@mokuyoaxis/dsh-iris 0.2.7 → 0.3.0-beta.1

package/lib/provider-settings.js

@@ -0,0 +1,136 @@
+// Owner-only editing boundary. No file I/O, secrets in projections, or implicit model authorization.
+import { CAPABILITIES } from './capability.js';
+import { providerModels, modelPool, functionPolicy, savedAssignmentRefs, resolvePoolModel } from './models.js';
+import { BUILTIN_PROVIDER_PROTOCOLS, normalizeMediaEndpoint, normalizeImageProtocol, normalizeMusicProtocol, selectMediaProtocol, providerForModelBinding, isConfiguredProvider } from './provider-protocol.js';
+import { clearModelCapabilityHealth, resetHealthOnCriticalChange } from './provider-health.js';
+import { checkedComfyWorkflow, projectComfyWorkflow } from './comfyui-workflow.js';
+import { validateProviderCredential, providerCredentialStatus, scrubProviderSecrets } from './provider-credentials.js';
+
+const CAPS = Object.values(CAPABILITIES);
+const fail = message => { throw Object.assign(new Error(message), { code: 'IRIS_CONFIG_INPUT_INVALID' }); };
+function object(value, fields) {
+  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).some(key => !fields.includes(key))) fail('设置包含不支持的字段');
+}
+function string(value, max, empty = false) {
+  if (typeof value !== 'string' || value.length > max || /[\u0000-\u001f\u007f]/.test(value) || !empty && !value.trim()) fail('设置文本为空、过长或含控制字符');
+  return value.trim();
+}
+function capabilities(value) {
+  if (!Array.isArray(value) || value.some(cap => !CAPS.includes(cap)) || new Set(value).size !== value.length) fail('模型用途必须是已知能力的非重复数组');
+  return [...value];
+}
+const protocols = registry => registry ? registry.snapshot().protocols : BUILTIN_PROVIDER_PROTOCOLS;
+
+export function projectProviderSettings(catalog, revision, registry) {
+  const pool = modelPool(catalog.providers, { includeHostVision: true });
+  const result = { contractVersion: 0, source: 'explicit-provider-config', revision,
+    protocols: protocols(registry).map(({ id, label, capabilities, configuration }) => ({ id, label, capabilities, configuration })),
+    capabilities: CAPS,
+    providers: catalog.providers.map(provider => ({ id: provider.id, name: provider.name || provider.id,
+      baseUrl: provider.baseUrl || '', mediaBaseUrl: provider.mediaBaseUrl || '',
+      enabled: provider.enabled !== false, auth: provider.auth === 'none' ? 'none' : 'bearer',
+      hasCredential: providerCredentialStatus(provider) === 'ready', configured: isConfiguredProvider(provider),
+      ...(provider.apiKeyEnv !== undefined ? { apiKeyEnv: provider.apiKeyEnv, credentialStatus: providerCredentialStatus(provider) } : {}),
+      mediaProtocol: selectMediaProtocol(provider).mediaProtocol,
+      models: providerModels(provider).map(model => ({ id: model.id, ref: model.ref, capabilities: model.capabilities,
+        imageProtocol: model.imageProtocol || 'auto', musicProtocol: model.musicProtocol || '',
+        ...(provider.models?.find(entry => entry?.id === model.id)?.comfyWorkflow ? {
+          comfyWorkflow: projectComfyWorkflow(provider.models.find(entry => entry?.id === model.id).comfyWorkflow) } : {}),
+        catalogStatus: model.catalogStatus || 'unknown', unavailableCapabilities: model.unavailableCapabilities || [],
+        rateLimited: model.rateLimited === true,
+        verified: Object.fromEntries(Object.entries(model.verified || {}).map(([cap, value]) => [cap, {
+          ok: value.ok === true, at: value.at, category: value.category
+        }])) })) })),
+    assignments: Object.fromEntries(CAPS.map(cap => {
+      const policy = functionPolicy(catalog.assignments?.[cap], cap);
+      return [cap, { ...policy, models: savedAssignmentRefs(pool, cap, policy.models) }];
+    })) };
+  // A mistakenly pasted key in a display field must not become a key read-back route.
+  return scrubProviderSecrets(result, catalog.providers);
+}
+
+export function applyProviderSettings(catalog, input, registry) {
+  object(input, ['expectedRevision', 'provider', 'credential', 'assignments']);
+  object(input.provider, ['id', 'name', 'baseUrl', 'mediaBaseUrl', 'mediaProtocol', 'enabled', 'auth', 'models']);
+  object(input.credential, ['action', 'value', 'name']);
+  const value = input.provider, id = string(value.id, 160);
+  const matches = catalog.providers.filter(item => item.id === id);
+  if (matches.length > 1) fail('供应商 ID 重复，请在本机核对');
+  const previous = matches[0];
+  const next = { ...previous, id, name: string(value.name, 80), baseUrl: string(value.baseUrl, 2048),
+    mediaBaseUrl: string(value.mediaBaseUrl ?? '', 2048, true), mediaProtocol: string(value.mediaProtocol, 80),
+    enabled: value.enabled, auth: value.auth };
+  next.protocolInferred = false;
+  if (typeof next.enabled !== 'boolean' || !['bearer', 'none'].includes(next.auth)) fail('供应商启用或认证方式无效');
+  try { normalizeMediaEndpoint(next.baseUrl); if (next.mediaBaseUrl) normalizeMediaEndpoint(next.mediaBaseUrl); }
+  catch (_) { fail('地址必须是无凭据、查询或片段的 HTTP(S) URL'); }
+  if (!protocols(registry).some(item => item.id === next.mediaProtocol) && previous?.mediaProtocol !== next.mediaProtocol) fail('协议未注册，请先显式加载对应扩展');
+  const credential = input.credential;
+  if (!['keep', 'replace', 'clear', 'env'].includes(credential.action)
+      || credential.action !== 'replace' && Object.hasOwn(credential, 'value')
+      || credential.action !== 'env' && Object.hasOwn(credential, 'name')) fail('密钥操作必须是 keep、replace、clear 或 env，并只提供对应字段');
+  if (credential.action === 'replace') { next.apiKey = string(credential.value, 8192); delete next.apiKeyEnv; }
+  if (credential.action === 'env') { next.apiKeyEnv = string(credential.name, 128); delete next.apiKey; }
+  if (credential.action === 'clear') { delete next.apiKey; delete next.apiKeyEnv; }
+  validateProviderCredential(next);
+  if (!Array.isArray(value.models) || value.models.length > 256) fail('单次最多保存 256 个模型');
+  const existing = providerModels(previous || {});
+  const entries = Array.isArray(previous?.models) ? previous.models.map(model => typeof model === 'string' ? { id: model } : { ...model })
+    : existing.map(({ id, capabilities }) => ({ id, capabilities }));
+  const ids = new Set();
+  for (const model of value.models) {
+    object(model, ['id', 'capabilities', 'imageProtocol', 'musicProtocol', 'comfyWorkflow']);
+    const modelId = string(model.id, 512);
+    if (ids.has(modelId)) fail('模型 ID 重复');
+    ids.add(modelId);
+    const old = entries.find(entry => entry.id === modelId), oldView = existing.find(entry => entry.id === modelId);
+    const updated = { ...old, id: modelId, capabilities: capabilities(model.capabilities) };
+    if (model.comfyWorkflow !== undefined) updated.comfyWorkflow = checkedComfyWorkflow(model.comfyWorkflow);
+    if (!oldView || JSON.stringify(oldView.capabilities) !== JSON.stringify(updated.capabilities)) updated.source = 'manual';
+    if (model.imageProtocol !== undefined) {
+      const protocol = model.imageProtocol === old?.imageProtocol ? model.imageProtocol : normalizeImageProtocol(model.imageProtocol, registry);
+      if (protocol === 'auto') delete updated.imageProtocol; else updated.imageProtocol = protocol;
+    }
+    if (model.musicProtocol !== undefined) {
+      if (model.musicProtocol === '') delete updated.musicProtocol;
+      else updated.musicProtocol = model.musicProtocol === old?.musicProtocol ? model.musicProtocol : normalizeMusicProtocol(model.musicProtocol, registry);
+    }
+    if (old) entries[entries.indexOf(old)] = updated; else entries.push(updated);
+  }
+  next.models = entries; // Omitted existing records survive. The Web has no hard-delete operation.
+  if (previous) {
+    const previousConnection = { ...previous, auth: previous.auth === 'none' ? 'none' : 'bearer',
+      mediaBaseUrl: previous.mediaBaseUrl || '', mediaProtocol: selectMediaProtocol(previous).mediaProtocol };
+    resetHealthOnCriticalChange(previousConnection, next, next);
+    for (const model of existing) {
+      const updated = next.models.find(entry => entry.id === model.id);
+      const connectionChanged = ['apiKey', 'apiKeyEnv', 'baseUrl', 'mediaBaseUrl', 'auth', 'mediaProtocol'].some(key => previousConnection[key] !== next[key]);
+      for (const cap of model.capabilities) if (connectionChanged || !updated.capabilities?.includes(cap)
+        || cap === 'image-gen' && JSON.stringify(previous.models?.find(entry => entry?.id === model.id)?.comfyWorkflow) !== JSON.stringify(updated.comfyWorkflow)
+        || cap === 'image-gen' && providerForModelBinding(previous, model.id, cap).mediaProtocol !== providerForModelBinding(next, model.id, cap).mediaProtocol
+        || cap === 'music-gen' && previous.models?.find(entry => entry.id === model.id)?.musicProtocol !== updated.musicProtocol) {
+        clearModelCapabilityHealth(next, model.id, cap);
+      }
+    }
+    catalog.providers[catalog.providers.indexOf(previous)] = next;
+  } else catalog.providers.push(next);
+  if (input.assignments !== undefined) applyFunctionPolicies(catalog, input.assignments);
+  return catalog;
+}
+
+export function applyFunctionPolicies(catalog, assignments) {
+  object(assignments, CAPS);
+  const pool = modelPool(catalog.providers, { includeHostVision: true });
+  catalog.assignments ||= {};
+  for (const [cap, assignment] of Object.entries(assignments)) {
+    object(assignment, ['mode', 'models', 'hostVision']);
+    let policy;
+    try { policy = functionPolicy(assignment, cap); } catch (_) { fail('功能策略无效'); }
+    if (!Object.hasOwn(assignment, 'mode') || new Set(policy.models).size !== policy.models.length || policy.models.length > 256) fail('功能策略或模型顺序无效');
+    // Existing invalid refs may be retained for diagnosis, but never newly authorized.
+    const oldRefs = savedAssignmentRefs(pool, cap, functionPolicy(catalog.assignments[cap], cap).models);
+    for (const ref of policy.models) if (!resolvePoolModel(pool, ref, cap) && !oldRefs.includes(ref)) fail('用途引用了不存在或未标注该能力的模型');
+    catalog.assignments[cap] = { mode: policy.mode, models: policy.models, ...(cap === 'vision' ? { hostVision: policy.hostVision } : {}) };
+  }
+  return catalog;
+}

package/lib/provider-task-runner.js

@@ -4,6 +4,7 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import sharp from 'sharp';
+import { isAudioRecipe, normalizeAudioFlowInput } from './audio-flow-input.js';
 import { adoptCoreArtifactFile, createCoreArtifact } from './core-artifacts.js';
 import {
   activateCoreWatch,
@@ -19,6 +20,7 @@ import {
   recordCoreAttemptResult,
   recordCoreCancelResult,
   recordCoreDownloadCompleted,
+  recordCoreNetworkRoute,
   recordCorePollResult,
   recordCoreWatchError,
   recoverCoreTask,
@@ -34,8 +36,11 @@ import { ProviderContractError, providerErrorRecord, submitWithAcceptanceBoundar
 import { imageEditCandidates, readImageEditArtifact } from './image-edit-input.js';
 import { createDeliveryCache, newDeliveryPayloadPath, readDeliveryCache,
   readDeliveryPayload, recordDeliveryPayload } from './core-delivery-cache.js';
-import { readFlowRun, flowFail } from './flow-store.js';
+import { readFlowRun, flowFail, flowStep } from './flow-store.js';
 import { normalizeGenerationInput } from './generation-input.js';
+import { assertPluginDependencyMatches } from './plugin-contract.js';
+import { checkedNetworkRequirement, sameNetworkRequirement, createNetworkAttemptBudget } from './network-policy.js';
+import { assertProviderMediaSize } from './provider-response.js';
 
 export const PROVIDER_TASK_RUNNER_VERSION = 0;
 
@@ -46,7 +51,7 @@ export const PROVIDER_TASK_RUNNER_VERSION = 0;
  */
 export const DELIVERY_PROFILES = Object.freeze({
   image: Object.freeze({ kind: 'generated-image', mediaTypes: Object.freeze(['image/png', 'image/jpeg', 'image/webp']), defaultMediaType: 'image/png' }),
-  video: Object.freeze({ kind: 'generated-video', mediaTypes: Object.freeze(['video/mp4']), defaultMediaType: 'video/mp4' }),
+  video: Object.freeze({ kind: 'generated-video', mediaTypes: Object.freeze(['video/mp4', 'video/webm']), defaultMediaType: 'video/mp4' }),
   // TTS 同步完成型：submit 内 completed → 同一次调用直接交付（无 remote 长轮询）。
   tts: Object.freeze({ kind: 'generated-audio', mediaTypes: Object.freeze(['audio/mpeg', 'audio/wav']), defaultMediaType: 'audio/mpeg' }),
   music: Object.freeze({ kind: 'generated-audio', mediaTypes: Object.freeze(['audio/mpeg', 'audio/wav']), defaultMediaType: 'audio/mpeg' }),
@@ -55,6 +60,20 @@ export const DELIVERY_PROFILES = Object.freeze({
 });
 const runtimeTaskGates = new WeakMap();
 
+// The Core operation owns the root and route persistence, including when the
+// network manager is supplied by a caller rather than created by CLI/Web.
+function networkOperationContext(runtime, dataRoot, taskId, context) {
+  const task = inspectCoreTask(dataRoot, taskId);
+  return { ...context, taskId, modelRef: task.modelRef, providerId: task.providerId,
+    ...(runtime.reportScheduling ? { onSchedulingState: runtime.reportScheduling } : {}),
+    recordNetworkRoute: fact => runtime.checkpoint ? runtime.checkpoint(() => recordCoreNetworkRoute(dataRoot, taskId, fact)) : recordCoreNetworkRoute(dataRoot, taskId, fact) };
+}
+
+function invokeNetwork(runtime, adapter, name, request, context) {
+  const invoke = () => invokeProviderOperation(adapter, name, request, context);
+  return runtime.networkWait ? runtime.networkWait(invoke, name) : invoke();
+}
+
 export class ProviderTaskRunnerError extends Error {
   constructor(code, message) {
     super(message);
@@ -73,12 +92,17 @@ function checkAdapterForTask(task, adapter) {
   if (!adapter || adapter.id !== task.providerId) {
     throw new ProviderTaskRunnerError('IRIS_PROVIDER_TASK_IDENTITY_MISMATCH', 'Provider Adapter 与 Task 已持久化身份不一致');
   }
+  assertPluginDependencyMatches(task.pluginDependency, adapter.pluginDependency);
+  const requirement = adapter.networkRequirement === undefined ? undefined : checkedNetworkRequirement(adapter.networkRequirement);
+  if (!sameNetworkRequirement(task.networkRequirement, requirement)) {
+    throw new ProviderTaskRunnerError('IRIS_NETWORK_REQUIREMENT_MISMATCH', 'Provider 网络要求与原 Task 不一致；不会隐式升级、解除或借用其他网络配置');
+  }
   return adapter;
 }
 
 function normalizedCandidates(capability, candidates) {
   if (!Array.isArray(candidates) || !candidates.length) throw new TypeError('至少需要一个 Provider 候选');
-  return candidates.map((candidate, index) => {
+  const normalized = candidates.map((candidate, index) => {
     const adapter = candidate?.adapter;
     const model = String(candidate?.model || '').trim();
     const parsed = parseModelRef(model);
@@ -86,12 +110,24 @@ function normalizedCandidates(capability, candidates) {
     if (!adapter || !adapter.capabilities?.includes(capability) || !parsed
         || parsed.providerId !== adapter.id || !parsed.modelId
         || (candidate.providerBinding !== undefined && !/^sha256:[a-f0-9]{64}$/.test(candidate.providerBinding))
-        || (selectionReason !== undefined && !['explicit', 'assignment', 'pool'].includes(selectionReason))) {
+        || (selectionReason !== undefined && !['explicit', 'assignment', 'pool'].includes(selectionReason))
+        || (adapter.pluginDependency && !candidate.providerBinding)) {
       throw new TypeError('Provider 候选 ' + (index + 1) + ' 不支持 Task capability 或模型复合身份无效');
     }
     if (candidate.prepareInput !== undefined && typeof candidate.prepareInput !== 'function') throw new TypeError('候选 prepareInput 必须是函数');
-    return { adapter, model, providerModel: parsed.modelId, providerBinding: candidate.providerBinding, selectionReason, prepareInput: candidate.prepareInput };
+    if (candidate.supportsImageEdit !== undefined && typeof candidate.supportsImageEdit !== 'boolean') throw new TypeError('候选 supportsImageEdit 必须是布尔值');
+    const networkRequirement = adapter.networkRequirement === undefined ? undefined : checkedNetworkRequirement(adapter.networkRequirement);
+    if (candidate.networkRequirement !== undefined && !sameNetworkRequirement(checkedNetworkRequirement(candidate.networkRequirement), networkRequirement)) {
+      throw new ProviderTaskRunnerError('IRIS_NETWORK_REQUIREMENT_MISMATCH', '候选与 Adapter 的网络要求不一致');
+    }
+    return { adapter, model, providerModel: parsed.modelId, providerBinding: candidate.providerBinding, pluginDependency: adapter.pluginDependency, selectionReason, prepareInput: candidate.prepareInput,
+      ...(networkRequirement ? { networkRequirement } : {}),
+      ...(candidate.supportsImageEdit !== undefined ? { supportsImageEdit: candidate.supportsImageEdit } : {}) };
   });
+  if (normalized.some(candidate => !sameNetworkRequirement(candidate.networkRequirement, normalized[0].networkRequirement))) {
+    throw new ProviderTaskRunnerError('IRIS_NETWORK_REQUIREMENT_MISMATCH', '同一 Task 的所有模型候选必须属于同一网络要求');
+  }
+  return normalized;
 }
 
 function stagingFile(dataRoot) {
@@ -115,7 +151,20 @@ async function generatedImageMediaType(bytes) {
   return mediaType;
 }
 
-async function deliverArtifacts(dataRoot, taskId, adapter, remoteArtifacts, signal) {
+/** Confirm the saved container, independently of an adapter's declared MIME; never buffer long audio. */
+function generatedAudioMediaType(file) {
+  const header = Buffer.alloc(12), fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+  let size;
+  try { size = fs.readSync(fd, header, 0, header.length, 0); }
+  finally { fs.closeSync(fd); }
+  if (size >= 12 && header.toString('ascii', 0, 4) === 'RIFF' && header.toString('ascii', 8, 12) === 'WAVE') return 'audio/wav';
+  if (size >= 10 && (header.toString('ascii', 0, 3) === 'ID3' || header[0] === 0xff && (header[1] & 0xe0) === 0xe0)) return 'audio/mpeg';
+  throw new ProviderContractError('供应商音频不是可识别的 WAV 或 MP3 容器', {
+    stage: 'download', category: 'protocol', acceptance: 'accepted'
+  });
+}
+
+async function deliverArtifacts(runtime, dataRoot, taskId, adapter, remoteArtifacts, signal) {
   beginCoreDelivery(dataRoot, taskId);
   const artifactIds = [];
   const stagedFiles = [];
@@ -141,22 +190,25 @@ async function deliverArtifacts(dataRoot, taskId, adapter, remoteArtifacts, sign
       }
       const target = stagingFile(dataRoot);
       stagedFiles.push({ target, mediaType });
-      const downloaded = await invokeProviderOperation(adapter, 'download', {
+      const downloaded = await invokeNetwork(runtime, adapter, 'download', {
         capability: task.capability,
         artifact: remote,
         targetPath: target,
         signal
-      }, { signal, taskId });
+      }, networkOperationContext(runtime, dataRoot, taskId, { signal, attemptId: task.activeAttemptId }));
       const stat = fs.lstatSync(target);
       if (!stat.isFile() || stat.isSymbolicLink() || stat.size !== downloaded.bytes) {
         throw Object.assign(new Error('Provider 物化结果与文件证据不一致'), {
           stage: 'download', category: 'local_io', acceptance: 'accepted'
         });
       }
+      assertProviderMediaSize(stat.size, task.capability);
       const staged = stagedFiles.at(-1);
       if (task.capability === 'image') {
         staged.bytes = fs.readFileSync(target);
         staged.mediaType = await generatedImageMediaType(staged.bytes);
+      } else if (['tts', 'music'].includes(task.capability)) {
+        staged.mediaType = generatedAudioMediaType(target);
       }
     }
     recordCoreDownloadCompleted(dataRoot, taskId);
@@ -182,30 +234,34 @@ async function deliverArtifacts(dataRoot, taskId, adapter, remoteArtifacts, sign
   }
 }
 
-async function observeWithinRoot(dataRoot, taskId, adapter, signal) {
+async function observeWithinRoot(runtime, dataRoot, taskId, adapter, signal) {
   const before = inspectCoreTask(dataRoot, taskId);
   checkAdapterForTask(before, adapter);
   activateCoreWatch(dataRoot, taskId);
   let result;
   try {
-    result = await invokeProviderOperation(adapter, 'poll', {
+    result = await invokeNetwork(runtime, adapter, 'poll', {
       capability: before.capability,
       remoteTaskId: before.remoteTaskId,
       signal
-    }, { signal, taskId });
+    }, networkOperationContext(runtime, dataRoot, taskId, { signal, attemptId: before.activeAttemptId }));
   } catch (error) {
     return recordCoreWatchError(dataRoot, taskId, error);
   }
-  const cachedFlowResult = Boolean(before.flowBinding && result.kind === 'succeeded');
-  if (cachedFlowResult) createDeliveryCache(dataRoot, before, result.artifacts);
+  let cachedFlowResult = false, cacheError;
+  if (before.flowBinding && result.kind === 'succeeded') {
+    try { createDeliveryCache(dataRoot, before, result.artifacts); cachedFlowResult = true; }
+    catch (error) { cacheError = error; }
+  }
   const recorded = recordCorePollResult(dataRoot, taskId, result, { deliveryCache: cachedFlowResult });
   if (result.kind !== 'succeeded') return recorded;
-  if (cachedFlowResult) return deliverCachedArtifacts(dataRoot, taskId, adapter, signal);
-  return deliverArtifacts(dataRoot, taskId, adapter, result.artifacts, signal);
+  if (cacheError) return failCoreDelivery(dataRoot, taskId, cacheError);
+  if (cachedFlowResult) return deliverCachedArtifacts(runtime, dataRoot, taskId, adapter, signal);
+  return deliverArtifacts(runtime, dataRoot, taskId, adapter, result.artifacts, signal);
 }
 
 /** 同步结果按已提交缓存补交付；已下载项不再访问 Provider，稳定 Artifact ID 防重复。 */
-async function deliverCachedArtifacts(dataRoot, taskId, adapter, signal) {
+async function deliverCachedArtifacts(runtime, dataRoot, taskId, adapter, signal) {
   beginCoreDelivery(dataRoot, taskId);
   try {
     const task = inspectCoreTask(dataRoot, taskId);
@@ -222,16 +278,17 @@ async function deliverCachedArtifacts(dataRoot, taskId, adapter, signal) {
         }
         checkAdapterForTask(task, adapter);
         const target = newDeliveryPayloadPath(dataRoot, cache);
-        const downloaded = await invokeProviderOperation(adapter, 'download', {
+        const downloaded = await invokeNetwork(runtime, adapter, 'download', {
           capability: task.capability, artifact: item.source, targetPath: target, signal
-        }, { signal, taskId });
+        }, networkOperationContext(runtime, dataRoot, taskId, { signal, attemptId: task.activeAttemptId }));
         const stat = fs.lstatSync(target);
         if (!stat.isFile() || stat.isSymbolicLink() || !stat.size || stat.size !== downloaded.bytes) {
           throw new Error('Provider 物化结果与文件证据不一致');
         }
+        assertProviderMediaSize(stat.size, task.capability);
         const mediaType = task.capability === 'image'
           ? await generatedImageMediaType(fs.readFileSync(target))
-          : declaredMediaType;
+          : ['tts', 'music'].includes(task.capability) ? generatedAudioMediaType(target) : declaredMediaType;
         if (!profile.mediaTypes.includes(mediaType)) throw new Error('交付媒体类型不在 Profile 白名单');
         recordDeliveryPayload(dataRoot, cache, index, target, mediaType);
       }
@@ -244,7 +301,7 @@ async function deliverCachedArtifacts(dataRoot, taskId, adapter, signal) {
       const sourcePath = readDeliveryPayload(dataRoot, cache, index);
       const mediaType = task.capability === 'image'
         ? await generatedImageMediaType(fs.readFileSync(sourcePath))
-        : (item.payload.mediaType || profile.defaultMediaType);
+        : ['tts', 'music'].includes(task.capability) ? generatedAudioMediaType(sourcePath) : (item.payload.mediaType || profile.defaultMediaType);
       if (!profile.mediaTypes.includes(mediaType)) throw new Error('交付媒体类型不在 Profile 白名单');
       const artifact = adoptCoreArtifactFile(dataRoot, {
         artifactId: item.artifactId, sourcePath, createdAt: cache.createdAt,
@@ -266,10 +323,11 @@ async function deliverCachedArtifacts(dataRoot, taskId, adapter, signal) {
  */
 export function createProviderTaskRunner(runtime) {
   checkRuntime(runtime);
-  let activeTasks = runtimeTaskGates.get(runtime);
+  const gate = runtime.taskGate || runtime;
+  let activeTasks = runtimeTaskGates.get(gate);
   if (!activeTasks) {
     activeTasks = new Set();
-    runtimeTaskGates.set(runtime, activeTasks);
+    runtimeTaskGates.set(gate, activeTasks);
   }
 
   async function runExclusive(taskId, operation, callback) {
@@ -293,28 +351,43 @@ export function createProviderTaskRunner(runtime) {
       if (signal.aborted) throw new ProviderTaskRunnerError('IRIS_PROVIDER_ABORTED', '提交已取消');
       const capability = String(input.capability || '').trim();
       let candidates = normalizedCandidates(capability, input.candidates);
+      const networkRequirement = candidates[0].networkRequirement;
+      const networkBudget = createNetworkAttemptBudget();
       let providerInput = input.providerInput ?? {};
+      if (providerInput.workflow_parameters !== undefined && candidates.some(candidate => candidate.adapter.protocol !== 'comfyui')) {
+        throw new ProviderTaskRunnerError('IRIS_COMFYUI_PARAMETERS_INVALID', '工作流参数仅用于明确的 ComfyUI 模板');
+      }
       let flow;
       if (input.flowRunId !== undefined) {
         flow = readFlowRun(dataRoot, input.flowRunId);
-        const expected = normalizeGenerationInput('image', flow.input).providerInput;
-        if (capability !== 'image' || !flow.edit.claimed || input.sourceArtifactId !== flow.source.artifactId
+        const audio = isAudioRecipe(flow.recipe), video = flow.recipe === 'video-generate/v0';
+        const expected = audio ? Object.fromEntries(Object.entries(normalizeAudioFlowInput(flow.recipe, flow.input)).filter(([key]) => key !== 'model_ref'))
+          : normalizeGenerationInput(video ? 'video' : 'image', flow.input).providerInput;
+        const expectedCapability = video ? 'video' : audio ? flow.recipe === 'speech/v0' ? 'tts' : 'transcribe' : 'image';
+        if (capability !== expectedCapability || !flowStep(flow).claimed || input.sourceArtifactId !== flow.source?.artifactId
             || Object.keys(providerInput).length !== Object.keys(expected).length
-            || Object.keys(expected).some(key => providerInput[key] !== expected[key])
+            || Object.keys(expected).some(key => key === 'workflow_parameters'
+              ? JSON.stringify(providerInput[key]) !== JSON.stringify(expected[key]) : providerInput[key] !== expected[key])
             || candidates.length !== 1 || candidates[0].model !== flow.input.model_ref
-            || candidates[0].providerBinding !== flow.providerBinding) {
+            || candidates[0].providerBinding !== flow.providerBinding || !sameNetworkRequirement(networkRequirement, flow.networkRequirement)) {
           flowFail('IRIS_FLOW_INPUT_CONFLICT', '提交与流程已保存的输入或模型绑定冲突');
         }
       }
-      if (input.sourceArtifactId !== undefined) {
-        if (capability !== 'image') throw new TypeError('sourceArtifactId 仅用于图片编辑');
+      if (input.sourceArtifactId !== undefined && capability === 'image') {
         candidates = imageEditCandidates(candidates);
         const image = await readImageEditArtifact(dataRoot, input.sourceArtifactId, signal);
         providerInput = { ...providerInput, image };
       }
+      if (input.sourceArtifactId !== undefined && !['image', 'transcribe'].includes(capability)) throw new TypeError('来源作品仅用于图片编辑或转写');
+      if (runtime.scheduler) await runtime.scheduler.beforeSubmit(runtime, dataRoot, { modelRef: candidates[0].model },
+        () => candidates[0].adapter.schedulingReadyAt?.(candidates[0].providerModel));
       const task = flow ? claimFlowTask(dataRoot, flow.id)
-        : createCoreTask(dataRoot, { capability, retriedFrom: input.retriedFrom, sourceArtifactId: input.sourceArtifactId });
+        : createCoreTask(dataRoot, { capability, retriedFrom: input.retriedFrom, sourceArtifactId: input.sourceArtifactId,
+          ...(networkRequirement ? { networkRequirement } : {}) });
       if (flow && task.attempts.length) flowFail('IRIS_FLOW_TASK_ALREADY_STARTED', '该流程 Task 已有提交意图，禁止重新 submit');
+      if (activeTasks.has(task.id)) throw new ProviderTaskRunnerError('IRIS_PROVIDER_TASK_BUSY', '该 Task 已有生命周期操作正在执行');
+      activeTasks.add(task.id);
+      try {
       const completedResults = new Map();
       const wrapped = candidates.map(({ adapter, model, providerModel, prepareInput }) => ({
         id: adapter.id,
@@ -322,17 +395,22 @@ export function createProviderTaskRunner(runtime) {
         adapter,
         submit: async (providerInput, context) => {
           if (prepareInput) {
-            try { providerInput = await prepareInput({ providerInput, signal }); }
-            catch (error) { throw new ProviderContractError('视频输入准备失败：' + (error.safeMessage || error.message), {
+            try {
+              const prepareContext = networkOperationContext(runtime, dataRoot, task.id, { providerInput, signal, attempt: context.attempt, attemptId: context.attempt.id, networkBudget });
+              const prepare = () => prepareInput(prepareContext);
+              providerInput = await (runtime.networkWait ? runtime.networkWait(prepare, 'prepareInput') : prepare());
+            }
+            catch (error) { throw new ProviderContractError((capability === 'video' ? '视频' : '音频') + '输入准备失败：' + (error.safeMessage || error.message), {
               ...providerErrorRecord(error), stage: error.stage || 'prepare', category: error.category || 'local_io', acceptance: 'not_accepted'
             }); }
           }
           if (signal.aborted) throw new ProviderContractError('提交已取消', { stage: 'prepare', category: 'aborted', acceptance: 'not_accepted' });
-          const result = await invokeProviderOperation(
+          const result = await invokeNetwork(
+            runtime,
             adapter,
             'submit',
             { capability, model: providerModel, input: providerInput, signal },
-            { ...context, signal, taskId: task.id }
+            networkOperationContext(runtime, dataRoot, task.id, { ...context, signal, attemptId: context.attempt.id, networkBudget })
           );
           if (result.kind === 'completed') completedResults.set(context.attempt.id, result.artifacts);
           return result;
@@ -342,9 +420,13 @@ export function createProviderTaskRunner(runtime) {
         signal,
         beforeAttempt: async (attempt) => {
           const candidate = candidates[attempt.ordinal - 1];
+          if (attempt.ordinal > 1 && runtime.scheduler) await runtime.scheduler.beforeSubmit(runtime, dataRoot, { modelRef: candidate.model },
+            () => candidate.adapter.schedulingReadyAt?.(candidate.providerModel));
           return beginCoreAttempt(dataRoot, task.id, {
             ...attempt,
             ...(candidate.providerBinding !== undefined ? { providerBinding: candidate.providerBinding } : {}),
+            ...(candidate.networkRequirement ? { networkRequirement: candidate.networkRequirement } : {}),
+            ...(candidate.pluginDependency ? { pluginDependency: candidate.pluginDependency } : {}),
             ...(candidate.selectionReason !== undefined ? { selectionReason: candidate.selectionReason } : {})
           });
         },
@@ -372,7 +454,7 @@ export function createProviderTaskRunner(runtime) {
       } else if (submitted.result.kind === 'completed') {
         return Object.freeze({
           taskId: task.id,
-          task: await deliverCachedArtifacts(dataRoot, task.id, submitted.candidate.adapter, signal),
+          task: await deliverCachedArtifacts(runtime, dataRoot, task.id, submitted.candidate.adapter, signal),
           attempts: submitted.attempts
         });
       }
@@ -381,6 +463,7 @@ export function createProviderTaskRunner(runtime) {
         task: inspectCoreTask(dataRoot, task.id),
         attempts: submitted.attempts
       });
+      } finally { activeTasks.delete(task.id); }
     });
   }
 
@@ -395,7 +478,7 @@ export function createProviderTaskRunner(runtime) {
         checkAdapterForTask(current, adapter);
         if (current.watchState === 'active') recoverCoreTask(dataRoot, taskId);
       }
-      return observeWithinRoot(dataRoot, taskId, adapter, signal);
+      return observeWithinRoot(runtime, dataRoot, taskId, adapter, signal);
     });
   }
 
@@ -404,14 +487,14 @@ export function createProviderTaskRunner(runtime) {
       const task = inspectCoreTask(dataRoot, taskId);
       if (adapter || !task.deliveryCache) checkAdapterForTask(task, adapter);
       prepareCoreRedelivery(dataRoot, taskId);
-      if (task.deliveryCache) return deliverCachedArtifacts(dataRoot, taskId, adapter, signal);
+      if (task.deliveryCache) return deliverCachedArtifacts(runtime, dataRoot, taskId, adapter, signal);
       let result;
       try {
-        result = await invokeProviderOperation(adapter, 'poll', {
+        result = await invokeNetwork(runtime, adapter, 'poll', {
           capability: task.capability,
           remoteTaskId: task.remoteTaskId,
           signal
-        }, { signal, taskId, redelivery: true });
+        }, networkOperationContext(runtime, dataRoot, taskId, { signal, attemptId: task.activeAttemptId, redelivery: true }));
       } catch (error) {
         return failCoreDelivery(dataRoot, taskId, error);
       }
@@ -421,7 +504,7 @@ export function createProviderTaskRunner(runtime) {
           { stage: 'download', category: 'protocol', acceptance: 'accepted' }
         ));
       }
-      return deliverArtifacts(dataRoot, taskId, adapter, result.artifacts, signal);
+      return deliverArtifacts(runtime, dataRoot, taskId, adapter, result.artifacts, signal);
     });
   }
 
@@ -433,23 +516,26 @@ export function createProviderTaskRunner(runtime) {
       if (!hasProviderOperation(adapter, 'cancel')) {
         return recordCoreCancelResult(dataRoot, taskId, { kind: 'not_supported' });
       }
-      const result = await invokeProviderOperation(adapter, 'cancel', {
+      const result = await invokeNetwork(runtime, adapter, 'cancel', {
         capability: task.capability,
         remoteTaskId: task.remoteTaskId,
         signal
-      }, { signal, taskId });
+      }, networkOperationContext(runtime, dataRoot, taskId, { signal, attemptId: task.activeAttemptId }));
       return recordCoreCancelResult(dataRoot, taskId, result);
     });
   }
 
   function recover(taskId, adapter) {
     return runExclusive(taskId, 'recover', async ({ dataRoot, signal }) => {
+      const before = inspectCoreTask(dataRoot, taskId);
+      if (before.acceptance === 'accepted' && before.remoteTaskId && before.outcome === 'none'
+          && ['accepted', 'running'].includes(before.phase)) checkAdapterForTask(before, adapter);
       const recovered = recoverCoreTask(dataRoot, taskId);
       if (recovered.acceptance === 'accepted' && recovered.remoteTaskId
           && recovered.outcome === 'none'
           && ['accepted', 'running'].includes(recovered.phase)) {
         checkAdapterForTask(recovered, adapter);
-        return observeWithinRoot(dataRoot, taskId, adapter, signal);
+        return observeWithinRoot(runtime, dataRoot, taskId, adapter, signal);
       }
       return recovered;
     });
@@ -462,6 +548,9 @@ export function createProviderTaskRunner(runtime) {
     observe,
     redeliver,
     cancel,
-    recover
+    recover,
+    assertIdle(taskId) {
+      if (activeTasks.has(taskId)) throw new ProviderTaskRunnerError('IRIS_PROVIDER_TASK_BUSY', '该 Task 已有生命周期操作正在执行');
+    }
   });
 }

package/lib/provider-transport.js

@@ -0,0 +1,16 @@
+// Bind all hops of an existing media transport to an instance-owned request function.
+import * as transport from './adapters.js';
+
+const REQUEST_METHODS = Object.freeze([
+  'generateImageMultimodal', 'startImageGeneration', 'submitImage', 'submitVideo', 'uploadTempFile',
+  'pollTask', 'synthesizeTts', 'openAiGenerateImage', 'openAiChatGenerateImage', 'openAiResponsesGenerateImage',
+  'listModels', 'visionStream', 'submitTranscription', 'pollTranscriptionTask', 'generateMusic'
+]);
+
+export function createProviderTransport(fetchPort) {
+  if (typeof fetchPort !== 'function') throw new TypeError('Provider transport 需要明确的 fetchPort');
+  const bound = { ...transport };
+  for (const name of REQUEST_METHODS) bound[name] = input => transport[name]({ ...input, fetchPort });
+  bound.downloadTo = (url, filePath, options) => transport.downloadTo(url, filePath, { ...options, fetchPort });
+  return Object.freeze(bound);
+}

package/lib/render.js

@@ -22,6 +22,7 @@ import { imageDimensions } from './pixels.js';
 
 const PNG_DATA_PREFIX = 'data:image/png;base64,';
 const MAX_SCREENSHOT_BYTES = 64 * 1024 * 1024;
+const pendingRenders = new Map();
 
 async function screenshotPng(result) {
   const dataUrl = result?.dataUrl;
@@ -127,6 +128,8 @@ export class BrowserHtmlRenderer {
     const htmlPath = path.join(dir, 'index.html');
     writePrivateFile(htmlPath, content);
     const url = `${address.baseUrl}/iris/render/${path.basename(dir)}/index.html`;
+    const delivery = { served: false };
+    pendingRenders.set(path.basename(dir), delivery);
     try {
       // open 只接受可选的会话名称；取消发生在打开期间时，取得会话后仍须关闭。
       const session = await b.open();
@@ -136,6 +139,9 @@ export class BrowserHtmlRenderer {
         throwIfAborted(signal);
         await waitForRender(this.waitMs, signal); // 等页面加载（无加载完成事件可用的折中）
         throwIfAborted(signal);
+        if (!delivery.served) throw Object.assign(new RenderError('未确认 Iris 已返回本次 HTML 页面；请检查渲染路由和 DSH_WEB_BASE。'), {
+          code: 'IRIS_RENDER_ROUTE_UNCONFIRMED'
+        });
         // 不要求浏览器写入 Iris 私有目录，兼容 downloadDir 内的保存路径限制。
         const result = await b.screenshot(session, { fullPage: fullPage !== false, format: 'png' }, signal);
         throwIfAborted(signal);
@@ -146,6 +152,7 @@ export class BrowserHtmlRenderer {
         try { await b.close(session); } catch (_) { /* 幂等 */ }
       }
     } finally {
+      pendingRenders.delete(path.basename(dir));
       fs.rmSync(dir, { recursive: true, force: true }); // 用完即清
     }
   }
@@ -196,7 +203,10 @@ export function serveRender(req, res) {
       'Referrer-Policy': 'no-referrer',
       'X-Content-Type-Options': 'nosniff'
     });
-    res.end(method === 'HEAD' ? undefined : fs.readFileSync(abs));
+    const body = method === 'HEAD' ? undefined : fs.readFileSync(abs);
+    const delivery = file === 'index.html' && method === 'GET' ? pendingRenders.get(subdir) : undefined;
+    if (delivery) res.once('finish', () => { delivery.served = true; });
+    res.end(body);
   } catch (err) {
     if (!res.headersSent) res.writeHead(500, { 'Content-Type': 'text/plain; charset=utf-8' });
     res.end('render error');