evolcore 0.0.1 → 0.0.3

package/dist/utils/log-writer.js

@@ -0,0 +1,270 @@
+/**
+ * LogWriter — 统一的日志文件管理。
+ *
+ * 一个实例 = 一份"活跃日志 + 历史归档"。所有 EvolCore 内部需要写日志的地方
+ * 都应通过它，避免每个模块各自实现切片/清理。
+ *
+ * 切片规则：
+ *   - 'hourly' / 'daily'：进入新时段时把当前活跃文件 rename 成
+ *     `<base>-YYYYMMDD-HH.log` / `<base>-YYYYMMDD.log`，活跃文件名固定为
+ *     `<base>.log`。这样 `tail -F <base>.log` 能跨切片续接（必须 -F，跟 path）。
+ *   - 'size'：活跃文件超过 maxSize 时 rename 成 `<base>.log.<ISO-15>`。
+ *   - 'none'：不切。
+ *
+ * 清理：进入新时段或启动时按 retention 删除过旧的归档文件。
+ *
+ * 设计取舍：LogWriter 不持有 stream，每次 write 时按需 open-append-close。
+ *   优点：跨切片简单（rename 后下次 write 自动开新文件）；
+ *   代价：每行一次 open/close 在高频日志下不便宜——但 EvolCore 的日志量
+ *   远低于 OS 缓存带宽，实测无瓶颈。
+ *   后续若有热点（如 messages.log）可改成持流模式 + 切片时 close。
+ */
+import fs from 'fs';
+import path from 'path';
+import { clearInterval as clearNativeInterval, clearTimeout as clearNativeTimeout, setInterval as setNativeInterval, setTimeout as setNativeTimeout, } from 'node:timers';
+const HOUR_MS = 60 * 60 * 1000;
+const DAY_MS = 24 * HOUR_MS;
+/**
+ * Rotate the daemon's redirected stdout before a launcher opens it for append.
+ * stdout is owned by the launcher rather than LogWriter, so both start and
+ * restart paths must call this after the previous daemon has exited.
+ */
+export function rotateStdoutLog(logDir, options = {}) {
+    const maxSize = options.maxSize ?? 10 * 1024 * 1024;
+    const retentionMs = options.retentionMs ?? 7 * DAY_MS;
+    const now = options.now ?? Date.now();
+    const stdoutLog = path.join(logDir, 'stdout.log');
+    let rotatedPath = null;
+    try {
+        if (fs.statSync(stdoutLog).size > maxSize) {
+            const timestamp = new Date(now).toISOString().replace(/[:.]/g, '').slice(0, 15);
+            const baseArchive = `${stdoutLog}.${timestamp}`;
+            let archive = baseArchive;
+            let suffix = 1;
+            while (fs.existsSync(archive))
+                archive = `${baseArchive}.${suffix++}`;
+            fs.renameSync(stdoutLog, archive);
+            rotatedPath = archive;
+        }
+    }
+    catch {
+        // Missing/unreadable stdout must not prevent the daemon from starting.
+    }
+    const removedArchives = [];
+    const cutoff = now - retentionMs;
+    try {
+        for (const name of fs.readdirSync(logDir)) {
+            if (!name.startsWith('stdout.log.'))
