weflow-cli 1.5.0 → 1.6.0

package/scripts/fav_server.py

@@ -9,14 +9,48 @@
 打开 http://localhost:8765 即可使用，点击 ☆ 收藏按钮实时写入磁盘。
 """
 
-import sys, os, json
+import sys, os, json, hashlib, shutil, ipaddress, socket
 from pathlib import Path
 from http.server import HTTPServer, SimpleHTTPRequestHandler
+from socketserver import ThreadingMixIn
+from urllib.parse import unquote, urlparse
 import urllib.request
 
 SCRIPTS_DIR = os.path.dirname(os.path.abspath(__file__))
 PROJECT_ROOT = os.path.dirname(SCRIPTS_DIR)
 SOURCE_ROOT = os.path.join(PROJECT_ROOT, 'output', 'biz-daily')
+MAX_BODY_BYTES = 1 * 1024 * 1024
+
+
+def is_safe_remote_url(raw_url):
+    """Allow public HTTP(S) image hosts while rejecting SSRF targets."""
+    try:
+        parsed = urlparse(raw_url)
+        if parsed.scheme not in ('http', 'https') or not parsed.hostname or parsed.username or parsed.password:
+            return False
+        if parsed.port and not 1 <= parsed.port <= 65535:
+            return False
+        addresses = socket.getaddrinfo(parsed.hostname, parsed.port or 443, type=socket.SOCK_STREAM)
+        for address in addresses:
+            ip = ipaddress.ip_address(address[4][0])
+            if ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved or ip.is_multicast or ip.is_unspecified:
+                return False
+        return True
+    except (ValueError, socket.gaierror, OSError):
+        return False
+
+
+class NoRedirectHandler(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        return None
+
+
+REMOTE_OPENER = urllib.request.build_opener(NoRedirectHandler)
+
+
+class ThreadingHTTPServer(ThreadingMixIn, HTTPServer):
+    """多线程 HTTP 服务器，避免图片代理阻塞其他请求。"""
+    daemon_threads = True  # 线程随主进程退出
 
 
 class FavHandler(SimpleHTTPRequestHandler):
@@ -42,7 +76,12 @@ class FavHandler(SimpleHTTPRequestHandler):
 
     def do_GET(self):
         try:
-            if self.path.startswith('/api/fav/list'):
+            if not self._is_local_origin():
+                self.send_error(403, 'Cross-origin request denied')
+                return
+            if self.path == '/api/status':
+                self._send_json({'ok': True, 'service': 'weflow-daily-reader', 'date': self.date_str})
+            elif self.path.startswith('/api/fav/list'):
                 self._handle_fav_list()
             elif self.path == '/api/read/list':
                 self._handle_read_list()
@@ -60,6 +99,13 @@ class FavHandler(SimpleHTTPRequestHandler):
 
     def do_POST(self):
         try:
+            content_length = int(self.headers.get('Content-Length', 0))
+            if content_length < 0 or content_length > MAX_BODY_BYTES:
+                self.send_error(413, 'Request body too large')
+                return
+            if not self._is_local_origin():
+                self.send_error(403, 'Cross-origin request denied')
+                return
             if self.path == '/api/fav/toggle':
                 self._handle_fav_toggle()
             elif self.path == '/api/read/toggle':
@@ -86,31 +132,73 @@ class FavHandler(SimpleHTTPRequestHandler):
             pass
 
