@zhin.js/plugin-qrcode 1.1.25 → 1.1.26

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 凉菜
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -27,13 +27,17 @@ This plugin currently has no configuration fields. Its [`schema.json`](./schema.
 
 - `gen hello beautiful world`: generate a 300 × 300 QR image.
 - `gen hello --size 512` / `gen hello -s 512`: choose 64–1024 pixels.
-- `scan https://example.com/qr.png`: decode an existing QR image.
+- `scan https://example.com/qr.png`: decode an existing QR image. The image URL (http/https only) is sent to the public `api.qrserver.com` decoder; the request times out after 10 seconds.
 - `gen --help`: show parameters, constraints and defaults.
 
 The Endpoint determines any command prefix. An explicit `commandNamespace` adds a plugin
 namespace; neither is hardcoded in the command. Generation declares text length (1–2048)
 and image size in `defineCommand`; invalid values are rejected before creating the image.
 
+QR images are generated locally (`zhin.js/qrcode`) by the `gen` command, the `qrcode_generate`
+Agent tool and the Console page alike, and are sent as PNG data URLs; the content is never
+forwarded to a third-party service.
+
 ## Language / 语言
 
 命令说明和执行反馈跟随当前操作语言（简体中文或英文）；用户输入与第三方内容保持原样，不进行自动翻译。语言与时区、权限和实际执行行为独立。参见[官方插件语言说明](../../README.md#语言与内容)。

package/commands/gen/index.js

@@ -1,10 +1,10 @@
 // Generated by build-plugin-runtime-entries.mjs. Do not edit.
 import { defineCommand } from 'zhin.js/command';
 import { raw } from '@zhin.js/core/runtime';
-import { buildQrImageUrl } from "../../lib/qrcode-lib.js";
+import { buildQrDataUrl } from "../../lib/qrcode-lib.js";
 export default defineCommand({
     description: '根据文本或链接生成二维码图片', descriptionI18n: { en: "Generate a QR code image from text or a link" },
     params: { text: { type: 'text', min: 1, max: 2048, description: '二维码内容（可含空格）', descriptionI18n: { en: "QR code content (spaces allowed)" } } },
     options: { size: { type: 'integer', alias: 's', default: 300, min: 64, max: 1024, description: '图片宽高（像素）', descriptionI18n: { en: "Image width and height in pixels" } } },
-    execute: ({ params, options }) => raw({ type: 'image', data: { url: buildQrImageUrl(params.text, options.size) } }),
+    execute: async ({ params, options }) => raw({ type: 'image', data: { url: await buildQrDataUrl(params.text, options.size) } }),
 });

package/commands/gen/index.ts

@@ -1,10 +1,10 @@
 import { defineCommand } from 'zhin.js/command';
 import { raw } from '@zhin.js/core/runtime';
-import { buildQrImageUrl } from '../../src/qrcode-lib.js';
+import { buildQrDataUrl } from '../../src/qrcode-lib.js';
 
 export default defineCommand({
   description: '根据文本或链接生成二维码图片', descriptionI18n: { en: "Generate a QR code image from text or a link" },
   params: { text: { type: 'text', min: 1, max: 2048, description: '二维码内容（可含空格）', descriptionI18n: { en: "QR code content (spaces allowed)" } } },
   options: { size: { type: 'integer', alias: 's', default: 300, min: 64, max: 1024, description: '图片宽高（像素）', descriptionI18n: { en: "Image width and height in pixels" } } },
-  execute: ({ params, options }) => raw({ type: 'image', data: { url: buildQrImageUrl(params.text, options.size) } }),
+  execute: async ({ params, options }) => raw({ type: 'image', data: { url: await buildQrDataUrl(params.text, options.size) } }),
 });

package/commands/scan/[url]/index.js

@@ -1,16 +1,21 @@
 // Generated by build-plugin-runtime-entries.mjs. Do not edit.
 import { defineCommand } from 'zhin.js/command';
 import { messages as t } from "../../../lib/i18n.js";
+import { isScannableImageUrl } from "../../../lib/qrcode-lib.js";
 const QR_API_BASE = 'https://api.qrserver.com/v1';
+const SCAN_TIMEOUT_MS = 10_000;
 export default defineCommand({
     description: '识别图片中的二维码内容', descriptionI18n: { en: "Read QR code content from an image" },
     params: { url: { type: 'string' } },
     async execute({ params, locale }) {
-        const imageUrl = String(params.url);
+        const imageUrl = String(params.url).trim();
+        if (!isScannableImageUrl(imageUrl))
+            return t(locale, 'invalidUrl');
         const apiUrl = `${QR_API_BASE}/read-qr-code/?fileurl=${encodeURIComponent(imageUrl)}`;
         try {
-            const response = await fetch(apiUrl);
+            const response = await fetch(apiUrl, { signal: AbortSignal.timeout(SCAN_TIMEOUT_MS) });
             if (!response.ok) {
+                await response.body?.cancel();
                 return t(locale, 'requestFailed');
             }
             const data = (await response.json());

