,batch,debug,statement,commit,rollback,result,resultset.

ruoyi-common/ruoyi-common-satoken/src/main/java/org/ruoyi/common/satoken/handler/SaTokenExceptionHandler.java

@@ -10,6 +10,8 @@ import org.ruoyi.common.core.domain.R;
 import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.RestControllerAdvice;
 
+import java.util.regex.Pattern;
+
 /**
  * SaToken异常处理器
  *
@@ -19,13 +21,17 @@ import org.springframework.web.bind.annotation.RestControllerAdvice;
 @RestControllerAdvice
 public class SaTokenExceptionHandler {
 
+    private static final Pattern CREDENTIAL_PATH_SEGMENT = Pattern.compile(
+        "(?i)(/(?:token(?:[-_]?id)?|access[-_]?token|refresh[-_]?token|api[-_]?key|"
+            + "monitor/online(?:/myself)?|myself)/)([^/?#;\\s]+)");
+
     /**
      * 权限码异常
      */
     @ExceptionHandler(NotPermissionException.class)
     public R<Void> handleNotPermissionException(NotPermissionException e, HttpServletRequest request) {
-        String requestURI = request.getRequestURI();
-        log.error("请求地址'{}',权限码校验失败'{}'", requestURI, e.getMessage());
+        log.error("authorization_failed category=PERMISSION method={} path={} exceptionType={}",
+            request.getMethod(), safePath(request), e.getClass().getName());
         return R.fail(HttpStatus.HTTP_FORBIDDEN, "没有访问权限，请联系管理员授权");
     }
 
@@ -34,8 +40,8 @@ public class SaTokenExceptionHandler {
      */
     @ExceptionHandler(NotRoleException.class)
     public R<Void> handleNotRoleException(NotRoleException e, HttpServletRequest request) {
-        String requestURI = request.getRequestURI();
-        log.error("请求地址'{}',角色权限校验失败'{}'", requestURI, e.getMessage());
+        log.error("authorization_failed category=ROLE method={} path={} exceptionType={}",
+            request.getMethod(), safePath(request), e.getClass().getName());
         return R.fail(HttpStatus.HTTP_FORBIDDEN, "没有访问权限，请联系管理员授权");
     }
 
@@ -44,9 +50,21 @@ public class SaTokenExceptionHandler {
      */
     @ExceptionHandler(NotLoginException.class)
     public R<Void> handleNotLoginException(NotLoginException e, HttpServletRequest request) {
-        String requestURI = request.getRequestURI();
-        log.error("请求地址'{}',认证失败'{}',无法访问系统资源", requestURI, e.getMessage());
+        log.error("authorization_failed category=NOT_LOGIN method={} path={} exceptionType={}",
+            request.getMethod(), safePath(request), e.getClass().getName());
         return R.fail(HttpStatus.HTTP_UNAUTHORIZED, "认证失败，无法访问系统资源");
     }
 
+    private static String safePath(HttpServletRequest request) {
+        String path = request.getRequestURI();
+        if (path == null) {
+            return null;
+        }
+        int queryIndex = path.indexOf('?');
+        if (queryIndex >= 0) {
+            path = path.substring(0, queryIndex);
+        }
+        return CREDENTIAL_PATH_SEGMENT.matcher(path).replaceAll("$1[REDACTED]");
+    }
+
 }

ruoyi-common/ruoyi-common-sse/pom.xml

@@ -32,5 +32,10 @@
             <groupId>org.ruoyi</groupId>
             <artifactId>ruoyi-common-json</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-test</artifactId>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 </project>

ruoyi-common/ruoyi-common-sse/src/main/java/org/ruoyi/common/sse/core/SseEmitterManager.java

@@ -97,7 +97,8 @@ public class SseEmitterManager {
             try {
                 emitter.send(SseEmitter.event().comment("disconnected"));
             } catch (Exception exception) {
-                log.error(exception.getMessage());
+                log.error("sse_connection operation=DISCONNECT routeType=SESSION status=FAILED errorType={}",
+                    errorType(exception));
             }
             emitter.complete();
         }
@@ -115,16 +116,18 @@ public class SseEmitterManager {
         }
         SseEmitter emitter = SESSION_EMITTERS.get(sessionId);
         if (emitter == null) {
-            log.warn("【SSE发送失败】sessionId: {} 没有活跃的SSE连接", sessionId);
+            log.warn("sse_delivery routeType=SESSION status=SKIPPED reason=NO_ACTIVE_CONNECTION activeSessionCount={}",
+                SESSION_EMITTERS.size());
             return;
         }
         try {
-            log.debug("【SSE发送】sessionId: {}, event: {}", sessionId, eventDto.getEvent());
+            log.debug("sse_delivery routeType=SESSION status=SENDING eventType={} payloadChars={}",
+                safeEventType(eventDto), eventPayloadLength(eventDto));
             emitter.send(SseEmitter.event()
                 .name(eventDto.getEvent())
                 .data(JSONUtil.toJsonStr(eventDto)));
         } catch (Exception e) {
-            log.error("【SSE发送失败】sessionId: {}, error: {}", sessionId, e.getMessage());
+            log.error("sse_delivery routeType=SESSION status=FAILED errorType={}", errorType(e));
             removeSessionEmitter(sessionId, emitter);
         }
     }
@@ -212,7 +215,8 @@ public class SseEmitterManager {
                 sseEmitter.send(SseEmitter.event().comment("disconnected"));
                 //sseEmitter.complete();
             } catch (Exception exception) {
-                log.error(exception.getMessage());
+                log.error("sse_connection operation=DISCONNECT routeType=USER status=FAILED errorType={}",
+                    errorType(exception));
             }
             emitters.remove(token);
         } else {
@@ -321,14 +325,15 @@ public class SseEmitterManager {
     public void sendEvent(Long userId, SseEventDto eventDto) {
         Map<String, SseEmitter> emitters = USER_TOKEN_EMITTERS.get(userId);
         if (MapUtil.isNotEmpty(emitters)) {
-            log.debug("【SSE发送】userId: {}, emitter数量: {}, event: {}", userId, emitters.size(), eventDto.getEvent());
+            log.debug("sse_delivery routeType=USER status=SENDING connectionCount={} eventType={} payloadChars={}",
+                emitters.size(), safeEventType(eventDto), eventPayloadLength(eventDto));
             for (Map.Entry<String, SseEmitter> entry : emitters.entrySet()) {
                 try {
                     entry.getValue().send(SseEmitter.event()
                         .name(eventDto.getEvent())
                         .data(JSONUtil.toJsonStr(eventDto)));
                 } catch (Exception e) {
-                    log.error("【SSE发送失败】userId: {}, token: {}, error: {}", userId, entry.getKey(), e.getMessage());
+                    log.error("{}", sendFailureSummary(e));
                     SseEmitter remove = emitters.remove(entry.getKey());
                     if (remove != null) {
                         remove.complete();
@@ -336,11 +341,17 @@ public class SseEmitterManager {
                 }
             }
         } else {
-            log.warn("【SSE发送失败】userId: {} 没有活跃的SSE连接, 当前连接用户: {}", userId, USER_TOKEN_EMITTERS.keySet());
+            log.warn("sse_delivery routeType=USER status=SKIPPED reason=NO_ACTIVE_CONNECTION activeUserCount={}",
+                USER_TOKEN_EMITTERS.size());
             USER_TOKEN_EMITTERS.remove(userId);
         }
     }
 
