u1s1-cli 1.3.0 → 1.3.2

package/dist/tools.js

@@ -8,6 +8,8 @@ import { generateImage, renderPage, searchWeb } from "./api.js";
 const FETCH_TIMEOUT_MS = 20_000;
 const MAX_FETCH_BYTES = 2_000_000;
 const MAX_TEXT_CHARS = 30_000;
+const MAX_GENERATED_IMAGE_BYTES = 64 * 1024 * 1024;
+const IMAGE_DOWNLOAD_TIMEOUT_MS = 60_000;
 /** 云端渲染是真开浏览器,比直连慢得多,给宽裕些。 */
 const RENDER_TIMEOUT_MS = 45_000;
 /** 200 但榨出的正文比这还短,多半是 JS 渲染的空壳页,值得上浏览器再试。 */
@@ -39,31 +41,37 @@ export function truncate(text) {
     return `${text.slice(0, MAX_TEXT_CHARS)}\n\n…（内容过长已截断，共 ${text.length} 字符）`;
 }
 /** 只下载前 maxBytes 就断流,超大页面不用整个拉完再丢。 */
-async function readBodyCapped(resp, maxBytes) {
+export async function readBodyCapped(resp, maxBytes) {
     if (!resp.body)
         return new Uint8Array(await resp.arrayBuffer()).subarray(0, maxBytes);
     const reader = resp.body.getReader();
     const chunks = [];
     let total = 0;
-    for (;;) {
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        chunks.push(value);
-        total += value.byteLength;
-        if (total >= maxBytes) {
-            void reader.cancel().catch(() => { });
-            break;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            chunks.push(value);
+            total += value.byteLength;
+            if (total >= maxBytes) {
+                void reader.cancel("web fetch body limit reached").catch(() => { });
+                break;
+            }
         }
     }
+    finally {
+        reader.releaseLock();
+    }
     const out = new Uint8Array(Math.min(total, maxBytes));
     let offset = 0;
     for (const chunk of chunks) {
         const room = out.byteLength - offset;
         if (room <= 0)
             break;
-        out.set(room < chunk.byteLength ? chunk.subarray(0, room) : chunk, offset);
-        offset += chunk.byteLength;
+        const copied = Math.min(room, chunk.byteLength);
+        out.set(copied < chunk.byteLength ? chunk.subarray(0, copied) : chunk, offset);
+        offset += copied;
     }
     return out;
 }
@@ -316,6 +324,44 @@ async function abortableDelay(ms, signal) {
         signal.addEventListener("abort", onAbort, { once: true });
     });
 }
+class GeneratedImageTooLargeError extends Error {
+}
+async function readGeneratedImageBody(resp, maxBytes) {
+    const declaredLength = Number(resp.headers.get("content-length"));
+    if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
+        if (resp.body)
+            void resp.body.cancel("generated image body limit reached").catch(() => { });
+        throw new GeneratedImageTooLargeError(`图片文件超过下载上限 ${Math.floor(maxBytes / 1024 / 1024)} MiB`);
+    }
+    if (!resp.body)
+        return new Uint8Array();
+    const reader = resp.body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (total + value.byteLength > maxBytes) {
+                void reader.cancel("generated image body limit reached").catch(() => { });
+                throw new GeneratedImageTooLargeError(`图片文件超过下载上限 ${Math.floor(maxBytes / 1024 / 1024)} MiB`);
+            }
+            chunks.push(value);
+            total += value.byteLength;
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const bytes = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return bytes;
+}
 /**
  * 下载方舟返回的同一个临时 URL。fetch() 拿到响应头后,body 仍可能在
  * arrayBuffer() 阶段以 Undici `terminated` 断流,所以两步必须放在同一个
@@ -325,17 +371,27 @@ export async function downloadGeneratedImage(url, signal, options = {}) {
     const attempts = Math.max(1, Math.floor(options.attempts ?? IMAGE_DOWNLOAD_ATTEMPTS));
     const retryDelayMs = Math.max(0, options.retryDelayMs ?? IMAGE_DOWNLOAD_RETRY_DELAY_MS);
     const fetchImpl = options.fetchImpl ?? fetch;
+    const maxBytes = Math.max(1, Math.floor(options.maxBytes ?? MAX_GENERATED_IMAGE_BYTES));
+    const attemptTimeoutMs = Math.max(1, Math.floor(options.attemptTimeoutMs ?? IMAGE_DOWNLOAD_TIMEOUT_MS));
     let lastError;
     for (let attempt = 1; attempt <= attempts; attempt++) {
         try {
-            const resp = await fetchImpl(url, { signal });
-            if (!resp.ok)
+            const resp = await fetchImpl(url, {
+                signal: AbortSignal.any([signal, AbortSignal.timeout(attemptTimeoutMs)]),
+            });
+            if (!resp.ok) {
+                if (resp.body)
+                    void resp.body.cancel("generated image HTTP error").catch(() => { });