package/commands/scan/[url]/index.ts

@@ -1,17 +1,21 @@
 import { defineCommand } from 'zhin.js/command';
 import { messages as t } from '../../../src/i18n.js';
+import { isScannableImageUrl } from '../../../src/qrcode-lib.js';
 
 const QR_API_BASE = 'https://api.qrserver.com/v1';
+const SCAN_TIMEOUT_MS = 10_000;
 
 export default defineCommand({
   description: '识别图片中的二维码内容', descriptionI18n: { en: "Read QR code content from an image" },
   params: { url: { type: 'string' } },
   async execute({ params, locale }) {
-    const imageUrl = String(params.url);
+    const imageUrl = String(params.url).trim();
+    if (!isScannableImageUrl(imageUrl)) return t(locale, 'invalidUrl');
     const apiUrl = `${QR_API_BASE}/read-qr-code/?fileurl=${encodeURIComponent(imageUrl)}`;
     try {
-      const response = await fetch(apiUrl);
+      const response = await fetch(apiUrl, { signal: AbortSignal.timeout(SCAN_TIMEOUT_MS) });
       if (!response.ok) {
+        await response.body?.cancel();
         return t(locale, 'requestFailed');
       }
       const data = (await response.json()) as Array<{

package/lib/i18n.d.ts

@@ -1,2 +1,2 @@
-export declare const messages: (locale: import("@zhin.js/plugin-runtime").Locale | undefined, key: "requestFailed" | "notFound" | "result" | "failed", values?: import("@zhin.js/plugin-runtime").MessageValues) => string;
+export declare const messages: (locale: import("@zhin.js/plugin-runtime").Locale | undefined, key: "invalidUrl" | "requestFailed" | "notFound" | "result" | "failed", values?: import("@zhin.js/plugin-runtime").MessageValues) => string;
 //# sourceMappingURL=i18n.d.ts.map

package/lib/i18n.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"i18n.d.ts","sourceRoot":"","sources":["../src/i18n.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,QAAQ,6LAiBnB,CAAC"}
+{"version":3,"file":"i18n.d.ts","sourceRoot":"","sources":["../src/i18n.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,QAAQ,4MAqBnB,CAAC"}

package/lib/i18n.js

@@ -1,5 +1,9 @@
 import { createMessages } from 'zhin.js/i18n';
 export const messages = createMessages({
+    "invalidUrl": {
+        "zh-CN": "请提供有效的 HTTP/HTTPS 图片链接",
+        "en": "Provide a valid HTTP or HTTPS image URL."
+    },
     "requestFailed": {
         "zh-CN": "二维码识别服务请求失败",
         "en": "The QR code service request failed."

package/lib/i18n.js.map

@@ -1 +1 @@
-{"version":3,"file":"i18n.js","sourceRoot":"","sources":["../src/i18n.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,CAAC,MAAM,QAAQ,GAAG,cAAc,CAAC;IACrC,eAAe,EAAE;QACf,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,qCAAqC;KAC5C;IACD,UAAU,EAAE;QACV,OAAO,EAAE,mBAAmB;QAC5B,IAAI,EAAE,kCAAkC;KACzC;IACD,QAAQ,EAAE;QACR,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,yBAAyB;KAChC;IACD,QAAQ,EAAE;QACR,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE,kDAAkD;KACzD;CACF,CAAC,CAAC"}
+{"version":3,"file":"i18n.js","sourceRoot":"","sources":["../src/i18n.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,CAAC,MAAM,QAAQ,GAAG,cAAc,CAAC;IACrC,YAAY,EAAE;QACZ,OAAO,EAAE,wBAAwB;QACjC,IAAI,EAAE,0CAA0C;KACjD;IACD,eAAe,EAAE;QACf,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,qCAAqC;KAC5C;IACD,UAAU,EAAE;QACV,OAAO,EAAE,mBAAmB;QAC5B,IAAI,EAAE,kCAAkC;KACzC;IACD,QAAQ,EAAE;QACR,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,yBAAyB;KAChC;IACD,QAAQ,EAAE;QACR,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE,kDAAkD;KACzD;CACF,CAAC,CAAC"}

