Stop persisting DeepSeek secrets into bucket config

app/config.py

@@ -5,29 +5,88 @@ import os
 logger = logging.getLogger(__name__)
 
 CONFIG_PATH = os.getenv("CONFIG_PATH", "config.json")
+SENSITIVE_ACCOUNT_FIELDS = {"password", "token", "hif_dliq", "hif_leim"}
+
+
+def _account_from_env() -> dict:
+    account = os.getenv("DEEPSEEK_ACCOUNT", "").strip()
+    password = os.getenv("DEEPSEEK_PASSWORD", "").strip()
+    if not account or not password:
+        return {}
+    env_account = {"password": password, "token": ""}
+    if "@" in account:
+        env_account["email"] = account
+    else:
+        env_account["mobile"] = account
+    return env_account
+
+
+def _merge_env_secrets(config: dict) -> dict:
+    merged = dict(config) if isinstance(config, dict) else {}
+
+    api_key = os.getenv("DEEPSEEK_API_KEY", "").strip()
+    if api_key:
+        merged["keys"] = [api_key]
+
+    env_account = _account_from_env()
+    if env_account:
+        accounts = merged.get("accounts")
+        if not isinstance(accounts, list):
+            accounts = []
+        desired_identity = env_account.get("email") or env_account.get("mobile")
+        identity_key = "email" if "email" in env_account else "mobile"
+        replaced = False
+        merged_accounts = []
+        for account in accounts:
+            if not isinstance(account, dict):
+                continue
+            current_identity = account.get("email") or account.get("mobile")
+            if current_identity == desired_identity:
+                updated = dict(account)
+                updated[identity_key] = desired_identity
+                updated["password"] = env_account["password"]
+                merged_accounts.append(updated)
+                replaced = True
+            else:
+                merged_accounts.append(account)
+        if not replaced:
+            merged_accounts.append(env_account)
+        merged["accounts"] = merged_accounts
+
+    return merged
+
+
+def _sanitize_for_persistence(obj):
+    if isinstance(obj, dict):
+        sanitized = {}
+        for key, value in obj.items():
+            if key.startswith("_"):
+                continue
+            if key == "keys":
+                continue
+            if key in SENSITIVE_ACCOUNT_FIELDS:
+                continue
+            sanitized[key] = _sanitize_for_persistence(value)
+        return sanitized
+    if isinstance(obj, list):
+        return [_sanitize_for_persistence(item) for item in obj]
+    return obj
 
 
 def load_config():
     """从 config.json 加载配置，出错则返回空 dict"""
     try:
         with open(CONFIG_PATH, "r", encoding="utf-8") as f:
-            return json.load(f)
+            return _merge_env_secrets(json.load(f))
     except Exception as e:
         logger.warning(f"[load_config] 无法读取配置文件: {e}")
-        return {}
+        return _merge_env_secrets({})
 
 
 def save_config(cfg):
-    """将配置写回 config.json（移除不可序列化的 _session 字段）"""
+    """将配置写回 config.json，但不持久化密钥、密码或会话令牌。"""
     try:
-        # 深拷贝配置，跳过不可序列化的字段
-        def clean(obj):
-            if isinstance(obj, dict):
-                return {k: clean(v) for k, v in obj.items() if not k.startswith("_")}
-            elif isinstance(obj, list):
-                return [clean(item) for item in obj]
-            return obj
-        cfg_clean = clean(cfg)
+        cfg_clean = _sanitize_for_persistence(cfg)
         with open(CONFIG_PATH, "w", encoding="utf-8") as f:
             json.dump(cfg_clean, f, ensure_ascii=False, indent=2)
     except Exception as e:

start_hf.py

@@ -5,40 +5,22 @@ import sys
 from pathlib import Path
 
 
-def _account_from_env() -> dict:
-    account = os.getenv("DEEPSEEK_ACCOUNT", "").strip()
-    password = os.getenv("DEEPSEEK_PASSWORD", "").strip()
-    if not account or not password:
-        return {}
-    account_config = {"password": password, "token": ""}
-    if "@" in account:
-        account_config["email"] = account
-    else:
-        account_config["mobile"] = account
-    return account_config
+SENSITIVE_FIELDS = {"keys", "password", "token", "hif_dliq", "hif_leim"}
 
 
-def _merge_account(existing_accounts: list[dict], desired_account: dict) -> list[dict]:
-    if not desired_account:
-        return existing_accounts
-    desired_identity = desired_account.get("email") or desired_account.get("mobile")
-    identity_key = "email" if "email" in desired_account else "mobile"
-    merged = []
-    replaced = False
-    for account in existing_accounts:
-        current_identity = account.get("email") or account.get("mobile")
-        if current_identity == desired_identity:
-            updated = dict(account)
-            updated[identity_key] = desired_identity
-            updated["password"] = desired_account["password"]
-            updated.setdefault("token", "")
-            merged.append(updated)
-            replaced = True
-        else:
-            merged.append(account)
-    if not replaced:
-        merged.append(desired_account)
-    return merged
+def _sanitize_for_persistence(obj):
+    if isinstance(obj, dict):
+        sanitized = {}
+        for key, value in obj.items():
+            if key.startswith("_"):
+                continue
+            if key in SENSITIVE_FIELDS:
+                continue
+            sanitized[key] = _sanitize_for_persistence(value)
+        return sanitized
+    if isinstance(obj, list):
+        return [_sanitize_for_persistence(item) for item in obj]
+    return obj
 
 
 def prepare_runtime_files() -> None:
@@ -57,19 +39,8 @@ def prepare_runtime_files() -> None:
         except Exception:
             config = {}
 
-    api_key = os.getenv("DEEPSEEK_API_KEY", "").strip()
-    if api_key:
-        config["keys"] = [api_key]
-    else:
-        config.setdefault("keys", [])
-
-    existing_accounts = config.get("accounts")
-    if not isinstance(existing_accounts, list):
-        existing_accounts = []
-    config["accounts"] = _merge_account(existing_accounts, _account_from_env())
-
     config_path.write_text(
-        json.dumps(config, ensure_ascii=False, indent=2),
+        json.dumps(_sanitize_for_persistence(config), ensure_ascii=False, indent=2),
         encoding="utf-8",
     )
     db_path.touch(exist_ok=True)