@mokuyoaxis/dsh-iris 0.3.0-alpha.1 → 0.3.0-beta.1

package/lib/comfyui-client.js

@@ -1,6 +1,9 @@
 // Native HTTP transport shared by generation and explicit read-only workflow checks.
 import { ProviderContractError } from './provider-contract.js';
 import { normalizeMediaEndpoint, providerApiKey, providerMediaBaseUrl } from './provider-protocol.js';
+import { resolveProviderCredential } from './provider-credentials.js';
+import { inheritedProviderFetch } from './provider-network.js';
+import { providerNetworkRequirement, sameNetworkRequirement, networkPolicyError } from './network-policy.js';
 
 export function comfyFail(message, stage, category = 'protocol', acceptance = stage === 'validate' ? 'not_accepted' : 'accepted', details = {}) {
   throw new ProviderContractError(message, { stage, category, acceptance, ...details });
@@ -15,7 +18,12 @@ async function bounded(response, limit, stage) {
   }
   return Buffer.concat(chunks, size);
 }
-export function createComfyUiClient(provider, { fetchPort = globalThis.fetch } = {}) {
+export function createComfyUiClient(provider, { fetchPort = inheritedProviderFetch, network } = {}) {
+  const requirement = providerNetworkRequirement(provider);
+  if (requirement && (!network || !sameNetworkRequirement(requirement, network.networkRequirement) || network.providerId !== provider.id)) {
+    throw networkPolicyError('IRIS_NETWORK_CONTEXT_REQUIRED', 'ComfyUI 需要供应商匹配的网络上下文，不会静默直连');
+  }
+  provider = resolveProviderCredential(provider);
   const base = normalizeMediaEndpoint(providerMediaBaseUrl(provider)), key = providerApiKey(provider);
   const route = leaf => base + '/' + leaf;
   async function request(url, { method = 'GET', value, signal, stage, timeoutMs = 15000, binary = false } = {}) {
@@ -26,6 +34,7 @@ export function createComfyUiClient(provider, { fetchPort = globalThis.fetch } =
         headers: { ...(key ? { Authorization: 'Bearer ' + key } : {}), ...(value ? { 'Content-Type': 'application/json' } : {}) },
         ...(value ? { body: JSON.stringify(value) } : {}) });
     } catch (error) {
+      if (error instanceof ProviderContractError) throw error;
       comfyFail('ComfyUI 服务通信失败，请核对原任务与服务状态', stage,
         error.name === 'AbortError' ? 'aborted' : error.name === 'TimeoutError' ? 'timeout' : 'network',
         stage === 'submit' ? 'unknown' : stage === 'validate' ? 'not_accepted' : 'accepted');

package/lib/command-service.js

@@ -429,23 +429,34 @@ export function createCommandService(runtime, ports = {}) {
       if (input.confirm_billing !== true) {
         throw commandError('IRIS_COMMAND_BILLING_CONFIRM_REQUIRED', '重试会创建新任务并可能产生重复生成费用；必须显式确认计费');
       }
-      return runtime.run('execute', async ({ dataRoot }) => {
+      return runtime.run('execute', async ({ dataRoot, signal }) => {
         const before = inspectCoreTask(dataRoot, input.task_id);
         if (before.phase !== 'terminal' || (before.outcome === 'succeeded' && before.deliveryState === 'ready')) {
           throw commandError('IRIS_TASK_NOT_RETRYABLE', '只有终态且未成功交付的 Task 可以重试为新任务');
         }
-        let normalized;
+        let normalized, requestedVideoMode;
+        let suppliedInput = input.provider_input;
+        if (before.capability === 'video') {
+          if (!plain(suppliedInput) || !['t2v', 'i2v', 's2v'].includes(suppliedInput.video_mode)) {
+            throw commandError('IRIS_COMMAND_INPUT_INVALID', '视频重试必须明确 video_mode（t2v/i2v/s2v），并重新提供该模式所需的首帧和音频；旧 Task 不保存这些输入');
+          }
+          const { video_mode, ...generation } = suppliedInput;
+          requestedVideoMode = video_mode; suppliedInput = generation;
+        }
         if (before.capability === 'music' && input.provider_input &&
             ['retry_502', 'retry_delay_ms'].some(field => Object.hasOwn(input.provider_input, field))) {
           throw commandError('IRIS_COMMAND_INPUT_INVALID', 'task.retry 只执行一次重新生成；502重试配置请使用Music生成入口');
         }
-        try { normalized = normalizeGenerationInput(before.capability, input.provider_input, { allowVideoPaths: before.capability === 'video' }); }
+        try { normalized = normalizeGenerationInput(before.capability, suppliedInput, { allowVideoPaths: before.capability === 'video' }); }
         catch (error) {
           if (error instanceof GenerationInputError) throw commandError('IRIS_COMMAND_INPUT_INVALID', error.message);
           throw error;
         }
+        if (before.capability === 'video' && normalized.videoMode !== requestedVideoMode) {
+          throw commandError('IRIS_COMMAND_INPUT_INVALID', 'video_mode 与重新提供的首帧/音频不符；i2v 需首帧，s2v 需首帧和音频，可通过 CLI 重新提供本地文件');
+        }
         const providerInput = normalized.providerInput;
-        if (before.sourceArtifactId && !normalized.sourceArtifactId) {
+        if (before.capability === 'image' && before.sourceArtifactId && !normalized.sourceArtifactId) {
           throw commandError('IRIS_COMMAND_INPUT_INVALID', '改图重试必须重新提供 source_artifact_id 和修改指令');
         }
         if (Object.hasOwn(input.provider_input, 'model_ref')) {
@@ -454,7 +465,9 @@ export function createCommandService(runtime, ports = {}) {
         const modelRef = String(input.model_ref || '').trim();
         if (input.model_ref !== undefined && !modelRef) throw commandError('IRIS_COMMAND_INPUT_INVALID', 'model_ref 必须是 providerId::modelId 复合引用');
         if (typeof ports.resolveTaskCandidates !== 'function') throw commandError('IRIS_COMMAND_PROVIDER_REQUIRED', 'task.retry 需要宿主显式提供候选链 resolver');
-        let candidates = await ports.resolveTaskCandidates({ capability: before.capability, modelRef });
+        signal.throwIfAborted();
+        let candidates = await ports.resolveTaskCandidates({ capability: before.capability, modelRef, signal });
+        signal.throwIfAborted();
         if (before.capability === 'video') candidates = videoTaskCandidates(candidates, normalized);
         const result = await createProviderTaskRunner(runtime).submit({
           capability: before.capability,

package/lib/config.js

@@ -7,7 +7,7 @@ import { refreshModelDirectory } from './model-directory-service.js';
 /**
  * Iris 配置存储：$DSH_HOME/iris/v1/providers.json
  * Iris 独立持有配置；旧工作台仅作为用户显式指定的一次性导入来源。
- * Key 明文落盘（0600）；接口层永远不回明文。
+ * 内联 Key 明文落盘（0600）；环境引用只存名称，解析值不持久化；接口层不回明文。
  */
 import fs from 'node:fs';
 import path from 'node:path';
@@ -17,6 +17,7 @@ import * as models from './models.js';
 import { atomicWritePrivate, chmodPrivateFile, privateSibling } from './private-storage.js';
 import { selectMediaProtocol, selectImageProtocol, normalizeImageProtocol, normalizeMusicProtocol, isConfiguredProvider } from './provider-protocol.js';
 import { redactProviderMessage } from './provider-contract.js';
+import { validateProviderCredential, providerCredentialStatus, providerCredentialValue, applyCredentialPatch } from './provider-credentials.js';
 import {
   PROVIDER_HEALTH_FRESH_MS,
   aggregateHealthStates,
@@ -37,6 +38,7 @@ function validateStoredConfig(value) {
   for (const [capability, assignment] of Object.entries(value.assignments)) models.functionPolicy(assignment, capability);
   for (const provider of value.providers) {
     if (!isPlainObject(provider)) throw new Error('provider 条目必须是对象');
+    validateProviderCredential(provider);
     validateModelDirectory(provider.modelDirectory);
     if (provider.id !== undefined && typeof provider.id !== 'string') throw new Error('provider.id 必须是字符串');
     if (provider.baseUrl !== undefined && typeof provider.baseUrl !== 'string') throw new Error('provider.baseUrl 必须是字符串');
@@ -47,7 +49,7 @@ function validateStoredConfig(value) {
       if (!isPlainObject(ref) || typeof ref.provider !== 'string' || !ref.provider.trim()
           || typeof ref.settingsNs !== 'string' || !ref.settingsNs.trim()
           || Object.keys(ref).some(key => !['provider', 'settingsNs'].includes(key))) throw new Error('DSH 连接引用无效');
-      if (provider.apiKey !== undefined || provider.baseUrl !== undefined) throw new Error('DSH 引用不能同时保存密钥或普通 Base URL');
+      if (provider.apiKey !== undefined || provider.apiKeyEnv !== undefined || provider.baseUrl !== undefined) throw new Error('DSH 引用不能同时保存密钥、环境引用或普通 Base URL');
     }
     if (provider.models !== undefined && !Array.isArray(provider.models)) throw new Error('provider.models 必须是数组');
     for (const model of provider.models || []) {
@@ -72,7 +74,7 @@ function authModeOf(provider) {
 function missingCredentials(provider) {
   if (!provider || authModeOf(provider) === 'none') return false;
   if (provider.dshProvider) return false;
-  return typeof provider.apiKey !== 'string' || !provider.apiKey.trim();
+  return providerCredentialStatus(provider) !== 'ready';
 }
 
 function normalizeStoredProvider(provider) {
@@ -133,6 +135,9 @@ export function load() {
     for (const provider of cache.providers) normalized = normalizeStoredProvider(provider) || normalized;
     if (normalized) persist();
   } catch (err) {
+    // A rejected source/field combination is actionable configuration, not corrupt
+    // JSON. Keep it intact so a policy change cannot quarantine user providers.
+    if (err.code === 'IRIS_CONFIG_INPUT_INVALID') throw err;
     // 文件存在但损坏：隔离，绝不静默覆盖证据
     const backup = privateSibling(file, 'corrupted');
     try {
@@ -400,9 +405,8 @@ function healthObservation(provider, modelId, capability) {
 function safeHealthNote(provider, value) {
   const raw = String(value ?? '').trim();
   if (!raw) return '';
-  let note = redactProviderMessage(raw, 200);
-  const key = String(provider && scopedProvider(provider).apiKey || '');
-  if (key) note = note.split(key).join('[REDACTED]');
+  const key = providerCredentialValue(provider && scopedProvider(provider));
+  let note = redactProviderMessage(key ? raw.split(key).join('[REDACTED]') : raw, 200);
   return note;
 }
 
@@ -587,7 +591,7 @@ export function upsert(provider) {
     if (!isPlainObject(reference) || typeof reference.provider !== 'string' || !reference.provider.trim()
         || typeof reference.settingsNs !== 'string' || !reference.settingsNs.trim()
         || Object.keys(reference).some(key => !['provider', 'settingsNs'].includes(key))) throw new Error('DSH 连接引用无效');
-    if (['apiKey', 'baseUrl'].some(key => rest[key] !== undefined || existing?.[key] !== undefined)) {
+    if (['apiKey', 'apiKeyEnv', 'baseUrl'].some(key => rest[key] !== undefined || existing?.[key] !== undefined)) {
       throw new Error('DSH 引用不保存密钥或普通 Base URL；请新建引用供应商');
     }
     rest.dshProvider = { provider: reference.provider.trim(), settingsNs: reference.settingsNs.trim() };
@@ -602,7 +606,7 @@ export function upsert(provider) {
     const i = c.providers.findIndex((p) => p.id === id);
     if (i >= 0) {
       const previous = c.providers[i];
-      const next = { ...previous, ...rest };
+      const next = applyCredentialPatch(previous, rest);
       if (Object.prototype.hasOwnProperty.call(rest, 'mediaProtocol')) next.protocolInferred = false;
       normalizeStoredProvider(next);
       resetHealthOnCriticalChange(previous, next, rest);
@@ -613,7 +617,7 @@ export function upsert(provider) {
       return next;
     }
   }
-  const fresh = { id: 'iris_' + Math.random().toString(36).slice(2, 8), ...rest };
+  const fresh = applyCredentialPatch(null, { id: 'iris_' + Math.random().toString(36).slice(2, 8), ...rest });
   fresh.protocolInferred = false;
   normalizeStoredProvider(fresh);
   c.providers.push(fresh);

package/lib/configured-image-runtime.js

@@ -1,42 +1,61 @@
 // Shared CLI/service assembly. Configuration is read only during explicit commands.
 import path from 'node:path';
-import { loadProviderCatalog, imageCandidatesFromCatalog, ttsCandidatesFromCatalog, transcribeCandidatesFromCatalog, providerForTaskFromCatalog, providerTaskBinding } from './provider-catalog.js';
+import { loadProviderCatalog, imageCandidatesFromCatalog, ttsCandidatesFromCatalog, transcribeCandidatesFromCatalog, videoCandidatesFromCatalog, providerForTaskFromCatalog, providerTaskBinding } from './provider-catalog.js';
 import { createConfiguredProviderAdapter } from './provider-adapters.js';
 import { recordCatalogAvailability, recordCatalogRateLimit } from './provider-config-service.js';
 import { parseModelRef } from './models.js';
 import { supportsImageEdit } from './provider-protocol.js';
 import { compileComfyWorkflow } from './comfyui-workflow.js';
+import { providerNetworkRequirement, sameNetworkRequirement, networkPolicyError } from './network-policy.js';
 
-export function createTrackedProviderAdapter(provider, providerConfigPath, task, registry) {
+export function createTrackedProviderAdapter(provider, providerConfigPath, task, registry, { network, modelRef, deferCooling = false } = {}) {
+  if (task && !sameNetworkRequirement(task.networkRequirement, providerNetworkRequirement(provider))) {
+    throw networkPolicyError('IRIS_NETWORK_REQUIREMENT_MISMATCH', '原 Task 的网络要求与当前供应商目录不一致；不会隐式转换或解除');
+  }
   return createConfiguredProviderAdapter(provider, {
     registry,
-    modelId: parseModelRef(task?.modelRef)?.modelId,
+    ...(network !== undefined ? { network } : {}),
+    modelId: parseModelRef(task?.modelRef || modelRef)?.modelId,
+    deferCooling,
     onModelAvailability: event => recordCatalogAvailability(providerConfigPath, event),
     onRateLimit: event => recordCatalogRateLimit(providerConfigPath, event)
   });
 }
 
-export function configuredImagePorts(providerConfigPath, registry) {
+export function configuredImagePorts(providerConfigPath, registry, { resolveProviderNetwork, deferCooling = false } = {}) {
   if (typeof providerConfigPath !== 'string' || !path.isAbsolute(providerConfigPath)) throw new TypeError('Provider 配置须为显式绝对路径');
+  if (resolveProviderNetwork !== undefined && typeof resolveProviderNetwork !== 'function') throw new TypeError('resolveProviderNetwork 必须是函数');
+  const adapterFor = (provider, task, modelRef) => createTrackedProviderAdapter(provider, providerConfigPath, task, registry, {
+    modelRef, deferCooling,
+    network: resolveProviderNetwork?.({ providerId: provider.id, modelRef: modelRef || task?.modelRef, taskId: task?.id,
+      ...(providerNetworkRequirement(provider) ? { networkRequirement: providerNetworkRequirement(provider) } : {}) })
+  });
   return Object.freeze({
+    resolveVideoCandidates({ modelRef, signal }) {
+      signal?.throwIfAborted();
+      return videoCandidatesFromCatalog(loadProviderCatalog(providerConfigPath), modelRef, registry, { deferCooling }).map(route => ({
+        adapter: adapterFor(route.provider, undefined, route.modelRef), model: route.modelRef,
+        providerBinding: providerTaskBinding(route.provider, registry), selectionReason: 'explicit'
+      }));
+    },
     resolveAudioCandidates({ capability, modelRef, signal }) {
       signal?.throwIfAborted();
       if (!['tts', 'transcribe'].includes(capability)) throw new TypeError('未知音频能力');
       const select = capability === 'tts' ? ttsCandidatesFromCatalog : transcribeCandidatesFromCatalog;
-      return select(loadProviderCatalog(providerConfigPath), modelRef, registry).map(route => ({
-        adapter: createTrackedProviderAdapter(route.provider, providerConfigPath, undefined, registry), model: route.modelRef,
+      return select(loadProviderCatalog(providerConfigPath), modelRef, registry, { deferCooling }).map(route => ({
+        adapter: adapterFor(route.provider, undefined, route.modelRef), model: route.modelRef,
         providerBinding: providerTaskBinding(route.provider, registry), selectionReason: 'explicit'
       }));
     },
     resolveImageCandidates({ modelRef, signal, input }) {
       signal?.throwIfAborted();
-      return imageCandidatesFromCatalog(loadProviderCatalog(providerConfigPath), modelRef, registry).map(route => {
+      return imageCandidatesFromCatalog(loadProviderCatalog(providerConfigPath), modelRef, registry, { deferCooling }).map(route => {
         if (input?.workflow_parameters !== undefined) {
           if (route.provider.mediaProtocol !== 'comfyui') throw Object.assign(new TypeError('工作流参数仅用于 ComfyUI 模板'), { code: 'IRIS_COMFYUI_PARAMETERS_INVALID' });
           compileComfyWorkflow(route.provider.comfyWorkflow, input);
         }
         return {
-          adapter: createTrackedProviderAdapter(route.provider, providerConfigPath, undefined, registry), model: route.modelRef,
+          adapter: adapterFor(route.provider, undefined, route.modelRef), model: route.modelRef,
           supportsImageEdit: supportsImageEdit(route.provider.mediaProtocol, route.model, registry),
           providerBinding: providerTaskBinding(route.provider, registry), selectionReason: 'explicit'
         };
@@ -44,7 +63,7 @@ export function configuredImagePorts(providerConfigPath, registry) {
     },
     resolveTaskAdapter(task, { signal } = {}) {
       signal?.throwIfAborted();
-      return createTrackedProviderAdapter(providerForTaskFromCatalog(loadProviderCatalog(providerConfigPath), task, registry), providerConfigPath, task, registry);
+      return adapterFor(providerForTaskFromCatalog(loadProviderCatalog(providerConfigPath), task, registry), task);
     }
   });
 }

package/lib/connection-skill.js

@@ -61,6 +61,14 @@ function imageGuidance(tools) {
   ];
 }
 
+function videoGuidance(tools) {
+  if (!tools.includes('iris_core_create_video') && !tools.includes('iris_core_video')) return [];
+  return ['## Text to video · 文生视频', '',
+    'Use the actual video directory when selected. Keep an explicit permitted modelRef; do not guess models or supported sizes/durations. This fixed flow takes a prompt and optional size/duration (1–60 seconds). It has no image/audio input or S2V path. Omit optional parameters unless required by the user or model.', '',
+    'Creation saves an intent without generation. Only an authorized continue can submit it and incur charges. Keep distinct stable creation/execution UUIDs, the original Run, Task and Operation. An asynchronous submission needs another explicit continue to observe the SAME Task. Unknown acceptance must never cause another submission. Local stop stops waiting, not remote billing.', '',
+    'Video has one output and needs no image selection. If the video reading tool is selected, it returns an iris://video/ resource_link for the original MP4/WebM (at most 32 MiB). Use standard resources/read to obtain its bytes; each read checks current Core authorization. Client playback support varies. Do not replace it with a provider URL or claim to have watched it merely from a reference.', ''];
+}
+
 export function connectionSkillResources(input, metadata) {
   const bundle = checkedConnectionSkillBundle(input), skillName = 'iris-mcp-' + bundle.connectionId;
   const write = bundle.tools.some(name => toolDeclarations.get(name).scope !== 'read');
@@ -74,6 +82,7 @@ export function connectionSkillResources(input, metadata) {
     ...bundle.tools.map(name => '- `' + name + '`: ' + toolDeclarations.get(name).guidance), '',
     ...imageGuidance(bundle.tools),
     ...audioGuidance(bundle.tools),
+    ...videoGuidance(bundle.tools),
     '## Work within the selection · 遵循所选范围', '',
     'Choose only the steps needed for the user\'s request and available in the list above. A partial selection may not support a complete workflow. Ask for missing input or report a missing tool rather than inventing IDs, changing grants, creating another connection, or bypassing permissions through a shell/CLI.', '',
     'This is a saved instruction snapshot. Core checks actual current authorization on every request; loading this skill grants no permission. If a tool is unavailable or denied, report the mismatch and have the owner regenerate the bundle when appropriate. Do not automatically retry a write.', '',

package/lib/core-artifact-store.js

@@ -46,7 +46,8 @@ function dirs(dataRoot) {
     objects: path.join(base, 'objects'),
     records: path.join(base, 'records'),
     manifests: path.join(base, 'manifests'),
-    index: path.join(base, 'index.json')
+    index: path.join(base, 'index.json'),
+    indexDirty: path.join(base, 'index.dirty')
   };
 }
 
@@ -186,7 +187,7 @@ function verifyObject(dataRoot, manifest, verifyContent = true) {
   return object;
 }
 
-function legacyManifest(dataRoot, record, id) {
+function legacyObject(dataRoot, record, id) {
   if (!record || record.schemaVersion !== 0 || record.id !== id
       || typeof record.kind !== 'string' || !MEDIA_EXTENSION[record.mediaType]
       || !Number.isSafeInteger(record.size) || record.size <= 0
@@ -197,6 +198,15 @@ function legacyManifest(dataRoot, record, id) {
   const object = path.join(dirs(dataRoot).objects, record.object);
   const stat = regularFile(object);
   if (stat.size !== record.size) fail('IRIS_ARTIFACT_DIGEST_MISMATCH', '早期 Core Artifact 大小不一致');
+  return object;
+}
+
+function legacyManifest(dataRoot, record, id, indexed) {
+  const object = legacyObject(dataRoot, record, id);
+  if (indexed && (indexed.id !== id || indexed.createdAt !== record.createdAt
+      || indexed.mediaType !== record.mediaType || indexed.size !== record.size || !HASH.test(indexed.digest))) {
+    fail('IRIS_ARTIFACT_INDEX_INVALID', '早期 Artifact 与缓存索引不一致，请显式重建索引');
+  }
   return {
     schemaVersion: 0,
     id,
@@ -205,13 +215,13 @@ function legacyManifest(dataRoot, record, id) {
     size: record.size,
     createdAt: record.createdAt,
     object: record.object,
-    digest: { algorithm: 'sha256', value: hashFile(object) },
+    digest: { algorithm: 'sha256', value: indexed ? indexed.digest : hashFile(object) },
     relations: [],
     metadata: { ...record.metadata }
   };
 }
 
-function readArtifact(dataRoot, id, { allowLegacy = true, verifyContent = true } = {}) {
+function readArtifact(dataRoot, id, { allowLegacy = true, verifyContent = true, legacyIndex } = {}) {
   checkStore(dataRoot);
   const stable = stableId(id);
   let record;
@@ -226,7 +236,7 @@ function readArtifact(dataRoot, id, { allowLegacy = true, verifyContent = true }
     manifest = validateManifest(
       jsonFile(manifestPath(dataRoot, stable), 'IRIS_ARTIFACT_MANIFEST_INVALID'), stable
     );
-  } else if (allowLegacy) manifest = legacyManifest(dataRoot, record, stable);
+  } else if (allowLegacy) manifest = legacyManifest(dataRoot, record, stable, legacyIndex?.(stable));
   else fail('IRIS_ARTIFACT_INVALID', 'Artifact 提交记录无效');
   const object = verifyObject(dataRoot, manifest, verifyContent);
   return { manifest, object, legacy: record.schemaVersion === 0 };
@@ -252,11 +262,9 @@ function readIndexRevision(file) {
 
 function committedIds(dataRoot) {
   const directory = dirs(dataRoot).records;
-  try {
-    return fs.readdirSync(directory)
-      .map((name) => name.endsWith('.json') ? name.slice(0, -5) : '')
-      .filter((id) => ID.test(id));
-  } catch (_) { return []; }
+  return fs.readdirSync(directory)
+    .map((name) => name.endsWith('.json') ? name.slice(0, -5) : '')
+    .filter((id) => ID.test(id));
 }
 
 function writeIndex(dataRoot, manifests) {
@@ -275,23 +283,35 @@ function writeIndex(dataRoot, manifests) {
   atomicWritePrivate(file, JSON.stringify({
     schemaVersion: 0, revision, count: artifacts.length, inventoryDigest, artifacts
   }, null, 2) + '\n');
+  try { fs.unlinkSync(dirs(dataRoot).indexDirty); }
+  catch (error) { if (error.code !== 'ENOENT') throw error; }
   return { revision, artifacts };
 }
 
+function markIndexDirty(dataRoot) {
+  atomicWritePrivate(dirs(dataRoot).indexDirty, 'Artifact index needs refresh\n');
+}
+
 function refreshIndex(dataRoot) {
-  const manifests = [];
-  for (const id of committedIds(dataRoot)) {
-    try { manifests.push(readArtifact(dataRoot, id).manifest); } catch (_) { /* rebuild 会报告坏记录 */ }
-  }
+  // The new object was just hashed. Historical bytes are checked on use and rebuild,
+  // not on every unrelated commit. Do not silently publish a subset of bad records.
+  let previous;
+  const legacyIndex = id => {
+    previous ||= new Map(readArtifactIndex(dataRoot, { allowDirty: true }).artifacts.map(entry => [entry.id, entry]));
+    const entry = previous.get(id);
+    if (!entry) fail('IRIS_ARTIFACT_INDEX_INVALID', '早期 Artifact 缺少缓存摘要，请显式重建索引');
+    return entry;
+  };
+  const manifests = committedIds(dataRoot).map(id => readArtifact(dataRoot, id, { verifyContent: false, legacyIndex }).manifest);
   return writeIndex(dataRoot, manifests);
 }
 
 /** 只更新已提交条目的派生索引，不升级旧记录或接回孤儿。 */
 export function refreshCoreArtifactInventory(dataRoot) {
   checkStore(dataRoot, { manifests: true });
-  const manifests = committedIds(dataRoot).map(id => readArtifact(dataRoot, id).manifest);
-  const index = writeIndex(dataRoot, manifests);
-  return { revision: index.revision, total: manifests.length };
+  markIndexDirty(dataRoot);
+  const index = refreshIndex(dataRoot);
+  return { revision: index.revision, total: index.artifacts.length };
 }
 
 function validateRelationTargets(dataRoot, relations) {
@@ -329,13 +349,15 @@ function finishObject(dataRoot, input) {
         || JSON.stringify(previous.relations) !== JSON.stringify(relations)) {
       fail('IRIS_ARTIFACT_INPUT_INVALID', '可恢复 Artifact 与已提交内容不一致');
     }
-    try { refreshIndex(dataRoot); } catch (_) { /* 不撤销已有提交 */ }
+    try { markIndexDirty(dataRoot); refreshIndex(dataRoot); } catch (_) { /* 已提交事实保留；脏索引由读取/Doctor 报告 */ }
     return publicArtifact(previous);
   }
-  let stat;
+  let stat, digest;
   try {
     if (resumable && exists(object)) {
-      if (regularFile(object).size !== input.expectedSize || hashFile(object) !== input.expectedDigest) {
+      stat = regularFile(object);
+      digest = hashFile(object);
+      if (stat.size !== input.expectedSize || digest !== input.expectedDigest) {
         fail('IRIS_ARTIFACT_INPUT_INVALID', '未提交 Artifact 与恢复内容不一致');
       }
     } else input.writeObject(object);
@@ -357,7 +379,7 @@ function finishObject(dataRoot, input) {
     size: stat.size,
     createdAt: input.createdAt || new Date().toISOString(),
     object: objectName,
-    digest: { algorithm: 'sha256', value: hashFile(object) },
+    digest: { algorithm: 'sha256', value: digest || hashFile(object) },
     relations,
     metadata
   };
@@ -372,6 +394,7 @@ function finishObject(dataRoot, input) {
   }
   try {
     writeManifest(dataRoot, manifest);
+    markIndexDirty(dataRoot);
     commitRecord(dataRoot, id);
   } catch (_) {
     if (!resumable) {
@@ -380,7 +403,7 @@ function finishObject(dataRoot, input) {
     }
     fail('IRIS_ARTIFACT_WRITE_FAILED', 'Artifact 无法安全提交');
   }
-  try { refreshIndex(dataRoot); } catch (_) { /* index 是可重建缓存，不撤销已提交 Artifact */ }
+  try { refreshIndex(dataRoot); } catch (_) { /* 脏索引保留；不撤销已提交 Artifact 或触发重新生成 */ }
   return publicArtifact(manifest);
 }
 
@@ -441,10 +464,16 @@ export function readCoreArtifactBytes(dataRoot, id) {
   const hit = readArtifact(dataRoot, id);
   return Object.freeze({
     artifact: publicArtifact(hit.manifest),
-    bytes: Buffer.from(fs.readFileSync(hit.object))
+    bytes: fs.readFileSync(hit.object)
   });
 }
 
+/** Caller owns the stream until close; content is verified in bounded chunks before delivery. */
+export function readCoreArtifactStream(dataRoot, id, { signal } = {}) {
+  const hit = readArtifact(dataRoot, id);
+  return { artifact: publicArtifact(hit.manifest), stream: fs.createReadStream(hit.object, { signal }) };
+}
+
 export function exportCoreArtifact(dataRoot, id, outputPath) {
   const destination = String(outputPath || '').trim();
   if (!destination || !path.isAbsolute(destination)) {
@@ -462,13 +491,19 @@ export function exportCoreArtifact(dataRoot, id, outputPath) {
   return Object.freeze({ artifact: publicArtifact(hit.manifest), exported: true, bytes: hit.manifest.size });
 }
 
-function readArtifactIndex(dataRoot) {
+function readArtifactIndex(dataRoot, { allowDirty = false } = {}) {
   try { fs.lstatSync(dirs(dataRoot).storeRoot); }
   catch (error) {
     if (error?.code !== 'ENOENT') fail('IRIS_ARTIFACT_STORE_INVALID', 'Artifact Store 无法读取');
     return { schemaVersion: 0, revision: 0, artifacts: [], absent: true };
   }
   checkStore(dataRoot, { manifests: true });
+  if (!allowDirty) {
+    try {
+      fs.lstatSync(dirs(dataRoot).indexDirty);
+      fail('IRIS_ARTIFACT_INDEX_INVALID', 'Artifact Index 尚未刷新；写入结束后重试，持续失败请显式重建');
+    } catch (error) { if (error.code !== 'ENOENT') throw error; }
+  }
   const index = jsonFile(dirs(dataRoot).index, 'IRIS_ARTIFACT_INDEX_INVALID');
   const inventoryDigest = Array.isArray(index?.artifacts)
     ? crypto.createHash('sha256').update(JSON.stringify(index.artifacts)).digest('hex') : '';
@@ -483,16 +518,22 @@ function readArtifactIndex(dataRoot) {
 /** 工作台目录只读已提交元数据和文件大小；媒体打开/识别仍须核验完整内容哈希。 */
 export function listCoreArtifactMetadata(dataRoot) {
   const index = readArtifactIndex(dataRoot), artifacts = [];
-  let dropped = 0;
+  let dropped = 0, legacySkipped = 0;
   for (const entry of index.artifacts) {
     try {
+      const record = jsonFile(recordPath(dataRoot, entry.id), 'IRIS_ARTIFACT_NOT_FOUND');
+      if (record?.schemaVersion === 0) {
+        legacyObject(dataRoot, record, entry.id);
+        if (entry.createdAt !== record.createdAt || entry.mediaType !== record.mediaType || entry.size !== record.size) throw new Error('index mismatch');
+        legacySkipped++; continue;
+      }
       const { manifest } = readArtifact(dataRoot, entry.id, { allowLegacy: false, verifyContent: false });
       if (entry.createdAt !== manifest.createdAt || entry.mediaType !== manifest.mediaType
           || entry.size !== manifest.size || entry.digest !== manifest.digest.value) throw new Error('index mismatch');
       artifacts.push(publicArtifact(manifest));
     } catch (_) { dropped++; }
   }
-  return { revision: index.revision, artifacts, dropped };
+  return { revision: index.revision, artifacts, dropped, legacySkipped };
 }
 
 export function listCoreArtifacts(dataRoot, { offset = 0, limit = 50, kind, media_type, task_id } = {}) {
@@ -623,6 +664,7 @@ function inferredOrphanManifest(dataRoot, id, objectName) {
  */
 export function rebuildCoreArtifactIndex(dataRoot) {
   const store = ensureStore(dataRoot);
+  markIndexDirty(dataRoot);
   const report = { recovered: 0, legacyUpgraded: 0, invalid: 0, unresolved: 0, danglingRelations: 0 };
   const records = new Set(committedIds(dataRoot));
   const manifests = new Set(names(store.manifests)

package/lib/core-bridge-tools.js

@@ -28,7 +28,7 @@ export function validateBridgeArguments(tool, value) {
       try { normalizeComfyParameters(item); } catch (_) { invalid(); }
       continue;
     }
-    if (field.type === 'integer' ? !Number.isSafeInteger(item) || item < field.minimum || field.maximum !== undefined && item > field.maximum
+    if (['integer', 'number'].includes(field.type) ? !(field.type === 'integer' ? Number.isSafeInteger(item) : typeof item === 'number' && Number.isFinite(item)) || item < field.minimum || field.maximum !== undefined && item > field.maximum
       : typeof item !== 'string' || field.minLength !== undefined && item.length < field.minLength || field.maxLength !== undefined && item.length > field.maxLength
         || field.pattern && !new RegExp(field.pattern).test(item) || field.enum && !field.enum.includes(item)) invalid();
   }
@@ -49,6 +49,7 @@ export async function callCoreBridgeTool(client, name, args, { signal } = {}) {
   if (name === 'iris_core_plugin_call') return { value: await client.callPlugin(args, options) };
   if (name === 'iris_core_models') return { value: await client.models(options) };
   if (name === 'iris_core_audio_models') return { value: await client.audioModels(options) };
+  if (name === 'iris_core_video_models') return { value: await client.videoModels(options) };
   if (name === 'iris_core_runs') return { value: await client.runs(args, options) };
   if (name === 'iris_core_run') return { value: await client.run(args.runId, options) };
   if (name === 'iris_core_import_image') {
@@ -66,13 +67,14 @@ export async function callCoreBridgeTool(client, name, args, { signal } = {}) {
     return { value: await client[name === 'iris_core_create_speech' ? 'createSpeech' : 'createTranscription']({ key, value }, options) };
   }
   if (name === 'iris_core_audio') return { audio: { artifactId: args.artifactId, ...await client.audio(args.artifactId, options) } };
+  if (name === 'iris_core_video') return { video: { artifactId: args.artifactId, ...await client.video(args.artifactId, options) } };
   if (name === 'iris_core_transcript') {
     const result = await client.transcript(args.artifactId, options);
     return { value: { contractVersion: 0, artifactId: args.artifactId, text: new TextDecoder('utf-8', { fatal: true }).decode(result.bytes) } };
   }
-  if (['iris_core_create_run', 'iris_core_create_generation'].includes(name)) {
+  if (['iris_core_create_run', 'iris_core_create_generation', 'iris_core_create_video'].includes(name)) {
     const { key, ...value } = args;
-    return { value: await client[name === 'iris_core_create_run' ? 'createRun' : 'createGeneration']({ key, value }, options) };
+    return { value: await client[name === 'iris_core_create_run' ? 'createRun' : name === 'iris_core_create_video' ? 'createVideo' : 'createGeneration']({ key, value }, options) };
   }
   if (name === 'iris_core_continue') return { value: await client.continueRun(args, options) };
   if (name === 'iris_core_operation') return { value: await client.operation(args.operationId, options) };