@waterplus-ai/waterbuddy 0.1.10 → 0.1.17

package/lib/client/index.js

@@ -143,6 +143,14 @@ window.__ModuleLoader__.load({
       })
     }
 
+    function SkipWelcomeNotice({ complete }) {
+      const { useEffect } = require('react')
+      useEffect(() => {
+        complete()
+      }, [complete])
+      return null
+    }
+
     const inject = ['slots']
     function apply(ctx) {
       ctx.effect(() => {
@@ -181,6 +189,7 @@ window.__ModuleLoader__.load({
           yield ctx.slots.register({ name: 'sidebar.brand.name', priority: -10 }, WaterBuddyName)
         }))
       ctx.slots.inject('sidebar.footer.action', () => ctx.slots.register({ name: 'sidebar.footer.action', id: 'waterbuddy-user', order: 90, label: '登录 WaterBuddy' }, UserAction))
+      ctx.slots.inject('settings.onboarding', () => ctx.slots.register({ name: 'settings.onboarding', id: 'welcome-notice', priority: -1000, order: -100 }, SkipWelcomeNotice))
     }
 
     exports.inject = inject

package/lib/host/index.js

@@ -17,8 +17,8 @@ function readPersistedAuth() {
   try {
     const value = JSON.parse(fs.readFileSync(authFile, 'utf8'))
     if (value?.token && value?.user) {
-      persistedAuth = value
-      currentUser = value.user
+      currentUser = normalizeUser(value.user)
+      persistedAuth = { ...value, user: currentUser }
     }
   } catch {}
 }
@@ -38,12 +38,24 @@ function clearPersistedAuth() {
   try { fs.rmSync(authFile, { force: true }) } catch {}
 }
 
+function isSupportedAvatarUrl(url) {
+  return (url.protocol === 'http:' || url.protocol === 'https:') && !url.username && !url.password
+}
+
 function normalizeAvatar(value) {
   if (typeof value !== 'string' || !value) return undefined
   if (value.startsWith('data:')) return value
   try {
-    const url = new URL(value, AI_URL)
-    if (url.protocol !== 'https:' || url.host !== new URL(AI_URL).host) return undefined
+    let source = value
+    for (let depth = 0; depth < 4; depth += 1) {
+      const candidate = new URL(source, 'http://127.0.0.1')
+      if (candidate.pathname !== '/api/waterbuddy/avatar') break
+      const nested = candidate.searchParams.get('url')
+      if (!nested) return undefined
+      source = nested
+    }
+    const url = new URL(source, AI_URL)
+    if (!isSupportedAvatarUrl(url)) return undefined
     return `/api/waterbuddy/avatar?url=${encodeURIComponent(url.href)}`
   } catch { return undefined }
 }
@@ -143,7 +155,7 @@ async function proxyAvatar(req, res) {
   const value = new URL(req.url, 'http://127.0.0.1').searchParams.get('url')
   let target
   try { target = new URL(value) } catch { return json(res, 400, { error: 'invalid-avatar-url' }) }
-  if (target.protocol !== 'https:' || target.host !== new URL(AI_URL).host) return json(res, 403, { error: 'avatar-host-not-allowed' })
+  if (!isSupportedAvatarUrl(target)) return json(res, 400, { error: 'avatar-url-not-supported' })
   const response = await fetch(target)
   if (!response.ok || !response.body) return json(res, response.status || 502, { error: 'avatar-fetch-failed' })
   res.writeHead(response.status, { 'content-type': response.headers.get('content-type') || 'image/jpeg', 'cache-control': 'private, max-age=3600' })
@@ -152,6 +164,7 @@ async function proxyAvatar(req, res) {
 }
 
 export const inject = ['webServer', 'systemPrompt']
+export { normalizeAvatar }
 
 export function apply(ctx) {
   readPersistedAuth()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@waterplus-ai/waterbuddy",
-  "version": "0.1.10",
+  "version": "0.1.17",
   "description": "WaterBuddy branding and Web profile bundle for DeepSeek Harness",
   "license": "UNLICENSED",
   "type": "module",