@zhin.js/plugin-nettools 0.1.10 → 0.1.12

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # @zhin.js/plugin-nettools
 
+## 0.1.12
+
+### Patch Changes
+
+- e1fda87: fix: 按审计待审清单处理（安全、功能、清理）
+
+  **行为变更（升级前请阅读）**
+
+  - kernel / core / zhin.js：出站文本中的 `${…}` 不再用 `vm` 求值，只替换 `TemplateContext` 上能解析到值的属性路径（如 `${sender.name}`）；表达式、函数调用、未知名字原样保留。整套 vm 沙箱（`evaluate` / `execute` / `compiler` / `getValueWithRuntime`）已移除。
+  - kernel / core / zhin.js：移除零引用的遗留导出——`Scheduler`、错误管理器与 `ZhinError` 子类、`compose`、`segment.from/toString`、AI 触发/准入函数、`@zhin.js/core/queue-im-field-contract`、`zhin.js/contexts`。
+  - agent：readonly 执行预设不再放行重定向、后台 `&`、进程替换、`find -delete/-exec`、`sed -i`、`sort -o`、`tee`、`xargs`、awk；curl/wget 校验每个 URL 与裸主机并识别更多上传参数；自定义 `execAllowlist` 中的只读命令带写入风险时改走审批。沙箱超时/取消会杀掉进程组或具名容器，默认镜像改为 `node:22-bookworm-slim` + `bash`。移除无生产调用的 `AuditLogger`、`AnomalyDetector`、旧 vision 回合等导出。
+  - ai：移除 `storage`、`FileStateCache`、`CostTracker`、`model-name-utils`、`./agent-step-checkpoint` 子路径、`ContextManager` 及旧压缩管线；延迟工具快照改为有界 LRU。
+  - cli：`zhin send` / `watch` / `schedule` 改为与运行中的 Host 通信（新增 `POST /message/send` 与 `/assistant/jobs` 写接口），`schedule` 不再支持离线改文件；移除 `zhin uninstall service`（用 `zhin service uninstall`）、`build --analyze`、`install -S`；`zhin stop` 杀不掉进程时保留 pid 文件并以非零退出；`runtime migrate` 新增 `verify`；未设置 `TZ` 时调度默认时区改为系统时区；不带 `ZHIN_SUPERVISOR_PID` 的进程被 init 接管后不再自行退出。
+  - schedule：后台 reconcile 出错不再产生未处理 rejection（新增 `onStoreError`）；启动途中 `stop()` 不再遗留定时器。
+  - schema：元组校验与 `safeParse`、JSON Schema 一致（空数组不通过，缺省的可选元组为 `undefined`）。
+  - client / contract：删除无后端路由的 agent-stream API、未使用的 `definePage` 与旧 PageManager 类型；`@zhin.js/contract` 不再依赖 `@zhin.js/ai`；客户端收到 401 会清除已保存的凭据；安装/更新/卸载 RPC 默认超时 120 秒。
+  - a2a：流式响应中途出错写入 SSE error 并结束；未配置 token 的非生产环境只接受本机请求；任务存储有上限与过期；Mailbox 凭据回退与生产环境缺密钥检查修复。
+  - speech：`provider: openai` 不再套用 Ollama 的默认 host/model；识别语言改为可配置，不再写死 `zh`。
+  - adapter-lark：支持 `encryptKey` 加密事件解密。adapter-github：Device Flow 可取消、带超时并回复失败原因。adapter-wecom / dingtalk：请求加超时并校验 HTTP 状态。adapter-weixin-ilink：输入关闭期间暂停轮询。adapter-milky：SSE 支持 CRLF、缓冲上限与空闲重连。adapter-onebot-events：好友删除通知改为 `notice.friend.decrease`。
