openclaw-openagent 1.0.8 → 1.0.9

package/src/proxy/auth-proxy.ts

@@ -20,6 +20,7 @@ import nodePath from 'node:path';
 import { logger } from '../util/logger.js';
 import { registry } from '../runtime/registry.js';
 import { isUnconfiguredOasnApiBase } from '../auth/config.js';
+import { resolveOasnRelativeUrl } from '../util/url-resolver.js';
 
 /** TIM 路径默认上游（兼容旧版） */
 const AUTH_UPSTREAM_TIM = 'https://auth.ai-talk.live';
@@ -62,7 +63,7 @@ let _gatewayBaseUrl: string | undefined;
 
 /** Returns the gateway base URL as seen by the browser (e.g. http://localhost:18794). */
 export function getGatewayBaseUrl(): string {
-  return _gatewayBaseUrl ?? `http://localhost:18794`;
+  return _gatewayBaseUrl ?? 'http://localhost:18794';
 }
 
 // ── Handler factory ─────────────────────────────────────────────────────
@@ -86,20 +87,19 @@ export function createAuthProxyHandler() {
       logger.info(`[proxy] Gateway base URL detected: ${_gatewayBaseUrl}`);
     }
 
-    // ── T4: Serve local media files from /tmp/openclaw/openagent-media/ ──
-    // Files downloaded from remote agents via C2C are stored here.
-    // Tool result references them as MEDIA:http://localhost:PORT/plugins/openagent/media/{filename}
-    // to pass through the framework's filterToolResultMediaUrls (http URLs bypass whitelist check).
-    if (url.pathname.startsWith('/media/')) {
-      return serveLocalMedia(url.pathname, res);
-    }
-
     // req.url may or may not have the /plugins/openagent prefix stripped by Gateway
     // (behavior varies across Gateway versions), so strip it defensively.
     let targetPath = url.pathname;
     if (targetPath.startsWith('/plugins/openagent')) {
       targetPath = targetPath.slice('/plugins/openagent'.length);
     }
+    // ── T4: Serve local media files from /tmp/openclaw/openagent-media/ ──
+    // Files downloaded from remote agents are stored here. The media route must
+    // be detected after prefix normalization because Gateway versions disagree
+    // on whether /plugins/openagent has already been stripped.
+    if (targetPath.startsWith('/media/')) {
+      return serveLocalMedia(targetPath, res);
+    }
     // v3.9+ 双轨抽象：上游按当前 transport 切换（OASN → api.oasn.ai；TIM → auth.ai-talk.live）
     const method = req.method ?? 'GET';
     const rt = registry.getDefault();
@@ -128,7 +128,7 @@ export function createAuthProxyHandler() {
       writeJson(res, 503, { error: 'OASN api_base is not configured' });
       return true;
     }
-    const targetUrl = new URL(targetPath + url.search, upstreamBase).href;
+    const targetUrl = resolveOasnProxyTargetUrl(upstreamBase, targetPath, url.search);
 
     logger.info(`[proxy] ${method} ${url.pathname} → ${targetUrl}`);
 
@@ -193,6 +193,10 @@ export function createAuthProxyHandler() {
   };
 }
 
+export function resolveOasnProxyTargetUrl(upstreamBase: string, targetPath: string, search = ''): string {
+  return resolveOasnRelativeUrl(upstreamBase, `${targetPath}${search}`);
+}
+
 // ── T4: Local media serve ────────────────────────────────────────────────
 
 const MEDIA_DIR = '/tmp/openclaw/openagent-media';
@@ -212,6 +216,12 @@ const MIME_MAP: Record<string, string> = {
   '.webp': 'image/webp',
   '.pdf': 'application/pdf',
   '.txt': 'text/plain',
+  '.md': 'text/markdown; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.zip': 'application/zip',
+  '.pptx': 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+  '.docx': 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+  '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
 };
 
