@mokuyoaxis/dsh-iris 0.2.7 → 0.3.0-beta.1

package/lib/actions.js

@@ -30,7 +30,7 @@ import { formatOcrResult } from './ocr.js';
 import { runOcrRequest } from './ocr-model-routing.js';
 import { ffmpegAvailable, extractFrames, probeVideo } from './media-probe.js';
 import { ensurePrivateDir, writePrivateFile } from './private-storage.js';
-import { selectMediaProtocol, selectImageProtocol, providerForImageModel, supportsImageEdit, supportsModelCapability, dashscopeTtsProtocolIssue, dashscopeTtsInputIssue } from './provider-protocol.js';
+import { selectMediaProtocol, selectImageProtocol, providerForImageModel, providerApiKey, supportsImageEdit, supportsModelCapability, dashscopeTtsProtocolIssue, dashscopeTtsInputIssue } from './provider-protocol.js';
 import { musicCandidatesFromCatalog, providerTaskBinding } from './provider-catalog.js';
 import { invokeProviderOperation, providerPollTaskView, prepareProviderInput } from './provider-adapter.js';
 import { createConfiguredProviderAdapter as createProviderAdapter } from './provider-adapters.js';
@@ -40,10 +40,14 @@ import { videoTaskCandidates } from './video-input.js';
 import { normalizeDshProvider, withDshProviderConfig } from './dsh-provider-config.js';
 import { modelDirectorySummary, modelUnavailableReason } from './model-directory.js';
 import { ModelPortError } from './model-port-contract.js';
+import { compileComfyWorkflow, projectComfyWorkflow } from './comfyui-workflow.js';
+import { createComfyUiClient } from './comfyui-client.js';
+import { inspectComfyWorkflow } from './comfyui-inspection.js';
+import { createProviderSecretScrubber } from './provider-credentials.js';
 
 const PROVIDER_ACTIONS = new Set(['image', 'image_edit', 'video', 'music', 'tts', 'transcribe', 'look', 'relook',
   'locate', 'ocr', 'media_summarize', 'task_reobserve', 'task_redeliver', 'task_manual_retry',
-  'providers_discover', 'providers_sync_directory', 'providers_test_vision', 'providers_test_model']);
+  'providers_discover', 'providers_sync_directory', 'providers_test_vision', 'providers_test_model', 'providers_check_comfy_workflow']);
 const AUTO_DIRECTORY_ACTIONS = new Set(['image', 'image_edit', 'video', 'music', 'tts', 'transcribe', 'look', 'relook',
   'locate', 'ocr', 'media_summarize']);
 const VISION_ACTIONS = new Set(['look', 'relook', 'locate', 'ocr', 'media_summarize']);
@@ -64,6 +68,12 @@ function imageRoutingForModel(provider, modelId) {
   return { ...routing, editSupported: supportsImageEdit(routing.mediaProtocol, modelId) };
 }
 
+function comfySummaryForModel(provider, modelId) {
+  const route = providerForImageModel(provider, modelId);
+  return route.mediaProtocol === 'comfyui' && route.comfyWorkflow !== undefined
+    ? { comfyWorkflow: projectComfyWorkflow(route.comfyWorkflow) } : {};
+}
+
 const EMPTY_ACTION_HOST = defineHostAdapter({
   id: 'iris-hostless',
   ports: {},
@@ -512,11 +522,22 @@ async function imageAction(host, args, { signal, core }, editing = false) {
   if (editing && !args.source_artifact_id) throw new Error('iris: 改图必须提供 source_artifact_id');
   const { providerInput, sourceArtifactId } = normalizeGenerationInput('image', {
     prompt: args.prompt, size: optionalActionText(args.size), n: args.n,
+    ...(args.workflow_parameters !== undefined ? { model_ref: args.model, workflow_parameters: args.workflow_parameters } : {}),
     ...(editing ? { source_artifact_id: args.source_artifact_id } : {})
   });
 
