@musnows/scriverse 1.1.2 → 1.1.4

package/README.en.md

@@ -109,6 +109,7 @@ Run `scriverse --help` for all local server, default server, authentication, wor
 | `SCRIVERSE_AI_RETRY_COUNT` | `3` | Retry count for AI upstream HTTP errors other than `403`, `429`, and `502`; valid integers are clamped to `1`–`20` |
 | `SCRIVERSE_AI_BACKOFF_RETRY_COUNT` | `10` | Backoff retry count when an AI upstream returns `429` or `502`; valid integers are clamped to `1`–`20` |
 | `SCRIVERSE_AI_STREAM_IDLE_TIMEOUT_SECONDS` | `30` | Maximum idle time while an interactive AI stream waits for its first or next valid event; valid integers are clamped to `10`–`120`, and invalid values fall back to `30` |
+| `SCRIVERSE_AI_RESPONSE_MAX_BYTES` | `0` (unlimited) | Byte limit for AI provider and Desktop local AI responses; a positive safe integer enables the limit, while unset, `0`, and invalid values mean unlimited |
 | `SCRIVERSE_CHAPTER_ANNOTATION_NOTE_MAX_LENGTH` | `6000` | Maximum character length for chapter comments and todos; valid integers are clamped to `2000`–`20000`, values below `2000` are treated as `2000`, and invalid values fall back to `6000` |
 | `APP_AUTH_USERNAME` | Empty | Optional deployment gateway username; the in-app user system is always enabled |
 | `APP_AUTH_PASSWORD` | Empty | Optional deployment gateway password, at least 12 characters; must be transported over HTTPS |
@@ -121,6 +122,8 @@ Run `scriverse --help` for all local server, default server, authentication, wor
 
 `SCRIVERSE_AI_STREAM_IDLE_TIMEOUT_SECONDS` is read when the service starts and only controls how long an interactive AI stream may remain without a new event. Every valid stream event restarts the timer, so generation may continue beyond 60 seconds; this setting does not impose a total-duration limit or change timeout behavior for analysis tasks and other AI requests. Restart the service after changing it.
 
+`SCRIVERSE_AI_RESPONSE_MAX_BYTES` controls the byte limit for streamed and regular AI provider responses, as well as Desktop local AI responses. The limit is disabled by default; unset, `0`, and invalid values mean unlimited. Set a positive safe integer to enable a byte limit. Restart the service after changing it.
+
 `SCRIVERSE_CHAPTER_ANNOTATION_NOTE_MAX_LENGTH` is read when the service starts and applies to API validation, the comment input, and AI write plans. Restart the service after changing it.
 
 The AI upstream HTTP retry settings are read when the service starts. `403` is never retried. `429` and `502` use exponential backoff starting at 500 milliseconds and capped at 5 seconds, honoring a numeric `Retry-After` within the same cap; other HTTP errors use a linear delay. Invalid values fall back to their defaults. Restart the service after changing either setting.

package/README.md

@@ -117,6 +117,7 @@ CLI 会按服务器保存登录凭据。所有连接服务的数据命令都可
 | `SCRIVERSE_AI_RETRY_COUNT` | `3` | AI 上游返回除 `403`、`429`、`502` 外的 HTTP 错误时的重试次数；有效整数按 `1`–`20` 钳制 |
 | `SCRIVERSE_AI_BACKOFF_RETRY_COUNT` | `10` | AI 上游返回 `429` 或 `502` 时的退避重试次数；有效整数按 `1`–`20` 钳制 |
 | `SCRIVERSE_AI_STREAM_IDLE_TIMEOUT_SECONDS` | `30` | 交互式 AI 流等待首个或下一个有效事件的最长空闲秒数；有效整数按 `10`–`120` 钳制，非法值回退为 `30` |
+| `SCRIVERSE_AI_RESPONSE_MAX_BYTES` | `0`（默认不限） | AI 供应商和 Desktop 本地 AI 响应的字节上限；正安全整数启用，未设置、`0` 或非法值表示不限 |
 | `APP_AI_CHAT_TAB_LIMIT` | `5` | 浏览器中可同时打开的 Agent 对话数；有效整数按 `1`–`20` 钳制，设为 `1` 时关闭多会话切换和工作台 |
 | `SCRIVERSE_CHAPTER_ANNOTATION_NOTE_MAX_LENGTH` | `6000` | 正文评论和待办内容的最大字符数；有效整数按 `2000`–`20000` 钳制，低于 `2000` 按 `2000` 处理，非法值回退为 `6000` |
 | `APP_AUTH_USERNAME` | 空 | 可选的部署网关账号；应用内用户系统始终启用 |
@@ -138,6 +139,8 @@ CLI 会按服务器保存登录凭据。所有连接服务的数据命令都可
 
 `SCRIVERSE_AI_STREAM_IDLE_TIMEOUT_SECONDS` 在服务启动时读取，只控制交互式 AI 流连续没有新事件的等待时间。每收到一个有效流事件都会重新计时，持续生成超过 60 秒不会因此中断；该配置不设置总时长上限，也不改变分析任务等其他 AI 请求的超时策略。修改后需重启服务生效。
 
+`SCRIVERSE_AI_RESPONSE_MAX_BYTES` 控制 AI 供应商流式响应、普通响应和 Desktop 本地 AI 响应的字节上限。默认关闭上限；未设置、设为 `0` 或非法值时不限，设为正安全整数后按该字节数限制。修改后需重启服务生效。
+
 `SCRIVERSE_CHAPTER_ANNOTATION_NOTE_MAX_LENGTH` 在服务启动时读取，同时约束 API、界面输入和 AI 写计划中的正文评论与待办。修改后需重启服务生效。
 
 AI 上游 HTTP 重试配置在服务启动时读取。`403` 始终不重试；`429` 和 `502` 使用指数退避，等待从 500 毫秒开始并在 5 秒封顶，同时遵循秒数格式的 `Retry-After`（同样最多等待 5 秒）；其余 HTTP 错误使用线性等待。非法配置回退到对应默认值，修改后需重启服务生效。

package/dist/ai-response-limit.js

@@ -0,0 +1,12 @@
+export const AI_RESPONSE_MAX_BYTES_ENV = "SCRIVERSE_AI_RESPONSE_MAX_BYTES";
+export function resolveAiResponseMaxBytes(environment = process.env) {
+    const raw = environment[AI_RESPONSE_MAX_BYTES_ENV]?.trim() ?? "";
+    if (!/^\d+$/u.test(raw))
+        return null;
+    const configured = Number(raw);
+    return Number.isSafeInteger(configured) && configured > 0 ? configured : null;
+}
+export function isAiResponseByteLimitExceeded(receivedBytes, maximumBytes) {
+    return maximumBytes !== null && receivedBytes > maximumBytes;
+}
+//# sourceMappingURL=ai-response-limit.js.map

package/dist/ai-response-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-response-limit.js","sourceRoot":"","sources":["../src/ai-response-limit.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,yBAAyB,GAAG,iCAAiC,CAAC;AAE3E,MAAM,UAAU,yBAAyB,CAAC,cAAiC,OAAO,CAAC,GAAG;IACpF,MAAM,GAAG,GAAG,WAAW,CAAC,yBAAyB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACjE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,aAAqB,EAAE,YAA2B;IAC9F,OAAO,YAAY,KAAK,IAAI,IAAI,aAAa,GAAG,YAAY,CAAC;AAC/D,CAAC"}