 /**
@@ -259,6 +269,9 @@ function serveLocalMedia(pathname: string, res: ServerResponse): true {
 
     res.setHeader('Content-Type', contentType);
     res.setHeader('Content-Length', stat.size);
+    if (shouldDownloadAsAttachment(contentType)) {
+      res.setHeader('Content-Disposition', `attachment; filename*=UTF-8''${encodeURIComponent(fileName)}`);
+    }
     // Allow browser to cache media for 1 hour
     res.setHeader('Cache-Control', 'private, max-age=3600');
 
@@ -284,6 +297,13 @@ function serveLocalMedia(pathname: string, res: ServerResponse): true {
   return true;
 }
 
+function shouldDownloadAsAttachment(contentType: string): boolean {
+  return !contentType.startsWith('image/')
+    && !contentType.startsWith('audio/')
+    && !contentType.startsWith('video/')
+    && !contentType.startsWith('text/plain');
+}
+
 // ── Helpers ──────────────────────────────────────────────────────────────
 
 /**

package/src/transport/oasn/oasn-http.ts

@@ -59,6 +59,62 @@ export interface OasnRequestOptions {
 const DEFAULT_TIMEOUT_MS = 30_000;
 const DEFAULT_MAX_RETRIES = 3;
 
+type GlobalAgentState = {
+  NO_PROXY?: string | null;
+};
+
+type GlobalWithAgent = typeof globalThis & {
+  GLOBAL_AGENT?: GlobalAgentState;
+};
+
+/**
+ * OpenClaw gateway may install global-agent for model/provider traffic. OASN
+ * REL endpoints should keep their original TLS hostname; otherwise a local
+ * proxy can turn `https://oasn-test...` into a certificate check against
+ * `localhost`.
+ */
+export function ensureOasnHostBypassesGlobalAgentProxy(hostname: string): void {
+  const normalized = hostname.trim().toLowerCase();
+  if (!normalized || normalized === 'localhost' || normalized === '127.0.0.1' || normalized === '::1') return;
+
+  const globalAgent = (globalThis as GlobalWithAgent).GLOBAL_AGENT;
+  if (!globalAgent || typeof globalAgent !== 'object') return;
+
+  const existing = String(globalAgent.NO_PROXY || '');
+  const entries = existing.split(/[\s,]+/).filter(Boolean);
+  if (entries.some((entry) => entry.toLowerCase() === normalized)) return;
+
+  globalAgent.NO_PROXY = entries.length > 0 ? `${entries.join(',')},${normalized}` : normalized;
+}
+
+function hasHeader(headers: Record<string, string>, name: string): boolean {
+  const lower = name.toLowerCase();
+  return Object.keys(headers).some((key) => key.toLowerCase() === lower);
+}
+
+export function buildNodeRequestOptions(
+  url: URL,
+  method: string,
+  headers: Record<string, string>,
+): RequestOptions & { servername?: string } {
+  const isHttps = url.protocol === 'https:';
+  const requestHeaders = { ...headers };
+  if (!hasHeader(requestHeaders, 'Host')) {
+    requestHeaders.Host = url.host;
+  }
+  const options: RequestOptions & { servername?: string } = {
+    method,
+    headers: requestHeaders,
+    hostname: url.hostname,
+    port: url.port || (isHttps ? 443 : 80),
+    path: `${url.pathname}${url.search}`,
+  };
+  if (isHttps) {
+    options.servername = url.hostname;
+  }
+  return options;
+}
+
 // ───────────────────────────────────────────────────────────────
 // 错误转换
 // ───────────────────────────────────────────────────────────────
@@ -354,15 +410,10 @@ export class OasnHttpClient {
   ): Promise<{ statusCode: number; headers: Record<string, string>; body: string }> {
     const isHttps = url.protocol === 'https:';
     const requestFn = isHttps ? httpsRequest : httpRequest;
+    ensureOasnHostBypassesGlobalAgentProxy(url.hostname);
 
     return new Promise((resolve, reject) => {
-      const reqOptions: RequestOptions = {
-        method,
-        headers,
-        hostname: url.hostname,
-        port: url.port || (isHttps ? 443 : 80),
-        path: `${url.pathname}${url.search}`,
-      };
+      const reqOptions = buildNodeRequestOptions(url, method, headers);
 