   const imageProviders = selectProviders(cap.CAPABILITIES.IMAGE, '图像', args.model);
   const routes = imageProviders.map((provider) => imageRoute(provider, args));
+  if (args.workflow_sha !== undefined && (typeof args.workflow_sha !== 'string' || routes.length !== 1
+      || projectComfyWorkflow(routes[0].provider.comfyWorkflow)?.sha256 !== args.workflow_sha)) {
+    throw Object.assign(new Error('工作流已变化，请重新选择并核对参数'), { code: 'IRIS_CONFIG_CHANGED' });
+  }
+  if (providerInput.workflow_parameters !== undefined) {
+    if (!models.parseModelRef(args.model) || routes.length !== 1 || routes[0].protocol !== 'comfyui') {
+      throw new TypeError('工作流参数需要明确选择一个 ComfyUI 工作流');
+    }
+    compileComfyWorkflow(routes[0].provider.comfyWorkflow, providerInput);
+  }
   const submitted = await submitCoreImage(core, routes, providerInput, signal, sourceArtifactId);
   const firstArtifactId = submitted.task.artifactIds[0];
   const ready = submitted.task.outcome === 'succeeded'
@@ -1084,13 +1105,14 @@ register('providers_list', async (host, args) => {
       ...selectMediaProtocol(p),
       visionInput: p.visionInput || null,
       directory: modelDirectorySummary(p),
-      apiKeyHint: p.dshProvider ? '由 DSH 管理' : String(p.apiKey || '').length <= 8 ? '****' : String(p.apiKey).slice(0, 3) + '****' + String(p.apiKey).slice(-4),
+      apiKeyHint: p.dshProvider ? '由 DSH 管理' : p.apiKeyEnv ? '由环境变量提供' : String(p.apiKey || '').length <= 8 ? '****' : String(p.apiKey).slice(0, 3) + '****' + String(p.apiKey).slice(-4),
       models: models.providerModelsWithDirectory(p).map((m) => ({
         id: m.id,
         capabilities: m.capabilities,
         ...(m.directoryOnly ? { directoryOnly: true } : {}),
         ...(m.catalogStatus ? { catalogStatus: m.catalogStatus } : {}),
         ...(m.imageProtocol !== undefined ? { imageProtocol: m.imageProtocol } : {}),
+        ...comfySummaryForModel(p, m.id),
         ...(m.musicProtocol !== undefined ? { musicProtocol: m.musicProtocol } : {}),
         ...(m.visionInput !== undefined ? { visionInput: m.visionInput } : {}),
         ...(m.capabilities.includes(cap.CAPABILITIES.VISION) ? { visionInputEffective: visionInputLimits(p, m.id) } : {}),
@@ -1112,6 +1134,34 @@ register('providers_host_connections', async host => {
   return { ok: true, connections: await host.ports.providerConnections.list() };
 });
 
+/** Explicit template save; no provider request or model execution. */
+register('providers_save_comfy_workflow', async (_host, args) => {
+  if (Object.keys(args).some(key => !['id', 'model_id', 'workflow', 'expectedSha', 'enableAutomatic'].includes(key))) throw new TypeError('工作流保存包含不支持的字段');
+  const entry = store.setComfyWorkflow(args.id, args.model_id, args.workflow, {
+    expectedSha: args.expectedSha, enableAutomatic: args.enableAutomatic
+  });
+  return { ok: true, modelId: entry.id, comfyWorkflow: projectComfyWorkflow(entry.comfyWorkflow),
+    text: '工作流已保存；未执行生成' + (args.enableAutomatic ? '，图片功能已使用自动池' : '，功能池设置保持') };
+});
+
+/** Uses only an already saved connection. /object_info never enqueues a prompt. */
+register('providers_check_comfy_workflow', async (_host, args, { signal }) => {
+  if (Object.keys(args).some(key => !['id', 'model_id', 'workflow', 'workflow_parameters'].includes(key))
+      || (args.workflow !== undefined) === (args.model_id !== undefined)) throw new TypeError('请选择已保存工作流或导入一份草稿进行检查');
+  const provider = store.providerById(args.id);
+  if (!provider) throw new TypeError('请先保存并启用 ComfyUI 连接');
+  const route = args.workflow !== undefined ? provider : providerForImageModel(provider, args.model_id);
+  if (route.mediaProtocol !== 'comfyui') throw new TypeError('此检查仅用于 ComfyUI 连接');
+  const file = path.join(store.irisHome(), 'providers.json'), before = fs.readFileSync(file);
+  const workflow = compileComfyWorkflow(args.workflow !== undefined ? args.workflow : route.comfyWorkflow,
+    { workflow_parameters: args.workflow_parameters });
+  const scrub = createProviderSecretScrubber([route]);
+  const report = await inspectComfyWorkflow(createComfyUiClient(route), workflow, { signal });
+  signal?.throwIfAborted();
+  if (!fs.readFileSync(file).equals(before)) throw Object.assign(new Error('检查期间配置已变化，请重新检查'), { code: 'IRIS_CONFIG_CHANGED' });
+  return { ok: true, report: scrub(report) };
+});
+
 /** 新增/更新供应商 */
 register('providers_upsert', async (host, args) => {
   const id = args.id || undefined;
@@ -1121,6 +1171,7 @@ register('providers_upsert', async (host, args) => {
   for (const key of allowed) {
     if (Object.prototype.hasOwnProperty.call(args, key)) patch[key] = args[key];
   }
+  if (Object.hasOwn(patch, 'auth') && !['none', 'bearer'].includes(patch.auth)) throw new TypeError('认证方式必须为 bearer 或 none');
   if (Object.hasOwn(args, 'dshProvider')) {
     patch.dshProvider = normalizeDshProvider(args.dshProvider);
     const source = requireHostPort(host, 'providerConnections', '复用 DSH 供应商连接');
@@ -1235,6 +1286,7 @@ async function probeModel(host, p, modelId, capability, signal) {
   }
   if (capability === cap.CAPABILITIES.IMAGE) {
     p = providerForImageModel(p, modelId);
+    if (p.mediaProtocol === 'comfyui') return { skipped: true, ok: false, note: 'ComfyUI 请在画图表单选择工作流验证，以持久 Task 保留受理与结果；只读工作流检查不生成图片' };
     const providerAdapter = createConfiguredProviderAdapter(p, { allowRateLimited: true, modelId });
     const submitted = await invokeProviderOperation(providerAdapter, 'submit', {
       capability: 'image', model: modelId,
@@ -1407,7 +1459,7 @@ register('assignments_get', async (host, args) => {
           ? (c === cap.CAPABILITIES.TTS && selectMediaProtocol(provider).mediaProtocol === 'dashscope'
             && dashscopeTtsProtocolIssue(m.id)) || '当前接口协议不支持此功能'
           : modelUnavailable ? modelUnavailableReason() : m.rateLimited ? '限流冷却或额度不可用，请稍后或检查账号' : m.source === 'discovered' ? '已发现，待确认模型用途' : '',
-        ...(c === cap.CAPABILITIES.IMAGE && provider ? { imageRouting: imageRoutingForModel(provider, m.id) } : {}) });
+        ...(c === cap.CAPABILITIES.IMAGE && provider ? { imageRouting: imageRoutingForModel(provider, m.id), ...comfySummaryForModel(provider, m.id) } : {}) });
     }
   }
   // order：归一化的有序分配列表（GUI 直接渲染 failover 顺序，无需处理单字符串旧格式）

