@bacnh85/pi-web 0.10.1 → 0.10.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.10.2 (2026-09-13)
+
+### Fixed
+
+- `.gif` downloads inline as `image/gif` (was mislabeled `image/png`).
+- **SSRF guard on gateway-supplied image URLs**: downloads to
+  loopback/private/link-local hosts (e.g. cloud metadata 169.254.169.254)
+  are refused before any request is made — the URL is surfaced instead.
+- **25 MB download cap**: oversized image downloads are not written to disk;
+  the URL is surfaced instead.
+- pi-hub catalog/README description updated to match 0.10.x features.
+
 ## 0.10.1 (2026-09-13)
 
 ### Added

package/extensions/index.ts

@@ -87,13 +87,15 @@ const engineSchema = {
 
 // Saved image file → inline image block (the 0.6.2 vision-loop lesson: the
 // generating model should see its own output).
-async function toImageBlock(file: string): Promise<{ type: "image"; data: string; mimeType: string }> {
+export async function toImageBlock(file: string): Promise<{ type: "image"; data: string; mimeType: string }> {
   const data = (await fs.promises.readFile(file)).toString("base64");
   const lower = file.toLowerCase();
   const mimeType = lower.endsWith(".jpg") || lower.endsWith(".jpeg")
     ? "image/jpeg"
     : lower.endsWith(".webp")
       ? "image/webp"
+      : lower.endsWith(".gif")
+        ? "image/gif"
       : "image/png";
   return { type: "image" as const, data, mimeType };
 }

package/extensions/lib/imageapi.ts

@@ -6,6 +6,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
 import { findEnvValue } from "./config";
+import { isLocalUrl } from "./chrome";
 import {
   describeGeminiError,
   geminiGenerateImage,
@@ -169,6 +170,9 @@ export interface ApiImageResult {
   model?: string;
 }
 
+/** Hard cap on downloaded image size — gateways can point at arbitrary URLs. */
+export const MAX_DOWNLOAD_BYTES = 25 * 1024 * 1024;
+
 export class ImageApiError extends Error {
   constructor(
     public status: number,
@@ -231,6 +235,7 @@ export async function apiGenerateImage(opts: {
     } else if (typeof item?.url === "string" && item.url) {
       // A failed download must not waste the generation: surface the URL.
       try {
+        if (isLocalUrl(item.url)) throw new Error("image host is private/loopback (SSRF-guarded)");
         paths.push(await downloadImage(fetchImpl, item.url, opts.outDir, i, opts.signal, opts.timeoutMs));
       } catch (err) {
         urls.push(item.url);
@@ -265,6 +270,7 @@ async function downloadImage(
   });
   if (!res.ok) throw new ImageApiError(res.status, `image download failed (HTTP ${res.status})`);
   const buf = Buffer.from(await res.arrayBuffer());
+  if (buf.length > MAX_DOWNLOAD_BYTES) throw new Error(`image exceeds the ${MAX_DOWNLOAD_BYTES}-byte download cap`);
   const file = path.join(outDir, `pi-web-image-${randomUUID().slice(0, 8)}-${i}${extFor(url)}`);
   fs.writeFileSync(file, buf);
   return file;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bacnh85/pi-web",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "description": "Pi extension for web search, page extraction, Firecrawl scraping/crawling, Crawl4AI headless browser crawling, Gemini web-tier research, free upstream image generation, and one-off gateway chat.",
   "type": "module",
   "license": "MIT",