+    /** This boundary accepts neither routing identifiers nor raw exception text. */
+    static String sendFailureSummary(Exception failure) {
+        return "sse_delivery routeType=USER status=FAILED errorType=" + errorType(failure);
+    }
+
 
     /**
      * 本机全用户会话发送消息
@@ -365,8 +376,7 @@ public class SseEmitterManager {
         broadcastMessage.setSessionId(sseMessageDto.getSessionId());
         broadcastMessage.setEventDto(sseMessageDto.getEventDto());
         RedisUtils.publish(SSE_TOPIC, broadcastMessage, consumer -> {
-            log.info("SSE发送主题订阅消息topic:{} session:{} session keys:{} message:{}",
-                SSE_TOPIC, sseMessageDto.getSessionId(), sseMessageDto.getUserIds(), sseMessageDto.getMessage());
+            log.info("{}", publishSummary(sseMessageDto));
         });
     }
 
@@ -379,7 +389,56 @@ public class SseEmitterManager {
         SseMessageDto broadcastMessage = new SseMessageDto();
         broadcastMessage.setMessage(message);
         RedisUtils.publish(SSE_TOPIC, broadcastMessage, consumer -> {
-            log.info("SSE发送主题订阅消息topic:{} message:{}", SSE_TOPIC, message);
+            log.info("sse_publish routeType=BROADCAST recipientCount=-1 payloadChars={} eventType=none",
+                textLength(message));
         });
     }
+
+    static String publishSummary(SseMessageDto message) {
+        if (message == null) {
+            return "sse_publish routeType=UNKNOWN recipientCount=0 payloadChars=0 eventType=none";
+        }
+        String routeType;
+        int recipientCount;
+        if (message.getSessionId() != null && !message.getSessionId().isBlank()) {
+            routeType = "SESSION";
+            recipientCount = 1;
+        } else if (message.getUserIds() != null && !message.getUserIds().isEmpty()) {
+            routeType = "USER";
+            recipientCount = message.getUserIds().size();
+        } else {
+            routeType = "BROADCAST";
+            recipientCount = -1;
+        }
+        return "sse_publish routeType=" + routeType
+            + " recipientCount=" + recipientCount
+            + " payloadChars=" + (textLength(message.getMessage()) + eventPayloadLength(message.getEventDto()))
+            + " eventType=" + safeEventType(message.getEventDto());
+    }
+
+    static String safeEventType(SseEventDto event) {
+        if (event == null || event.getEvent() == null) {
+            return "none";
+        }
+        return switch (event.getEvent()) {
+            case "content", "reasoning", "done", "error", "mcp_tool", "message" -> event.getEvent();
+            default -> "custom";
+        };
+    }
+
+    private static int eventPayloadLength(SseEventDto event) {
+        if (event == null) {
+            return 0;
+        }
+        return textLength(event.getContent()) + textLength(event.getReasoningContent())
+            + textLength(event.getError());
+    }
+
+    private static int textLength(String value) {
+        return value == null ? 0 : value.length();
+    }
+
+    private static String errorType(Throwable failure) {
+        return failure == null ? "unknown" : failure.getClass().getName();
+    }
 }

ruoyi-common/ruoyi-common-sse/src/main/java/org/ruoyi/common/sse/listener/SseTopicListener.java

@@ -30,8 +30,7 @@ public class SseTopicListener implements ApplicationRunner, Ordered {
     @Override
     public void run(ApplicationArguments args) throws Exception {
         sseEmitterManager.subscribeMessage((message) -> {
-            log.info("SSE主题订阅收到消息session:{} session keys={} message={}",
-                message.getSessionId(), message.getUserIds(), message.getMessage());
+            log.info("{}", deliverySummary(message));
             // 优先按会话路由（对话流式响应）
             if (StrUtil.isNotBlank(message.getSessionId())) {
                 if (message.getEventDto() != null) {
@@ -59,4 +58,44 @@ public class SseTopicListener implements ApplicationRunner, Ordered {
     public int getOrder() {
         return -1;
     }
+
+    static String deliverySummary(SseMessageDto message) {
+        if (message == null) {
+            return "sse_subscription status=RECEIVED routeType=UNKNOWN recipientCount=0 payloadChars=0 eventType=none";
+        }
+        String routeType;
+        int recipientCount;
+        if (StrUtil.isNotBlank(message.getSessionId())) {
+            routeType = "SESSION";
+            recipientCount = 1;
+        } else if (CollUtil.isNotEmpty(message.getUserIds())) {
+            routeType = "USER";
+            recipientCount = message.getUserIds().size();
+        } else {
+            routeType = "BROADCAST";
+            recipientCount = -1;
+        }
+        int payloadChars = textLength(message.getMessage());
+        String eventType = "none";
+        if (message.getEventDto() != null) {
+            payloadChars += textLength(message.getEventDto().getContent())
+                + textLength(message.getEventDto().getReasoningContent())
+                + textLength(message.getEventDto().getError());
+            String rawEventType = message.getEventDto().getEvent();
+            if (rawEventType != null) {
+                eventType = switch (rawEventType) {
+                    case "content", "reasoning", "done", "error", "mcp_tool", "message" -> rawEventType;
+                    default -> "custom";
+                };
+            }
+        }
+        return "sse_subscription status=RECEIVED routeType=" + routeType
+            + " recipientCount=" + recipientCount
+            + " payloadChars=" + payloadChars
+            + " eventType=" + eventType;
+    }
+
+    private static int textLength(String value) {
+        return value == null ? 0 : value.length();
+    }
 }

ruoyi-common/ruoyi-common-sse/src/main/java/org/ruoyi/common/sse/utils/SseMessageUtils.java

@@ -18,6 +18,7 @@ import org.ruoyi.common.sse.dto.SseMessageDto;
 @NoArgsConstructor(access = AccessLevel.PRIVATE)
 public class SseMessageUtils {
 
+    private static final String SAFE_ERROR_MESSAGE = "请求处理失败，请稍后重试";
     private final static Boolean SSE_ENABLE = SpringUtils.getProperty("sse.enabled", Boolean.class, true);
     private static SseEmitterManager MANAGER;
 
@@ -196,7 +197,7 @@ public class SseMessageUtils {
      * @param error  错误信息
      */
     public static void sendError(Long userId, String error) {
-        sendEvent(userId, SseEventDto.error(error));
+        sendEvent(userId, SseEventDto.error(SAFE_ERROR_MESSAGE));
     }
 
     /**
@@ -206,7 +207,7 @@ public class SseMessageUtils {
      * @param error     错误信息
      */
     public static void sendError(String sessionId, String error) {
-        sendEvent(sessionId, SseEventDto.error(error));
+        sendEvent(sessionId, SseEventDto.error(SAFE_ERROR_MESSAGE));
     }
 
     /**

ruoyi-common/ruoyi-common-trace/src/main/java/org/ruoyi/common/trace/core/DefaultTraceStreamSpan.java

