@nocobase/plugin-ai 2.2.0-alpha.5 → 2.2.0-alpha.7

package/dist/ai/docs/nocobase/file-manager/storage/local.md

@@ -9,6 +9,8 @@ Local Storage does not support private access. After a file is uploaded, NocoBas
 
 If you need to store contracts, identity documents, internal materials, or other files that should not be public, use [S3 Pro](./s3-pro). If historical files already exist, see [Migrate to S3 Pro](./migrate-to-s3-pro.md).
 
+If you are not using Docker or the official nginx configuration and access local uploaded files through a custom proxy, make sure the `/storage/uploads/` path sets `X-Content-Type-Options: nosniff` and returns active content files such as `html`, `svg`, `xhtml`, and `pdf` as attachments. For details, see [Security guide: File storage](../../security/guide.md#file-storage).
+
 :::
 
 ## Configuration Parameters
@@ -26,4 +28,4 @@ This section only introduces parameters specific to the local storage engine. Fo
 Represents both the relative path for file storage on the server and the URL access path. For example, "`user/avatar`" (without leading or trailing slashes) represents:
 
 1. The relative path on the server where uploaded files are stored: `/path/to/nocobase-app/storage/uploads/user/avatar`.
-2. The URL prefix for accessing the files: `http://localhost:13000/storage/uploads/user/avatar`.
+2. The URL prefix for accessing the files: `http://localhost:13000/storage/uploads/user/avatar`.

package/dist/ai/docs/nocobase/get-started/installation/docker-caddy.mdx

@@ -18,6 +18,7 @@ In this setup, the NocoBase app container and the Caddy container run separately
 
 If you need the `full` image, replace `latest-no-nginx` with `latest-full-no-nginx`.
 
+The `13000:80` mapping is only for convenient local testing, so it does not occupy the standard host ports directly. In production, you usually do not keep using `13000:80`; instead, let the external Caddy container map directly to the host `80` and `443` ports.
 ```yml
 networks:
   nocobase:
@@ -66,7 +67,11 @@ services:
         caddy run --config /etc/caddy/Caddyfile --adapter caddyfile
       '
     ports:
+      # This is only a local testing example.
       - "13000:80"
+      # In production, usually change it to:
+      # - "80:80"
+      # - "443:443"
 
   postgres:
     image: postgres:16
@@ -89,7 +94,7 @@ services:
 - `NOCOBASE_PROXY_UPSTREAM_HOST=app` lets the Caddy container reach the `app` service through the Compose network
 - `./storage` must be mounted into both the `app` and `caddy` containers so they can share proxy config, static assets, and uploaded files
 - The `caddy` container should wait until `nocobase.caddy` is generated, then link it to `/etc/caddy/Caddyfile` with `ln -sf`
-- Expose only the Caddy container port to the host. The `app` service does not need to expose its port to the host
+- Expose only the Caddy container port to the host. For testing, you can start with `13000:80`; in production, you usually expose the host `80` and `443` ports directly, while the `app` service does not need to expose its port to the host
 
 ## If you use a local host Caddy
 

package/dist/ai/docs/nocobase/get-started/installation/docker-nginx.mdx

@@ -18,6 +18,7 @@ In this setup, the NocoBase app container and the Nginx container run separately
 
 If you need the `full` image, replace `latest-no-nginx` with `latest-full-no-nginx`.
 
+The `13000:80` mapping is only for convenient local testing, so it does not occupy the standard host ports directly. In production, you usually do not keep using `13000:80`; instead, let the external Nginx container map directly to the host `80` and `443` ports.
 ```yml
 networks:
   nocobase:
@@ -67,7 +68,11 @@ services:
         nginx -g "daemon off;"
       '
     ports:
+      # This is only a local testing example.
       - "13000:80"
+      # In production, usually change it to:
+      # - "80:80"
+      # - "443:443"
 
   postgres:
     image: postgres:16
@@ -90,8 +95,7 @@ services:
 - `NOCOBASE_PROXY_UPSTREAM_HOST=app` lets the Nginx container reach the `app` service through the Compose network
 - `./storage` must be mounted into both the `app` and `nginx` containers so they can share proxy config, static assets, and uploaded files
 - The `nginx` container should wait until `nocobase.conf` is generated, then link it to `/etc/nginx/conf.d/default.conf` with `ln -sf`
-- If you use the built-in Nginx image, the `app` container itself exposes the port with `ports: "13000:80"`
-- If you use an external Nginx container, let the `nginx` container handle the host port mapping, and do not expose the `app` service port to the host
+- If you use an external Nginx container, let the `nginx` container handle the host port mapping. For testing, you can start with `13000:80`; in production, you usually expose the host `80` and `443` ports directly, while the `app` service does not need to expose its port to the host
 
 ## If you use a local host Nginx
 

package/dist/ai/docs/nocobase/get-started/installation/docker.mdx

@@ -617,4 +617,97 @@ Open [http://localhost:13000](http://localhost:13000) in your browser. The initi
 
 After logging in for the first time, please change the default password promptly to ensure system security.
 