package/lib/adapters.js

@@ -8,6 +8,7 @@
  * 所有函数只收显式 key；错误统一 throw Error(人话)。
  */
 import fs from 'node:fs';
+import { inheritedProviderFetch } from './provider-network.js';
 import path from 'node:path';
 import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
@@ -15,6 +16,7 @@ import { dashscopeApiBase, imageSizeViolation, isDashScopeBaseUrl, normalizeImag
 import { chmodPrivateFile, ensurePrivateDir, privateSibling } from './private-storage.js';
 import { isFreeQuotaExhausted, retryAfterDelay } from './provider-health.js';
 import { ProviderContractError } from './provider-contract.js';
+import { boundedProviderBody, readProviderText, PROVIDER_RESPONSE_LIMITS } from './provider-response.js';
 export { generateMusic } from './music-transport.js';
 
 /**
@@ -42,8 +44,8 @@ function authHeaders(key) {
   };
 }
 
-async function readJson(res) {
-  const text = await res.text();
+async function readJson(res, maxBytes = PROVIDER_RESPONSE_LIMITS.json) {
+  const text = await readProviderText(res, { maxBytes });
   try {
     return text ? JSON.parse(text) : null;
   } catch (_) {
@@ -145,12 +147,13 @@ function transportFetchError(err, response) {
 }
 
 /** 只包装网络读取；HTTP 业务错误和图片协议校验由调用方处理。 */
-async function fetchImageJson(url, options) {
+async function fetchImageJson(url, options, fetchPort) {
   let response;
   try {
-    response = await fetch(url, options);
-    return { res: response, body: await readJson(response) };
+    response = await fetchPort(url, options);
+    return { res: response, body: await readJson(response, response.ok ? PROVIDER_RESPONSE_LIMITS.mediaJson : PROVIDER_RESPONSE_LIMITS.json) };
   } catch (err) {
+    if (err instanceof ProviderContractError) throw err;
     throw transportFetchError(err, response);
   }
 }
@@ -189,11 +192,12 @@ export function applyImageSize({ protocol, mode, size }) {
 }
 