@@ -65,7 +65,12 @@ public class DefaultTraceStreamSpan implements TraceStreamSpan {
             traceRecordService.finishNode(traceId, nodeId, status, errorMessage, outputPayload,
                 new Date(), System.currentTimeMillis() - startMillis);
         } catch (Exception e) {
-            log.warn("结束 trace stream span 失败，traceId={}, nodeId={}", traceId, nodeId, e);
+            log.warn("trace_persistence operation=FINISH_STREAM_NODE status=FAILED traceId={} nodeId={} errorType={}",
+                traceId, nodeId, errorType(e));
         }
     }
+
+    private static String errorType(Throwable error) {
+        return error == null ? "unknown" : error.getClass().getName();
+    }
 }

ruoyi-common/ruoyi-common-trace/src/main/java/org/ruoyi/common/trace/util/TracePayloadUtils.java

@@ -37,9 +37,14 @@ public final class TracePayloadUtils {
         if (throwable == null) {
             return null;
         }
-        int maxLength = properties == null ? 1000 : properties.getPayload().getMaxErrorLength();
-        String message = throwable.getClass().getSimpleName() + ": " + (throwable.getMessage() == null ? "" : throwable.getMessage());
-        return truncate(message, maxLength);
+        int maxLength = properties == null || properties.getPayload() == null
+            ? 1000 : properties.getPayload().getMaxErrorLength();
+        // Trace payloads are durable, operator-visible records. Provider exception messages can
+        // carry prompts, credentials, SQL, file-system paths, or response bodies, so this boundary
+        // must never read or retain Throwable#getMessage(). The exception type is sufficient for
+        // classification and remains useful without persisting untrusted content.
+        String summary = "TRACE_FAILURE errorType=" + throwable.getClass().getName();
+        return truncate(summary, maxLength);
     }
 
     public static String toJson(Object value) {

ruoyi-common/ruoyi-common-trace/src/test/java/org/ruoyi/common/trace/core/DefaultTraceStreamSpanTest.java

@@ -1,6 +1,10 @@
 package org.ruoyi.common.trace.core;
 
+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
 import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Tag;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.ArgumentCaptor;
@@ -9,11 +13,14 @@ import org.mockito.junit.jupiter.MockitoExtension;
 import org.ruoyi.common.trace.config.TraceProperties;
 import org.ruoyi.common.trace.constant.TraceConstants;
 import org.ruoyi.common.trace.service.TraceRecordService;
+import org.slf4j.LoggerFactory;
 
 import java.util.Date;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyLong;
 import static org.mockito.ArgumentMatchers.eq;
@@ -23,6 +30,7 @@ import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
 
 @ExtendWith(MockitoExtension.class)
+@Tag("dev")
 class DefaultTraceStreamSpanTest {
 
     @Mock
@@ -45,17 +53,18 @@ class DefaultTraceStreamSpanTest {
     }
 
     @Test
-    void finishErrorShouldRecordTruncatedError() {
+    void finishErrorShouldRecordOnlyBoundedExceptionType() {
         TraceProperties properties = new TraceProperties();
-        properties.getPayload().setMaxErrorLength(8);
+        properties.getPayload().setMaxErrorLength(200);
         DefaultTraceStreamSpan span = new DefaultTraceStreamSpan(traceRecordService, properties, "trace-1", "node-1", System.currentTimeMillis());
 
-        span.finishError(new IllegalStateException("abcdef"));
+        span.finishError(new IllegalStateException("provider-credential-path-canary"));
 
         ArgumentCaptor<String> errorCaptor = ArgumentCaptor.forClass(String.class);
         verify(traceRecordService).finishNode(eq("trace-1"), eq("node-1"), eq(TraceConstants.STATUS_ERROR),
             errorCaptor.capture(), isNull(), any(Date.class), anyLong());
-        assertEquals("IllegalS", errorCaptor.getValue());
+        assertEquals("TRACE_FAILURE errorType=java.lang.IllegalStateException", errorCaptor.getValue());
+        assertFalse(errorCaptor.getValue().contains("provider-credential-path-canary"));
     }
 
     @Test
@@ -72,12 +81,38 @@ class DefaultTraceStreamSpanTest {
 
     @Test
     void writeFailureShouldNotEscape() {
-        doThrow(new IllegalStateException("db down")).when(traceRecordService)
+        Logger logger = (Logger) LoggerFactory.getLogger(DefaultTraceStreamSpan.class);
+        ListAppender<ILoggingEvent> appender = attach(logger);
+        doThrow(new IllegalStateException("trace-storage-credential-canary")).when(traceRecordService)
             .finishNode(eq("trace-1"), eq("node-1"), eq(TraceConstants.STATUS_SUCCESS), isNull(), isNull(), any(Date.class), anyLong());
         DefaultTraceStreamSpan span = new DefaultTraceStreamSpan(traceRecordService, new TraceProperties(), "trace-1", "node-1", System.currentTimeMillis());
 
-        span.finishSuccess();
+        try {
+            span.finishSuccess();
 
-        assertNull(TraceContext.currentNodeId());
+            String logs = formattedLogs(appender);
+            assertNull(TraceContext.currentNodeId());
+            assertFalse(logs.contains("trace-storage-credential-canary"));
+            assertTrue(logs.contains("java.lang.IllegalStateException"));
+        } finally {
+            detach(logger, appender);
+        }
+    }
+
+    private static ListAppender<ILoggingEvent> attach(Logger logger) {
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        return appender;
+    }
+
+    private static void detach(Logger logger, ListAppender<ILoggingEvent> appender) {
+        logger.detachAppender(appender);
+        appender.stop();
+    }
+
+    private static String formattedLogs(ListAppender<ILoggingEvent> appender) {
+        return appender.list.stream().map(ILoggingEvent::getFormattedMessage)
+            .reduce("", (left, right) -> left + "\n" + right);
     }
 }

ruoyi-common/ruoyi-common-trace/src/test/java/org/ruoyi/common/trace/util/TracePayloadUtilsTest.java

@@ -1,13 +1,18 @@
 package org.ruoyi.common.trace.util;
 
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Tag;
+import org.ruoyi.common.trace.config.TraceProperties;
 
 import java.util.Map;
+import java.util.concurrent.atomic.AtomicBoolean;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
+@Tag("dev")
 class TracePayloadUtilsTest {
 
     @Test
@@ -25,4 +30,25 @@ class TracePayloadUtilsTest {
         String json = TracePayloadUtils.toJson(Map.of("count", 2));
         assertTrue(json.contains("\"count\":2"));
     }
+
+    @Test
+    void errorShouldPersistOnlyTypeWithoutReadingThrowableMessage() {
+        AtomicBoolean messageRead = new AtomicBoolean();
+        Throwable failure = new IllegalStateException() {
+            @Override
+            public String getMessage() {
+                messageRead.set(true);
+                return "provider-credential-path-canary";
+            }
+        };
+
+        String summary = TracePayloadUtils.error(failure, new TraceProperties());
+        TraceProperties missingPayloadPolicy = new TraceProperties();
+        missingPayloadPolicy.setPayload(null);
+
+        assertFalse(messageRead.get());
+        assertEquals("TRACE_FAILURE errorType=" + failure.getClass().getName(), summary);
+        assertEquals(summary, TracePayloadUtils.error(failure, missingPayloadPolicy));
+        assertFalse(summary.contains("provider-credential-path-canary"));
+    }
 }

ruoyi-common/ruoyi-common-web/pom.xml

@@ -52,6 +52,12 @@
             <groupId>cn.hutool</groupId>
             <artifactId>hutool-crypto</artifactId>
         </dependency>
+
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-test</artifactId>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 
 </project>

ruoyi-common/ruoyi-common-web/src/main/java/org/ruoyi/common/web/handler/GlobalExceptionHandler.java

