Troubleshooting and Security

故障排查与安全边界

Troubleshooting and Security Boundaries

首页 · 宿主集成 · 工具链

模块找不到或相对路径错误

检查 @module 是否为第一条有效语句、入口路径是否相对 Resolver 根，以及 import / include 的目标是否位于 Resolver 可见范围。自定义 Resolver 必须按导入来源处理相对路径，不能只按当前工作目录解析。

Check that @module is the first effective statement, that the entry path is relative to the Resolver root, and that the import / include target is visible to the Resolver. A custom resolver must resolve relative paths from the importing source, not merely from the current working directory.

构建成功但执行失败

先记录 AuroraRuntimeException、脚本调用栈、入口模块名和方法名。确认导出函数名正确、Domain 尚未释放、宿主全局已在创建 Domain 时注入，以及调用参数可以转换为 ScriptDatum。

First record the AuroraRuntimeException, script stack, entry module name, and method name. Confirm the export name is correct, the domain has not been disposed, host globals were injected when the domain was created, and call arguments can convert to ScriptDatum.

编辑器没有补全或跳转

确认工作区根目录正确、Language Server 已启动且未向 stdout 写入额外日志。若名称来自宿主，添加可见的 @global(); 声明文件；该文件仅用于静态分析，不会创建运行时全局。

Confirm the workspace root is correct, the Language Server has started, and no extra log text is written to stdout. If a name comes from the host, add a visible @global(); declaration file; it is for static analysis only and does not create a runtime global.

MCP 无法启动或调用

先在终端运行 aurora-mcp，确认命令可被找到。MCP 使用 stdin/stdout 传输 JSON-RPC；不要在该通道插入启动日志。对本地发布的可执行文件，使用绝对路径并显式设置工作目录。

Run aurora-mcp in a terminal first to confirm the command can be found. MCP uses stdin/stdout for JSON-RPC; do not insert startup logs into that channel. For a locally published executable, use an absolute path and set a working directory explicitly.

运行不可信脚本

AuroraScript 是嵌入式执行引擎，不应被视为安全沙箱。不要向不可信脚本注册能够访问文件系统、网络、进程、反射、环境变量或敏感业务对象的 CLR 类型；也不要把敏感状态直接写入 $state 或可枚举宿主全局。

AuroraScript is an embedded execution engine and must not be treated as a security sandbox. Do not register CLR types that can access the file system, network, processes, reflection, environment variables, or sensitive business objects to untrusted scripts; do not put sensitive state directly in $state or enumerable host globals.

推荐的隔离方式

• 为每次租户、请求或规则会话创建独立的 ScriptDomain。
• 仅暴露窄小、显式审核过的 CLR 包装类型和函数。
• 将 Source Resolver 根限制在允许的目录或内存来源。
• 对脚本大小、执行时间和并发策略设置宿主侧限制。
• 在部署前使用 aurora_check_script、aurora_check_file 和项目测试验证脚本。

• Create an isolated ScriptDomain for each tenant, request, or rule session.
• Expose only narrow, explicitly reviewed CLR wrapper types and functions.
• Restrict Source Resolver roots to allowed directories or memory sources.
• Enforce host-side limits for script size, execution time, and concurrency.
• Validate scripts with aurora_check_script, aurora_check_file, and project tests before deployment.