 /** 新版多模态同步协议：响应中直接返回图片 URL。 */
-export async function generateImageMultimodal({ key, baseUrl, model, prompt, image, size, n = 1, timeoutMs = T_SYNC_GEN, signal }) {
+export async function generateImageMultimodal({ key, baseUrl, model, prompt, image, size, n = 1, timeoutMs = T_SYNC_GEN, signal, fetchPort = inheritedProviderFetch }) {
   const apiBase = dashscopeApiBase(baseUrl);
   const requestSize = applyImageSize({ protocol: 'dashscope', mode: 'multimodal-sync', size });
   const { res, body } = await fetchImageJson(`${apiBase}/services/aigc/multimodal-generation/generation`, {
     method: 'POST',
+    redirect: 'error',
     headers: authHeaders(key),
     signal: timeoutSignal(timeoutMs, signal),
     body: JSON.stringify({
@@ -204,7 +208,7 @@ export async function generateImageMultimodal({ key, baseUrl, model, prompt, ima
       ] }] },
       parameters: { ...(requestSize ? { size: requestSize } : {}), n: Number(n) || 1 }
     })
-  });
+  }, fetchPort);
   if (!res.ok) throw providerError(res.status, body, '生成失败', res.headers);
   const urls = [];
   for (const choice of (body && body.output && body.output.choices) || []) {
@@ -224,15 +228,16 @@ export async function startImageGeneration(opts) {
   }
   return { remoteTaskId: await submitImage(opts), urls: [] };
 }
-export async function submitImage({ key, baseUrl, model, prompt, size, n = 1, timeoutMs = T_SUBMIT, signal }) {
+export async function submitImage({ key, baseUrl, model, prompt, size, n = 1, timeoutMs = T_SUBMIT, signal, fetchPort = inheritedProviderFetch }) {
   const apiBase = dashscopeApiBase(baseUrl);
   const requestSize = applyImageSize({ protocol: 'dashscope', mode: 'legacy-async', size });
   const { res, body } = await fetchImageJson(`${apiBase}/services/aigc/text2image/image-synthesis`, {
     method: 'POST',
+    redirect: 'error',
     headers: { ...authHeaders(key), 'X-DashScope-Async': 'enable' },
     signal: timeoutSignal(timeoutMs, signal),
     body: JSON.stringify({ model, input: { prompt }, parameters: { ...(requestSize ? { size: requestSize } : {}), n: Number(n) || 1 } })
-  });
+  }, fetchPort);
   if (!res.ok) throw providerError(res.status, body, '提交失败', res.headers);
   const taskId = body && body.output && body.output.task_id;
   if (!taskId) throw new Error('提交成功但未返回 task_id');
@@ -248,7 +253,7 @@ export async function submitImage({ key, baseUrl, model, prompt, size, n = 1, ti
  * - 其他（t2v/i2v）：POST /services/aigc/video-generation/video-synthesis，
  *   imgDataUrl 支持公网 URL 或 data:image base64。
  */
-export async function submitVideo({ key, baseUrl, model, prompt, imgDataUrl, size = '1280*720', duration, audioUrl, resolution, timeoutMs = T_SUBMIT, signal }) {
+export async function submitVideo({ key, baseUrl, model, prompt, imgDataUrl, size = '1280*720', duration, audioUrl, resolution, timeoutMs = T_SUBMIT, signal, fetchPort = inheritedProviderFetch }) {
   const apiBase = dashscopeApiBase(baseUrl);
   const isS2V = /s2v/i.test(model || '');
   let url, input, parameters;
@@ -265,11 +270,12 @@ export async function submitVideo({ key, baseUrl, model, prompt, imgDataUrl, siz
     url = `${apiBase}/services/aigc/video-generation/video-synthesis`;
     input = { prompt };
     if (imgDataUrl) input.img_url = imgDataUrl;
-    parameters = { size };
+    parameters = { size: typeof size === 'string' ? size.replace(/^(\d+)[xX](\d+)$/, '$1*$2') : size };
     if (duration) parameters.duration = Number(duration);
   }
-  const res = await fetch(url, {
+  const res = await fetchPort(url, {
     method: 'POST',
+    redirect: 'error',
     headers,
     signal: timeoutSignal(timeoutMs, signal),
     body: JSON.stringify({ model, input, parameters })
@@ -287,16 +293,19 @@ export async function submitVideo({ key, baseUrl, model, prompt, imgDataUrl, siz
  * 返回 oss:// 形式 URL；调用模型时请求头须带 X-DashScope-OssResourceResolve: enable
  * （submitVideo 的 s2v 分支已自动处理）。
  */
-export async function uploadTempFile({ key, baseUrl, model, filePath, timeoutMs = T_UPLOAD, signal }) {
+export async function uploadTempFile({ key, baseUrl, model, filePath, bytes, filename, timeoutMs = T_UPLOAD, signal, fetchPort = inheritedProviderFetch }) {
+  if ((filePath === undefined) === (bytes === undefined)) throw new TypeError('上传须且只能提供本地路径或明确字节');
+  const name = filePath !== undefined ? path.basename(filePath) : filename;
+  if (typeof name !== 'string' || !name || name.length > 128 || /[\/\\\0]/.test(name)
+      || bytes !== undefined && (!(bytes instanceof Uint8Array) || !bytes.length)) throw new TypeError('上传字节或文件名无效');
   const apiBase = dashscopeApiBase(baseUrl);
   const u = new URL(`${apiBase}/uploads`);
   u.searchParams.set('action', 'getPolicy');
   u.searchParams.set('model', model);
-  const pres = await fetch(u, { headers: authHeaders(key), signal: timeoutSignal(timeoutMs, signal) });
+  const pres = await fetchPort(u, { headers: authHeaders(key), signal: timeoutSignal(timeoutMs, signal) });
   const pbody = await readJson(pres);
   if (!pres.ok || !pbody || !pbody.data) throw providerError(pres.status, pbody, '获取上传凭证失败', pres.headers);
   const pol = pbody.data;
-  const name = path.basename(filePath);
   const keyPath = `${pol.upload_dir}/${Date.now()}-${name}`;
   const fd = new FormData();
   fd.append('OSSAccessKeyId', pol.oss_access_key_id);
@@ -306,8 +315,9 @@ export async function uploadTempFile({ key, baseUrl, model, filePath, timeoutMs
   fd.append('x-oss-forbid-overwrite', pol.x_oss_forbid_overwrite);
   fd.append('key', keyPath);
   fd.append('success_action_status', '200');
-  fd.append('file', new Blob([fs.readFileSync(filePath)]), name);
-  const up = await fetch(pol.upload_host, { method: 'POST', body: fd, signal: timeoutSignal(timeoutMs, signal) });
+  fd.append('file', new Blob([bytes ?? fs.readFileSync(filePath)]), name);
+  const up = await fetchPort(pol.upload_host, { method: 'POST', redirect: 'error', body: fd, signal: timeoutSignal(timeoutMs, signal) });
+  await up.body?.cancel();
   if (up.status !== 200) throw new Error(`临时上传失败：HTTP ${up.status}`);
   return 'oss://' + keyPath;
 }
@@ -315,9 +325,9 @@ export async function uploadTempFile({ key, baseUrl, model, filePath, timeoutMs
 const TERMINAL = new Set(['SUCCEEDED', 'FAILED', 'CANCELED', 'UNKNOWN']);
 