@@ -5,16 +5,14 @@ import cn.hutool.http.HttpStatus;
 import com.fasterxml.jackson.core.JsonParseException;
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
-import jakarta.validation.ConstraintViolation;
 import jakarta.validation.ConstraintViolationException;
 import lombok.extern.slf4j.Slf4j;
 import org.ruoyi.common.core.domain.R;
 import org.ruoyi.common.core.exception.ServiceException;
 import org.ruoyi.common.core.exception.SseException;
 import org.ruoyi.common.core.exception.base.BaseException;
-import org.ruoyi.common.core.utils.StreamUtils;
 import org.ruoyi.common.json.utils.JsonUtils;
-import org.springframework.context.support.DefaultMessageSourceResolvable;
+import org.ruoyi.common.web.utils.SafeRequestLogUtils;
 import org.springframework.http.converter.HttpMessageNotReadableException;
 import org.springframework.validation.BindException;
 import org.springframework.web.HttpRequestMethodNotSupportedException;
@@ -38,15 +36,18 @@ import java.io.IOException;
 @RestControllerAdvice
 public class GlobalExceptionHandler {
 
+    private static final String SAFE_SERVICE_ERROR_MESSAGE = "请求处理失败";
+    private static final String SAFE_VALIDATION_ERROR_MESSAGE = "请求参数校验失败";
+
     /**
      * 请求方式不支持
      */
     @ExceptionHandler(HttpRequestMethodNotSupportedException.class)
     public R<Void> handleHttpRequestMethodNotSupported(HttpRequestMethodNotSupportedException e,
                                                                 HttpServletRequest request) {
-        String requestURI = request.getRequestURI();
+        String requestURI = safeUri(request);
         log.error("请求地址'{}',不支持'{}'请求", requestURI, e.getMethod());
-        return R.fail(HttpStatus.HTTP_BAD_METHOD, e.getMessage());
+        return R.fail(HttpStatus.HTTP_BAD_METHOD, "请求方式不支持");
     }
 
     /**
@@ -54,9 +55,11 @@ public class GlobalExceptionHandler {
      */
     @ExceptionHandler(ServiceException.class)
     public R<Void> handleServiceException(ServiceException e, HttpServletRequest request) {
-        log.error(e.getMessage());
+        log.error("request_failure category=SERVICE_EXCEPTION errorType={}", e.getClass().getName());
         Integer code = e.getCode();
-        return ObjectUtil.isNotNull(code) ? R.fail(code, e.getMessage()) : R.fail(e.getMessage());
+        return ObjectUtil.isNotNull(code)
+            ? R.fail(code, SAFE_SERVICE_ERROR_MESSAGE)
+            : R.fail(SAFE_SERVICE_ERROR_MESSAGE);
     }
 
     /**
@@ -65,8 +68,8 @@ public class GlobalExceptionHandler {
     @ResponseStatus(org.springframework.http.HttpStatus.UNAUTHORIZED)
     @ExceptionHandler(SseException.class)
     public String handleNotLoginException(SseException e, HttpServletRequest request) {
-        String requestURI = request.getRequestURI();
-        log.debug("请求地址'{}',认证失败'{}',无法访问系统资源", requestURI, e.getMessage());
+        String requestURI = safeUri(request);
+        log.debug("请求地址'{}',认证失败,无法访问系统资源", requestURI);
         return JsonUtils.toJsonString(R.fail(HttpStatus.HTTP_UNAUTHORIZED, "认证失败，无法访问系统资源"));
     }
 
@@ -75,9 +78,9 @@ public class GlobalExceptionHandler {
      */
     @ExceptionHandler(ServletException.class)
     public R<Void> handleServletException(ServletException e, HttpServletRequest request) {
-        String requestURI = request.getRequestURI();
-        log.error("请求地址'{}',发生未知异常.", requestURI, e);
-        return R.fail(e.getMessage());
+        String requestURI = safeUri(request);
+        log.error("请求地址'{}',发生 Servlet 异常: {}", requestURI, e.getClass().getSimpleName());
+        return internalError();
     }
 
     /**
@@ -85,8 +88,8 @@ public class GlobalExceptionHandler {
      */
     @ExceptionHandler(BaseException.class)
     public R<Void> handleBaseException(BaseException e, HttpServletRequest request) {
-        log.error(e.getMessage());
-        return R.fail(e.getMessage());
+        log.error("request_failure category=BASE_EXCEPTION errorType={}", e.getClass().getName());
+        return R.fail(SAFE_SERVICE_ERROR_MESSAGE);
     }
 
     /**
@@ -94,9 +97,9 @@ public class GlobalExceptionHandler {
      */
     @ExceptionHandler(MissingPathVariableException.class)
     public R<Void> handleMissingPathVariableException(MissingPathVariableException e, HttpServletRequest request) {
-        String requestURI = request.getRequestURI();
+        String requestURI = safeUri(request);
         log.error("请求路径中缺少必需的路径变量'{}',发生系统异常.", requestURI);
-        return R.fail(String.format("请求路径中缺少必需的路径变量[%s]", e.getVariableName()));
+        return R.fail("请求路径参数缺失");
     }
 
     /**
@@ -104,9 +107,9 @@ public class GlobalExceptionHandler {
      */
     @ExceptionHandler(MethodArgumentTypeMismatchException.class)
     public R<Void> handleMethodArgumentTypeMismatchException(MethodArgumentTypeMismatchException e, HttpServletRequest request) {
-        String requestURI = request.getRequestURI();
+        String requestURI = safeUri(request);
         log.error("请求参数类型不匹配'{}',发生系统异常.", requestURI);
-        return R.fail(String.format("请求参数类型不匹配，参数[%s]要求类型为：'%s'，但输入值为：'%s'", e.getName(), e.getRequiredType().getName(), e.getValue()));
+        return R.fail("请求参数类型不匹配");
     }
 
     /**
@@ -114,9 +117,9 @@ public class GlobalExceptionHandler {
      */
     @ExceptionHandler(NoHandlerFoundException.class)
     public R<Void> handleNoHandlerFoundException(NoHandlerFoundException e, HttpServletRequest request) {
-        String requestURI = request.getRequestURI();
+        String requestURI = safeUri(request);
         log.error("请求地址'{}'不存在.", requestURI);
-        return R.fail(HttpStatus.HTTP_NOT_FOUND, e.getMessage());
+        return R.fail(HttpStatus.HTTP_NOT_FOUND, "请求地址不存在");
     }
 
