v1.4.4

🚀 新增功能

• 原生异步 MCP 治理中心与 AI 赋能：后端构建基于 Model Context Protocol 规范的异步服务端点，原生支持 SSE 直连 (/mcp/sse) 与 Stdio 桥接双模架构；注册 get_asset_profile（按资产类型两阶自适应下钻并具备令牌预算控制）与 get_enterprise_profile（企业生态资产画像分析）两大核心工具；前端上线独立「MCP 治理中心」视图，提供 API 密钥全生命周期管理、毫秒级调用日志流水、令牌预算消耗审计与白名单访问策略看板；配套引入 tools/verify_mcp_pentest.py 自动化测试套件与安全攻防验证用例。
• 集团全生命周期管理与资产组解散划转：重构集团生命周期控制，支持集团注销删除，并提供下属资产组一键解散（剥离集团归属恢复为独立资产组）或划转至其他指定目标集团；配套更新资产组前端交互视图，强化层级隶属认知与危险操作二次确认防呆。
• 扫描器存活探测端口字典解耦：将扫描引擎存活探测基准从硬编码逻辑彻底解耦为外部字典文件 backend/app/dicts/port_alive.txt；剔除高误报与冲突端口（如 843），扩充覆盖现代 Web/API 与微服务框架的常用基准端口，并在系统更新链路内置字典自动填充与格式规范化逻辑。

🛠️ 性能与重构

• 硬件网关 Web 探针韧性与双向服务反哺机制：加固 fetchSite 与 checkHTTP 探针在遭遇硬件网关、反向代理（如 401/403 鉴权拦截、空正文、高延迟）场景下的容错韧性；实现站点探测元数据向底层资产服务的双向反哺闭环，避免因基础网络阻断导致资产服务记录丢失或状态失真。
• 资产检索紧凑布局与大盘单一事实源重构：资产检索页面重构为紧凑栅格布局并支持多维高级筛选栏平滑收折，提升多屏与小尺寸终端显示密度；重构大盘全局任务指标聚合管道，解耦队列排队态与活动执行态计算口径，统一全生命周期状态流转事实源。
• 系统设置视图解耦与分包体积优化：拆分庞大的 SystemSettings.vue 为多个独立模块组件（BackupRestorePanel、CdnRulePanel、SystemUpdatePanel），解耦超长路由并优化前端分包策略，缩短前端生产环境加载耗时。

🐛 问题修复与加固

• WIH 信息泄露巡航监控心跳与详情渲染加固：在长时间运行的 WIH 接口挖掘与监控任务执行期间引入周期性心跳写入机制，杜绝 Celery 调度器因静默超时导致的误判异常；新增接口请求与响应详情抽屉组件，强化敏感字段脱敏与三语国际化渲染。
• 任务管理筛选枚举与状态路由联动修复：修复任务列表多状态组合筛选条件下的路由参数同步逻辑，收敛资产组与企业测绘联动跳转过程中的选项重置异常，确保筛选行为与分页状态保持强一致。
• 老旧 Linux 内核容器兼容性加固：针对部分搭载老旧内核（< 4.19）的主机环境，优化前端 Nginx 容器的基础配置与启动探测逻辑，收敛容器假死与网络命名空间自愈失败问题。

🛡️ 安全与配置

• 数据备份还原暂存沙箱与路径穿越防护：重构备份还原执行引擎，新增 backup_archive.py 与 backup_workers.py 严格校验归档包解压路径与文件名规范，强制在受控临时沙箱内完成解压与结构校验，彻底阻断利用特制压缩包进行目录穿越覆盖宿主机关键文件的安全风险；恢复任务执行期间建立全局防并发互斥锁。
• 会话 Token 优雅生命周期与敏感资源鉴权保护：用户会话 Token 增设 token_expire_at 宽限淘汰机制与 MongoDB 原生 TTL 自动清理索引；引入 AuthenticatedImage 与签名下载凭据 (download_ticket)，对资产截图与系统升级包下载实施严格鉴权；加固 IP 黑名单解析器语法校验与容错异常捕获。
• 生产镜像工具链完善与 GeoIP 预填充机制收敛：Dockerfile.prod 补充包含生产运维必备的 tools/ 脚本套件与 mongodump 二进制依赖；优化 GeoIP 离线数据卷初始化机制，保障离线与弱网部署环境下的容器启动稳定性。