 /** @returns {{done:boolean, ok:boolean, urls:string[], message?:string}} */
-export async function pollTask({ key, baseUrl, remoteTaskId, timeoutMs = T_POLL, signal }) {
+export async function pollTask({ key, baseUrl, remoteTaskId, timeoutMs = T_POLL, signal, fetchPort = inheritedProviderFetch }) {
   const apiBase = dashscopeApiBase(baseUrl);
-  const res = await fetch(`${apiBase}/tasks/${encodeURIComponent(remoteTaskId)}`, {
+  const res = await fetchPort(`${apiBase}/tasks/${encodeURIComponent(remoteTaskId)}`, {
     headers: authHeaders(key),
     signal: timeoutSignal(timeoutMs, signal)
   });
@@ -358,15 +368,16 @@ export async function pollTask({ key, baseUrl, remoteTaskId, timeoutMs = T_POLL,
 }
 
 /* ---------------- DashScope：qwen-tts（同步） ---------------- */
-export async function synthesizeTts({ key, baseUrl, model = 'qwen-tts-latest', text, voice = 'Cherry', timeoutMs = T_SYNC_GEN, signal }) {
+export async function synthesizeTts({ key, baseUrl, model = 'qwen-tts-latest', text, voice = 'Cherry', timeoutMs = T_SYNC_GEN, signal, fetchPort = inheritedProviderFetch }) {
   const apiBase = dashscopeApiBase(baseUrl);
-  const res = await fetch(`${apiBase}/services/aigc/multimodal-generation/generation`, {
+  const res = await fetchPort(`${apiBase}/services/aigc/multimodal-generation/generation`, {
     method: 'POST',
+    redirect: 'error',
     headers: authHeaders(key),
     signal: timeoutSignal(timeoutMs, signal),
     body: JSON.stringify({ model, input: { text, voice } })
   });
-  const body = await readJson(res);
+  const body = await readJson(res, res.ok ? PROVIDER_RESPONSE_LIMITS.mediaJson : PROVIDER_RESPONSE_LIMITS.json);
   if (!res.ok) {
     const error = providerError(res.status, body, '合成失败', res.headers);
     if (res.status === 404 && (/NotFound\.Model|model_not_found/i.test(error.providerCode)
@@ -384,15 +395,16 @@ export async function synthesizeTts({ key, baseUrl, model = 'qwen-tts-latest', t
 }
 
 /* ---------------- OpenAI Images 兼容（同步 base64/url） ---------------- */
-export async function openAiGenerateImage({ key, baseUrl, model, prompt, size = '1024x1024', n = 1, timeoutMs = T_SYNC_GEN, signal }) {
+export async function openAiGenerateImage({ key, baseUrl, model, prompt, size = '1024x1024', n = 1, timeoutMs = T_SYNC_GEN, signal, fetchPort = inheritedProviderFetch }) {
   const base = String(baseUrl || '').replace(/\/+$/, '');
   const requestSize = applyImageSize({ protocol: 'openai-images', size });
   const { res, body } = await fetchImageJson(`${base}/images/generations`, {
     method: 'POST',
+    redirect: 'error',
     headers: authHeaders(key),
     signal: timeoutSignal(timeoutMs, signal),
     body: JSON.stringify({ model, prompt, size: requestSize, n: Number(n) || 1 })
-  });
+  }, fetchPort);
   if (!res.ok) throw providerError(res.status, body, '生成失败', res.headers);
   const items = (body && Array.isArray(body.data) && body.data) || [];
   const out = [];
@@ -452,7 +464,7 @@ function chatImageItems(body, label = '聊天生图') {
   return items;
 }
 
-export async function openAiChatGenerateImage({ key, baseUrl, model, prompt, image, size, n = 1, timeoutMs = T_SYNC_GEN, signal }) {
+export async function openAiChatGenerateImage({ key, baseUrl, model, prompt, image, size, n = 1, timeoutMs = T_SYNC_GEN, signal, fetchPort = inheritedProviderFetch }) {
   if (typeof size === 'string' && size.trim()) {
     throw new ProviderContractError('聊天生图协议不支持 size 参数；请在提示词中描述所需尺寸', {
       stage: 'validate', category: 'invalid_request', acceptance: 'not_accepted'
@@ -464,16 +476,16 @@ export async function openAiChatGenerateImage({ key, baseUrl, model, prompt, ima
     { type: 'image_url', image_url: { url: 'data:' + image.mediaType + ';base64,' + Buffer.from(image.bytes).toString('base64') } }
   ] : prompt;
   const { res, body } = await fetchImageJson(`${base}/chat/completions`, {
-    method: 'POST', headers: authHeaders(key), signal: timeoutSignal(timeoutMs, signal),
+    method: 'POST', redirect: 'error', headers: authHeaders(key), signal: timeoutSignal(timeoutMs, signal),
     body: JSON.stringify({ model, stream: false, messages: [{ role: 'user', content }],
       ...(Number(n) > 1 ? { n: Number(n) } : {}) })
-  });
+  }, fetchPort);
   if (!res.ok) throw providerError(res.status, body, '聊天生图失败', res.headers);
   return chatImageItems(body);
 }
 