     /**
@@ -126,7 +129,7 @@ public class GlobalExceptionHandler {
      */
     @ExceptionHandler(IOException.class)
     public R<Void> handleIoException(IOException e, HttpServletRequest request) {
-        String requestURI = request.getRequestURI();
+        String requestURI = safeUri(request);
         if (requestURI.contains("sse")) {
             // sse 经常性连接中断 例如关闭浏览器 直接屏蔽
             return null;
@@ -134,10 +137,12 @@ public class GlobalExceptionHandler {
         // 排除文件下载/导出相关的 IOException，让异常正常传播以便上层处理
         if (requestURI.contains("/export") || requestURI.contains("/download")) {
             // 重新抛出，让调用方处理
-            throw new RuntimeException("文件导出/下载IO异常: " + e.getMessage(), e);
+            log.error("请求地址'{}',文件导出/下载连接中断: {}", requestURI,
+                e.getClass().getSimpleName());
+            return internalError();
         }
-        log.error("请求地址'{}',连接中断", requestURI, e);
-        return R.fail(e.getMessage());
+        log.error("请求地址'{}',连接中断: {}", requestURI, e.getClass().getSimpleName());
+        return internalError();
     }
 
     /**
@@ -152,16 +157,16 @@ public class GlobalExceptionHandler {
      */
     @ExceptionHandler(RuntimeException.class)
     public R<Void> handleRuntimeException(RuntimeException e, HttpServletRequest request) {
-        String requestURI = request.getRequestURI();
+        String requestURI = safeUri(request);
         // 对于文件导出相关异常，不进行封装处理，让原始异常信息传播
         Throwable cause = e.getCause();
         if (requestURI.contains("/export") || requestURI.contains("/download")) {
-            log.error("请求地址'{}',文件导出/下载异常.", requestURI, e);
-            // 对于文件导出，直接返回异常信息，不进行额外封装
-            return R.fail(cause != null ? cause.getMessage() : e.getMessage());
+            log.error("请求地址'{}',文件导出/下载异常: {}", requestURI,
+                cause == null ? e.getClass().getSimpleName() : cause.getClass().getSimpleName());
+            return internalError();
         }
-        log.error("请求地址'{}',发生未知异常.", requestURI, e);
-        return R.fail(e.getMessage());
+        log.error("请求地址'{}',发生未知异常: {}", requestURI, e.getClass().getSimpleName());
+        return internalError();
     }
 
     /**
@@ -169,9 +174,9 @@ public class GlobalExceptionHandler {
      */
     @ExceptionHandler(Exception.class)
     public R<Void> handleException(Exception e, HttpServletRequest request) {
-        String requestURI = request.getRequestURI();
-        log.error("请求地址'{}',发生系统异常.", requestURI, e);
-        return R.fail(e.getMessage());
+        String requestURI = safeUri(request);
+        log.error("请求地址'{}',发生系统异常: {}", requestURI, e.getClass().getSimpleName());
+        return internalError();
     }
 
     /**
@@ -179,9 +184,8 @@ public class GlobalExceptionHandler {
      */
     @ExceptionHandler(BindException.class)
     public R<Void> handleBindException(BindException e) {
-        log.error(e.getMessage());
-        String message = StreamUtils.join(e.getAllErrors(), DefaultMessageSourceResolvable::getDefaultMessage, ", ");
-        return R.fail(message);
+        log.error("请求绑定失败: {}", e.getClass().getSimpleName());
+        return R.fail(SAFE_VALIDATION_ERROR_MESSAGE);
     }
 
     /**
@@ -189,9 +193,8 @@ public class GlobalExceptionHandler {
      */
     @ExceptionHandler(ConstraintViolationException.class)
     public R<Void> constraintViolationException(ConstraintViolationException e) {
-        log.error(e.getMessage());
-        String message = StreamUtils.join(e.getConstraintViolations(), ConstraintViolation::getMessage, ", ");
-        return R.fail(message);
+        log.error("约束校验失败: {}", e.getClass().getSimpleName());
+        return R.fail(SAFE_VALIDATION_ERROR_MESSAGE);
     }
 
     /**
@@ -199,9 +202,8 @@ public class GlobalExceptionHandler {
      */
     @ExceptionHandler(MethodArgumentNotValidException.class)
     public R<Void> handleMethodArgumentNotValidException(MethodArgumentNotValidException e) {
-        log.error(e.getMessage());
-        String message = StreamUtils.join(e.getBindingResult().getAllErrors(), DefaultMessageSourceResolvable::getDefaultMessage, ", ");
-        return R.fail(message);
+        log.error("请求参数校验失败: {}", e.getClass().getSimpleName());
+        return R.fail(SAFE_VALIDATION_ERROR_MESSAGE);
     }
 
     /**
@@ -210,9 +212,9 @@ public class GlobalExceptionHandler {
      */
     @ExceptionHandler(JsonParseException.class)
     public R<Void> handleJsonParseException(JsonParseException e, HttpServletRequest request) {
-        String requestURI = request.getRequestURI();
-        log.error("请求地址'{}' 发生 JSON 解析异常: {}", requestURI, e.getMessage());
-        return R.fail(HttpStatus.HTTP_BAD_REQUEST, "请求数据格式错误（JSON 解析失败）：" + e.getMessage());
+        String requestURI = safeUri(request);
+        log.error("请求地址'{}'发生 JSON 解析异常: {}", requestURI, e.getClass().getSimpleName());
+        return R.fail(HttpStatus.HTTP_BAD_REQUEST, "请求数据格式错误（JSON 解析失败）");
     }
 
     /**
@@ -220,8 +222,16 @@ public class GlobalExceptionHandler {
      */
     @ExceptionHandler(HttpMessageNotReadableException.class)
     public R<Void> handleHttpMessageNotReadableException(HttpMessageNotReadableException e, HttpServletRequest request) {
-        log.error("请求地址'{}', 参数解析失败: {}", request.getRequestURI(), e.getMessage());
-        return R.fail(HttpStatus.HTTP_BAD_REQUEST, "请求参数格式错误：" + e.getMostSpecificCause().getMessage());
+        log.error("请求地址'{}',参数解析失败: {}", safeUri(request), e.getClass().getSimpleName());
+        return R.fail(HttpStatus.HTTP_BAD_REQUEST, "请求参数格式错误");
+    }
+
+    private String safeUri(HttpServletRequest request) {
+        return SafeRequestLogUtils.sanitizeUri(request.getRequestURI());
+    }
+
+    private R<Void> internalError() {
+        return R.fail("系统异常，请联系管理员");
     }
 
 }

ruoyi-common/ruoyi-common-web/src/main/java/org/ruoyi/common/web/interceptor/PlusWebInvokeTimeInterceptor.java

@@ -1,24 +1,16 @@
 package org.ruoyi.common.web.interceptor;
 
-import cn.hutool.core.io.IoUtil;
-import cn.hutool.core.map.MapUtil;
-import cn.hutool.core.util.ObjectUtil;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang3.time.StopWatch;
-import org.ruoyi.common.core.utils.StringUtils;
-import org.ruoyi.common.json.utils.JsonUtils;
-import org.ruoyi.common.web.filter.RepeatedlyRequestWrapper;
-import org.springframework.http.MediaType;
+import org.ruoyi.common.web.utils.SafeRequestLogUtils;
 import org.springframework.web.servlet.HandlerInterceptor;
 import org.springframework.web.servlet.ModelAndView;
 
