@dream-craft/canvas-agent 0.6.7 → 0.6.8

package/dist/server/http.js

@@ -10,6 +10,28 @@ import { DEFAULT_PORT, ensureSiteWorkspace, loadConfig, saveConfig, updateSiteWo
 import { logger } from "../utils/logger.js";
 import { checkVersions } from "../version-check.js";
 import { SkillStore, SkillStoreError } from "../skills/store.js";
+/** 远程图片转存的体积与耗时上限（防止本地服务被大文件拖垮）。 */
+const REMOTE_IMAGE_MAX_BYTES = 20 * 1024 * 1024;
+const REMOTE_IMAGE_TIMEOUT_MS = 30_000;
+/** 拒绝把转存端点当作访问内网/回环地址的跳板（SSRF 防护）。 */
+function isPrivateHost(hostname) {
+    const host = hostname.toLowerCase();
+    if (host === "localhost" || host === "::1" || host.endsWith(".localhost") || host.endsWith(".local"))
+        return true;
+    if (/^127\./.test(host) || /^10\./.test(host) || /^192\.168\./.test(host) || /^169\.254\./.test(host))
+        return true;
+    const matched = /^172\.(\d{1,3})\./.exec(host);
+    if (matched) {
+        const second = Number(matched[1]);
+        if (second >= 16 && second <= 31)
+            return true;
+    }
+    if (/^0\./.test(host))
+        return true;
+    if (host.includes(":"))
+        return true; // IPv6 字面量（含回环与链路本地）一律拒绝
+    return false;
+}
 /** 启动仅监听本机的 Canvas Agent HTTP 服务。 */
 export function startHttpServer() {
     const config = loadConfig(true);
@@ -176,13 +198,45 @@ export function startHttpServer() {
     app.post("/agent/local-image", route(async (req, res) => {
         const filePath = String(req.body?.path || "");
         if (!path.isAbsolute(filePath) || !/\.(?:avif|gif|jpe?g|png|webp)$/i.test(filePath))
-            return res.status(400).json({ ok: false, error: "图片路径无效" });
+            return void res.status(400).json({ ok: false, error: "图片路径无效" });
         const file = await stat(filePath);
         if (!file.isFile())
-            return res.status(400).json({ ok: false, error: "图片文件无效" });
+            return void res.status(400).json({ ok: false, error: "图片文件无效" });
         res.setHeader("Cache-Control", "no-store");
         res.type(path.extname(filePath)).send(await readFile(filePath));
     }));
+    // 远程图片转存：浏览器直连上游图片常被 CORS 拦下，<img> 能显示但取不到字节，产物无法持久化。
+    // 这里是本地服务端，取字节无跨域限制——不参与任何模型请求转发，模型请求仍直连上游。
+    app.post("/agent/fetch-image", route(async (req, res) => {
+        const raw = String(req.body?.url || "").trim();
+        if (!/^https?:\/\//i.test(raw))
+            return void res.status(400).json({ ok: false, error: "仅支持 http/https 图片地址" });
+        const target = new URL(raw);
+        if (isPrivateHost(target.hostname))
+            return void res.status(400).json({ ok: false, error: "拒绝访问内网地址" });
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), REMOTE_IMAGE_TIMEOUT_MS);
+        try {
+            const response = await fetch(target, { signal: controller.signal, redirect: "follow" });
+            if (!response.ok)
+                return void res.status(502).json({ ok: false, error: `上游返回 ${response.status}` });
+            const contentType = response.headers.get("content-type") || "";
+            if (!contentType.startsWith("image/"))
+                return void res.status(415).json({ ok: false, error: "目标不是图片" });
+            const buffer = Buffer.from(await response.arrayBuffer());
+            if (buffer.byteLength > REMOTE_IMAGE_MAX_BYTES)
+                return void res.status(413).json({ ok: false, error: "图片超过大小上限" });
+            res.setHeader("Cache-Control", "no-store");
+            res.type(contentType).send(buffer);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            res.status(502).json({ ok: false, error: `图片下载失败：${message}` });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }));
     app.post("/api/tools", route(async (req, res) => res.json({ ok: true, result: await session.callTool(req.body?.name, req.body?.input || {}) })));
     app.get("/agent/codex/workspace", (_req, res) => {
         const workspace = ensureSiteWorkspace(config);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dream-craft/canvas-agent",
-  "version": "0.6.7",
+  "version": "0.6.8",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",