                 throw new Error(`HTTP ${resp.status}`);
-            return new Uint8Array(await resp.arrayBuffer());
+            }
+            return await readGeneratedImageBody(resp, maxBytes);
         }
         catch (error) {
             if (signal.aborted)
                 throw error;
+            if (error instanceof GeneratedImageTooLargeError) {
+                throw new Error(`图片已经生成,但${error.message}。不要重新调用 generate_image,可在 24 小时内手动下载: ${url}`, { cause: error });
+            }
             lastError = error;
             if (attempt < attempts)
                 await abortableDelay(retryDelayMs * attempt, signal);
@@ -350,7 +406,7 @@ export function createImageTool(cfg) {
         name: "generate_image",
         label: "生成图片",
         description: "Generate an image from a text prompt, or edit/compose existing images, using the Seedream image model. " +
-            "Saves the result as a local image file and returns its path. " +
+            "Saves the result as a local image file and displays it directly in supported chat UIs. " +
             "Pass local file paths or http(s) URLs in `images` to edit an image or use references (style transfer, adding elements, combining up to 10 images). " +
             "Prompts work in Chinese or English; describe content, style, composition, and any text to render.",
         promptSnippet: "AI image generation/editing (text-to-image, editing, multi-image composition)",
@@ -359,6 +415,7 @@ export function createImageTool(cfg) {
             "Each call generates one image and costs the user credits; refine the prompt first instead of regenerating repeatedly.",
             "If an error says the image may/already has been generated or says not to call generate_image again, stop immediately; never retry with a new generation.",
             "To edit an existing image, pass its path in `images` and describe only the change in `prompt`.",
+            "A successful result is already displayed in supported chat UIs; never open an OS image viewer or claim that you opened one when the user asks to see it.",
         ],
         parameters: Type.Object({
             prompt: Type.String({
@@ -386,9 +443,17 @@ export function createImageTool(cfg) {
             mkdirSync(dirname(path), { recursive: true });
             writeFileSync(path, bytes);
             const sizeNote = result.size ? ` (${result.size})` : "";
+            const mimeType = REF_IMAGE_MIME[urlExt] ?? "image/jpeg";
             return {
-                content: [{ type: "text", text: `图片已保存: ${path}${sizeNote}` }],
-                details: { path, size: result.size, bytes: bytes.byteLength },
+                content: [{ type: "text", text: `图片已保存并在对话中展示: ${path}${sizeNote}` }],
+                // displayImage 只给 UI 预览，不放进 content：避免每轮都把整张 2K/4K
+                // 图片送回模型占用 context。pi-web-ui 会从 tool details 序列化它。
+                details: {
+                    path,
+                    size: result.size,
+                    bytes: bytes.byteLength,
+                    displayImage: { data: Buffer.from(bytes).toString("base64"), mimeType },
+                },
             };
         },
     });
@@ -425,13 +490,25 @@ async function fetchDirect(url, signal) {
         throw new DirectFetchError(`打不开 ${url.href}: ${e.message}`, true);
     }
     if (!resp.ok) {
+        void resp.body?.cancel("web fetch rejected HTTP response").catch(() => undefined);
         throw new DirectFetchError(`${url.href} 返回 ${resp.status} ${resp.statusText}`, RENDER_WORTHY_STATUS.has(resp.status));
     }
     const type = resp.headers.get("content-type") ?? "";
     if (!/text\/|json|xml|javascript/i.test(type)) {
+        void resp.body?.cancel("web fetch rejected non-text response").catch(() => undefined);
         throw new DirectFetchError(`${url.href} 不是文本内容 (${type || "unknown"}),读不了`, false);
     }
-    const raw = decodeBody(await readBodyCapped(resp, MAX_FETCH_BYTES), type);
+    let bytes;
+    try {
+        bytes = await readBodyCapped(resp, MAX_FETCH_BYTES);
+    }
+    catch (error) {
+        if (signal?.aborted)
+            throw error;
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new DirectFetchError(`${url.href} 正文读取失败: ${detail}`, true);
+    }
+    const raw = decodeBody(bytes, type);
     const isHtml = /html|xml/i.test(type);
     return { text: isHtml ? htmlToText(raw) : raw.trim(), contentType: type, isHtml };
 }