     def _handle_proxy(self):
-        """代理微信CDN图片，绕过防盗链Referer检查。"""
-        from urllib.parse import unquote
+        """代理微信CDN图片，绕过防盗链Referer检查（带本地缓存）。"""
         qs = self.path.split('?', 1)[1] if '?' in self.path else ''
         url = ''
         for p in qs.split('&'):
             if p.startswith('url='):
                 url = unquote(p[4:])
                 break
-        if not url or not url.startswith(('http://', 'https://')):
+        if not url or not is_safe_remote_url(url):
             self.send_error(400, 'Missing url')
             return
+
+        # 本地缓存：URL 的 MD5 作为文件名
+        cache_dir = os.path.join(self.date_dir, '.img_cache')
+        os.makedirs(cache_dir, exist_ok=True)
+        cache_key = hashlib.md5(url.encode()).hexdigest()
+        cache_file = os.path.join(cache_dir, cache_key)
+
+        # 尝试从缓存读取
+        if os.path.isfile(cache_file):
+            try:
+                with open(cache_file, 'rb') as f:
+                    data = f.read()
+                ext = os.path.splitext(urlparse(url).path)[1].lower()
+                mime_map = {'.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
+                            '.gif': 'image/gif', '.webp': 'image/webp', '.svg': 'image/svg+xml'}
+                content_type = mime_map.get(ext, 'image/jpeg')
+                self.send_response(200)
+                self.send_header('Content-Type', content_type)
+                self.send_header('Content-Length', len(data))
+                self.send_header('Cache-Control', 'public, max-age=86400')
+                self.send_header('X-Cache', 'HIT')
+                self.end_headers()
+                self.wfile.write(data)
+                return
+            except:
+                pass  # cache miss, re-fetch
+
         try:
             req = urllib.request.Request(url, headers={
                 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
                 'Referer': 'https://mp.weixin.qq.com/',
                 'Accept': 'image/webp,image/apng,image/*,*/*;q=0.8',
             })
-            with urllib.request.urlopen(req, timeout=15) as resp:
+            with REMOTE_OPENER.open(req, timeout=8) as resp:
+                if resp.headers.get('Content-Length') and int(resp.headers['Content-Length']) > 10 * 1024 * 1024:
+                    self.send_error(413, 'Image too large')
+                    return
                 data = resp.read(10 * 1024 * 1024)  # max 10MB
                 content_type = resp.headers.get('Content-Type', 'image/jpeg')
+
+            # 写入缓存
+            try:
+                tmp = cache_file + '.tmp'
+                with open(tmp, 'wb') as f:
+                    f.write(data)
+                shutil.move(tmp, cache_file)
+            except:
+                pass
+
             self.send_response(200)
             self.send_header('Content-Type', content_type)
             self.send_header('Content-Length', len(data))
             self.send_header('Cache-Control', 'public, max-age=86400')
-            self.send_header('Access-Control-Allow-Origin', '*')
+            self.send_header('X-Cache', 'MISS')
+            self.send_header('Cache-Control', 'public, max-age=86400')
+            if self._is_local_origin():
+                self.send_header('Access-Control-Allow-Origin', self.headers.get('Origin', f'http://localhost:{self.server.server_port}'))
             self.end_headers()
             self.wfile.write(data)
         except Exception as e:
@@ -167,8 +255,13 @@ class FavHandler(SimpleHTTPRequestHandler):
 
         desired_names = set()
         for rel_path in favs:
-            src = Path(self.date_dir) / rel_path
-            if src.exists():
+            src = (Path(self.date_dir) / str(rel_path)).resolve()
+            date_root = Path(self.date_dir).resolve()
+            try:
+                src.relative_to(date_root)
+            except ValueError:
+                continue
+            if src.is_file():
                 desired_names.add(src.name)
                 link = fav_dir / src.name
                 if not link.exists():
@@ -337,13 +430,27 @@ class FavHandler(SimpleHTTPRequestHandler):
         self.send_response(200)
         self.send_header('Content-Type', 'application/json; charset=utf-8')
         self.send_header('Content-Length', len(body))
-        self.send_header('Access-Control-Allow-Origin', '*')
+        if self._is_local_origin():
+            self.send_header('Access-Control-Allow-Origin', self.headers.get('Origin', f'http://localhost:{self.server.server_port}'))
         self.end_headers()
         self.wfile.write(body)
 
+    def _is_local_origin(self):
+        origin = self.headers.get('Origin')
+        if not origin:
+            return True
+        expected = {
+            f'http://localhost:{self.server.server_port}',
+            f'http://127.0.0.1:{self.server.server_port}',
+        }
+        return origin in expected
+
     def do_OPTIONS(self):
+        if not self._is_local_origin():
+            self.send_error(403, 'Cross-origin request denied')
+            return
         self.send_response(200)
-        self.send_header('Access-Control-Allow-Origin', '*')
+        self.send_header('Access-Control-Allow-Origin', self.headers.get('Origin', f'http://localhost:{self.server.server_port}'))
         self.send_header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS')
         self.send_header('Access-Control-Allow-Headers', 'Content-Type')
         self.end_headers()
@@ -374,7 +481,7 @@ def main():
     # 切换到日报目录以提供静态文件服务
     os.chdir(date_dir)
 
-    server = HTTPServer(('0.0.0.0', args.port), FavHandler)
+    server = ThreadingHTTPServer(('127.0.0.1', args.port), FavHandler)
     print(f'⭐ 收藏服务器已启动')
     print(f'   打开: http://localhost:{args.port}')
     print(f'   日期: {args.date}')

