@raolin2025/claude-code-node 2.3.4 → 2.3.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raolin2025/claude-code-node",
-  "version": "2.3.4",
+  "version": "2.3.6",
   "description": "Node.js AI Code Agent CLI - Zero dependencies, pure JavaScript, security hardened, multi-channel notifications",
   "type": "module",
   "main": "src/index.js",

package/src/core/cli.js

@@ -144,6 +144,7 @@ function buildBanner({ model, permissionMode, session, maxTokens }) {
   const BLUE = '\x1b[34m'
   const CYAN = '\x1b[36m'
   const RESET = '\x1b[0m'
+  const RED = '\x1b[31m'
 
   // 像素风格 CC 机器人（19字符宽，带颜色边框）
   const robotRaw = [
@@ -151,8 +152,8 @@ function buildBanner({ model, permissionMode, session, maxTokens }) {
     '  │  ██       ██  │  ',
     '  │    ██████     │  ',
     '  │  ██       ██  │  ',
-    '  │              │  ',
-    '  │    ███████   │  ',
+    '  │               │  ',
+    '  │    ███████    │  ',
     '  │  ██       ██  │  ',
     '  │    ██████     │  ',
     '  │  ██   ██   ██ │  ',
@@ -163,7 +164,7 @@ function buildBanner({ model, permissionMode, session, maxTokens }) {
   const colorize = (line) =>
     line
       .replace(/[┌└─╭╮┐┘│]/g, BLUE + '$&' + RESET)
-      .replace(/[█]/g, CYAN + '$&' + RESET)
+      .replace(/[█]/g, RED + '$&' + RESET)
 
   const robotColored = robotRaw.map(colorize)
 

package/src/core/query-engine.js

@@ -17,7 +17,6 @@ import { parseStream, parseNonStreamResponse } from './streaming.js'
 import { autoCompact } from './compact.js'
 import { CostTracker } from './cost-tracker.js'
 import { EnhancedPermissionChecker } from '../security/enhanced-permission.js'
-import { checkHostSafety } from '../security/ssrf-guard.js'
 
 /**
  * 配置选项
@@ -312,21 +311,8 @@ export class QueryEngine {
 
     const url = apiBase.replace(/\/+$/, '') + '/chat/completions'
 
-    // H3 修复：SSRF 防护 — 在 fetch 之前检查 API 主机名
-    try {
-      const parsedUrl = new URL(url)
-      const hostResult = await checkHostSafety(parsedUrl.hostname)
-      if (!hostResult.allowed) {
-        throw new Error(`SSRF blocked: ${hostResult.reason}`)
-      }
-    } catch (err) {
-      if (err.message.startsWith('SSRF blocked:')) {
-        throw err
-      }
-      // URL 解析错误忽略，让 fetch 自己处理
-    }
-
-    // 带重试的 fetch
+    // apiBase 是用户显式指定的配置（--api-base），不是外部输入，跳过 SSRF 检查
+    // SSRF 防护仅适用于 web-fetch/web-search 等工具发起的请求
     const maxRetries = 3
     // Jitter 退避 — 指数退避 + 随机 ±50%，防止惊群效应
     const retryDelay = (baseMs, attempt) => {