+                continue;
+            const full = path.join(logDir, name);
+            try {
+                const stat = fs.lstatSync(full);
+                if (stat.isSymbolicLink() || stat.mtimeMs < cutoff) {
+                    fs.unlinkSync(full);
+                    removedArchives.push(full);
+                }
+            }
+            catch { }
+        }
+    }
+    catch { }
+    return { rotatedPath, removedArchives };
+}
+export class LogWriter {
+    baseName;
+    logDir;
+    rotation;
+    maxSize;
+    retentionMs;
+    /** 当前活跃时段 tag（hourly: YYYYMMDD-HH，daily: YYYYMMDD），用于检测切片 */
+    currentTag;
+    /** 周期清理 timer（unref 不阻塞退出） */
+    cleanupTimer = null;
+    boundaryTimer = null;
+    constructor(opts) {
+        this.baseName = opts.baseName;
+        this.logDir = opts.logDir;
+        this.rotation = opts.rotation;
+        this.maxSize = opts.maxSize ?? 10 * 1024 * 1024;
+        this.retentionMs =
+            (opts.retention.hours ?? 0) * HOUR_MS +
+                (opts.retention.days ?? 0) * DAY_MS;
+        fs.mkdirSync(this.logDir, { recursive: true });
+        this.currentTag = this.tagOfNow();
+        // 启动时如果 active 文件已存在但归属上一时段，先归档掉
+        this.rotateIfNeeded(/* sync */ true);
+        this.cleanupOldArchives();
+        // 周期触发切片+清理。两段式定时器：先用 setTimeout 对齐到下一个整点
+        //（hourly: 下个整点；daily: 明日 00:00），然后切到每小时一次的 setInterval。
+        // 这样空闲期也能按时切片——而不是等到下一次有人 write 才补切。
+        if (this.rotation === 'hourly' || this.rotation === 'daily') {
+            const tick = () => {
+                this.rotateIfNeeded(false);
+                this.cleanupOldArchives();
+            };
+            const initialDelay = this.msUntilNextBoundary();
+            this.boundaryTimer = setNativeTimeout(() => {
+                this.boundaryTimer = null;
+                tick();
+                this.cleanupTimer = setNativeInterval(tick, HOUR_MS);
+                this.cleanupTimer.unref?.();
+            }, initialDelay);
+            this.boundaryTimer.unref?.();
+        }
+    }
+    /** 写一行（自动加 \n） */
+    write(line) {
+        this.rotateIfNeeded(false);
+        try {
+            fs.appendFileSync(this.activePath(), line + '\n');
+        }
+        catch {
+            // 写入失败不抛——日志不能影响业务
+        }
+    }
+    /** 关闭（停掉清理 timer）。一般不需要调用，进程退出 timer 自动失效 */
+    close() {
+        if (this.boundaryTimer) {
+            clearNativeTimeout(this.boundaryTimer);
+            this.boundaryTimer = null;
+        }
+        if (this.cleanupTimer) {
+            clearNativeInterval(this.cleanupTimer);
+            this.cleanupTimer = null;
+        }
+    }
+    /** 当前活跃文件绝对路径 */
+    activePath() {
+        return path.join(this.logDir, `${this.baseName}.log`);
+    }
+    // ── Internal ──
+    /** 距离下一个整时段边界的毫秒数（hourly: 下个整点；daily: 明日 00:00） */
+    msUntilNextBoundary() {
+        const now = new Date();
+        const next = new Date(now);
+        if (this.rotation === 'daily') {
+            next.setDate(next.getDate() + 1);
+            next.setHours(0, 0, 0, 0);
+        }
+        else {
+            next.setHours(next.getHours() + 1, 0, 0, 0);
+        }
+        // 给 1 秒余量，确保 Date 时钟跨越整点后再触发，避免边界误差
+        return Math.max(1000, next.getTime() - now.getTime() + 1000);
+    }
+    tagOfNow() {
+        const d = new Date();
+        const pad = (n) => String(n).padStart(2, '0');
+        const day = `${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}`;
+        if (this.rotation === 'daily')
+            return day;
+        return `${day}-${pad(d.getHours())}`;
+    }
+    archivePath(tag) {
+        return path.join(this.logDir, `${this.baseName}-${tag}.log`);
+    }
+    rotateIfNeeded(initial) {