package/lib/index.d.ts

@@ -1,2 +1,2 @@
-export { buildQrImageUrl, qrImageSegment } from './qrcode-lib.js';
+export { buildQrDataUrl, isScannableImageUrl, qrImageSegment } from './qrcode-lib.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC"}

package/lib/index.js

@@ -1,2 +1,2 @@
-export { buildQrImageUrl, qrImageSegment } from './qrcode-lib.js';
+export { buildQrDataUrl, isScannableImageUrl, qrImageSegment } from './qrcode-lib.js';
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC"}

package/lib/qrcode-lib.d.ts

@@ -1,8 +1,14 @@
-export declare function buildQrImageUrl(text: string, size?: number): string;
-export declare function qrImageSegment(text: string): {
+/**
+ * Render `text` as a PNG data URL in this process. The content never leaves the host:
+ * chat command, Agent tool and Console action all use this same local generator.
+ */
+export declare function buildQrDataUrl(text: string, size?: number): Promise<string>;
+export declare function qrImageSegment(text: string, size?: number): Promise<{
     type: "image";
     data: {
         url: string;
     };
-}[];
+}[]>;
+/** `scan` hands the image URL to the decoding service: only plain http(s) URLs are forwarded. */
+export declare function isScannableImageUrl(input: string): boolean;
 //# sourceMappingURL=qrcode-lib.d.ts.map

package/lib/qrcode-lib.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"qrcode-lib.d.ts","sourceRoot":"","sources":["../src/qrcode-lib.ts"],"names":[],"mappings":"AAEA,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,SAAM,GAAG,MAAM,CAGhE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM;;;;;IAG1C"}
+{"version":3,"file":"qrcode-lib.d.ts","sourceRoot":"","sources":["../src/qrcode-lib.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,SAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG9E;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,SAAM;;;;;KAE5D;AAED,iGAAiG;AACjG,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAQ1D"}

package/lib/qrcode-lib.js

@@ -1,11 +1,26 @@
-const QR_API_BASE = 'https://api.qrserver.com/v1';
-export function buildQrImageUrl(text, size = 300) {
+import { generateQrCode } from 'zhin.js/qrcode';
+/**
+ * Render `text` as a PNG data URL in this process. The content never leaves the host:
+ * chat command, Agent tool and Console action all use this same local generator.
+ */
+export async function buildQrDataUrl(text, size = 300) {
     if (!Number.isInteger(size) || size < 64 || size > 1024)
         throw new TypeError('QR size must be an integer between 64 and 1024');
-    return `${QR_API_BASE}/create-qr-code/?size=${size}x${size}&data=${encodeURIComponent(text)}`;
+    return (await generateQrCode(text, { width: size })).toDataUrl();
 }
-export function qrImageSegment(text) {
-    const qrUrl = buildQrImageUrl(text);
-    return [{ type: 'image', data: { url: qrUrl } }];
+export async function qrImageSegment(text, size = 300) {
+    return [{ type: 'image', data: { url: await buildQrDataUrl(text, size) } }];
+}
+/** `scan` hands the image URL to the decoding service: only plain http(s) URLs are forwarded. */
+export function isScannableImageUrl(input) {
+    if (input.length > 2048)
+        return false;
+    try {
+        const url = new URL(input);
+        return (url.protocol === 'http:' || url.protocol === 'https:') && !url.username && !url.password && url.hostname.includes('.');
+    }
+    catch {
+        return false;
+    }
 }
 //# sourceMappingURL=qrcode-lib.js.map

