@musnows/scriverse 0.8.7 → 0.9.0

package/README.en.md

@@ -112,10 +112,12 @@ Run `scriverse --help` for all local server, default server, authentication, wor
 | `APP_AUTH_USERNAME` | Empty | Optional deployment gateway username; the in-app user system is always enabled |
 | `APP_AUTH_PASSWORD` | Empty | Optional deployment gateway password, at least 12 characters; must be transported over HTTPS |
 | `APP_TRUST_PROXY` | `false` | Set to the trusted proxy hop count (usually `1`) or `true` behind a trusted reverse proxy |
-| `APP_ALLOW_PRIVATE_AI_ENDPOINTS` | `true` in development, `false` in production | Allow AI providers on loopback/private networks; link-local and cloud metadata addresses are always blocked |
+| `APP_ALLOW_PRIVATE_AI_ENDPOINTS` | `true` in development, `false` in production | Loopback and private-network AI provider URLs are blocked by default. Setting `true`/`1` allows them with a warning toast and a startup warning log; link-local and cloud metadata addresses stay blocked |
 | `APP_ALLOW_REGISTRATION` | `false` | Registration is enabled only when explicitly set to `true`; unset and all other values stay closed, including first-admin setup |
 | `APP_SETUP_TOKEN` | Empty | Required when registration is enabled and must contain at least 32 characters; only the first administrator must enter it |
 
+`APP_ALLOW_PRIVATE_AI_ENDPOINTS` weakens SSRF protection and should be enabled only when you must reach a trusted local or private-network model. Unset production deployments keep blocking these addresses; when enabled, connection tests no longer fail for that reason, the UI shows a warning, and startup writes a warning log. Link-local and cloud metadata addresses remain blocked.
+
 `SCRIVERSE_AI_STREAM_IDLE_TIMEOUT_SECONDS` is read when the service starts and only controls how long an interactive AI stream may remain without a new event. Every valid stream event restarts the timer, so generation may continue beyond 60 seconds; this setting does not impose a total-duration limit or change timeout behavior for analysis tasks and other AI requests. Restart the service after changing it.
 
 The AI upstream HTTP retry settings are read when the service starts. `403` is never retried. `429` and `502` use exponential backoff starting at 500 milliseconds and capped at 5 seconds, honoring a numeric `Retry-After` within the same cap; other HTTP errors use a linear delay. Invalid values fall back to their defaults. Restart the service after changing either setting.

package/README.md

@@ -121,7 +121,7 @@ CLI 会按服务器保存登录凭据。所有连接服务的数据命令都可
 | `APP_AUTH_USERNAME` | 空 | 可选的部署网关账号；应用内用户系统始终启用 |
 | `APP_AUTH_PASSWORD` | 空 | 可选的部署网关密码，至少 12 个字符；必须通过 HTTPS 传输 |
 | `APP_TRUST_PROXY` | `false` | 位于可信反向代理后时设为代理跳数（通常为 `1`）或 `true` |
-| `APP_ALLOW_PRIVATE_AI_ENDPOINTS` | 开发环境 `true`，生产环境 `false` | 是否允许 AI 供应商连接本机或内网地址；链路本地与云元数据地址始终禁止 |
+| `APP_ALLOW_PRIVATE_AI_ENDPOINTS` | 开发环境 `true`，生产环境 `false` | 默认拦截指向本机或内网的 AI 供应商地址。显式设为 `true`/`1` 后改为允许连接并仅提示风险，启动时会打印警告；链路本地与云元数据地址始终禁止 |
 | `APP_ALLOW_REGISTRATION` | `false` | 仅明确设为 `true` 或 `1` 时开放注册；未设置或其他值均关闭，首次初始化创建管理员也必须显式开启 |
 | `APP_SETUP_TOKEN` | 空 | 开放注册时必填且至少 32 个字符；仅首位管理员注册需要在页面输入 |
 | `SCRIVERSE_AVATAR_IMAGE_MAX_BYTES` | `2097152` | 头像图片上传大小上限，单位为字节 |
@@ -133,6 +133,8 @@ CLI 会按服务器保存登录凭据。所有连接服务的数据命令都可
 
 上述三个图片大小限制均使用字节配置；非法、小于 1 或超过 1 GiB 的值会回退到默认值或按 1 GiB 处理。
 
+`APP_ALLOW_PRIVATE_AI_ENDPOINTS` 会削弱 SSRF 防护，只应在必须连接本机或内网模型时显式开启。未设置时生产环境继续拦截这类地址；开启后连接测试不再因此失败，但会弹出提示，服务启动时也会写入警告日志。链路本地地址和云元数据地址即使开启也仍然禁止。
+
 `SCRIVERSE_AI_STREAM_IDLE_TIMEOUT_SECONDS` 在服务启动时读取，只控制交互式 AI 流连续没有新事件的等待时间。每收到一个有效流事件都会重新计时，持续生成超过 60 秒不会因此中断；该配置不设置总时长上限，也不改变分析任务等其他 AI 请求的超时策略。修改后需重启服务生效。
 
 AI 上游 HTTP 重试配置在服务启动时读取。`403` 始终不重试；`429` 和 `502` 使用指数退避，等待从 500 毫秒开始并在 5 秒封顶，同时遵循秒数格式的 `Retry-After`（同样最多等待 5 秒）；其余 HTTP 错误使用线性等待。非法配置回退到对应默认值，修改后需重启服务生效。

package/dist/ai-analysis-timeout.js

@@ -0,0 +1,12 @@
+export const DEFAULT_AI_ANALYSIS_TIMEOUT_SECONDS = 300;
+export const MIN_AI_ANALYSIS_TIMEOUT_SECONDS = 30;
+export const MAX_AI_ANALYSIS_TIMEOUT_SECONDS = 3_600;
+export function normalizeAiAnalysisTimeoutSeconds(value) {
+    if (!Number.isSafeInteger(value))
+        return DEFAULT_AI_ANALYSIS_TIMEOUT_SECONDS;
+    return Math.min(MAX_AI_ANALYSIS_TIMEOUT_SECONDS, Math.max(MIN_AI_ANALYSIS_TIMEOUT_SECONDS, value));
+}
+export function isLongRunningAiAnalysisTaskType(taskType) {
+    return taskType === "book-analysis" || taskType === "relationship-analysis";
+}
+//# sourceMappingURL=ai-analysis-timeout.js.map

package/dist/ai-analysis-timeout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-analysis-timeout.js","sourceRoot":"","sources":["../src/ai-analysis-timeout.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AACvD,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAClD,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAErD,MAAM,UAAU,iCAAiC,CAAC,KAAa;IAC7D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,mCAAmC,CAAC;IAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,+BAA+B,EAAE,IAAI,CAAC,GAAG,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,QAAgB;IAC9D,OAAO,QAAQ,KAAK,eAAe,IAAI,QAAQ,KAAK,uBAAuB,CAAC;AAC9E,CAAC"}