+        const active = this.activePath();
+        if (this.rotation === 'none')
+            return;
+        if (this.rotation === 'size') {
+            let stat;
+            try {
+                stat = fs.statSync(active);
+            }
+            catch {
+                return;
+            }
+            if (stat.size <= this.maxSize)
+                return;
+            const tag = new Date().toISOString().replace(/[:.]/g, '').slice(0, 15);
+            try {
+                fs.renameSync(active, `${active}.${tag}`);
+            }
+            catch { }
+            this.cleanupOldArchives();
+            return;
+        }
+        // hourly / daily
+        const nowTag = this.tagOfNow();
+        // 文件不存在 → 直接更新 currentTag，下次 write 会创建
+        let stat = null;
+        try {
+            stat = fs.statSync(active);
+        }
+        catch { /* not exist */ }
+        if (!stat) {
+            this.currentTag = nowTag;
+            return;
+        }
+        // 启动时：用 mtime 判断 active 文件归属哪个 tag
+        const ownerTag = initial ? this.tagOfTime(stat.mtimeMs) : this.currentTag;
+        if (ownerTag === nowTag) {
+            this.currentTag = nowTag;
+            return;
+        }
+        // 切片：把 active 重命名为 archive
+        const archive = this.archivePath(ownerTag);
+        try {
+            // 如果 archive 已存在（重名），先合并：append 老 active 内容到 archive 末尾
+            if (fs.existsSync(archive)) {
+                try {
+                    const content = fs.readFileSync(active);
+                    fs.appendFileSync(archive, content);
+                    fs.unlinkSync(active);
+                }
+                catch { }
+            }
+            else {
+                fs.renameSync(active, archive);
+            }
+        }
+        catch { }
+        this.currentTag = nowTag;
+    }
+    tagOfTime(ms) {
+        const d = new Date(ms);
+        const pad = (n) => String(n).padStart(2, '0');
+        const day = `${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}`;
+        if (this.rotation === 'daily')
+            return day;
+        return `${day}-${pad(d.getHours())}`;
+    }
+    cleanupOldArchives() {
+        LogWriter.cleanupArchivesIn(this.logDir, this.retentionMs);
+    }
+    /**
+     * 全局清理：扫整个 logDir，按 retention 删除所有匹配 LogWriter 归档命名约定的文件。
+     *
+     * 命名约定：`<baseName>-YYYYMMDD-HH.log`（hourly）或 `<baseName>-YYYYMMDD.log`（daily），
+     * 其中 baseName 由字母/数字/连字符组成。
+     *
+     * 这条规则跨 baseName 统一——只要文件按这个 pattern 命名就认为受 LogWriter 体系管辖。
+     * 这样 conditional 启用的 LogWriter（如 aun trace 关闭时）不会留下永久无人清的归档：
+     * 任意 LogWriter 实例化都会顺便清掉它们。
+     */
+    static cleanupArchivesIn(logDir, retentionMs) {
+        if (retentionMs <= 0)
+            return;
+        const cutoff = Date.now() - retentionMs;
+        let entries;
+        try {
+            entries = fs.readdirSync(logDir);
+        }
+        catch {
+            return;
+        }
+        const generalPattern = /^[A-Za-z0-9][A-Za-z0-9_-]*-\d{8}(?:-\d{2})?\.log$/;
+        for (const name of entries) {
+            if (!generalPattern.test(name))
+                continue;
+            const full = path.join(logDir, name);
+            try {
+                const st = fs.lstatSync(full);
+                if (st.isSymbolicLink() || st.mtimeMs < cutoff)
+                    fs.unlinkSync(full);
+            }
+            catch { }
+        }
+    }
+}

package/dist/utils/logger.js

@@ -0,0 +1,89 @@
+import fs from 'fs';
+import { resolvePaths } from '../paths.js';
+import { LogWriter } from './log-writer.js';
+let currentLevel = process.env.LOG_LEVEL || 'INFO';
+const LEVELS = { DEBUG: 0, INFO: 1, WARN: 2, ERROR: 3 };
+const config = {