+  - plugin-group-suite：`teachAllowRegex` 默认关闭，正则安全检查更严格。plugin-qrcode：改为本地生成，回复 data URL 图片。plugin-rss / short-url / link-poster：拒绝解析到内网的地址；rss 修复条目每周重复推送；short-url 的 Console 创建改为真实调用 is.gd。plugin-lottery：按 `historyLimit` 同步。
+
+  **其余**
+
+  - host-http：插件市场详情加缓存与包名校验，SSE 回放容忍背压。host-http-contract：新增 `readTextBody()`，九个适配器改用它。
+  - pagemanager：页面外壳 importmap 升级到 React 19.2.8 / react-router 7.12.0。console-contract：`definePage` 接受 `description` / `group` / `parent` / `fullWidth`。
+  - command：进度提示本地化，匹配不再重复拷贝消息段。runtime：源码监听降级后退避重试原生监听。
+  - html-renderer：删除未接线的 `aiTextAsImage`。create-zhin-app / scaffold-wizard：移除不起作用的"全局安装 CLI"与运行时选择提示。
+  - 依赖声明清理、发布清单不再携带解析不到的 `src` 目录、移除未使用的 Skill 挂载、README 与示例配置按当前实现更正。
+
+- eae4ea8: 官方插件接入分层功能配置（ADR 0050 / 0055）：所有带配置 Schema 的官方插件都声明全部四级（全局 / 适配器 / 账号 / 会话），Console 的适配器、账号与会话页面都能开关它们；密钥、调度与全局资源类字段收窄为仅全局。answers 与 group-suite 可按会话覆盖字段并开放群内自助字段（答题超时、科目一开关；欢迎语、排行条数、教学冷却与分页），ledger 的 `reportWhenEmpty` 可按订阅者会话覆盖。主动推送在发送前按目标会话检查开关：提醒（含管理员提醒）、日历授权通知、地震速报、记账日报、彩票推送、B 站开播 / 动态推送、activity-feedback 的状态提示在已停用的账号或会话上不再发送；roulette 的超时扫描在已停用的会话里静默结束对局（不结算、不禁言、不发消息）。`@zhin.js/schema` 新增 `.fieldLevels(levels)` 用于收窄单个字段的层级；`@zhin.js/testing` 的假插件上下文提供 `isEnabledFor` / `configFor`（`feature` 选项可模拟按会话停用与字段覆盖）。
+- 68659cd: `zod` 改为运行时依赖（原为可选对等依赖）：插件运行时在启动时就会加载这些包的约定目录（Agent 工具、命令等），其中静态导入了 `zod`；生成的项目里没有安装可选对等依赖，启动会报 `Cannot find package 'zod'`。范围为 `^4.6.7`（已修复的版本）。
+- Updated dependencies [e1fda87]
+- Updated dependencies [120e225]
+  - @zhin.js/skill@1.1.17
+  - @zhin.js/tool@1.1.19
+
+## 0.1.11
+
+### Patch Changes
+
+- @zhin.js/skill@1.1.16
+- @zhin.js/tool@1.1.18
+
 ## 0.1.10
 
 ### Patch Changes

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 凉菜
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -53,6 +53,12 @@ nettools:
   pingMaxNodes: 6
 ```
 
+## 分层配置（ADR 0050 / 0055）
+
+冷却、超时、重试等都是服务级设置，只能在全局层修改；启停开关支持适配器、账号与会话四级。在 Console「功能」区可以按适配器、账号或会话（群 / 私聊）单独停用；开启 `features.selfService.enabled` 后，群里有 `admin` 角色（默认含群主 / 管理员）的人也可以用 `功能 关闭 nettools` 关闭本群。上级停用后下级锁定，不能再开启。
+
+Layered configuration: all fields are global-only; the enable switch works per adapter, account and conversation.