-import java.io.BufferedReader;
-import java.util.Map;
-
 /**
- * web的调用时间统计拦截器
+ * Web request timing interceptor. Request payloads, form fields and query strings are
+ * deliberately outside this logging boundary.
  *
  * @author Lion Li
  * @since 3.3.0
@@ -26,64 +18,44 @@ import java.util.Map;
 @Slf4j
 public class PlusWebInvokeTimeInterceptor implements HandlerInterceptor {
 
-    private final static ThreadLocal<StopWatch> KEY_CACHE = new ThreadLocal<>();
+    private static final ThreadLocal<StopWatch> KEY_CACHE = new ThreadLocal<>();
 
     @Override
-    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
-        String url = request.getMethod() + " " + request.getRequestURI();
-
-        // 打印请求参数
-        if (isJsonRequest(request)) {
-            String jsonParam = "";
-            if (request instanceof RepeatedlyRequestWrapper) {
-                BufferedReader reader = request.getReader();
-                jsonParam = IoUtil.read(reader);
-            }
-            log.info("[PLUS]开始请求 => URL[{}],参数类型[json],参数:[{}]", url, jsonParam);
-        } else {
-            Map<String, String[]> parameterMap = request.getParameterMap();
-            if (MapUtil.isNotEmpty(parameterMap)) {
-                String parameters = JsonUtils.toJsonString(parameterMap);
-                log.info("[PLUS]开始请求 => URL[{}],参数类型[param],参数:[{}]", url, parameters);
-            } else {
-                log.info("[PLUS]开始请求 => URL[{}],无参数", url);
-            }
-        }
-
+    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
         StopWatch stopWatch = new StopWatch();
         KEY_CACHE.set(stopWatch);
         stopWatch.start();
-
+        log.info("[PLUS] request_started method={} path={}", request.getMethod(), safePath(request));
         return true;
     }
 
     @Override
-    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
-
+    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler,
+                           ModelAndView modelAndView) {
+        // Completion metadata is emitted once from afterCompletion.
     }
 
     @Override
-    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
+    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler,
+                                Exception ex) {
         StopWatch stopWatch = KEY_CACHE.get();
-        if (ObjectUtil.isNotNull(stopWatch)) {
-            stopWatch.stop();
-            log.info("[PLUS]结束请求 => URL[{}],耗时:[{}]毫秒", request.getMethod() + " " + request.getRequestURI(), stopWatch.getDuration().toMillis());
+        try {
+            if (stopWatch == null) {
+                return;
+            }
+            if (stopWatch.isStarted() && !stopWatch.isStopped()) {
+                stopWatch.stop();
+            }
+            log.info("[PLUS] request_completed method={} path={} status={} elapsedMs={} outcome={} errorType={}",
+                request.getMethod(), safePath(request), response.getStatus(),
+                stopWatch.getDuration().toMillis(), ex == null ? "SUCCESS" : "FAILED",
+                ex == null ? "none" : ex.getClass().getName());
+        } finally {
             KEY_CACHE.remove();
         }
     }
 
-    /**
-     * 判断本次请求的数据类型是否为json
-     *
-     * @param request request
-     * @return boolean
-     */
-    private boolean isJsonRequest(HttpServletRequest request) {
-        String contentType = request.getContentType();
-        if (contentType != null) {
-            return StringUtils.startsWithIgnoreCase(contentType, MediaType.APPLICATION_JSON_VALUE);
-        }
-        return false;
+    private static String safePath(HttpServletRequest request) {
+        return SafeRequestLogUtils.sanitizeUri(request.getRequestURI());
     }
-
 }

ruoyi-common/ruoyi-common-web/src/main/java/org/ruoyi/common/web/utils/SafeRequestLogUtils.java