---

🚀 New Features

• Native asynchronous MCP (Model Context Protocol) governance center: introduced standard Model Context Protocol backend endpoints supporting native SSE direct streaming (/mcp/sse) and Stdio bridge dual modes; registered two core intelligence tools: get_asset_profile (two-stage adaptive drill-down by asset category with token budget controls) and get_enterprise_profile (enterprise ecosystem mapping); delivered a dedicated "MCP Center" frontend console featuring API key lifecycle management, sub-millisecond execution audit logging, token consumption dashboards, and whitelist access control; accompanied by automated pentest suites (tools/verify_mcp_pentest.py) and security validation test cases.
• Group scope lifecycle governance with asset group dissolve and transfer: overhauled group entity lifecycle, enabling safe group deletion along with options to either dissolve underlying asset groups (reverting to standalone scope) or transfer them to another designated parent group; upgraded UI hierarchy views and added secondary confirmation guardrails for irreversible operations.
• Externalized alive probe port dictionary: decoupled scanner alive host probing baselines from hardcoded routines into backend/app/dicts/port_alive.txt; purged conflicting high-false-positive ports (such as 843) while appending modern web, API, and microservice baseline ports; integrated automatic file seeding, deduplication, and normalization in the update pipeline.

🛠️ Performance & Refactoring

• Hardware gateway probe resilience and bidirectional service enrichment: enhanced fetchSite and checkHTTP probes to handle hardware gateways and reverse proxies returning 401/403 authorization challenges, empty payloads, or high latency; implemented bidirectional metadata feedback from web probing back into underlying service records to prevent missing assets under restrictive network filtering.
• Asset search compact layout and dashboard single source of truth: refactored the asset search interface into a compact grid layout with a smooth collapsible multi-dimensional filter bar for improved screen density; overhauled dashboard metric aggregation pipelines to decouple queue pending states from active execution counters, enforcing a single source of truth across task lifecycles.
• System settings view modularization and bundle optimization: decomposed the monolithic SystemSettings.vue into focused modular components (BackupRestorePanel, CdnRulePanel, SystemUpdatePanel), decoupling oversized routes and optimizing frontend bundle chunking for faster production loading.

🐛 Bug Fixes & Hardening

• WIH recon heartbeat persistence and detail inspection drawer: implemented periodic heartbeat updates during long-running WIH API discovery runs to prevent scheduler timeouts; added an inspection drawer displaying raw HTTP request paths and response payloads with sensitive data masking and full trilingual localization.
• Task list filter enum synchronization and navigation fixes: fixed route query synchronization when filtering tasks across multiple compound states; rectified option reset glitches during navigation from asset groups or enterprise recon, keeping filter states strictly bound to pagination.
• Legacy Linux kernel container runtime compatibility: refined frontend Nginx container startup probes and configuration profiles for hosts running older kernels (< 4.19), addressing container hang conditions and self-healing startup failures.

🛡️ Security & Configuration

• Backup archive staging sandbox and directory traversal prevention: re-engineered the backup restore engine with backup_archive.py and backup_workers.py to enforce strict archive path and filename verification, isolating decompression within a temporary staging sandbox to eliminate path traversal risks; added global mutual exclusion locks during restore executions.
• Session token expiration lifecycle and sensitive asset authentication: introduced bounded token_expire_at grace periods and MongoDB TTL index auto-cleanup for user session tokens; enforced authentication headers and signed download tickets (download_ticket) for asset screenshot previews and updater binaries; fortified IP blacklist parsing against syntax errors.
• Production image toolchain enrichment and GeoIP population refinement: bundled essential tools/ CLI suites and mongodump binaries inside Dockerfile.prod; refined GeoIP volume pre-population to guarantee smooth container initialization in offline or air-gapped environments.

What's Changed

• fix(security): 修复备份越界、出站请求和认证凭据风险 by @jikdarren in #83
• feat(wih): 展示接口请求与响应详情（#15 第三阶段） by @WeilianC in #82
• fix(wih): 资产 WIH 监控任务执行期间写入心跳 by @WeilianC in #90
• fix: 加固 MCP 治理与备份恢复，兼容企业画像接入 by @jikdarren in #89

Full Changelog: v1.4.3...v1.4.4