+
 ## Security: target policy (SSRF guard)
 
 User input is canonicalised with the WHATWG URL host parser (the parser `fetch` uses), so odd spellings such as `2130706433`, `0x7f.1`, `017700000001`, `127.1` or `[::ffff:127.0.0.1]` are checked in their real form. URLs, ports, paths, user-info, zone ids and percent-encoding are refused outright.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhin.js/plugin-nettools",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "description": "Network tools plugin for Zhin.js — multi-region ping, RDAP whois, DNS-over-HTTPS lookup and domain price comparison (Plugin Runtime)",
   "type": "module",
   "main": "./lib/index.js",
@@ -42,27 +42,23 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@zhin.js/skill": "1.1.15",
-    "@zhin.js/tool": "1.1.17"
+    "zod": "^4.6.7",
+    "@zhin.js/skill": "1.1.17",
+    "@zhin.js/tool": "1.1.19"
   },
   "devDependencies": {
     "typescript": "^6.0.3",
     "vitest": "^4.1.10",
-    "zod": "^4.4.3",
-    "@zhin.js/command": "1.1.16",
-    "zhin.js": "1.1.23"
+    "@zhin.js/command": "1.2.0",
+    "zhin.js": "1.1.26"
   },
   "peerDependencies": {
-    "zod": "^4.0.0",
-    "@zhin.js/command": "^1.1.16",
-    "zhin.js": "^1.1.23"
+    "@zhin.js/command": "^1.2.0",
+    "zhin.js": "^1.1.26"
   },
   "peerDependenciesMeta": {
     "@zhin.js/command": {
       "optional": true
-    },
-    "zod": {
-      "optional": true
     }
   },
   "repository": {
@@ -103,6 +99,6 @@
     "build": "tsc",
     "check": "tsc -p tsconfig.check.json",
     "clean": "rimraf lib",
-    "test": "NODE_OPTIONS=--experimental-strip-types vitest run --root ../../.. plugins/utils/nettools/tests"
+    "test": "vitest run --root ../../.. plugins/utils/nettools/tests"
   }
 }

package/schema.json

@@ -2,61 +2,120 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "type": "object",
   "additionalProperties": false,
+  "x-zhin-config": {
+    "levels": [
+      "global",
+      "adapter",
+      "endpoint",
+      "conversation"
+    ]
+  },
   "properties": {
     "cooldownSeconds": {
       "type": "integer",
       "minimum": 0,
       "maximum": 3600,
       "default": 10,
-      "description": "Per-user cooldown in seconds, shared by all nettools commands and tools (0 disables)"
+      "description": "Per-user cooldown in seconds, shared by all nettools commands and tools (0 disables)",
+      "x-zhin-config": {
+        "levels": [
+          "global"
+        ]
+      }
     },
     "requestTimeoutMs": {
       "type": "integer",
       "minimum": 1000,
       "maximum": 30000,
       "default": 8000,
-      "description": "Per-attempt timeout for each external HTTP request, in milliseconds"
+      "description": "Per-attempt timeout for each external HTTP request, in milliseconds",
+      "x-zhin-config": {
+        "levels": [
+          "global"
+        ]
+      }
     },
     "maxRetries": {
       "type": "integer",
       "minimum": 0,
       "maximum": 5,
       "default": 2,
-      "description": "Retries for transient failures (network errors, timeouts, 429, 5xx) with exponential backoff and jitter"
+      "description": "Retries for transient failures (network errors, timeouts, 429, 5xx) with exponential backoff and jitter",
+      "x-zhin-config": {
+        "levels": [
+          "global"
+        ]
+      }
     },
     "pingMaxNodes": {
       "type": "integer",
       "minimum": 1,
       "maximum": 10,
       "default": 4,
-      "description": "Number of check-host.net probe nodes used by ping"
+      "description": "Number of check-host.net probe nodes used by ping",
+      "x-zhin-config": {
+        "levels": [
+          "global"
+        ]
+      }
     },
     "pingPollIntervalMs": {
       "type": "integer",
       "minimum": 500,
       "maximum": 10000,
       "default": 2000,
-      "description": "Wait between ping result polls, in milliseconds"
+      "description": "Wait between ping result polls, in milliseconds",
+      "x-zhin-config": {
+        "levels": [
+          "global"
+        ]
+      }
     },
     "pingMaxPolls": {
       "type": "integer",
       "minimum": 1,
       "maximum": 10,
       "default": 5,
-      "description": "Maximum number of ping result polls before reporting partial results"
+      "description": "Maximum number of ping result polls before reporting partial results",
+      "x-zhin-config": {
+        "levels": [
+          "global"
+        ]
+      }
     },
     "dohProviders": {
       "type": "array",
-      "items": { "type": "string", "enum": ["cloudflare", "alidns", "google"] },
-      "default": ["cloudflare", "alidns", "google"],
-      "description": "DNS-over-HTTPS providers in fallback order"
+      "items": {
+        "type": "string",
+        "enum": [
+          "cloudflare",
+          "alidns",
+          "google"
+        ]
+      },
+      "default": [
+        "cloudflare",
+        "alidns",
+        "google"
+      ],
+      "description": "DNS-over-HTTPS providers in fallback order",
+      "x-zhin-config": {
+        "levels": [
+          "global"
+        ]
+      }
     },
     "priceListLimit": {
       "type": "integer",
       "minimum": 1,
       "maximum": 20,
       "default": 8,
-      "description": "Number of registrars shown in a domain price comparison"
+      "description": "Number of registrars shown in a domain price comparison",
+      "x-zhin-config": {
+        "levels": [
+          "global"
+        ]
+      }
     }
   }
 }