@logictan/dsh-imagegen 2.0.3 → 2.0.5

package/lib/index.js

@@ -135,7 +135,7 @@ function installSettingsSectionCompat(ctx, ns, schema, entry, hooks) {
 */
 /** Settings namespace this plugin owns (host settings seam + bridge). */
 const IMAGEGEN_SETTINGS_NAMESPACE = "imagegen";
-/** Same-origin route family (loopback-only, mirroring the dsh-ssh fence). */
+/** Same-origin route family (fenced by the composition's connection service). */
 const SETTINGS_API = {
 	describe: "/api/dsh-imagegen/settings/describe",
 	mutate: "/api/dsh-imagegen/settings/mutate"
@@ -189,7 +189,7 @@ const PROMPT_ENHANCE_API = {
 const IMAGE_MODEL_API = { models: "/api/dsh-imagegen/image-models" };
 /** Host-served built-in provider catalog (channels the user can instantiate). */
 const PRESETS_API = "/api/dsh-imagegen/presets";
-/** Loopback-only image reader for Agent tool-result previews. */
+/** Image reader for Agent tool-result previews (fenced by the connection service). */
 const AGENT_IMAGE_API = "/api/dsh-imagegen/agent-image";
 /** Store the current composer image for the direct edit_image command. */
 const CONVERSATION_IMAGE_API = "/api/dsh-imagegen/conversation-image";
@@ -1967,27 +1967,33 @@ function presetById(id) {
 //#region src/routes.ts
 /** Cap on JSON request bodies (settings ops and generate payloads are small). */
 const MAX_JSON_BODY_BYTES = 24 * 1024 * 1024;
-/** Loopback literal check plus browser same-origin markers (mirrors dsh-ssh). */
-function isLoopbackRequest(request) {
-	const address = request.socket.remoteAddress;
-	if (address !== "127.0.0.1" && address !== "::1" && address !== "::ffff:127.0.0.1") return false;
-	const host = request.headers.host;
-	if (typeof host !== "string") return false;
-	let hostUrl;
-	try {
-		hostUrl = new URL(`http://${host}`);
-	} catch {
-		return false;
-	}
-	if (hostUrl.hostname !== "127.0.0.1" && hostUrl.hostname !== "localhost" && hostUrl.hostname !== "[::1]") return false;
-	if (request.headers["sec-fetch-site"] === "cross-site") return false;
-	const origin = request.headers.origin;
-	if (origin === void 0) return true;
-	try {
-		return new URL(origin).host === hostUrl.host;
-	} catch {
-		return false;
+/**
+* Ask the composition whether one request may be served.
+*
+* `connection.requestRejection` is the deployment's single trust fence: it
+* applies the Host/Origin checks (loopback plus the LAN authorities the
+* deployment declares) and the browser authentication that rides with them.
+* This plugin answers with the verdict instead of re-deriving it, because the
+* declared LAN authorities live in `connection`'s config and a local check
+* cannot see them.
+*
+* A missing `connection` refuses rather than serves: these routes sit in front
+* of Connection's `/api` prefix route, so serving them without its fence would
+* serve them unfenced.
+* @param connection - the composition's Connection service, when it is up.
+* @param req - the incoming request.
+* @param res - the response, written to when the request is refused.
+* @returns whether the request was refused.
+*/
+function refuseUntrusted(connection, req, res) {
+	if (connection === void 0) {
+		writeJson(res, 403, { error: "forbidden" });
+		return true;
 	}
+	const rejection = connection.requestRejection(req);
+	if (rejection === void 0) return false;
+	writeJson(res, rejection, { error: rejection === 401 ? "unauthorized" : "forbidden" });
+	return true;
 }
 /** One JSON response. */
 function writeJson(res, status, body) {
@@ -2277,10 +2283,7 @@ function makeRoutes(deps) {
 		};
 	};
 	const guard = (req, res, method) => {
-		if (!isLoopbackRequest(req)) {
-			writeJson(res, 403, { error: "forbidden: loopback-only" });
-			return false;
-		}
+		if (refuseUntrusted(deps.connection(), req, res)) return false;
 		if (req.method !== method) {
 			writeJson(res, 405, { error: `method not allowed: ${req.method}` });
 			return false;
@@ -2325,10 +2328,7 @@ function makeRoutes(deps) {
 			kind: "prefix",
 			path: AGENT_IMAGE_API,
 			handler: async (req, res) => {
-				if (!isLoopbackRequest(req)) {
-					writeJson(res, 403, { error: "forbidden: loopback-only" });
-					return;
-				}
+				if (refuseUntrusted(deps.connection(), req, res)) return;
 				if (req.method !== "GET") {
 					writeJson(res, 405, { error: `method not allowed: ${req.method}` });
 					return;
@@ -3301,9 +3301,9 @@ const ImageGenSettingsNamespace = settingsNamespaceCompat(IMAGEGEN_SETTINGS_NAME
 * the running fiber instead of remounting the plugin.