 /** 同步 Responses 生图：主模型由 model 指定，图片工具模型沿用服务端默认。 */
-export async function openAiResponsesGenerateImage({ key, baseUrl, model, prompt, size, n = 1, timeoutMs = T_SYNC_GEN, signal }) {
+export async function openAiResponsesGenerateImage({ key, baseUrl, model, prompt, size, n = 1, timeoutMs = T_SYNC_GEN, signal, fetchPort = inheritedProviderFetch }) {
   if (Number(n) !== 1) {
     throw new ProviderContractError('Responses 生图当前只支持 n=1', {
       stage: 'validate', category: 'invalid_request', acceptance: 'not_accepted'
@@ -482,11 +494,11 @@ export async function openAiResponsesGenerateImage({ key, baseUrl, model, prompt
   const base = String(baseUrl || '').replace(/\/+$/, '');
   const requestSize = applyImageSize({ protocol: 'openai-responses-images', size });
   const { res, body } = await fetchImageJson(`${base}/responses`, {
-    method: 'POST', headers: authHeaders(key), signal: timeoutSignal(timeoutMs, signal),
+    method: 'POST', redirect: 'error', headers: authHeaders(key), signal: timeoutSignal(timeoutMs, signal),
     body: JSON.stringify({ model, input: prompt, stream: false, store: false, background: false,
       tools: [{ type: 'image_generation', action: 'generate', ...(requestSize ? { size: requestSize } : {}) }],
       tool_choice: { type: 'image_generation' } })
-  });
+  }, fetchPort);
   if (!res.ok) throw providerError(res.status, body, 'Responses 生图失败', res.headers);
   if (body?.status !== 'completed') throw imageResponseError('Responses 生图未返回同步完成结果；禁止自动重提');
   const output = Array.isArray(body.output) ? body.output : [];
@@ -510,7 +522,7 @@ export async function openAiResponsesGenerateImage({ key, baseUrl, model, prompt
  * 普通 OpenAI 兼容端点维持 GET /models 与字符串 id 返回形状。
  * @returns {Promise<Array<string|{id:string,capabilities?:string[]}>>}
  */
-export async function listModels({ key, baseUrl, timeoutMs = T_SUBMIT, signal }) {
+export async function listModels({ key, baseUrl, timeoutMs = T_SUBMIT, signal, fetchPort = inheritedProviderFetch }) {
   const base = String(baseUrl || '').trim().replace(/\/+$/, '');
   if (!base) throw new Error('iris: 供应商缺 baseUrl，无法发现模型');
   const dashscope = isDashScopeBaseUrl(base);
@@ -525,7 +537,7 @@ export async function listModels({ key, baseUrl, timeoutMs = T_SUBMIT, signal })
       url.searchParams.set('page_no', String(page));
       url.searchParams.set('page_size', '100');
     }
-    const res = await fetch(url, { headers: authHeaders(key), signal: timeoutSignal(timeoutMs, signal) });
+    const res = await fetchPort(url, { headers: authHeaders(key), signal: timeoutSignal(timeoutMs, signal) });
     const body = await readJson(res);
     if (!res.ok) throw providerError(res.status, body, '模型发现失败', res.headers);
     if (!body || body.success === false) throw new ProviderContractError('模型目录响应无效，已保留上次完整目录', {
@@ -588,14 +600,17 @@ export async function listModels({ key, baseUrl, timeoutMs = T_SUBMIT, signal })
  * @param {AbortSignal} [signal] 取消传播
  * @returns {Promise<string>} 完整回答文本
  */
-export async function visionStream({ key, baseUrl, model = 'qwen-vl-plus', prompt, imageDataUrl, signal, timeoutMs = T_VISION }) {
+export async function visionStream({ key, baseUrl, model = 'qwen-vl-plus', prompt, imageDataUrl, signal, timeoutMs = T_VISION, fetchPort = inheritedProviderFetch }) {
   const base = String(baseUrl || '').trim().replace(/\/+$/, '');
+  const requestSignal = timeoutSignal(timeoutMs, signal);
+  requestSignal.throwIfAborted();
   let res;
   try {
-    res = await fetch(`${base}/chat/completions`, {
+    res = await fetchPort(`${base}/chat/completions`, {
       method: 'POST',
+      redirect: 'error',
       headers: authHeaders(key),
-      signal: timeoutSignal(timeoutMs, signal),
+      signal: requestSignal,
       body: JSON.stringify({
         model,
         stream: true,
@@ -611,10 +626,12 @@ export async function visionStream({ key, baseUrl, model = 'qwen-vl-plus', promp
       })
     });
   } catch (err) {
+    requestSignal.throwIfAborted();
     throw networkError(err); // 网络层失败归类为 network
   }
+  if (requestSignal.aborted) { await res.body?.cancel(); requestSignal.throwIfAborted(); }
   if (!res.ok) {
-    const text = await res.text().catch(() => '');
+    const text = await readProviderText(res, { maxBytes: PROVIDER_RESPONSE_LIMITS.json, stage: 'response', acceptance: 'unknown' });
     let body = null;
     try { body = JSON.parse(text); } catch (_) { /* keep null */ }
     throw providerError(res.status, body, '视觉理解失败', res.headers);
@@ -622,8 +639,8 @@ export async function visionStream({ key, baseUrl, model = 'qwen-vl-plus', promp
   let full = '';
   const decoder = new TextDecoder();
   let buffer = '';
-  for await (const chunk of res.body) {
-    if (signal && signal.aborted) break;
+  for await (const chunk of boundedProviderBody(res, { maxBytes: PROVIDER_RESPONSE_LIMITS.json, stage: 'response', acceptance: 'unknown' })) {
+    requestSignal.throwIfAborted();
     buffer += decoder.decode(chunk, { stream: true });
     let idx;
     while ((idx = buffer.indexOf('\n')) >= 0) {
@@ -641,6 +658,7 @@ export async function visionStream({ key, baseUrl, model = 'qwen-vl-plus', promp
       }
     }
   }
+  requestSignal.throwIfAborted();
   return full.trim();
 }
 