+    messageLog: process.env.MESSAGE_LOG === 'true',
+    eventLog: process.env.EVENT_LOG === 'true'
+};
+let writers = null;
+fs.mkdirSync(resolvePaths().logs, { recursive: true });
+function closeWriters(current) {
+    current.main.close();
+    current.message?.close();
+    current.event?.close();
+    current.channelIn.close();
+    current.channelOut.close();
+}
+function getWriters() {
+    const logDir = resolvePaths().logs;
+    if (writers?.logDir === logDir)
+        return writers;
+    if (writers)
+        closeWriters(writers);
+    writers = {
+        logDir,
+        main: new LogWriter({ baseName: 'daemon', logDir, rotation: 'hourly', retention: { hours: 24 } }),
+        message: config.messageLog
+            ? new LogWriter({ baseName: 'messages', logDir, rotation: 'hourly', retention: { hours: 24 } })
+            : null,
+        event: config.eventLog
+            ? new LogWriter({ baseName: 'events', logDir, rotation: 'hourly', retention: { hours: 24 } })
+            : null,
+        channelIn: new LogWriter({ baseName: 'channel-in', logDir, rotation: 'hourly', retention: { hours: 24 } }),
+        channelOut: new LogWriter({ baseName: 'channel-out', logDir, rotation: 'hourly', retention: { hours: 24 } }),
+    };
+    return writers;
+}
+function shouldLog(level) {
+    return (LEVELS[level] ?? 1) >= (LEVELS[currentLevel] ?? 1);
+}
+export function localTimestamp() {
+    const d = new Date();
+    const pad = (n) => String(n).padStart(2, '0');
+    return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}T${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}.${String(d.getMilliseconds()).padStart(3, '0')}`;
+}
+function log(level, ...args) {
+    if (!shouldLog(level))
+        return;
+    const msg = `[${localTimestamp()}] [${level}] ${args.join(' ')}`;
+    getWriters().main.write(msg);
+}
+/**
+ * 设置日志级别（config 加载后调用，覆盖环境变量默认值）
+ * 优先级：config.debug.logLevel → LOG_LEVEL 环境变量 → 'INFO'
+ */
+export function setLogLevel(level) {
+    const upper = level.toUpperCase();
+    if (upper in LEVELS) {
+        currentLevel = upper;
+    }
+}
+export function getLogLevel() {
+    return currentLevel;
+}
+export const logger = {
+    debug: (...args) => log('DEBUG', ...args),
+    info: (...args) => log('INFO', ...args),
+    warn: (...args) => log('WARN', ...args),
+    error: (...args) => log('ERROR', ...args),
+    message: (data) => {
+        const writer = getWriters().message;
+        if (!writer)
+            return;
+        writer.write(JSON.stringify({ ts: localTimestamp(), ...data }));
+    },
+    event: (data) => {
+        const writer = getWriters().event;
+        if (!writer)
+            return;
+        writer.write(JSON.stringify({ ts: localTimestamp(), ...data }));
+    },
+    channelIn: (data) => {
+        getWriters().channelIn.write(JSON.stringify({ ts: localTimestamp(), ...data }));
+    },
+    channelOut: (data) => {
+        getWriters().channelOut.write(JSON.stringify({ ts: localTimestamp(), ...data }));
+    }
+};

package/dist/utils/markdown-to-plain-text.js

@@ -0,0 +1,20 @@
+export function markdownToPlainText(text) {
+    let result = text;
+    result = result.replace(/```[^\n]*\n?([\s\S]*?)```/g, (_, code) => code.trim());
+    result = result.replace(/!\[[^\]]*\]\([^)]*\)/g, '');
+    result = result.replace(/\[([^\]]+)\]\([^)]*\)/g, '$1');
+    result = result.replace(/^\|[\s:|-]+\|$/gm, '');
+    result = result.replace(/^\|(.+)\|$/gm, (_, inner) => inner.split('|').map(cell => cell.trim()).join('  '));
+    result = result.replace(/\*\*(.+?)\*\*/g, '$1');
+    result = result.replace(/\*(.+?)\*/g, '$1');
+    result = result.replace(/__(.+?)__/g, '$1');
+    result = result.replace(/_(.+?)_/g, '$1');
