@musnows/scriverse 1.0.9 → 1.0.10

package/README.en.md

@@ -112,11 +112,11 @@ Run `scriverse --help` for all local server, default server, authentication, wor
 | `APP_AUTH_USERNAME` | Empty | Optional deployment gateway username; the in-app user system is always enabled |
 | `APP_AUTH_PASSWORD` | Empty | Optional deployment gateway password, at least 12 characters; must be transported over HTTPS |
 | `APP_TRUST_PROXY` | `false` | Set to the trusted proxy hop count (usually `1`) or `true` behind a trusted reverse proxy |
-| `APP_ALLOW_PRIVATE_AI_ENDPOINTS` | `true` in development, `false` in production | Loopback and private-network AI provider URLs are blocked by default. Setting `true`/`1` allows them with a warning toast and a startup warning log; link-local and cloud metadata addresses stay blocked |
+| `APP_ALLOW_PRIVATE_AI_ENDPOINTS` | `true` in development, `false` in production | In production, AI provider URLs are validated and loopback, private-network, link-local, and reserved ranges are blocked by default. Setting `true`/`1` disables that validation for a trusted transparent-proxy or fake-IP deployment and writes a startup warning |
 | `APP_ALLOW_REGISTRATION` | `false` | Registration is enabled only when explicitly set to `true`; unset and all other values stay closed, including first-admin setup |
 | `APP_SETUP_TOKEN` | Empty | Required when registration is enabled and must contain at least 32 characters; only the first administrator must enter it |
 
-`APP_ALLOW_PRIVATE_AI_ENDPOINTS` weakens SSRF protection and should be enabled only when you must reach a trusted local or private-network model. Unset production deployments keep blocking these addresses; when enabled, connection tests no longer fail for that reason, the UI shows a warning, and startup writes a warning log. Link-local and cloud metadata addresses remain blocked.
+`APP_ALLOW_PRIVATE_AI_ENDPOINTS` disables AI provider URL SSRF validation and should be enabled only for a trusted deployment that must reach a provider through a transparent proxy or fake-IP mapping. Unset production deployments keep validating and blocking loopback, private-network, link-local, and reserved ranges; when enabled, those addresses no longer fail provider connection tests and startup writes a warning log. Remote MCP server URLs retain independent SSRF validation.
 
 `SCRIVERSE_AI_STREAM_IDLE_TIMEOUT_SECONDS` is read when the service starts and only controls how long an interactive AI stream may remain without a new event. Every valid stream event restarts the timer, so generation may continue beyond 60 seconds; this setting does not impose a total-duration limit or change timeout behavior for analysis tasks and other AI requests. Restart the service after changing it.
 

package/README.md

@@ -121,7 +121,7 @@ CLI 会按服务器保存登录凭据。所有连接服务的数据命令都可
 | `APP_AUTH_USERNAME` | 空 | 可选的部署网关账号；应用内用户系统始终启用 |
 | `APP_AUTH_PASSWORD` | 空 | 可选的部署网关密码，至少 12 个字符；必须通过 HTTPS 传输 |
 | `APP_TRUST_PROXY` | `false` | 位于可信反向代理后时设为代理跳数（通常为 `1`）或 `true` |
-| `APP_ALLOW_PRIVATE_AI_ENDPOINTS` | 开发环境 `true`，生产环境 `false` | 默认拦截指向本机或内网的 AI 供应商地址。显式设为 `true`/`1` 后改为允许连接并仅提示风险，启动时会打印警告；链路本地与云元数据地址始终禁止 |
+| `APP_ALLOW_PRIVATE_AI_ENDPOINTS` | 开发环境 `true`，生产环境 `false` | 生产环境默认校验 AI 供应商地址并拦截本机、内网、链路本地和保留网段。显式设为 `true`/`1` 后关闭该校验，适用于受信任的透明代理或 fake-ip 部署；启动时会打印警告 |
 | `APP_ALLOW_REGISTRATION` | `false` | 仅明确设为 `true` 或 `1` 时开放注册；未设置或其他值均关闭，首次初始化创建管理员也必须显式开启 |
 | `APP_SETUP_TOKEN` | 空 | 开放注册时必填且至少 32 个字符；仅首位管理员注册需要在页面输入 |
 | `SCRIVERSE_AVATAR_IMAGE_MAX_BYTES` | `2097152` | 头像图片上传大小上限，单位为字节 |
@@ -133,7 +133,7 @@ CLI 会按服务器保存登录凭据。所有连接服务的数据命令都可
 
 上述三个图片大小限制均使用字节配置；非法、小于 1 或超过 1 GiB 的值会回退到默认值或按 1 GiB 处理。
 
-`APP_ALLOW_PRIVATE_AI_ENDPOINTS` 会削弱 SSRF 防护，只应在必须连接本机或内网模型时显式开启。未设置时生产环境继续拦截这类地址；开启后连接测试不再因此失败，但会弹出提示，服务启动时也会写入警告日志。链路本地地址和云元数据地址即使开启也仍然禁止。
+`APP_ALLOW_PRIVATE_AI_ENDPOINTS` 会关闭 AI 供应商地址的 SSRF 校验，只应在可信部署必须经透明代理或 fake-ip 访问供应商时显式开启。未设置时生产环境继续校验并拦截本机、内网、链路本地和保留网段；开启后这些地址不再导致连接测试失败，服务启动时会写入警告日志。远程 MCP 服务地址仍保持独立的 SSRF 校验。
 
 `SCRIVERSE_AI_STREAM_IDLE_TIMEOUT_SECONDS` 在服务启动时读取，只控制交互式 AI 流连续没有新事件的等待时间。每收到一个有效流事件都会重新计时，持续生成超过 60 秒不会因此中断；该配置不设置总时长上限，也不改变分析任务等其他 AI 请求的超时策略。修改后需重启服务生效。
 

package/dist/ai.js

@@ -2465,7 +2465,7 @@ export class AiManager {
         this.authorizeTaskRun = authorizeTaskRun;
         this.attachmentStorage = attachmentStorage;
         this.connectivityTestGate = new AiConnectivityTestGate(store.db);
-        this.remoteMcp = new RemoteMcpManager(store.db, vault, fetchImpl, validateOutboundUrl);
+        this.remoteMcp = new RemoteMcpManager(store.db, vault, fetchImpl, options.remoteMcpValidateOutboundUrl ?? validateOutboundUrl);
         this.allowPrivateAiEndpoints = options.allowPrivateAiEndpoints === true;
         this.interactiveStreamIdleTimeoutMs = Number.isSafeInteger(options.interactiveStreamIdleTimeoutMs)
             && Number(options.interactiveStreamIdleTimeoutMs) > 0