@@ -655,15 +673,19 @@ export function extFromUrl(url, fallback = 'bin') {
   return fallback;
 }
 
-export async function downloadTo(url, filePath, { timeoutMs = T_DOWNLOAD, signal } = {}) {
-  const res = await fetch(url, { signal: timeoutSignal(timeoutMs, signal) });
-  if (!res.ok) throw new Error(`下载结果失败：HTTP ${res.status}`);
-  if (!res.body) throw new Error('下载结果失败：响应没有内容');
+export async function downloadTo(url, filePath, { timeoutMs = T_DOWNLOAD, signal, maxBytes = PROVIDER_RESPONSE_LIMITS.video, fetchPort = inheritedProviderFetch } = {}) {
   ensurePrivateDir(path.dirname(filePath));
   const tmp = privateSibling(filePath, 'download');
+  const res = await fetchPort(url, { signal: timeoutSignal(timeoutMs, signal) });
+  if (!res.ok) {
+    await res.body?.cancel();
+    throw Object.assign(new Error(`下载结果失败：HTTP ${res.status}`), { stage: 'download', category: 'provider', httpStatus: res.status, acceptance: 'accepted' });
+  }
+  if (!res.body) throw new Error('下载结果失败：响应没有内容');
   try {
     const output = fs.createWriteStream(tmp, { flags: 'wx', mode: 0o600 });
-    await pipeline(Readable.fromWeb(res.body), output);
+    const closed = new Promise(resolve => output.once('close', resolve));
+    await pipeline(Readable.from(boundedProviderBody(res, { maxBytes, stage: 'download', acceptance: 'accepted' })), output).finally(() => closed);
     const bytes = fs.statSync(tmp).size;
     fs.renameSync(tmp, filePath);
     chmodPrivateFile(filePath);
@@ -679,7 +701,7 @@ export async function downloadTo(url, filePath, { timeoutMs = T_DOWNLOAD, signal
  * @param {{key:string, model:string, audioUrl:string}} opts audioUrl 为 oss:// 或公网 URL
  * @returns {Promise<string>} remoteTaskId
  */
-export async function submitTranscription({ key, baseUrl, model = 'qwen-audio-3.0-asr-flash-filetrans', audioUrl, timeoutMs = T_SUBMIT, signal }) {
+export async function submitTranscription({ key, baseUrl, model = 'qwen-audio-3.0-asr-flash-filetrans', audioUrl, timeoutMs = T_SUBMIT, signal, fetchPort = inheritedProviderFetch }) {
   const apiBase = dashscopeApiBase(baseUrl);
   const headers = { ...authHeaders(key), 'X-DashScope-Async': 'enable' };
   if (/^oss:\/\//.test(audioUrl || '')) headers['X-DashScope-OssResourceResolve'] = 'enable';
@@ -687,8 +709,9 @@ export async function submitTranscription({ key, baseUrl, model = 'qwen-audio-3.
   const input = /^qwen3-asr-.*filetrans/i.test(model || '')
     ? { file_url: audioUrl }
     : { file_urls: [audioUrl] };
-  const res = await fetch(`${apiBase}/services/audio/asr/transcription`, {
+  const res = await fetchPort(`${apiBase}/services/audio/asr/transcription`, {
     method: 'POST',
+    redirect: 'error',
     headers,
     signal: timeoutSignal(timeoutMs, signal),
     body: JSON.stringify({ model, input })
@@ -719,9 +742,9 @@ export function transcriptionText(payload) {
 }
 