+    result = result.replace(/~~(.+?)~~/g, '$1');
+    result = result.replace(/`([^`]+)`/g, '$1');
+    result = result.replace(/^#{1,6}\s+/gm, '');
+    result = result.replace(/^>\s?/gm, '');
+    result = result.replace(/^[-*_]{3,}$/gm, '');
+    result = result.replace(/^(\s*)[-*+]\s/gm, '$1');
+    result = result.replace(/^(\s*)\d+\.\s/gm, '$1');
+    return result.trim();
+}

package/dist/utils/media-cache.js

@@ -0,0 +1,274 @@
+/**
+ * 统一媒体下载/缓存/SSRF防护框架
+ *
+ * 提供跨通道复用的文件处理能力：
+ * - 文件保存到 uploads 目录（自动去重、文件名清洗）
+ * - 图片类型白名单 + 大小限制
+ * - URL SSRF 防护（域名白名单 + 私有 IP 拦截）
+ * - 下载缓存（相同 key 不重复下载）
+ */
+import path from 'path';
+import fs from 'fs';
+import crypto from 'crypto';
+import { logger } from './logger.js';
+// ── 常量 ──────────────────────────────────────────────────────────────────────
+const DEFAULT_MAX_IMAGE_SIZE = 10 * 1024 * 1024; // 10 MB
+const DEFAULT_MAX_FILE_SIZE = 100 * 1024 * 1024; // 100 MB
+const ALLOWED_IMAGE_MIMES = new Set([
+    'image/png', 'image/jpeg', 'image/gif', 'image/webp',
+]);
+const UPLOADS_SUBDIR = '.evolcore/uploads';
+// ── SSRF 防护 ─────────────────────────────────────────────────────────────────
+/** 已知安全的 CDN 域名白名单 */
+const ALLOWED_CDN_HOSTS = new Set([
+    'novac2c.cdn.weixin.qq.com',
+    'open.feishu.cn',
+    'internal-api-lark-file.feishu.cn',
+    'oapi.dingtalk.com',
+    'api.dingtalk.com',
+]);
+/** 私有 IP 段正则（IPv4） */
+const PRIVATE_IP_RE = /^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|127\.|0\.|169\.254\.|::1|fc|fd|fe80)/;
+/**
+ * 检查 URL 是否安全（非 SSRF）
+ * - 拒绝私有 IP
+ * - 仅允许 https（或白名单域名的 http）
+ * - 可选：域名白名单模式
+ */
+export function validateUrl(url, opts) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return { ok: false, reason: `Invalid URL: ${url}` };
+    }
+    // 协议检查
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+        return { ok: false, reason: `Blocked protocol: ${parsed.protocol}` };
+    }
+    // 私有 IP 检查
+    const host = parsed.hostname;
+    if (PRIVATE_IP_RE.test(host)) {
+        return { ok: false, reason: `Blocked private IP: ${host}` };
+    }
+    // 域名白名单（如果提供）
+    const allowed = opts?.allowedHosts ?? ALLOWED_CDN_HOSTS;
+    if (allowed.size > 0 && !allowed.has(host)) {
+        return { ok: false, reason: `Host not in allowlist: ${host}` };
+    }
+    return { ok: true };
+}
+// ── 文件名清洗 ────────────────────────────────────────────────────────────────
+/**
+ * 清洗文件名：
+ * - 移除路径穿越字符（只保留 basename）
+ * - 替换非法字符
+ * - 空结果兜底
+ */
+export function sanitizeFileName(name) {
+    return path.basename(name).replace(/[<>:"|?*\x00-\x1f]/g, '_') || `file_${Date.now()}`;
+}
+// ── 图片验证 ──────────────────────────────────────────────────────────────────
+/**
+ * 验证图片 Buffer：类型白名单 + 大小限制
+ * 返回检测到的 MIME 类型，验证失败返回 null + reason
+ */
+export async function validateImage(buffer, opts) {
+    const maxSize = opts?.maxSize ?? DEFAULT_MAX_IMAGE_SIZE;
+    const allowed = opts?.allowedMimes ?? ALLOWED_IMAGE_MIMES;
+    if (buffer.length === 0) {
+        return { mime: null, reason: 'Empty buffer' };
+    }
+    if (buffer.length > maxSize) {
+        return { mime: null, reason: `Image too large: ${buffer.length} bytes (max ${maxSize})` };
+    }
+    // 动态导入 image-type（ESM only）
+    const { default: imageType } = await import('image-type');
+    // image-type 对极短/截断的 buffer 会抛 EndOfStreamError，捕获后按「无法识别」处理。
+    let type;
+    try {
+        type = await imageType(buffer);
+    }
+    catch (e) {
+        return { mime: null, reason: `Image type detection error: ${e.message}` };
+    }
+    if (!type) {
+        return { mime: null, reason: 'Unable to detect image type' };
+    }
+    if (!allowed.has(type.mime)) {
+        return { mime: null, reason: `Unsupported image type: ${type.mime}` };
+    }
+    return { mime: type.mime };
+}
+/**
+ * 把已下载的附件 Buffer 转成入站图片条目（供 baseagent 视觉通道）。
+ *
+ * 适用于所有「需要先下载再注入」的通道（AUN ticket 下载、未来其它 CDN 下载等）。
+ * 飞书/微信已有各自的 SDK 下载路径，可按需复用本函数统一 MIME 判定。
+ *
+ * 判定优先级：
+ *   1. magic bytes（image-type 库，最可靠，同时做大小/白名单校验）
+ *   2. 元数据 MIME 字段（att.content_type / mime_type / mimeType）
+ *   3. 文件名后缀
+ *
+ * @returns 是图片返回 InboundImage；非图片或校验失败返回 null。
+ */
+export async function bufferToInboundImage(buffer, hints) {
+    // 1. magic bytes（含大小 + 白名单校验；validateImage 已吞掉 image-type 的异常）
+    const validated = await validateImage(buffer);
+    if (validated.mime) {
+        return { data: buffer.toString('base64'), mimeType: validated.mime };
+    }
+    // 2/3. magic bytes 未识别时，回退到元数据字段 / 文件名后缀
+    //      （仍受 image 白名单约束，避免把任意文件当图片注入）
+    const metaCt = hints?.contentType || hints?.mimeType || '';
+    const byMeta = typeof metaCt === 'string' && ALLOWED_IMAGE_MIMES.has(metaCt) ? metaCt : '';
+    const byExt = hints?.filename
+        ? (ALLOWED_IMAGE_MIMES.has(guessMime(hints.filename)) ? guessMime(hints.filename) : '')
+        : '';
+    const fallback = byMeta || byExt;
+    if (fallback && buffer.length > 0 && buffer.length <= DEFAULT_MAX_IMAGE_SIZE) {
+        return { data: buffer.toString('base64'), mimeType: fallback };
+    }
+    return null;
+}
+/**
+ * 保存 Buffer 到 uploads 目录
+ * - 自动创建目录
+ * - 文件名清洗
+ * - 同名文件自动添加时间戳后缀
+ */
+export function saveToUploads(buffer, rawFileName, projectPath, opts) {
+    const fileName = sanitizeFileName(rawFileName);
+    const uploadsDir = path.join(projectPath, UPLOADS_SUBDIR);
+    fs.mkdirSync(uploadsDir, { recursive: true });
+    let targetName = fileName;
+    const targetPath = path.join(uploadsDir, targetName);
+    // 去重：内容相同则复用
+    if (opts?.dedup !== false && fs.existsSync(targetPath)) {
+        const existingHash = hashFile(targetPath);
+        const newHash = crypto.createHash('md5').update(buffer).digest('hex');
+        if (existingHash === newHash) {
+            logger.debug(`[MediaCache] Dedup hit: ${targetName}`);
+            return { filePath: targetPath, fileName: targetName, size: buffer.length };
+        }
+        // 不同内容同名 → 加时间戳
+        const ext = path.extname(fileName);
+        const base = path.basename(fileName, ext);
+        targetName = `${base}_${Date.now()}${ext}`;
+    }
+    const finalPath = path.join(uploadsDir, targetName);
+    fs.writeFileSync(finalPath, buffer);
+    logger.info(`[MediaCache] Saved: ${finalPath} (${buffer.length} bytes)`);
+    return { filePath: finalPath, fileName: targetName, size: buffer.length };
+}
+function hashFile(filePath) {
+    const content = fs.readFileSync(filePath);
+    return crypto.createHash('md5').update(content).digest('hex');
+}
+/**
+ * 安全下载 URL 内容，带 SSRF 防护
+ */
+export async function safeFetch(url, opts) {
+    const maxSize = opts?.maxSize ?? DEFAULT_MAX_FILE_SIZE;
+    const timeout = opts?.timeout ?? 30_000;
+    // SSRF 检查
+    if (!opts?.skipSsrfCheck) {
+        const check = validateUrl(url, { allowedHosts: opts?.allowedHosts });
+        if (!check.ok) {
+            throw new Error(`SSRF blocked: ${check.reason}`);
+        }
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeout);
+    try {
+        const res = await fetch(url, {
+            signal: controller.signal,
+            redirect: opts?.rejectRedirects ? 'error' : 'follow',
+        });
+        if (!res.ok)
+            throw new Error(`Download failed: ${res.status} ${res.statusText}`);
+        // 检查 Content-Length（如果可用）
+        const contentLength = res.headers.get('content-length');
+        if (contentLength && parseInt(contentLength) > maxSize) {
+            throw new Error(`File too large: ${contentLength} bytes (max ${maxSize})`);
+        }
+        const buffer = Buffer.from(await res.arrayBuffer());
+        if (buffer.length > maxSize) {
+            throw new Error(`File too large: ${buffer.length} bytes (max ${maxSize})`);
+        }
+        return buffer;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * 内存级下载缓存
+ * - 相同 key 不重复下载
+ * - TTL 过期自动清理
+ * - 最大条目限制防止内存泄漏
+ */
+export class DownloadCache {
+    cache = new Map();
+    ttlMs;
+    maxEntries;
+    constructor(opts) {
+        this.ttlMs = opts?.ttlMs ?? 5 * 60 * 1000; // 5 min
+        this.maxEntries = opts?.maxEntries ?? 100;
+    }
+    /**
+     * 获取或下载：缓存命中直接返回，否则执行 fetcher 并缓存结果
+     */
+    async getOrFetch(key, fetcher) {
+        this.evict();
+        const cached = this.cache.get(key);
+        if (cached) {
+            logger.debug(`[DownloadCache] Hit: ${key}`);
+            return cached.buffer;
+        }
+        const buffer = await fetcher();
+        this.cache.set(key, { buffer, createdAt: Date.now() });
+        // 超过 maxEntries 时删最旧
+        if (this.cache.size > this.maxEntries) {
+            const oldest = this.cache.keys().next().value;
+            this.cache.delete(oldest);
+        }
+        return buffer;
+    }
+    evict() {
+        const now = Date.now();
+        for (const [key, entry] of this.cache) {
+            if (now - entry.createdAt > this.ttlMs) {
+                this.cache.delete(key);
+            }
+        }
+    }
+    clear() {
+        this.cache.clear();
+    }
+}
+// ── MIME / Size helpers ──────────────────────────────────────────────────────
+const MIME_MAP = {
+    '.txt': 'text/plain', '.md': 'text/markdown', '.json': 'application/json',
+    '.js': 'text/javascript', '.ts': 'text/typescript', '.py': 'text/x-python',
+    '.html': 'text/html', '.css': 'text/css', '.csv': 'text/csv',
+    '.pdf': 'application/pdf', '.zip': 'application/zip', '.gz': 'application/gzip',
+    '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif', '.webp': 'image/webp', '.svg': 'image/svg+xml',
+    '.xml': 'application/xml', '.yaml': 'application/x-yaml', '.yml': 'application/x-yaml',
+    '.mp4': 'video/mp4', '.mov': 'video/quicktime', '.webm': 'video/webm', '.avi': 'video/x-msvideo',
+    '.opus': 'audio/ogg', '.mp3': 'audio/mpeg', '.aac': 'audio/aac', '.m4a': 'audio/mp4', '.wav': 'audio/wav',
+};
+export function guessMime(filename) {
+    const ext = path.extname(filename).toLowerCase();
+    return MIME_MAP[ext] || 'application/octet-stream';
+}
+export function formatSize(bytes) {
+    if (bytes < 1024)
+        return `${bytes} B`;
+    if (bytes < 1048576)
+        return `${(bytes / 1024).toFixed(1)} KB`;
+    return `${(bytes / 1048576).toFixed(1)} MB`;
+}

package/dist/utils/model-prices.jsonl

@@ -0,0 +1,20 @@
+{"model":"claude-opus-4-8","effective_from":0,"billing_fn":"per_token_v1","currency":"USD","price_input":15,"price_output":75,"price_cache_creation":18.75,"price_cache_read":1.5}
+{"model":"claude-opus-4-7","effective_from":0,"billing_fn":"per_token_v1","currency":"USD","price_input":15,"price_output":75,"price_cache_creation":18.75,"price_cache_read":1.5}
+{"model":"claude-opus-4-6","effective_from":0,"billing_fn":"per_token_v1","currency":"USD","price_input":15,"price_output":75,"price_cache_creation":18.75,"price_cache_read":1.5}
+{"model":"claude-sonnet-4-6","effective_from":0,"billing_fn":"per_token_v1","currency":"USD","price_input":3,"price_output":15,"price_cache_creation":3.75,"price_cache_read":0.3}
+{"model":"claude-haiku-4-5-20251001","effective_from":0,"billing_fn":"per_token_v1","currency":"USD","price_input":0.8,"price_output":4,"price_cache_creation":1,"price_cache_read":0.08}