package/scripts/fix_topics.py

@@ -1,111 +1,111 @@
-#!/usr/bin/env python3
-"""修复已生成文章的主题分类（关键词 fallback）。用法: python scripts/fix_topics.py 2026-05-19"""
-import sys, os, re
-from pathlib import Path
-
-sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-from biz_daily import _guess_topic
-
-TOPICS = ['AI', '学术', '新闻', '文学', '投资']
-
-def fix_date(date_str: str):
-    sys.stdout.reconfigure(encoding='utf-8', errors='replace')
-    base = Path('output/biz-daily') / date_str
-    if not base.is_dir():
-        print(f'[ERROR] 目录不存在: {base}')
-        sys.exit(1)
-
-    fixed = 0
-    for topic in TOPICS:
-        topic_dir = base / topic
-        if not topic_dir.is_dir():
-            continue
-        for md_file in topic_dir.glob('*.md'):
-            try:
-                content = md_file.read_text(encoding='utf-8')
-            except:
-                continue
-
-            # Extract current topic from frontmatter
-            m = re.search(r'^topic:\s*(.+)', content, re.MULTILINE)
-            old_topic = m.group(1).strip() if m else ''
-
-            # Extract title
-            title = md_file.stem
-            m2 = re.search(r'^title:\s*"?(.+?)"?\s*$', content, re.MULTILINE)
-            if m2:
-                title = m2.group(1).strip().strip('"').strip("'")
-
-            # Guess topic
-            article = {'title': title, 'account_name': ''}
-            m3 = re.search(r'^source:\s*"?(.+?)"?\s*$', content, re.MULTILINE)
-            if m3:
-                article['account_name'] = m3.group(1).strip().strip('"').strip("'")
-
-            guessed = _guess_topic(article)
-
-            if guessed != old_topic:
-                # Update frontmatter
-                new_content = re.sub(
-                    r'^topic:\s*.+', f'topic: {guessed}',
-                    content, flags=re.MULTILINE
-                )
-                # Update topic folder if needed - move file
-                if guessed != topic:
-                    new_dir = base / guessed
-                    new_dir.mkdir(exist_ok=True)
-                    new_path = new_dir / md_file.name
-                    md_file.rename(new_path)
-                    # Also update the file at new location
-                    new_path.write_text(new_content, encoding='utf-8')
-                    print(f'  [FIX] {title[:50]} -> {guessed} (was {topic})')
-                else:
-                    md_file.write_text(new_content, encoding='utf-8')
-                fixed += 1
-
-    print(f'\n✓ 修复 {fixed} 篇，未变动 {sum(1 for _ in base.rglob("*.md") if _.name != "README.md") - fixed} 篇')
-
-    # Rebuild README
-    from biz_daily import sanitize_filename
-    all_articles = []
-    for topic in TOPICS:
-        topic_dir = base / topic
-        if not topic_dir.is_dir():
-            continue
-        for md_file in sorted(topic_dir.glob('*.md')):
-            content = md_file.read_text(encoding='utf-8')
-            title = md_file.stem
-            source = ''
-            article_time = ''
-            for line in content.split('\n'):
-                if line.startswith('title:'):
-                    title = line.split(':', 1)[1].strip().strip('"').strip("'")
-                elif line.startswith('source:'):
-                    source = line.split(':', 1)[1].strip().strip('"').strip("'")
-            mm = re.search(r'时间：\d{4}-\d{2}-\d{2} (\d{2}:\d{2})', content)
-            if mm: article_time = mm.group(1)
-            all_articles.append({'title': title, 'source': source, 'time': article_time, 'topic': topic, 'file': md_file.name})
-
-    index_lines = [f'# 公众号日报 — {date_str}', '', f'共 {len(all_articles)} 篇推送，按主题分类', '']
-    for topic in TOPICS:
-        group = [a for a in all_articles if a['topic'] == topic]
-        if not group: continue
-        index_lines.append(f'## {topic} ({len(group)}篇)')
-        index_lines.append('')
-        index_lines.append('| # | 时间 | 公众号 | 标题 |')
-        index_lines.append('|---|------|--------|------|')
-        for j, a in enumerate(group):
-            index_lines.append(f'| {j+1} | {a["time"]} | {a["source"]} | [{a["title"]}](./{topic}/{a["file"]}) |')
-        index_lines.append('')
-
-    with open(base / 'README.md', 'w', encoding='utf-8') as f:
-        f.write('\n'.join(index_lines))
-
-    print(f'  README 已重建')
-
-
-if __name__ == '__main__':
-    if len(sys.argv) < 2:
-        print('用法: python scripts/fix_topics.py 2026-05-19')
-        sys.exit(1)
-    fix_date(sys.argv[1])
+#!/usr/bin/env python3
+"""修复已生成文章的主题分类（关键词 fallback）。用法: python scripts/fix_topics.py 2026-05-19"""
+import sys, os, re
+from pathlib import Path
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from biz_daily import _guess_topic
+
+TOPICS = ['AI', '学术', '新闻', '文学', '投资', '政治']
+
+def fix_date(date_str: str):
+    sys.stdout.reconfigure(encoding='utf-8', errors='replace')
+    base = Path('output/biz-daily') / date_str
+    if not base.is_dir():
+        print(f'[ERROR] 目录不存在: {base}')
+        sys.exit(1)
+
+    fixed = 0
+    for topic in TOPICS:
+        topic_dir = base / topic
+        if not topic_dir.is_dir():
+            continue
+        for md_file in topic_dir.glob('*.md'):
+            try:
+                content = md_file.read_text(encoding='utf-8')
+            except:
+                continue
+
+            # Extract current topic from frontmatter
+            m = re.search(r'^topic:\s*(.+)', content, re.MULTILINE)
+            old_topic = m.group(1).strip() if m else ''
+
+            # Extract title
+            title = md_file.stem
+            m2 = re.search(r'^title:\s*"?(.+?)"?\s*$', content, re.MULTILINE)
+            if m2:
+                title = m2.group(1).strip().strip('"').strip("'")
+
+            # Guess topic
+            article = {'title': title, 'account_name': ''}
+            m3 = re.search(r'^source:\s*"?(.+?)"?\s*$', content, re.MULTILINE)
+            if m3:
+                article['account_name'] = m3.group(1).strip().strip('"').strip("'")
+
+            guessed = _guess_topic(article)
+
+            if guessed != old_topic:
+                # Update frontmatter
+                new_content = re.sub(
+                    r'^topic:\s*.+', f'topic: {guessed}',
+                    content, flags=re.MULTILINE
+                )
+                # Update topic folder if needed - move file
+                if guessed != topic:
+                    new_dir = base / guessed
+                    new_dir.mkdir(exist_ok=True)
+                    new_path = new_dir / md_file.name
+                    md_file.rename(new_path)
+                    # Also update the file at new location
+                    new_path.write_text(new_content, encoding='utf-8')
+                    print(f'  [FIX] {title[:50]} -> {guessed} (was {topic})')
+                else:
+                    md_file.write_text(new_content, encoding='utf-8')
+                fixed += 1
+
+    print(f'\n✓ 修复 {fixed} 篇，未变动 {sum(1 for _ in base.rglob("*.md") if _.name != "README.md") - fixed} 篇')
+
+    # Rebuild README
+    from biz_daily import sanitize_filename
+    all_articles = []
+    for topic in TOPICS:
+        topic_dir = base / topic
+        if not topic_dir.is_dir():
+            continue
+        for md_file in sorted(topic_dir.glob('*.md')):
+            content = md_file.read_text(encoding='utf-8')
+            title = md_file.stem
+            source = ''
+            article_time = ''
+            for line in content.split('\n'):
+                if line.startswith('title:'):
+                    title = line.split(':', 1)[1].strip().strip('"').strip("'")
+                elif line.startswith('source:'):
+                    source = line.split(':', 1)[1].strip().strip('"').strip("'")
+            mm = re.search(r'时间：\d{4}-\d{2}-\d{2} (\d{2}:\d{2})', content)
+            if mm: article_time = mm.group(1)
+            all_articles.append({'title': title, 'source': source, 'time': article_time, 'topic': topic, 'file': md_file.name})
+
+    index_lines = [f'# 公众号日报 — {date_str}', '', f'共 {len(all_articles)} 篇推送，按主题分类', '']
+    for topic in TOPICS:
+        group = [a for a in all_articles if a['topic'] == topic]
+        if not group: continue
+        index_lines.append(f'## {topic} ({len(group)}篇)')
+        index_lines.append('')
+        index_lines.append('| # | 时间 | 公众号 | 标题 |')
+        index_lines.append('|---|------|--------|------|')
+        for j, a in enumerate(group):
+            index_lines.append(f'| {j+1} | {a["time"]} | {a["source"]} | [{a["title"]}](./{topic}/{a["file"]}) |')
+        index_lines.append('')
+
+    with open(base / 'README.md', 'w', encoding='utf-8') as f:
+        f.write('\n'.join(index_lines))
+
+    print(f'  README 已重建')
+
+
+if __name__ == '__main__':
+    if len(sys.argv) < 2:
+        print('用法: python scripts/fix_topics.py 2026-05-19')
+        sys.exit(1)
+    fix_date(sys.argv[1])

package/scripts/generate_ai_report.py

@@ -31,7 +31,7 @@ SOURCE_ROOT = os.path.join(ROOT_DIR, 'output', 'biz-daily')
 OUTPUT_DIR = os.path.join(ROOT_DIR, 'output', 'ai-reports')
 
 TZ = timezone(timedelta(hours=8))
-TOPICS = ['AI', '学术', '新闻', '文学', '投资']
+TOPICS = ['AI', '学术', '新闻', '文学', '投资', '政治']
 FOCUS_TOPIC = 'AI'