package/dist/ai.js

@@ -8,6 +8,7 @@ import { AiConnectivityTestGate, hashAiConnectivityConfiguration } from "./ai-co
 import { aiHttpRetryCount, aiHttpRetryDelayMs, normalizeAiRetryPolicy } from "./ai-retry.js";
 import { DEFAULT_AI_STREAM_IDLE_TIMEOUT_MS, normalizeAiStreamIdleTimeoutSeconds } from "./ai-stream-timeout.js";
 import { DEFAULT_AI_CHAT_IMAGE_MAX_BYTES, formatUploadLimit } from "./upload-limits.js";
+import { isAiResponseByteLimitExceeded, resolveAiResponseMaxBytes } from "./ai-response-limit.js";
 import { characterExtractionHash, characterExtractionSelectionFingerprint, editableCharacterExtractionCandidate, normalizeCharacterExtractionCandidate, parseStoredCharacterExtractionCandidates } from "./character-extraction.js";
 import { AI_WRITE_TOOL_IDS, aiWritePlanOperationToolSchemas, askAiUserQuestionInputSchema } from "./ai-write-plans.js";
 import { DEFAULT_CHAPTER_ANNOTATION_NOTE_MAX_LENGTH } from "./chapter-annotation-note.js";
@@ -169,15 +170,18 @@ function completionSkillsTokens(messages) {
 // A small but non-transparent 128x128 PNG. The model test must exercise an actual image_url
 // payload, while keeping the request cheap and avoiding any user data in the probe.
 const MULTIMODAL_TEST_IMAGE_DATA_URL = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIAAAACACAYAAADDPmHLAAAACXBIWXMAAAPoAAAD6AG1e1JrAAACfklEQVR4nO2cwY3EQBACJ8LOglRJyw4DJOpR/xOUuF17Zp91H9xsBi/9B8AhABIcC4AEx78AJDg+AyDB8SEQCY5vAUhwfA1EguM5ABIcD4KQ4HgSiATHo2AkON4FIMHxMggJjreBSHC8DkaC4zwAEhwHQpDgOBGEBMeRMCQ4zgQiwXEoFAmOU8FIcBwLR4LjXgASHBdDkOC4GYQEx9UwJDjuBiLBcTkUCY7bwUhwXA8319P5fQCPS8APRChfAgIUBOFRWADlS0CAgiA8CgugfAkIUBCER2EBlC8BAQqC8CgsgPIlIEBBEB6FBVC+BAQoCMKjsADKl4AABUF4FBZA+RIQoCAIj8ICKF8CAhQE4VFYAOVLQICCIDwKC6B8CQhQEIRHYQGULwEBCoLwKCyA8iUgQEEQHoUFUL4EBCgIwqOwAMqXgAAFQXgUFkD5EhCgIAiPwgIoXwICFAThUVgA5UtAgIIgPAoLoHwJCFAQhEdhAZQvAQEKgvAoLIDyJSBAQRAehQVQvgQEKAjCo7AAypeAAAVBeBQWQPkSEKAgCI/CAihfAgIUBOFRWADlS0CAgiA8CgugfAkIUBCER2EBlC8BAQqC8CgsgPIlIEBBEB6FBVC+BAQoCMKjsADKl4AABUF4FBZA+RIQoCAIj8ICKF8CAhQE4VFYAOVLQICCIDwKC6B8CQhQEIRHYQGULwEBCoLwKCyA8iUgQEEQHoUFUL4EBCgIwqOwAMqXgAAFQXgUFkD5EhCgIAiPwgIoXwICFAThUVgA5UtAgIIgPAoLoHwJCFAQhEdhAZQvAQEKgvAoLIDyJSBAQRAehQVQvgQEKAjCo7AAypeAAAVBeJQfFY4JQ620WGEAAAAASUVORK5CYII=";
-/** 出站 AI 响应体上限，防止恶意或故障供应商推送超大响应拖垮进程。 */
-export const AI_RESPONSE_MAX_BYTES = 20 * 1024 * 1024;
-export async function readResponseTextLimited(response, maximumBytes = AI_RESPONSE_MAX_BYTES) {
+export async function readResponseTextLimited(response, maximumBytes = resolveAiResponseMaxBytes()) {
     const declared = response.headers.get("content-length");
-    if (declared && /^\d+$/u.test(declared) && Number(declared) > maximumBytes) {
+    if (maximumBytes !== null && declared && /^\d+$/u.test(declared) && Number(declared) > maximumBytes) {
         throw new AppError(502, "AI_RESPONSE_TOO_LARGE", `AI 供应商响应超过 ${maximumBytes} 字节上限`);
     }
-    if (!response.body)
-        return response.text();
+    if (!response.body) {
+        const text = await response.text();
+        if (isAiResponseByteLimitExceeded(Buffer.byteLength(text, "utf8"), maximumBytes)) {