package/lib/qrcode-lib.js.map

@@ -1 +1 @@
-{"version":3,"file":"qrcode-lib.js","sourceRoot":"","sources":["../src/qrcode-lib.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,GAAG,6BAA6B,CAAC;AAElD,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAI,GAAG,GAAG;IACtD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAE,IAAI,IAAI,GAAG,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IAC/H,OAAO,GAAG,WAAW,yBAAyB,IAAI,IAAI,IAAI,SAAS,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;AAChG,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"qrcode-lib.js","sourceRoot":"","sources":["../src/qrcode-lib.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,IAAI,GAAG,GAAG;IAC3D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAE,IAAI,IAAI,GAAG,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IAC/H,OAAO,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,IAAI,GAAG,GAAG;IAC3D,OAAO,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjI,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhin.js/plugin-qrcode",
-  "version": "1.1.25",
+  "version": "1.1.26",
   "description": "QR code generator & reader plugin for Zhin.js (Plugin Runtime)",
   "type": "module",
   "main": "./lib/index.js",
@@ -19,7 +19,6 @@
     "pages",
     "src",
     "lib",
-    "tools",
     "skills",
     "README.md"
   ],
@@ -38,30 +37,26 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@zhin.js/console-contract": "1.1.5",
-    "@zhin.js/core": "1.1.60",
-    "@zhin.js/page": "1.1.17",
-    "@zhin.js/tool": "1.1.18",
-    "@zhin.js/skill": "1.1.16"
+    "zod": "^4.6.7",
+    "@zhin.js/console-contract": "1.1.6",
+    "@zhin.js/core": "1.2.0",
+    "@zhin.js/page": "1.1.18",
+    "@zhin.js/skill": "1.1.17",
+    "@zhin.js/tool": "1.1.19"
   },
   "devDependencies": {
     "typescript": "^6.0.3",
     "vitest": "^4.1.10",
-    "zod": "^4.4.3",
-    "zhin.js": "1.1.25"
+    "zhin.js": "1.1.26"
   },
   "peerDependencies": {
-    "zod": "^4.0.0",
-    "@zhin.js/command": "^1.1.17",
-    "@zhin.js/page": "^1.1.17",
-    "zhin.js": "^1.1.25"
+    "@zhin.js/command": "^1.2.0",
+    "@zhin.js/page": "^1.1.18",
+    "zhin.js": "^1.1.26"
   },
   "peerDependenciesMeta": {
     "@zhin.js/command": {
       "optional": true
-    },
-    "zod": {
-      "optional": true
     }
   },
   "repository": {
@@ -105,6 +100,6 @@
   "scripts": {
     "build": "tsc",
     "clean": "rimraf lib",
-    "test": "NODE_OPTIONS=--experimental-strip-types vitest run --root ../../.. plugins/utils/qrcode/tests"
+    "test": "vitest run --root ../../.. plugins/utils/qrcode/tests"
   }
 }

package/pages/index/index.js

@@ -41,7 +41,7 @@ export default definePageBlueprint({
             ],
         },
         {
-            name: 'clearHistory',
+            name: 'clear-history',
             label: { zh: '清空记录', en: 'Clear History' },
             variant: 'secondary',
         },

package/pages/index/index.ts

@@ -43,7 +43,7 @@ export default definePageBlueprint<QrCodeConsoleStatus>({
       ],
     },
     {
-      name: 'clearHistory',
+      name: 'clear-history',
       label: { zh: '清空记录', en: 'Clear History' },
       variant: 'secondary',
     },

package/plugin.js

@@ -1,7 +1,7 @@
 // Generated by build-plugin-runtime-entries.mjs. Do not edit.
 import { randomUUID } from 'node:crypto';
 import { definePlugin, definePluginCapabilityGraph, definePluginConsoleRpc, PluginConsoleRpcError, pluginConsoleRpcToken, } from 'zhin.js';
-import { generateQrCode } from 'zhin.js/qrcode';
+import { buildQrDataUrl } from "./lib/qrcode-lib.js";
 const MAX_HISTORY_ITEMS = 20;
 export default definePlugin({
     name: 'qrcode',
@@ -20,6 +20,8 @@ export default definePlugin({
     setup() {
         const history = [];
         const rpc = definePluginConsoleRpc({
+            // Day-to-day edits belong to operators; `:write` would otherwise infer `manage` (ADR 0049).
+            permissions: [{ id: 'qrcode:write', level: 'operate', description: '生成二维码' }],
             status: {
                 page: 'index',
                 demo: true,
@@ -46,9 +48,7 @@ export default definePlugin({
                         const width = Number.isFinite(rawWidth) && rawWidth >= 64 && rawWidth <= 1024
                             ? Math.round(rawWidth)
                             : 280;
-                        // Generates QR data URL via QRCode.toDataURL(...) under the hood
-                        const qr = await generateQrCode(rawText, { width });
-                        const dataUrl = qr.toDataUrl();
+                        const dataUrl = await buildQrDataUrl(rawText, width);
                         const entry = {
                             id: randomUUID(),
                             content: rawText,
@@ -79,11 +79,6 @@ export default definePlugin({
                 },
             },
         });
-        const methods = rpc.methods;
-        const clearHistoryMethod = methods.get('clear-history');
-        if (clearHistoryMethod) {
-            methods.set('clearHistory', clearHistoryMethod);
-        }
         return {
             consoleRpc: rpc,
         };