 */
 const Config = z.object({
-	enabled: z.boolean().default(true),
-	announceToAgent: z.boolean().default(true),
-	allowAgentImageGeneration: z.boolean().default(true),
+	enabled: z.boolean().default(true).comment("启用插件").description("关闭后生图面板不可用（设置卡片始终可用）"),
+	announceToAgent: z.boolean().default(true).comment("向 Agent 播报本插件").description("开启后，本插件的存在与能力会写入每个 Agent 的系统提示词"),
+	allowAgentImageGeneration: z.boolean().default(true).comment("允许 Agent 调用生图").description("默认开启。关闭后，Agent 无法提交、查询或取消生图任务；侧边栏工作台不受影响。"),
 	channels: z.array(z.object({
 		id: z.string(),
 		preset: z.string().default(""),
@@ -3315,11 +3315,11 @@ const Config = z.object({
 			id: z.string()
 		})).default([])
 	})).default([]),
-	defaultChannelId: z.string().default(""),
-	promptApiUrl: z.string().default(""),
-	promptModel: z.string().default(""),
-	apiUrl: z.string().default(""),
-	imageModels: z.array(z.string()).default([])
+	defaultChannelId: z.string().default("").hidden(),
+	promptApiUrl: z.string().default("").comment("对话 API 地址（可选）").description("OpenAI 兼容基址；留空则复用图像 API 地址。"),
+	promptModel: z.string().default("").comment("对话模型").description("选择或填写支持 /chat/completions 的模型。"),
+	apiUrl: z.string().default("").hidden(),
+	imageModels: z.array(z.string()).default([]).hidden()
 }).volatile();
 /** Schema defaults, re-read for hand-built contexts (the loader applies them normally). */
 const DEFAULT_ENABLED = true;
@@ -3476,6 +3476,7 @@ function apply(ctx, config) {
 		};
 		sctx.effect(() => {
 			const disposers = makeRoutes({
+				connection: () => sctx.get("connection"),
 				settings: seam,
 				credentials: credentialsSeam,
 				resolve: () => {

package/lib/locale-tables.js

@@ -411,8 +411,8 @@ const zh = {
 	"settings.addModelConfirm": "添加",
 	"settings.removeModel": "移除模型",
 	"settings.optional": "可选",
-	"settings.moreOptions": "更多设置",
 	"settings.promptEnhanceTitle": "提示词增强模型",
+	"settings.scalarsTitle": "插件开关与对话模型",
 	"settings.promptEnhanceHint": "用于将简短描述扩写为更完整的生图提示词；留空的地址和密钥会复用生图配置。",
 	"settings.promptApiUrl": "对话 API 地址（可选）",
 	"settings.promptApiUrlHint": "OpenAI 兼容基址；留空则复用图像 API 地址。",
@@ -433,9 +433,6 @@ const zh = {
 	"settings.allowAgentImageGenerationHint": "默认开启。关闭后，Agent 无法提交、查询或取消生图任务；侧边栏工作台不受影响。",
 	"settings.enabled": "启用插件",
 	"settings.enabledHint": "关闭后生图面板不可用（设置卡片始终可用）",
-	"settings.save": "保存",
-	"settings.saving": "保存中…",
-	"settings.discard": "放弃修改",
 	"settings.unsaved": "有未保存的修改",
 	"settings.saveFailed": "保存失败，请重试",
 	"settings.readOnly": "当前设置文档为只读，无法保存。",
@@ -1170,8 +1167,8 @@ const IMAGEGEN_DICTIONARIES = {
 		"settings.addModelConfirm": "Add",
 		"settings.removeModel": "Remove model",
 		"settings.optional": "Optional",
-		"settings.moreOptions": "More settings",
 		"settings.promptEnhanceTitle": "Prompt enhancement model",
+		"settings.scalarsTitle": "Plugin switches and chat model",
 		"settings.promptEnhanceHint": "Expands short requests into complete image prompts. Blank URL and key reuse the image API configuration.",
 		"settings.promptApiUrl": "Chat API URL (optional)",
 		"settings.promptApiUrlHint": "OpenAI-compatible base URL. Leave blank to reuse the image API URL.",
@@ -1192,9 +1189,6 @@ const IMAGEGEN_DICTIONARIES = {
 		"settings.allowAgentImageGenerationHint": "On by default. When off, agents cannot submit, query, or cancel image tasks; the sidebar studio remains available.",