-:::
+:::
+
+## 5. Production deployment
+
+If you use the built-in Nginx image, it is usually better not to expose `13000` directly to the public internet. A more common setup is to keep the container port available only on the host and let the host Nginx handle the domain, HTTPS, and reverse proxy.
+
+### Proxy the root path with Nginx
+
+The following config proxies domain requests to `http://127.0.0.1:13000/`:
+
+```bash
+server {
+    listen 80;
+    server_name your_domain.com;  # Replace your_domain.com with your domain
+
+    location / {
+        proxy_pass http://127.0.0.1:13000/;
+        proxy_http_version 1.1;
+
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $upstream_x_forwarded_proto;
+        proxy_set_header Host $final_host;
+        proxy_set_header Referer $http_referer;
+        proxy_set_header User-Agent $http_user_agent;
+
+        add_header Cache-Control "no-cache, no-store" always;
+        proxy_cache_bypass $http_upgrade;
+
+        proxy_connect_timeout 600;
+        proxy_send_timeout 600;
+        proxy_read_timeout 600;
+        send_timeout 600;
+        proxy_buffering off;
+    }
+}
+```
+
+If you also want to enable HTTPS, configure `443` and the certificate on the host Nginx. The NocoBase container does not need to handle certificates separately.
+
+### Subpath deployment
+
+If you want to deploy the app under a subpath, such as `https://your_domain.com/nocobase/`, configure the `APP_PUBLIC_PATH` environment variable first:
+
+```diff
+services:
+  app:
+    image: nocobase/nocobase:latest
+    environment:
++     - APP_PUBLIC_PATH=/nocobase/
+```
+
+Keep the leading and trailing `/` in the path. After this is configured, the app URL becomes `http://127.0.0.1:13000/nocobase/`.
+
+Then configure the host Nginx with the same subpath proxy:
+
+```bash
+server {
+    listen 80;
+    server_name your_domain.com;  # Replace your_domain.com with your domain
+
+    location /nocobase/ {
+        proxy_pass http://127.0.0.1:13000/nocobase/;
+        proxy_http_version 1.1;
+
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $upstream_x_forwarded_proto;
+        proxy_set_header Host $final_host;
+        proxy_set_header Referer $http_referer;
+        proxy_set_header User-Agent $http_user_agent;
+
+        add_header Cache-Control "no-cache, no-store" always;
+        proxy_cache_bypass $http_upgrade;
+
+        proxy_connect_timeout 600;
+        proxy_send_timeout 600;
+        proxy_read_timeout 600;
+        send_timeout 600;
+        proxy_buffering off;
+    }
+}
+```
+
+The key point is that `APP_PUBLIC_PATH` and the path in `proxy_pass` must stay consistent. If either side misses `/nocobase/`, static assets and routing will usually not work correctly.
+
+### Other options
+
+If you do not want to use the built-in Nginx, you can also use one of these separate proxy setups:
+
+- [Docker Installation (External Nginx)](./docker-nginx.mdx)
+- [Docker Installation (External Caddy)](./docker-caddy.mdx)

package/dist/ai/docs/nocobase/security/guide.md

@@ -215,6 +215,29 @@ If you need to store sensitive files, it is recommended to use a cloud storage s
 
 For local storage or other public storage that can be accessed directly through same-origin application URLs, you should also pay extra attention to the risks introduced by active content files. Files such as `html`, `xhtml`, and `svg` may be parsed and executed directly by the browser. If an attacker can upload such a file and trick a user into opening it, the attacker may use your trusted application domain to host a malicious page or script.
 
+NocoBase upload validation does not trust the `Content-Type` sent by the request. It prefers the MIME type detected on the server side. A file extension only represents the filename and should not be treated as the authoritative file content type. Therefore, when serving public uploaded files, you also need to make sure the file access path has proper security response headers.
+
+If you deploy with Docker or use the nginx configuration generated by NocoBase, the upload directory already includes this protection: all uploaded files return `X-Content-Type-Options: nosniff`, and active content files such as `html`, `xhtml`, `svg`, `svgz`, and `pdf` are returned as downloads through `Content-Disposition: attachment`.
+
+If you use a custom proxy, CDN, object storage, or expose the local upload directory directly, make sure these rules are not bypassed. You can use the following nginx configuration as a reference:
+
+```nginx
+location ~* ^/storage/uploads/(.*\.(?:htm|html|svg|svgz|xhtml|pdf))$ {
+    alias /path/to/nocobase/storage/uploads/$1;
+    add_header Content-Disposition "attachment" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    autoindex off;
+}
+
+location /storage/uploads/ {
+    alias /path/to/nocobase/storage/uploads/;
+    add_header X-Content-Type-Options "nosniff" always;
+    autoindex off;
+}
+```
+
+If your NocoBase app uses `APP_PUBLIC_PATH`, replace `/storage/uploads/` with the actual access prefix, such as `/nocobase/storage/uploads/`.
+
 In most cases, we recommend that administrators:
 
 - Prefer private storage, signed URLs, or a separate file domain, so that user-uploaded files are not served directly from the same origin as the main application.

package/dist/ai/tools/subAgentWebSearch.js

@@ -40,9 +40,12 @@ var subAgentWebSearch_default = (0, import_ai.defineTools)({
   },
   definition: {
     name: "subAgentWebSearch",
-    description: "Use the query to search the web and return concise, relevant findings with source links.",
+    description: "Search the web for current information. Put all independent search queries needed for this turn into one call so they can run in parallel. Do not call this tool repeatedly with similar queries unless the previous results are clearly insufficient for a critical missing fact.",
     schema: import_zod.z.object({
-      query: import_zod.z.array(import_zod.z.string(), "A clear and specific web search query describing the information to retrieve.")
+      query: import_zod.z.array(
+        import_zod.z.string(),
+        "A list of clear, specific, non-overlapping web search queries. Include all independent queries needed for this answer in a single tool call so they can run in parallel."
+      )
     })
   },
   invoke: async (ctx, args, id) => {
@@ -51,7 +54,8 @@ var subAgentWebSearch_default = (0, import_ai.defineTools)({
     const { model } = ((_b = (_a = ctx.action) == null ? void 0 : _a.params) == null ? void 0 : _b.values) ?? {};
     const { provider } = await pluginAI.aiManager.getLLMService({
       ...model,
-      webSearch: true
+      webSearch: true,
+      reasoning: { mode: "off" }
     });
     if (!((_c = args.query) == null ? void 0 : _c.length)) {
       return {
@@ -85,19 +89,20 @@ var subAgentWebSearch_default = (0, import_ai.defineTools)({
     };
   }
 });
-const WEB_SEARCH_SYSTEM_PROMPT = `You are a web search assistant.
+const WEB_SEARCH_SYSTEM_PROMPT = `You are a web search retrieval assistant.
 
-Your primary task is to retrieve up-to-date information from the internet based on the user's input query.
+Your output is for another AI model, not the final user-facing answer.
 
 Requirements:
-1. Actively attempt web retrieval first. Use internet search to find relevant and recent information.
-2. Summarize and synthesize findings clearly and concisely.
-3. Explicitly cite sources for key points whenever possible (for example: website/publication name, article title, and URL if available).
-4. Distinguish confirmed facts from uncertain or incomplete information.
-5. Do not fabricate search results, sources, or real-time data.
-6. If you cannot access reliable real-time information from the internet, clearly and honestly state that real-time retrieval was not possible, then provide the best available general information with that limitation noted.
+1. Retrieve current, relevant information for the query.
+2. Return concise findings only. Do not write a polished final answer.
+3. Include source title, publisher/site, URL, and publication or update date when available.
+4. Prefer authoritative and recent sources.
+5. Distinguish confirmed facts from uncertain or incomplete information.
+6. Do not fabricate results, sources, dates, or URLs.
+7. If results are weak, say exactly what is missing instead of broadening the search yourself.
 
-Output style:
-- Start with a brief direct answer.
-- Then provide a structured summary of findings.
-- End with a "Sources" section listing the origin of the information used.`;
+Output format:
+- Findings: 3-6 concise bullet points.
+- Sources: numbered list with title, site, URL, and date when available.
+- Gaps: one short sentence if important information could not be verified.`;