       let settled = false;
       let timeoutHandle: ReturnType<typeof setTimeout> | undefined;
@@ -421,15 +472,10 @@ export class OasnHttpClient {
   ): Promise<{ content: ArrayBuffer; mimeType: string; displayName: string }> {
     const isHttps = url.protocol === 'https:';
     const requestFn = isHttps ? httpsRequest : httpRequest;
+    ensureOasnHostBypassesGlobalAgentProxy(url.hostname);
 
     return new Promise((resolve, reject) => {
-      const reqOptions: RequestOptions = {
-        method: 'GET',
-        headers,
-        hostname: url.hostname,
-        port: url.port || (isHttps ? 443 : 80),
-        path: `${url.pathname}${url.search}`,
-      };
+      const reqOptions = buildNodeRequestOptions(url, 'GET', headers);
 
       let settled = false;
       let timeoutHandle: ReturnType<typeof setTimeout> | undefined;

package/src/util/url-resolver.ts

@@ -10,12 +10,23 @@ export function resolveOasnAccessUrl(accessApiBase: string | undefined, url: str
   if (/^https?:\/\//i.test(url)) return url;
   if (!accessApiBase) return url;
   try {
-    return new URL(url, accessApiBase).toString();
+    return resolveOasnRelativeUrl(accessApiBase, url);
   } catch {
     return url;
   }
 }
 
+/**
+ * Resolve an OASN API/WebUI-relative path without losing env prefixes such as
+ * `/e/limj1`. `new URL('/api/..', 'https://host/e/limj1')` resets to the
+ * origin root, so use explicit path joining for env-scoped public bases.
+ */
+export function resolveOasnRelativeUrl(accessApiBase: string, path: string): string {
+  const base = accessApiBase.replace(/\/+$/, '');
+  const suffix = path.startsWith('/') ? path : `/${path}`;
+  return new URL(`${base}${suffix}`).toString();
+}
+
 /**
  * Resolve a WebUI continuation URL for user-facing browser clicks.
  *
@@ -30,23 +41,28 @@ export function resolveOasnWebuiUrl(
 ): string {
   if (!url) return url;
 
-  const claimOrigin = originOf(claimUrl);
-  if (!claimOrigin || !isWebuiUrl(url, accessApiBase || claimOrigin)) {
+  const claimPublicBase = publicBaseOfClaimUrl(claimUrl);
+  if (!claimPublicBase || !isWebuiUrl(url, accessApiBase || claimPublicBase)) {
     return resolveOasnAccessUrl(accessApiBase, url);
   }
 
   try {
-    const absolute = new URL(url, accessApiBase || claimOrigin);
-    return new URL(`${absolute.pathname}${absolute.search}${absolute.hash}`, claimOrigin).toString();
+    const absolute = new URL(resolveOasnAccessUrl(accessApiBase || claimPublicBase, url));
+    const webuiIndex = absolute.pathname.indexOf('/webui/');
+    const path = webuiIndex >= 0 ? absolute.pathname.slice(webuiIndex) : absolute.pathname;
+    return resolveOasnRelativeUrl(claimPublicBase, `${path}${absolute.search}${absolute.hash}`);
   } catch {
     return resolveOasnAccessUrl(accessApiBase, url);
   }
 }
 
-function originOf(value: string | undefined): string | undefined {
+function publicBaseOfClaimUrl(value: string | undefined): string | undefined {
   if (!value) return undefined;
   try {
-    return new URL(value).origin;
+    const parsed = new URL(value);
+    const claimPathIndex = parsed.pathname.indexOf('/agents/claim');
+    if (claimPathIndex <= 0) return parsed.origin;
+    return `${parsed.origin}${parsed.pathname.slice(0, claimPathIndex)}`;
   } catch {
     return undefined;
   }
@@ -54,7 +70,7 @@ function originOf(value: string | undefined): string | undefined {
 
 function isWebuiUrl(url: string, base: string): boolean {
   try {
-    return new URL(url, base).pathname.startsWith('/webui/');
+    return /(?:^|\/)webui\//.test(new URL(resolveOasnAccessUrl(base, url)).pathname);
   } catch {
     return false;
   }