 		"settings.enabled": "Enable plugin",
 		"settings.enabledHint": "When off, the generation studio is unavailable (this card stays available)",
-		"settings.save": "Save",
-		"settings.saving": "Saving…",
-		"settings.discard": "Discard",
 		"settings.unsaved": "Unsaved changes",
 		"settings.saveFailed": "Save failed, please retry",
 		"settings.readOnly": "The settings document is read-only; saving is disabled.",
@@ -1912,8 +1906,8 @@ const IMAGEGEN_DICTIONARIES = {
 		"settings.addModelConfirm": "Добавить",
 		"settings.removeModel": "Удалить модель",
 		"settings.optional": "необязательно",
-		"settings.moreOptions": "Дополнительно",
 		"settings.promptEnhanceTitle": "Модель улучшения промптов",
+		"settings.scalarsTitle": "Переключатели плагина и модель чата",
 		"settings.promptEnhanceHint": "Разворачивает краткое описание в полноценный промпт; пустые адрес и ключ наследуют настройки генерации.",
 		"settings.promptApiUrl": "Адрес диалогового API (необязательно)",
 		"settings.promptApiUrlHint": "OpenAI-совместимая база; если пусто — используется адрес API генерации.",
@@ -1934,9 +1928,6 @@ const IMAGEGEN_DICTIONARIES = {
 		"settings.allowAgentImageGenerationHint": "Включено по умолчанию. Выключено — агенты не могут создавать, смотреть или отменять задачи; боковая панель работает.",
 		"settings.enabled": "Включить плагин",
 		"settings.enabledHint": "Выключено — панель генерации недоступна (карточка настроек работает всегда)",
-		"settings.save": "Сохранить",
-		"settings.saving": "Сохраняем…",
-		"settings.discard": "Отменить правки",
 		"settings.unsaved": "Есть несохранённые правки",
 		"settings.saveFailed": "Не удалось сохранить, попробуйте ещё раз",
 		"settings.readOnly": "Документ настроек сейчас только для чтения, сохранить нельзя.",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@logictan/dsh-imagegen",
   "description": "Chat-invoked AI image generation for the dsh web GUI: text-to-image and image-to-image through configurable provider channels (gpt-image-2 / grok-imagine-image / nanobanana series / seedream-5.0-pro / dall-e-3, with native xAI Grok Imagine, Google Nano Banana and ByteDance Seedream request shaping) and per-channel model catalogs.",
-  "version": "2.0.3",
+  "version": "2.0.5",
   "type": "module",
   "main": "lib/index.js",
   "exports": {
@@ -25,12 +25,27 @@
         "@deepseek-ai/dsh-client-ui-settings",
         "@deepseek-ai/dsh-client-ui-tool"
       ],
-      "platform": "web"
+      "platform": "web",
+      "external": [
+        "@logictan/dsh-plugins-shared-client"
+      ]
     }
   },
   "dependencies": {
     "@deepseek-ai/schemastery": "^3.18.4"
   },
+  "peerDependencies": {
+    "@deepseek-ai/dsh-client-connection": "^0.1.5-alpha.1 || ^0.1.6-alpha.1 || ^0.1.7-alpha.1 || ^0.1.7-rc.1 || ^0.2.0-rc.1 || ^0.2.0-rc.2",
+    "@logictan/dsh-plugins-shared-client": "^0.1.0"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/dsh-client-connection": {
+      "optional": true
+    },
+    "@logictan/dsh-plugins-shared-client": {
+      "optional": true
+    }
+  },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.2",
     "@deepseek-ai/dsh-api-remotes": "^0.2.0-rc.2",
@@ -77,6 +92,7 @@
     "build": "tsdown",
     "prepack": "tsdown",
     "watch": "tsdown --watch",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "test": "npx tsdown && node --test \"test/*.spec.mjs\""
   }
 }