 /** 轮询 ASR 任务；正式结果位于 results[].transcription_url 指向的 JSON。 */
-export async function pollTranscriptionTask({ key, baseUrl, remoteTaskId, timeoutMs = T_POLL, signal }) {
+export async function pollTranscriptionTask({ key, baseUrl, remoteTaskId, timeoutMs = T_POLL, signal, fetchPort = inheritedProviderFetch }) {
   const apiBase = dashscopeApiBase(baseUrl);
-  const res = await fetch(`${apiBase}/tasks/${encodeURIComponent(remoteTaskId)}`, {
+  const res = await fetchPort(`${apiBase}/tasks/${encodeURIComponent(remoteTaskId)}`, {
     headers: authHeaders(key),
     signal: timeoutSignal(timeoutMs, signal)
   });
@@ -742,8 +765,11 @@ export async function pollTranscriptionTask({ key, baseUrl, remoteTaskId, timeou
       if (typeof result.transcription_text === 'string') text += result.transcription_text;
       else if (typeof result.text === 'string') text += result.text;
       if (status === 'SUCCEEDED' && result.subtask_status !== 'FAILED' && typeof result.transcription_url === 'string') {
-        const transcriptRes = await fetch(result.transcription_url, { signal: timeoutSignal(timeoutMs, signal) });
-        if (!transcriptRes.ok) throw new Error(`下载转写结果失败：HTTP ${transcriptRes.status}`);
+        const transcriptRes = await fetchPort(result.transcription_url, { signal: timeoutSignal(timeoutMs, signal) });
+        if (!transcriptRes.ok) {
+          await transcriptRes.body?.cancel();
+          throw new Error(`下载转写结果失败：HTTP ${transcriptRes.status}`);
+        }
         const transcriptBody = await readJson(transcriptRes);
         if (!transcriptBody) throw new Error('下载转写结果失败：响应不是 JSON');
         text += transcriptionText(transcriptBody);

package/lib/api.js

@@ -13,6 +13,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
+import { pipeline } from 'node:stream/promises';
 import { irisHome, capabilitiesOf, onChange as onConfigChange, providerHealthSnapshot } from './config.js';
 import { mimeOf, mediaUrl } from './media.js';
 import * as tasks from './tasks.js';
@@ -65,7 +66,7 @@ function providerPublic(p) {
     mediaBaseUrl: p.mediaBaseUrl || '',
     enabled: p.enabled !== false,
     ...selectMediaProtocol(p),
-    apiKeyHint: p.dshProvider ? '由 DSH 管理' : keyHint(p.apiKey),
+    apiKeyHint: p.dshProvider ? '由 DSH 管理' : p.apiKeyEnv ? '由环境变量提供' : keyHint(p.apiKey),
     ...(p.dshProvider ? { dshProvider: p.dshProvider } : {}),
     capabilities: capabilitiesOf(p),
     // 迁移/推断结果是否与原始声明不同（UI 提示旧配置已推断）
@@ -445,19 +446,22 @@ function handleWorkbenchPost(req, res, execute, download = false, core) {
 
 async function serveCoreArtifactMedia(artifactId, method, res, core) {
   try {
-    const result = await core.readCoreArtifactMediaForDsh(artifactId);
-    if (res.writableEnded || res.destroyed) return;
-    res.writeHead(200, {
-      'Content-Type': result.artifact.mediaType,
-      'Content-Length': result.bytes.length,
-      'Content-Disposition': 'inline',
-      'Cache-Control': 'private, max-age=3600',
-      'X-Content-Type-Options': 'nosniff',
-      'Cross-Origin-Resource-Policy': 'same-origin',
-      'Referrer-Policy': 'no-referrer'
-    });
-    res.end(method === 'HEAD' ? undefined : result.bytes);
+    await core.streamCoreArtifactMediaForDsh(artifactId, async result => {
+      if (res.writableEnded || res.destroyed) return;
+      res.writeHead(200, {
+        'Content-Type': result.artifact.mediaType,
+        'Content-Length': result.artifact.size,
+        'Content-Disposition': 'inline',
+        'Cache-Control': 'private, max-age=3600',
+        'X-Content-Type-Options': 'nosniff',
+        'Cross-Origin-Resource-Policy': 'same-origin',
+        'Referrer-Policy': 'no-referrer'
+      });
+      if (method === 'HEAD') res.end();
+      else await pipeline(result.stream, res);
+    }, { headOnly: method === 'HEAD' });
   } catch (_) {
+    if (res.headersSent || res.destroyed) { res.destroy(); return; }
     return sendJson(res, 404, { error: 'not found' });
   }
 }
@@ -567,10 +571,16 @@ function handleCoreTaskRetry(taskId, req, res, core) {
         error.statusCode = 400;
         throw error;
       }
+      if (body.video_mode !== undefined && ['img_data_url', 'first_frame_path', 'audio_path'].some(field => Object.hasOwn(body, field))) {
+        throw Object.assign(new Error('DSH 视频重试仅提供明确的文生入口；图生/数字人视频请通过视频工具或 CLI 重新提供首帧和音频'), {
+          code: 'IRIS_COMMAND_INPUT_INVALID'
+        });
+      }
       const prompt = String(body.prompt || '');
       const result = await core.retryProviderTaskForDsh({
         taskId,
         prompt,
+        ...(body.video_mode !== undefined ? { videoMode: body.video_mode } : {}),
         ...(body.source_artifact_id !== undefined ? { sourceArtifactId: body.source_artifact_id } : {}),
         ...(body.text !== undefined ? { text: String(body.text) } : {}),
         ...(body.voice !== undefined ? { voice: String(body.voice) } : {}),