fix(files): restrict temporary uploads to supported regions

Author: hopelynd

docs/agents/url-change.md

@@ -23,18 +23,23 @@ runtime/src/urls.ts                      ← 用户面控制台 URL(cn-only)
   MCP_WEBSEARCH_PAGE        mcpMarketplaceDetailPage("WebSearch")
   mcpMarketplaceDetailPage    BAILIAN_CONSOLE?tab=mcp#/mcp-market/detail/<serverCode>
 
-core/files/upload.ts                     ← 文件上传 endpoint(与 model 域凭证同源)
-  UploadOptions.baseUrl     Client 传入有效凭证的 baseUrl,经 normalizeModelBaseUrl 取 origin
-  /api/v1/uploads           直接 SDK 调用未提供 baseUrl 时保持 REGIONS.cn 默认值
+core/files/upload.ts                     ← model baseUrl → 同源临时上传 endpoint
+  北京/新加坡公共站         保持当前公共站 origin + /api/v1/uploads
+  北京/新加坡 Workspace     保持当前 Workspace origin + /api/v1/uploads
+  显式自定义代理            保持代理 origin,不改写到公共站
+  其他官方地域 / Token Plan 联网前报 usage error,引导使用 HTTPS URL
+  UploadOptions.baseUrl     直接 SDK 调用未提供时保持北京公共站默认值
 ```
 
-临时文件上传与后续模型请求使用同一 API origin,包括国际区、Workspace 和自定义代理。
 Prime 视频命令通过 `Client.uploadFile` / `resolveImageInput` 的 `defaultBaseUrl` 回调,
-复用 `resolvePrimeEndpoint` 推导默认 Workspace origin;显式配置的 API origin 仍优先,
-已有媒体 URL 不触发上传或求值上传默认地址。
-上传服务的区域/模型支持由服务端决定:错误中附上有效上传 endpoint 并保留原始服务响应,
-不自动换区域重试。
-如果所选服务不支持临时上传,使用服务可访问的 HTTPS 媒体 URL;已有 URL 会跳过本地上传。
+复用 `resolvePrimeEndpoint` 推导 model Workspace origin;上传策略与模型提交均保持该
+Workspace origin。显式配置的 model origin 仍优先;已有媒体 URL 不触发上传或求值上传默认地址。
+
+官方临时文件上传当前只支持 `cn-beijing` 与 `ap-southeast-1`;其他已知官方地域与
+Token Plan 在发送 API Key 前失败。显式自定义代理视为自身路由的权威来源,保持同源并由
+代理/服务决定能力。任何路径都不得回退公共站或跨 origin 重试;不支持时用户可改用服务
+可访问的 HTTPS 媒体 URL。服务端错误保留 message/code/request ID/raw response,并在
+message 的结构化上下文中展示本次有效上传 endpoint。
 
 ## 必查清单
 

packages/commands/tests/prime.test.ts

@@ -1,7 +1,7 @@
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { Client, REGIONS, type ApiKeyCredential, type Settings } from "bailian-cli-core";
+import { Client, ExitCode, REGIONS, type ApiKeyCredential, type Settings } from "bailian-cli-core";
 import { afterEach, beforeEach, describe, expect, test, vi } from "vite-plus/test";
 import { resolvePrimeEndpoint, validatePrimeFlags } from "../src/commands/shared/prime.ts";
 import videoGenerate from "../src/commands/video/generate.ts";
@@ -145,20 +145,25 @@ describe("Prime video upload origins", () => {
     } as never);
   }
 
-  function expectUploadOrigin(origin: string, uploadCount = 1) {
+  function expectRequestOrigins(options: {
+    uploadOrigin: string;
+    submitOrigin: string;
+    uploadCount?: number;
+  }) {
+    const { uploadOrigin, submitOrigin, uploadCount = 1 } = options;
     const policyCalls = fetchMock.mock.calls.filter(([input]) => {
       const url = input instanceof Request ? input.url : input.toString();
       return url.includes("/api/v1/uploads?");
     });
     expect(policyCalls).toHaveLength(uploadCount);
     for (const [policyUrl, policyOptions] of policyCalls) {
-      expect(policyUrl).toBe(`${origin}/api/v1/uploads?action=getPolicy&model=wan3.0-video`);
+      expect(policyUrl).toBe(`${uploadOrigin}/api/v1/uploads?action=getPolicy&model=wan3.0-video`);
       expect(new Headers(policyOptions?.headers).get("Authorization")).toBe(