+            throw new AppError(502, "AI_RESPONSE_TOO_LARGE", `AI 供应商响应超过 ${maximumBytes} 字节上限`);
+        }
+        return text;
+    }
     const reader = response.body.getReader();
     const chunks = [];
     let total = 0;
@@ -188,7 +192,7 @@ export async function readResponseTextLimited(response, maximumBytes = AI_RESPON
         if (!value?.byteLength)
             continue;
         total += value.byteLength;
-        if (total > maximumBytes) {
+        if (isAiResponseByteLimitExceeded(total, maximumBytes)) {
             await reader.cancel().catch(() => undefined);
             throw new AppError(502, "AI_RESPONSE_TOO_LARGE", `AI 供应商响应超过 ${maximumBytes} 字节上限`);
         }
@@ -236,7 +240,6 @@ export function autoRunFailureDisposition(error, attemptCount) {
 }
 const DESKTOP_LOCAL_AI_RUN_LIMIT = 20;
 const DESKTOP_LOCAL_AI_RUN_RETENTION_MS = 10 * 60_000;
-const DESKTOP_LOCAL_AI_RESPONSE_MAX_BYTES = 4 * 1024 * 1024;
 const allowedParameters = new Set(["temperature", "top_p", "max_tokens", "presence_penalty", "frequency_penalty", "seed"]);
 const DEFAULT_MAX_TOKENS = 32_000;
 const MAX_MODEL_OUTPUT_TOKENS = 2_000_000;
@@ -5961,8 +5964,10 @@ export class AiManager {
         if (pending.request.requestId !== input.requestId) {
             throw new AppError(409, "DESKTOP_LOCAL_AI_REQUEST_MISMATCH", "Desktop 本地 AI 响应与当前请求不匹配");
         }
-        if (Buffer.byteLength(input.body, "utf8") > DESKTOP_LOCAL_AI_RESPONSE_MAX_BYTES) {
-            throw new AppError(413, "DESKTOP_LOCAL_AI_RESPONSE_TOO_LARGE", "Desktop 本地 AI 响应过大");
+        const maximumResponseBytes = resolveAiResponseMaxBytes();
+        const responseBytes = Buffer.byteLength(input.body, "utf8");
+        if (isAiResponseByteLimitExceeded(responseBytes, maximumResponseBytes)) {
+            throw new AppError(413, "DESKTOP_LOCAL_AI_RESPONSE_TOO_LARGE", `Desktop 本地 AI 响应超过 ${maximumResponseBytes} 字节上限`);
         }
         run.pending = null;
         run.status = "running";
@@ -9973,6 +9978,7 @@ export class AiManager {
                 onThinkingDelta(finalReasoning);
             }
         };
+        const maximumResponseBytes = resolveAiResponseMaxBytes();
         let receivedBytes = 0;
         let readerEnded = false;
         try {
@@ -9988,9 +9994,9 @@ export class AiManager {
                 }
                 if (chunk.value?.byteLength) {
                     receivedBytes += chunk.value.byteLength;
-                    if (receivedBytes > AI_RESPONSE_MAX_BYTES) {
+                    if (isAiResponseByteLimitExceeded(receivedBytes, maximumResponseBytes)) {
                         await reader.cancel().catch(() => undefined);
-                        throw new AppError(502, "AI_RESPONSE_TOO_LARGE", `AI 供应商响应超过 ${AI_RESPONSE_MAX_BYTES} 字节上限`);
+                        throw new AppError(502, "AI_RESPONSE_TOO_LARGE", `AI 供应商响应超过 ${maximumResponseBytes} 字节上限`);
                     }
                 }
                 buffer += decoder.decode(chunk.value, { stream: !chunk.done });