@waterplus-ai/waterbuddy 0.1.10 → 0.1.12

package/lib/host/index.js

@@ -38,13 +38,17 @@ function clearPersistedAuth() {
   try { fs.rmSync(authFile, { force: true }) } catch {}
 }
 
+function isSupportedAvatarUrl(url) {
+  return (url.protocol === 'http:' || url.protocol === 'https:') && !url.username && !url.password
+}
+
 function normalizeAvatar(value) {
   if (typeof value !== 'string' || !value) return undefined
   if (value.startsWith('data:')) return value
   try {
     const url = new URL(value, AI_URL)
-    if (url.protocol !== 'https:' || url.host !== new URL(AI_URL).host) return undefined
-    return `/api/waterbuddy/avatar?url=${encodeURIComponent(url.href)}`
+    if (!isSupportedAvatarUrl(url)) return undefined
+    return url.href
   } catch { return undefined }
 }
 
@@ -143,15 +147,13 @@ async function proxyAvatar(req, res) {
   const value = new URL(req.url, 'http://127.0.0.1').searchParams.get('url')
   let target
   try { target = new URL(value) } catch { return json(res, 400, { error: 'invalid-avatar-url' }) }
-  if (target.protocol !== 'https:' || target.host !== new URL(AI_URL).host) return json(res, 403, { error: 'avatar-host-not-allowed' })
-  const response = await fetch(target)
-  if (!response.ok || !response.body) return json(res, response.status || 502, { error: 'avatar-fetch-failed' })
-  res.writeHead(response.status, { 'content-type': response.headers.get('content-type') || 'image/jpeg', 'cache-control': 'private, max-age=3600' })
-  for await (const chunk of response.body) res.write(chunk)
+  if (!isSupportedAvatarUrl(target)) return json(res, 400, { error: 'avatar-url-not-supported' })
+  res.writeHead(302, { location: target.href, 'cache-control': 'private, max-age=3600' })
   res.end()
 }
 
 export const inject = ['webServer', 'systemPrompt']
+export { normalizeAvatar }
 
 export function apply(ctx) {
   readPersistedAuth()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@waterplus-ai/waterbuddy",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "description": "WaterBuddy branding and Web profile bundle for DeepSeek Harness",
   "license": "UNLICENSED",
   "type": "module",