@@ -0,0 +1,263 @@
+package org.ruoyi.common.web.utils;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.ruoyi.common.core.utils.StringUtils;
+
+import java.lang.reflect.Array;
+import java.time.temporal.TemporalAccessor;
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.IdentityHashMap;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Set;
+import java.util.regex.Pattern;
+
+/**
+ * Fail-closed boundary for values that may be written to HTTP logs.
+ */
+public final class SafeRequestLogUtils {
+
+    public static final String REDACTED = "[REDACTED]";
+
+    private static final int MAX_URI_LENGTH = 512;
+    private static final int MAX_TEXT_LENGTH = 4096;
+    private static final int MAX_DEPTH = 16;
+    private static final int MAX_COLLECTION_ITEMS = 100;
+    private static final String TRUNCATED = "[TRUNCATED]";
+    private static final String CYCLE = "[CYCLE]";
+    private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
+    private static final Set<String> SECRET_KEYS = Set.of(
+        "token", "tokenid", "accesstoken", "refreshtoken", "authorization",
+        "apikey", "clientsecret", "password", "passwd", "pwd", "secret",
+        "secretkey", "secretaccesskey", "sessiontoken", "jwtsecretkey",
+        "signingkey", "signature", "privatekey", "credential", "credentials"
+    );
+    private static final Pattern ONLINE_TOKEN_PATH = Pattern.compile(
+        "(?i)(/monitor/online/(?:myself/)?)([^/?#;\\s]+)");
+    private static final Pattern MYSELF_TOKEN_PATH = Pattern.compile(
+        "(?i)(/myself/)([^/?#;\\s]+)");
+    private static final Pattern GENERIC_SECRET_PATH = Pattern.compile(
+        "(?i)(/(?:token(?:[-_]?id)?|access[-_]?token|refresh[-_]?token|api[-_]?key)/)"
+            + "([^/?#;\\s]+)");
+    private static final String SECRET_FIELD =
+        "(?:[a-z0-9_-]*(?:token|api[_-]?key|secret|password|passwd|pwd|credential|"
+            + "authorization|signing[_-]?key|signature)[a-z0-9_-]*)";
+    private static final Pattern JSON_SECRET = Pattern.compile(
+        "(?i)(\\\"" + SECRET_FIELD + "\\\"\\s*:\\s*)"
+            + "(?:\\\"(?:\\\\.|[^\\\"])*\\\"|'(?:\\\\.|[^'])*'|"
+            + "\\[[^\\]]*\\]|[^,}\\r\\n]*(?=[,}\\r\\n]|$))");
+    private static final Pattern KEY_VALUE_SECRET = Pattern.compile(
+        "(?i)(\\b" + SECRET_FIELD + "\\b\\s*(?:=|:)\\s*)"
+            + "(?:\\\"(?:\\\\.|[^\\\"])*\\\"|'(?:\\\\.|[^'])*'|"
+            + "[^&,;}\\r\\n]*?(?=\\s+[a-z0-9_-]+\\s*(?:=|:)|[&,;}\\r\\n]|$))");
+    private static final Pattern AUTH_SCHEME = Pattern.compile(
+        "(?i)\\b(?:Bearer|Basic)\\s+[^\\s\\\"'<>]+");
+    private static final Pattern JWT = Pattern.compile(
+        "\\beyJ[A-Za-z0-9_-]{5,}\\.[A-Za-z0-9_-]{5,}(?:\\.[A-Za-z0-9_-]{5,})?\\b");
+    private static final Pattern OPENAI_STYLE_KEY = Pattern.compile(
+        "\\bsk[-_][A-Za-z0-9][A-Za-z0-9._~+/-]{7,}\\b");
+    private static final Pattern URI_PASSWORD = Pattern.compile(
+        "(?i)((?:jdbc:)?[a-z][a-z0-9+.-]*://[^\\s/@:]+:)([^\\s/@]+)(@)");
+
+    private SafeRequestLogUtils() {
+    }
+
+    /**
+     * Keeps only the path portion and removes query/fragment data entirely.
+     */
+    public static String sanitizeUri(String uri) {
+        if (StringUtils.isBlank(uri)) {
+            return uri;
+        }
+        int suffixIndex = firstNonNegative(uri.indexOf('?'), uri.indexOf('#'));
+        String safe = suffixIndex >= 0 ? uri.substring(0, suffixIndex) : uri;
+        safe = ONLINE_TOKEN_PATH.matcher(safe).replaceAll("$1" + REDACTED);
+        safe = MYSELF_TOKEN_PATH.matcher(safe).replaceAll("$1" + REDACTED);
+        safe = GENERIC_SECRET_PATH.matcher(safe).replaceAll("$1" + REDACTED);
+        safe = sanitizeUnstructuredText(safe);
+        return abbreviate(safe, MAX_URI_LENGTH);
+    }
+
+    /**
+     * Sanitizes structured JSON recursively and falls back to bounded text patterns.
+     */
+    public static String sanitizeText(String value) {
+        if (StringUtils.isBlank(value)) {
+            return value;
+        }
+        String trimmed = value.trim();
+        if (looksLikeJson(trimmed)) {
+            try {
+                Object parsed = OBJECT_MAPPER.readValue(trimmed, Object.class);
+                return abbreviate(writeSanitized(parsed), MAX_TEXT_LENGTH);
+            } catch (JsonProcessingException ignored) {
+                // Invalid JSON is still protected by the unstructured boundary below.
+            }
+        }
+        return abbreviate(sanitizeUnstructuredText(value), MAX_TEXT_LENGTH);
+    }
+
+    /**
+     * Recursively sanitizes maps, iterables, arrays, POJOs and JSON-compatible values.
+     */
+    public static String sanitizeObject(Object value) {
+        if (value == null) {
+            return null;
+        }
+        return abbreviate(writeSanitized(value), MAX_TEXT_LENGTH);
+    }
+
+    private static String writeSanitized(Object value) {
+        Object safe = sanitizeValue(value, null, 0, new IdentityHashMap<>());
+        if (safe instanceof String text) {
+            return text;
+        }
+        try {
+            return OBJECT_MAPPER.writeValueAsString(safe);
+        } catch (JsonProcessingException ignored) {
+            return "[UNSERIALIZABLE:" + safeType(value) + "]";
+        }
+    }
+
+    private static Object sanitizeValue(Object value, String fieldName, int depth,
+                                        IdentityHashMap<Object, Boolean> seen) {
+        if (isSecretKey(fieldName)) {
+            return REDACTED;
+        }
+        if (value == null || value instanceof Number || value instanceof Boolean
+            || value instanceof Character || value instanceof Enum<?>) {
+            return value;
+        }
+        if (value instanceof CharSequence text) {
+            return sanitizeUnstructuredText(text.toString());
+        }
+        if (value instanceof Throwable failure) {
+            return "[THROWABLE:" + failure.getClass().getName() + "]";
+        }
+        if (value instanceof Date || value instanceof TemporalAccessor) {
+            return value.toString();
+        }
+        if (depth >= MAX_DEPTH) {
+            return TRUNCATED;
+        }
+        if (seen.put(value, Boolean.TRUE) != null) {
+            return CYCLE;
+        }
+        try {
+            if (value instanceof Map<?, ?> map) {
+                Map<String, Object> safe = new LinkedHashMap<>();
+                int count = 0;
+                for (Map.Entry<?, ?> entry : map.entrySet()) {
+                    if (count++ >= MAX_COLLECTION_ITEMS) {
+                        safe.put(TRUNCATED, TRUNCATED);
+                        break;
+                    }
+                    String key = safeMapKey(entry.getKey());
+                    safe.put(key, sanitizeValue(entry.getValue(), key, depth + 1, seen));
+                }
+                return safe;
+            }
+            if (value instanceof Iterable<?> iterable) {
+                List<Object> safe = new ArrayList<>();
+                int count = 0;
+                for (Object item : iterable) {
+                    if (count++ >= MAX_COLLECTION_ITEMS) {
+                        safe.add(TRUNCATED);
+                        break;
+                    }
+                    safe.add(sanitizeValue(item, null, depth + 1, seen));
+                }
+                return safe;
+            }
+            if (value.getClass().isArray()) {
+                List<Object> safe = new ArrayList<>();
+                int length = Math.min(Array.getLength(value), MAX_COLLECTION_ITEMS);
+                for (int index = 0; index < length; index++) {
+                    safe.add(sanitizeValue(Array.get(value, index), null, depth + 1, seen));
+                }
+                if (Array.getLength(value) > length) {
+                    safe.add(TRUNCATED);
+                }
+                return safe;
+            }
+            try {
+                Object converted = OBJECT_MAPPER.convertValue(value, Object.class);
+                if (converted == value || converted == null) {
+                    return "[OBJECT:" + safeType(value) + "]";
+                }
+                return sanitizeValue(converted, fieldName, depth + 1, seen);
+            } catch (IllegalArgumentException | StackOverflowError ignored) {
+                return "[OBJECT:" + safeType(value) + "]";
+            }
+        } finally {
+            seen.remove(value);
+        }
+    }
+
+    private static String sanitizeUnstructuredText(String value) {
+        String safe = AUTH_SCHEME.matcher(value).replaceAll("[AUTH " + REDACTED + "]");
+        safe = JSON_SECRET.matcher(safe).replaceAll("$1\"" + REDACTED + "\"");
+        safe = KEY_VALUE_SECRET.matcher(safe).replaceAll("$1" + REDACTED);
+        safe = JWT.matcher(safe).replaceAll(REDACTED);
+        safe = OPENAI_STYLE_KEY.matcher(safe).replaceAll(REDACTED);
+        safe = URI_PASSWORD.matcher(safe).replaceAll("$1" + REDACTED + "$3");
+        return safe;
+    }
+
+    private static boolean isSecretKey(String fieldName) {
+        if (fieldName == null) {
+            return false;
+        }
+        String normalized = fieldName.toLowerCase(Locale.ROOT).replaceAll("[^a-z0-9]", "");
+        return SECRET_KEYS.contains(normalized)
+            || normalized.contains("token")
+            || normalized.contains("authorization")
+            || normalized.contains("apikey")
+            || normalized.contains("secret")
+            || normalized.contains("signingkey")
+            || normalized.contains("signature")
+            || normalized.contains("password")
+            || normalized.contains("passwd")
+            || normalized.contains("credential");
+    }
+
+    private static String safeMapKey(Object key) {
+        if (key == null) {
+            return "null";
+        }
+        if (key instanceof CharSequence || key instanceof Number || key instanceof Enum<?>) {
+            return sanitizeUnstructuredText(String.valueOf(key));
+        }
+        return "[KEY:" + safeType(key) + "]";
+    }
+
+    private static boolean looksLikeJson(String value) {
+        return (value.startsWith("{") && value.endsWith("}"))
+            || (value.startsWith("[") && value.endsWith("]"));
+    }
+
+    private static int firstNonNegative(int left, int right) {
+        if (left < 0) {
+            return right;
+        }
+        if (right < 0) {
+            return left;
+        }
+        return Math.min(left, right);
+    }
+
+    private static String safeType(Object value) {
+        return value == null ? "null" : value.getClass().getSimpleName();
+    }
+
+    private static String abbreviate(String value, int maximumLength) {
+        if (value == null || value.length() <= maximumLength) {
+            return value;
+        }
+        return value.substring(0, maximumLength) + "...(truncated)";
+    }
+}

