```

feat(database): 使用SQLite替换MySQL作为默认数据库

将默认数据库从MySQL切换到SQLite以简化本地开发环境配置

BREAKING CHANGE: 数据库连接字符串已从MySQL更改为SQLite格式

---

refactor(audit): 实现敏感数据脱敏功能

添加敏感键名常量定义，并实现递归脱敏函数，
确保审计日志中不会泄露敏感信息如API密钥、密码等

---

fix(legacy-mysql): 修复查询参数限制验证和注入漏洞

增强只读查询参数处理逻辑，添加类型验证并防止SQL注入
同时修复参数限制数值越界问题

---

test(smoke): 增加审计脱敏和审批流程测试用例

添加审计日志脱敏验证测试和审批决策流程测试，
确保敏感数据不会被记录到审计日志中

---

chore(config): 添加Ruff缓存目录到忽略列表

更新.gitignore和.dockerignore文件，
添加.ruff_cache/目录到忽略列表以避免提交临时文件

---

build(deps): 添加Ruff依赖项到环境配置

在environment.yml中添加ruff==0.8.4依赖项，
并在pyproject.toml中配置相关忽略规则

---

refactor(approval): 移除审批创建中的冗余字段

从ApprovalDecision模型中移除不必要的approver字段，
简化审批决策接口设计

---

refactor(database): 明确数据库模块导出接口

为app/core/database.py添加__all__列表，
明确指定模块对外暴露的公共接口
```

app/modules/audit/constants.py

@@ -39,3 +39,23 @@ class AuditTargetType(StrEnum):
 
 class AuditStatus(StrEnum):
     SUCCESS = "success"
+
+
+AUDIT_REDACTED_VALUE = "[REDACTED]"
+AUDIT_SENSITIVE_KEYS = frozenset(
+    {
+        "authorization",
+        "api_key",
+        "apikey",
+        "access_token",
+        "tenant_access_token",
+        "token",
+        "secret",
+        "password",
+        "openclaw_gateway_token",
+        "hermes_api_key",
+        "direct_llm_api_key",
+        "feishu_app_secret",
+        "feishu_verification_token",
+    }
+)

app/modules/audit/service.py

@@ -5,10 +5,28 @@ from sqlalchemy import select
 from sqlalchemy.orm import Session
 
 from app.core.pagination import bounded_limit
+from app.modules.audit.constants import AUDIT_REDACTED_VALUE, AUDIT_SENSITIVE_KEYS
 from app.modules.audit.models import AuditLog
 from app.modules.audit.schemas import AuditLogCreate
 
 
+def _redact(value: Any) -> Any:
+    if isinstance(value, dict):
+        safe: dict[str, Any] = {}
+        for key, item in value.items():
+            key_text = str(key)
+            if key_text.lower() in AUDIT_SENSITIVE_KEYS:
+                safe[key_text] = AUDIT_REDACTED_VALUE
+            else:
+                safe[key_text] = _redact(item)
+        return safe
+    if isinstance(value, list):
+        return [_redact(item) for item in value]
+    if isinstance(value, tuple):
+        return [_redact(item) for item in value]
+    return value
+
+
 def _dump(value: Any | None) -> str | None:
     """Serialize audit payloads while preserving existing strings."""
 
@@ -16,7 +34,7 @@ def _dump(value: Any | None) -> str | None:
         return None
     if isinstance(value, str):
         return value
-    return json.dumps(value, ensure_ascii=False, default=str)
+    return json.dumps(_redact(value), ensure_ascii=False, default=str)
 
 
 class AuditService: