新增LLM审计摘要边界

src/lib/llm/__tests__/audit.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, it } from "vitest";
+
+import { createLlmAuditSummary, hashContent } from "../audit";
+
+describe("LLM audit summary", () => {
+  it("hashes content deterministically", async () => {
+    await expect(hashContent("abc")).resolves.toBe(
+      "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",
+    );
+  });
+
+  it("does not retain raw prompt or response", async () => {
+    const summary = await createLlmAuditSummary({
+      provider: "deepseek",
+      model: "deepseek-v4-pro",
+      task: "renwei_copy_optimizer",
+      duration_ms: 12,
+      schema_valid: true,
+      prompt: "完整 prompt 不应长期保存",
+      output: "完整 response 不应长期保存",
+      error_summary: null,
+    });
+
+    expect(summary).toMatchObject({
+      provider: "deepseek",
+      model: "deepseek-v4-pro",
+      task: "renwei_copy_optimizer",
+      duration_ms: 12,
+      schema_valid: true,
+      error_summary: null,
+    });
+    expect(JSON.stringify(summary)).not.toContain("完整 prompt");
+    expect(JSON.stringify(summary)).not.toContain("完整 response");
+    expect(summary.input_hash).toHaveLength(64);
+    expect(summary.output_hash).toHaveLength(64);
+  });
+});

src/lib/llm/__tests__/client.test.ts

@@ -41,6 +41,32 @@ describe("generateValidatedJson", () => {
     expect(result).toEqual({ value: "from-llm" });
   });
 
+  it("emits an audit summary without raw prompt or response", async () => {
+    const audits: unknown[] = [];
+    process.env.LLM_PROVIDER = "deepseek";
+    process.env.DEEPSEEK_API_KEY = "test-key";
+    client.setGenerateJsonForValidation(async () => ({ value: "ok" }));
+
+    const result = await client.generateValidatedJson({
+      schema: z.object({ value: z.string() }),
+      prompt: "raw prompt",
+      task: "unknown",
+      onAuditSummary: (summary) => audits.push(summary),
+    });
+
+    expect(result).toEqual({ value: "ok" });
+    expect(JSON.stringify(audits)).not.toContain("raw prompt");
+    expect(JSON.stringify(audits)).not.toContain("ok");
+    expect(audits).toEqual([
+      expect.objectContaining({
+        task: "unknown",
+        schema_valid: true,
+        input_hash: expect.any(String),
+        output_hash: expect.any(String),
+      }),
+    ]);
+  });
+
   it("throws clearly when the model response fails schema validation", async () => {
     process.env.LLM_PROVIDER = "deepseek";
     process.env.DEEPSEEK_API_KEY = "test-key";