ruoyi-common/ruoyi-common-websocket/pom.xml

@@ -42,5 +42,10 @@
                 </exclusion>
             </exclusions>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-test</artifactId>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 </project>

ruoyi-common/ruoyi-common-websocket/src/main/java/org/ruoyi/common/websocket/handler/PlusWebSocketHandler.java

@@ -89,7 +89,8 @@ public class PlusWebSocketHandler extends AbstractWebSocketHandler {
      */
     @Override
     public void handleTransportError(WebSocketSession session, Throwable exception) throws Exception {
-        log.error("[transport error] sessionId: {} , exception:{}", session.getId(), exception.getMessage());
+        log.error("websocket_transport_failed sessionId={} exceptionType={}", session.getId(),
+            exception.getClass().getName());
     }
 
     /**

ruoyi-common/ruoyi-common-websocket/src/main/java/org/ruoyi/common/websocket/interceptor/PlusWebSocketInterceptor.java

@@ -13,6 +13,7 @@ import org.springframework.web.socket.WebSocketHandler;
 import org.springframework.web.socket.server.HandshakeInterceptor;
 
 import java.util.Map;
+import java.util.regex.Pattern;
 
 import static org.ruoyi.common.websocket.constant.WebSocketConstants.LOGIN_USER_KEY;
 
@@ -24,6 +25,10 @@ import static org.ruoyi.common.websocket.constant.WebSocketConstants.LOGIN_USER_
 @Slf4j
 public class PlusWebSocketInterceptor implements HandshakeInterceptor {
 
+    private static final Pattern CREDENTIAL_PATH_SEGMENT = Pattern.compile(
+        "(?i)(/(?:token(?:[-_]?id)?|access[-_]?token|refresh[-_]?token|api[-_]?key|"
+            + "monitor/online(?:/myself)?|myself)/)([^/?#;\\s]+)");
+
     /**
      * WebSocket握手之前执行的前置处理方法
      *
@@ -54,7 +59,8 @@ public class PlusWebSocketInterceptor implements HandshakeInterceptor {
             attributes.put(LOGIN_USER_KEY, loginUser);
             return true;
         } catch (NotLoginException e) {
-            log.error("WebSocket 认证失败'{}',无法访问系统资源", e.getMessage());
+            log.error("websocket_handshake_failed category=NOT_LOGIN path={} exceptionType={}",
+                safePath(request), e.getClass().getName());
             return false;
         }
     }
@@ -72,4 +78,10 @@ public class PlusWebSocketInterceptor implements HandshakeInterceptor {
         // 在这个方法中可以执行一些握手成功后的后续处理逻辑，比如记录日志或者其他操作
     }
 
+    private static String safePath(ServerHttpRequest request) {
+        String path = request.getURI().getPath();
+        return path == null ? null
+            : CREDENTIAL_PATH_SEGMENT.matcher(path).replaceAll("$1[REDACTED]");
+    }
+
 }

ruoyi-common/ruoyi-common-websocket/src/main/java/org/ruoyi/common/websocket/listener/WebSocketTopicListener.java

@@ -26,7 +26,11 @@ public class WebSocketTopicListener implements ApplicationRunner, Ordered {
     public void run(ApplicationArguments args) throws Exception {
         // 订阅WebSocket消息
         WebSocketUtils.subscribeMessage((message) -> {
-            log.info("WebSocket主题订阅收到消息session keys={} message={}", message.getSessionKeys(), message.getMessage());
+            boolean broadcast = CollUtil.isEmpty(message.getSessionKeys());
+            int recipientCount = broadcast ? WebSocketSessionHolder.getSessionsAll().size()
+                : message.getSessionKeys().size();
+            log.info("websocket_topic_received broadcast={} recipientCount={} payloadLength={}",
+                broadcast, recipientCount, message.getMessage() == null ? 0 : message.getMessage().length());
             // 如果key不为空就按照key发消息 如果为空就群发
             if (CollUtil.isNotEmpty(message.getSessionKeys())) {
                 message.getSessionKeys().forEach(key -> {
@@ -40,7 +44,7 @@ public class WebSocketTopicListener implements ApplicationRunner, Ordered {
                 });
             }
         });
-        log.info("初始化WebSocket主题订阅监听器成功");
+        log.info("websocket_topic_listener_initialized status=SUCCESS");
     }
 
     @Override

ruoyi-common/ruoyi-common-websocket/src/main/java/org/ruoyi/common/websocket/utils/WebSocketUtils.java

@@ -69,8 +69,8 @@ public class WebSocketUtils {
             broadcastMessage.setMessage(webSocketMessage.getMessage());
             broadcastMessage.setSessionKeys(unsentSessionKeys);
             RedisUtils.publish(WEB_SOCKET_TOPIC, broadcastMessage, consumer -> {
-                log.info(" WebSocket发送主题订阅消息topic:{} session keys:{} message:{}",
-                    WEB_SOCKET_TOPIC, unsentSessionKeys, webSocketMessage.getMessage());
+                log.info("websocket_publish topic={} broadcast=false recipientCount={} payloadLength={}",
+                    WEB_SOCKET_TOPIC, unsentSessionKeys.size(), payloadLength(webSocketMessage.getMessage()));
             });
         }
     }
@@ -84,7 +84,8 @@ public class WebSocketUtils {
         WebSocketMessageDto broadcastMessage = new WebSocketMessageDto();
         broadcastMessage.setMessage(message);
         RedisUtils.publish(WEB_SOCKET_TOPIC, broadcastMessage, consumer -> {
-            log.info("WebSocket发送主题订阅消息topic:{} message:{}", WEB_SOCKET_TOPIC, message);
+            log.info("websocket_publish topic={} broadcast=true recipientCount=all payloadLength={}",
+                WEB_SOCKET_TOPIC, payloadLength(message));
         });
     }
 
@@ -120,8 +121,14 @@ public class WebSocketUtils {
             try {
                 session.sendMessage(message);
             } catch (IOException e) {
-                log.error("[send] session({}) 发送消息({}) 异常", session, message, e);
+                log.error("websocket_send_failed sessionId={} payloadType={} payloadLength={} exceptionType={}",
+                    session.getId(), message.getClass().getSimpleName(), message.getPayloadLength(),
+                    e.getClass().getName());
             }
         }
     }
+
+    private static int payloadLength(String message) {
+        return message == null ? 0 : message.length();
+    }
 }