package/dist/update.js

@@ -1,14 +1,24 @@
-import { execSync, spawnSync } from "node:child_process";
+import { execFileSync, spawnSync } from "node:child_process";
 import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { isPortableInstall } from "./config.js";
+import { readJsonResponseCapped, readResponseTextCapped } from "./api.js";
 const require = createRequire(import.meta.url);
 const pkg = require("../package.json");
 export const VERSION = pkg.version;
 export const PACKAGE_NAME = "u1s1-cli";
+const MAX_NPM_METADATA_BYTES = 64 * 1024;
+const MAX_INSTALL_SCRIPT_BYTES = 1024 * 1024;
+function publishedVersion(value) {
+    return typeof value === "string"
+        && value.length <= 100
+        && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(value)
+        ? value
+        : undefined;
+}
 /** engines.node 里要求的最低版本(如 ">=22.19.0" → "22.19.0");解析不出返回 undefined。 */
 function requiredNodeVersion() {
     const m = /(\d+\.\d+\.\d+)/.exec(pkg.engines?.node ?? "");
@@ -36,8 +46,8 @@ export async function getLatestVersion() {
         });
         if (!res.ok)
             return undefined;
-        const body = (await res.json());
-        return body.version;
+        const body = await readJsonResponseCapped(res, MAX_NPM_METADATA_BYTES);
+        return publishedVersion(body.version);
     }
     catch {
         return undefined;
@@ -97,7 +107,7 @@ async function portableSelfUpdate(latest) {
         });
         if (!res.ok)
             throw new Error(`HTTP ${res.status}`);
-        script = await res.text();
+        script = await readResponseTextCapped(res, MAX_INSTALL_SCRIPT_BYTES);
     }
     catch {
         console.error("安装脚本下载失败。请手动运行:");
@@ -107,7 +117,7 @@ async function portableSelfUpdate(latest) {
     const tmp = join(mkdtempSync(join(tmpdir(), "u1s1-update-")), "install.sh");
     writeFileSync(tmp, script, { mode: 0o755 });
     try {
-        execSync(`bash ${JSON.stringify(tmp)}`, { stdio: "inherit" });
+        execFileSync("bash", [tmp], { stdio: "inherit" });
     }
     catch {
         console.error("\n自动升级失败。请手动运行:");
@@ -171,8 +181,10 @@ export async function update() {
     console.log(`正在用 ${pm} 更新 ${PACKAGE_NAME}…`);
     try {
         // npm 压掉 EBADENGINE 等警告墙,对新手只有噪音;出错时 error 仍会显示
-        const installCmd = pm === "npm" ? `npm install -g --loglevel=error ${PACKAGE_NAME}@latest` : `${pm} add -g ${PACKAGE_NAME}@latest`;
-        execSync(installCmd, { stdio: "inherit" });
+        const args = pm === "npm"
+            ? ["install", "-g", "--loglevel=error", `${PACKAGE_NAME}@latest`]
+            : ["add", "-g", `${PACKAGE_NAME}@latest`];
+        execFileSync(pm, args, { stdio: "inherit" });
         console.log(`\n✅ 已更新到 v${latest}，重启 u1s1 后生效。`);
     }
     catch {

package/dist/web.js

@@ -55,21 +55,33 @@ export async function prepareWebEnv(cfg) {
     // 老网关没有 /v1/image,image_gen 缺失时按关闭处理,不注册生图工具
     let imageGenEnabled = false;
     let clientAttestation;
+    let clientAttestationExpiresInSeconds;
     const endpointsReady = loadCustomEndpoints(cfg);
     try {
-        const { models, features, clientAttestation: attestation } = await fetchModels(cfg);
+        const { models, features, clientAttestation: attestation, clientAttestationExpiresInSeconds: attestationTtl } = await fetchModels(cfg);
         setModelsFromApi(models.map(apiModelToDef));
         webSearchEnabled = features.web_search !== false;
         webFetchRenderEnabled = features.web_fetch_render === true;
         imageGenEnabled = features.image_gen === true;
         clientAttestation = attestation;
+        clientAttestationExpiresInSeconds = attestationTtl;
     }
     catch (e) {
         console.error("  获取模型列表失败,使用内置列表:", e.message);
     }
     await endpointsReady;
     ensureDefaultSettings(MODELS);
-    const signing = await ensureSigningProxy(cfg, "desktop", clientAttestation);
+    const signing = await ensureSigningProxy(cfg, "desktop", {
+        token: clientAttestation,
+        expiresInSeconds: clientAttestationExpiresInSeconds,
+        refresh: async () => {
+            const refreshed = await fetchModels(cfg);
+            return {
+                token: refreshed.clientAttestation,
+                expiresInSeconds: refreshed.clientAttestationExpiresInSeconds,
+            };
+        },
+    });
     const officialCfg = { ...cfg, baseUrl: signing.baseUrl, apiKey: signing.localKey };
     webOfficialCfg = officialCfg;
     const modelsPath = refreshWebModels();

package/dist/workflow/runner.d.ts

@@ -3,6 +3,22 @@ import { type ParentModelRef } from "../subagent.js";
 export declare const WORKFLOW_TIMEOUT_MS: number;
 /** 默认整个 run 的 token 预算;0 或负数表示不设限。 */
 export declare const WORKFLOW_DEFAULT_BUDGET_TOKENS = 20000000;
+interface ProgressEntry {
+    key: string;
+    /** 任务摘要(前 120 字),调试/排查用,key 才是身份。 */
+    task: string;
+    ok: boolean;
+    text: string;
+    ms: number;
+}
+/** JSONL 进度存档:一行一个已完成的子任务,断点续跑时按 key 跳过。 */
+export declare class ProgressStore {
+    #private;
+    readonly path: string;
+    constructor(path: string);
+    getSuccessful(key: string): ProgressEntry | undefined;
+    append(entry: ProgressEntry): void;
+}
 /** 静态白名单校验:语法能编译 + 不碰沙箱之外的任何能力。 */
 export declare function validateScript(code: string): string[];
 export interface WorkflowRunResult {
@@ -46,3 +62,4 @@ export declare function runWorkflow(opts: WorkflowRunOptions): Promise<WorkflowR
 export declare function workflowsDir(): string;
 /** 内联脚本落盘,返回脚本路径(进度存档按同名约定派生)。 */
 export declare function saveWorkflowScript(code: string): string;
+export {};

package/dist/workflow/runner.js

@@ -15,7 +15,7 @@ const MAX_LOG_LINES = 60;
 /** 默认整个 run 的 token 预算;0 或负数表示不设限。 */
 export const WORKFLOW_DEFAULT_BUDGET_TOKENS = 20_000_000;
 /** JSONL 进度存档:一行一个已完成的子任务,断点续跑时按 key 跳过。 */
-class ProgressStore {
+export class ProgressStore {
     path;
     #cache = new Map();
     constructor(path) {
@@ -36,8 +36,9 @@ class ProgressStore {
             }
         }
     }
-    get(key) {
-        return this.#cache.get(key);
+    getSuccessful(key) {
+        const entry = this.#cache.get(key);
+        return entry?.ok === true && typeof entry.text === "string" ? entry : undefined;
     }
     append(entry) {
         this.#cache.set(entry.key, entry);
@@ -154,14 +155,12 @@ export async function runWorkflow(opts) {
         }
         const key = taskKey(task, model);
         if (opts.resume) {
-            const prev = store.get(key);
+            const prev = store.getSuccessful(key);
             if (prev) {
                 stats.cached++;
                 progress.cached = stats.cached;
                 reportProgress();
-                if (prev.ok)
-                    return prev.text;
-                throw new Error(prev.text);
+                return prev.text;
             }
         }
         stats.spawns++;

package/dist/workflow/templates.js

@@ -127,14 +127,14 @@ return { synthesis };
     },
     refactor: {
         name: "refactor",
-        description: "批量重构/迁移:先由一个 agent 读代表文件制定统一规则,然后每个文件一个子 agent 在独立 worktree 里套用规则,互不冲突",
+        description: "批量重构/迁移:先由一个 agent 读代表文件制定统一规则,然后每个文件一个子 agent 在当前工作区套用规则",
         inputHint: '{ "instruction": "把所有 var 改为 const", "files": ["src/a.ts", ...] } — files 省略时用 git diff 改动文件',
         build(input) {
             const instruction = str(input.instruction);
             if (!instruction)
                 throw new Error('refactor 模板需要 instruction,例如 { "instruction": "把 var 全部改为 const" }');
             // 与 review 模板一致:构建期取 git 改动文件,不花一个 subagent 在沙箱里跑 git
-            let files = strArray(input.files);
+            let files = [...new Set(strArray(input.files))];
             if (files.length === 0)
                 files = gitDiffFiles();
             if (files.length === 0)
@@ -150,8 +150,8 @@ const rule = await subagent({
 });
 const results = await parallel(targetFiles.map(f => () =>
   subagent({
-    task: "按以下重构规则处理文件 " + f + ",改完检查该文件语法正确(必要时运行 tsc 或构建验证)。\\n\\n重构规则:\\n" + rule,
-    worktree: true
+    task: "按以下重构规则处理文件 " + f + "。只修改这个目标文件,不要改动其他文件,避免与并行任务冲突。" +
+      "改完检查该文件语法正确(必要时运行 tsc 或构建验证)。\\n\\n重构规则:\\n" + rule
   })
 ));
 const done = targetFiles.filter((_, i) => results[i] !== null);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "u1s1-cli",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "description": "u1s1 — 有一说一,最省心的 AI 编程搭子。终端里用中文说需求,AI 帮你读文件、改代码、跑命令。",
   "type": "module",
   "bin": {