+{"model":"gpt-5.6-sol","effective_from":0,"billing_fn":"per_token_v1","currency":"USD","price_input":5,"price_output":30,"price_cache_creation":6.25,"price_cache_read":0.5,"tiers":[{"up_to_input_tokens":272000,"price_input":5,"price_output":30,"price_cache_creation":6.25,"price_cache_read":0.5},{"up_to_input_tokens":null,"price_input":10,"price_output":45,"price_cache_creation":12.5,"price_cache_read":1}]}
+{"model":"gpt-5.6-terra","effective_from":0,"billing_fn":"per_token_v1","currency":"USD","price_input":2.5,"price_output":15,"price_cache_creation":3.125,"price_cache_read":0.25,"tiers":[{"up_to_input_tokens":272000,"price_input":2.5,"price_output":15,"price_cache_creation":3.125,"price_cache_read":0.25},{"up_to_input_tokens":null,"price_input":5,"price_output":22.5,"price_cache_creation":6.25,"price_cache_read":0.5}]}
+{"model":"gpt-5.6-luna","effective_from":0,"billing_fn":"per_token_v1","currency":"USD","price_input":1,"price_output":6,"price_cache_creation":1.25,"price_cache_read":0.1,"tiers":[{"up_to_input_tokens":272000,"price_input":1,"price_output":6,"price_cache_creation":1.25,"price_cache_read":0.1},{"up_to_input_tokens":null,"price_input":2,"price_output":9,"price_cache_creation":2.5,"price_cache_read":0.2}]}
+{"model":"gpt-5.5","effective_from":0,"billing_fn":"per_token_v1","currency":"USD","price_input":5,"price_output":30,"price_cache_creation":0,"price_cache_read":0.5,"tiers":[{"up_to_input_tokens":272000,"price_input":5,"price_output":30,"price_cache_creation":0,"price_cache_read":0.5},{"up_to_input_tokens":null,"price_input":10,"price_output":45,"price_cache_creation":0,"price_cache_read":1}]}
+{"model":"gpt-5.4","effective_from":0,"billing_fn":"per_token_v1","currency":"USD","price_input":2.5,"price_output":15,"price_cache_creation":0,"price_cache_read":0.25,"tiers":[{"up_to_input_tokens":272000,"price_input":2.5,"price_output":15,"price_cache_creation":0,"price_cache_read":0.25},{"up_to_input_tokens":null,"price_input":5,"price_output":22.5,"price_cache_creation":0,"price_cache_read":0.5}]}
+{"model":"gpt-5.3-codex","effective_from":0,"billing_fn":"per_token_v1","currency":"USD","price_input":1.75,"price_output":14,"price_cache_creation":0,"price_cache_read":0.175}
+{"model":"deepseek-v4-pro","effective_from":0,"billing_fn":"per_token_deepseek_v1","currency":"CNY","price_cache_hit":0.5,"price_cache_miss":2,"price_output":8}
+{"model":"deepseek-v4-flash","effective_from":0,"billing_fn":"per_token_deepseek_v1","currency":"CNY","price_cache_hit":0.1,"price_cache_miss":0.5,"price_output":2}
+{"model":"deepseek-v3.2","effective_from":0,"billing_fn":"per_token_deepseek_v1","currency":"CNY","price_cache_hit":0.5,"price_cache_miss":2,"price_output":8}
+{"model":"kimi-k2.6","effective_from":0,"billing_fn":"per_token_v1","currency":"CNY","price_input":2,"price_output":8,"price_cache_creation":0,"price_cache_read":0}
+{"model":"kimi-k2.5","effective_from":0,"billing_fn":"per_token_v1","currency":"CNY","price_input":2,"price_output":8,"price_cache_creation":0,"price_cache_read":0}
+{"model":"glm-5.1","effective_from":0,"billing_fn":"per_token_v1","currency":"CNY","price_input":5,"price_output":20,"price_cache_creation":0,"price_cache_read":0}
+{"model":"glm-5","effective_from":0,"billing_fn":"per_token_v1","currency":"CNY","price_input":5,"price_output":20,"price_cache_creation":0,"price_cache_read":0}
+{"model":"glm-4.7","effective_from":0,"billing_fn":"per_token_v1","currency":"CNY","price_input":1,"price_output":5,"price_cache_creation":0,"price_cache_read":0}
+{"model":"MiniMax-M2.7","effective_from":0,"billing_fn":"per_token_v1","currency":"CNY","price_input":1,"price_output":5,"price_cache_creation":0,"price_cache_read":0}