package/skills/qrcode/SKILL.md

@@ -30,7 +30,7 @@ tools:
 → qrcode_generate(text="https://example.com")
 ```
 
-生成 300×300 像素的 PNG 图片，支持任意文本和 URL。
+在本机生成 300×300 像素的 PNG 图片（data URL），内容不会发送给第三方服务；支持任意文本和 URL。
 
 ## 注意
 

package/skills/qrcode/tools/qrcode_generate/index.js

@@ -1,14 +1,13 @@
 // Generated by build-plugin-runtime-entries.mjs. Do not edit.
 import { defineAgentTool } from '@zhin.js/tool';
 import { z } from 'zod';
-import { buildQrImageUrl } from "../../../../lib/qrcode-lib.js";
+import { qrImageSegment } from "../../../../lib/qrcode-lib.js";
 export default defineAgentTool({
     description: '根据文本或 URL 生成二维码图片',
     inputSchema: z.object({ text: z.string().min(1) }),
     keywords: ['二维码', 'QR', 'qrcode'],
     tags: ['qrcode', 'image'],
     async execute({ text }) {
-        const qrUrl = buildQrImageUrl(text);
-        return JSON.stringify([{ type: 'image', data: { url: qrUrl } }]);
+        return JSON.stringify(await qrImageSegment(text));
     },
 });

package/skills/qrcode/tools/qrcode_generate/index.ts

@@ -1,6 +1,6 @@
 import { defineAgentTool } from '@zhin.js/tool';
 import { z } from 'zod';
-import { buildQrImageUrl } from '../../../../src/qrcode-lib.js';
+import { qrImageSegment } from '../../../../src/qrcode-lib.js';
 
 export default defineAgentTool<{ text: string }>({
   description: '根据文本或 URL 生成二维码图片',
@@ -8,7 +8,6 @@ export default defineAgentTool<{ text: string }>({
   keywords: ['二维码', 'QR', 'qrcode'],
   tags: ['qrcode', 'image'],
   async execute({ text }) {
-    const qrUrl = buildQrImageUrl(text);
-    return JSON.stringify([{ type: 'image', data: { url: qrUrl } }]);
+    return JSON.stringify(await qrImageSegment(text));
   },
 });

package/src/i18n.ts

@@ -1,6 +1,10 @@
 import { createMessages } from 'zhin.js/i18n';
 
 export const messages = createMessages({
+  "invalidUrl": {
+    "zh-CN": "请提供有效的 HTTP/HTTPS 图片链接",
+    "en": "Provide a valid HTTP or HTTPS image URL."
+  },
   "requestFailed": {
     "zh-CN": "二维码识别服务请求失败",
     "en": "The QR code service request failed."

package/src/index.ts

@@ -1 +1 @@
-export { buildQrImageUrl, qrImageSegment } from './qrcode-lib.js';
+export { buildQrDataUrl, isScannableImageUrl, qrImageSegment } from './qrcode-lib.js';

package/src/qrcode-lib.ts

@@ -1,11 +1,25 @@
-const QR_API_BASE = 'https://api.qrserver.com/v1';
+import { generateQrCode } from 'zhin.js/qrcode';
 
-export function buildQrImageUrl(text: string, size = 300): string {
+/**
+ * Render `text` as a PNG data URL in this process. The content never leaves the host:
+ * chat command, Agent tool and Console action all use this same local generator.
+ */
+export async function buildQrDataUrl(text: string, size = 300): Promise<string> {
   if (!Number.isInteger(size) || size < 64 || size > 1024) throw new TypeError('QR size must be an integer between 64 and 1024');
-  return `${QR_API_BASE}/create-qr-code/?size=${size}x${size}&data=${encodeURIComponent(text)}`;
+  return (await generateQrCode(text, { width: size })).toDataUrl();
 }
 
-export function qrImageSegment(text: string) {
-  const qrUrl = buildQrImageUrl(text);
-  return [{ type: 'image' as const, data: { url: qrUrl } }];
+export async function qrImageSegment(text: string, size = 300) {
+  return [{ type: 'image' as const, data: { url: await buildQrDataUrl(text, size) } }];
+}
+
+/** `scan` hands the image URL to the decoding service: only plain http(s) URLs are forwarded. */
+export function isScannableImageUrl(input: string): boolean {
+  if (input.length > 2048) return false;
+  try {
+    const url = new URL(input);
+    return (url.protocol === 'http:' || url.protocol === 'https:') && !url.username && !url.password && url.hostname.includes('.');
+  } catch {
+    return false;
+  }
 }