修复异常 security 配置导致接口崩溃 (#88)

app.py

@@ -412,13 +412,20 @@ def settings_config_from_params(params: Dict[str, list], base_config: Dict[str,
 
 def configured_api_token() -> str:
     """Return the optional API write token."""
-    return str(config.get("security", {}).get("api_token", "")).strip()
+    security = config.get("security", {})
+    if not isinstance(security, dict):
+        return ""
+    return str(security.get("api_token", "")).strip()
 
 
 def public_config() -> Dict[str, Any]:
     """Return configuration safe to expose through the read-only config API."""
     safe_config = copy.deepcopy(config)
-    token = str(safe_config.get("security", {}).get("api_token", "")).strip()
+    security = safe_config.get("security", {})
+    if not isinstance(security, dict):
+        safe_config["security"] = {}
+        return safe_config
+    token = str(security.get("api_token", "")).strip()
     if token:
         safe_config.setdefault("security", {})["api_token"] = "<configured>"
     return safe_config

tests/test_vibe_status.py

@@ -551,6 +551,16 @@ def test_public_config_redacts_configured_api_token(self):
         self.assertEqual(safe["security"]["api_token"], "<configured>")
         self.assertEqual(app.config, original_config)
 
+    def test_security_helpers_tolerate_invalid_security_section(self):
+        original_config = app.config
+        try:
+            app.config = {"security": "not-an-object"}
+
+            self.assertEqual(app.configured_api_token(), "")
+            self.assertEqual(app.public_config()["security"], {})
+        finally:
+            app.config = original_config
+
     def test_compute_local_token_usage_sums_recent_last_usage(self):
         codex_home = Path(self.tmpdir.name) / ".codex"
         session_dir = codex_home / "sessions" / "2026" / "05"