         "Bearer synthetic-workspace-key",
       );
     }
     const [submitUrl, submitOptions] = fetchMock.mock.calls.at(-1)!;
-    expect(submitUrl).toBe(`${origin}/api/v1/services/aigc/video-generation/video-synthesis`);
+    expect(submitUrl).toBe(`${submitOrigin}/api/v1/services/aigc/video-generation/video-synthesis`);
     expect(new Headers(submitOptions?.headers).get("Authorization")).toBe(
       "Bearer synthetic-workspace-key",
     );
@@ -175,24 +180,49 @@ describe("Prime video upload origins", () => {
           settingsWorkspaceId: credentialSource === "env" ? "ws_test" : undefined,
         },
       );
-      expectUploadOrigin(workspaceOrigin);
+      expectRequestOrigins({ uploadOrigin: workspaceOrigin, submitOrigin: workspaceOrigin });
     },
   );
 
   test("uploads both local keyframes to the derived workspace", async () => {
     await runVideo({ image: fixturePath, lastFrame: fixturePath, workspaceId: "ws_test" });
-    expectUploadOrigin(workspaceOrigin, 2);
+    expectRequestOrigins({
+      uploadOrigin: workspaceOrigin,
+      submitOrigin: workspaceOrigin,
+      uploadCount: 2,
+    });
   });
 
   test.each([
-    REGIONS.intl,
-    REGIONS.us,
-    "https://configured-workspace.ap-southeast-1.maas.aliyuncs.com",
-    "https://proxy.example.test",
-  ])("keeps the configured origin %s without requiring a workspace", async (baseUrl) => {
-    await runVideo({ file: fixturePath }, { baseUrl });
-    expectUploadOrigin(baseUrl);
-  });
+    [REGIONS.cn, REGIONS.cn],
+    [REGIONS.intl, REGIONS.intl],
+    [
+      "https://configured-workspace.cn-beijing.maas.aliyuncs.com",
+      "https://configured-workspace.cn-beijing.maas.aliyuncs.com",
+    ],
+    [
+      "https://configured-workspace.ap-southeast-1.maas.aliyuncs.com",
+      "https://configured-workspace.ap-southeast-1.maas.aliyuncs.com",
+    ],
+    ["https://proxy.example.test", "https://proxy.example.test"],
+  ])(
+    "routes configured origin %s through upload service %s without requiring a workspace",
+    async (baseUrl, uploadOrigin) => {
+      await runVideo({ file: fixturePath }, { baseUrl });
+      expectRequestOrigins({ uploadOrigin, submitOrigin: baseUrl });
+    },
+  );
+
+  test.each([REGIONS.us, "https://configured-workspace.us-east-1.maas.aliyuncs.com"])(
+    "rejects unsupported local upload origin %s before submitting",
+    async (baseUrl) => {
+      await expect(runVideo({ file: fixturePath }, { baseUrl })).rejects.toMatchObject({
+        exitCode: ExitCode.USAGE,
+        hint: expect.stringContaining("HTTPS media URL"),
+      });
+      expect(fetchMock).not.toHaveBeenCalled();
+    },
+  );
 
   test("rejects a missing default workspace before making an upload request", async () => {
     await expect(runVideo({ file: fixturePath })).rejects.toMatchObject({
@@ -203,6 +233,10 @@ describe("Prime video upload origins", () => {
 
   test("passes an existing media URL through without uploading", async () => {
     await runVideo({ file: "https://media.example.test/video.mp4", workspaceId: "ws_test" });
-    expectUploadOrigin(workspaceOrigin, 0);
+    expectRequestOrigins({
+      uploadOrigin: workspaceOrigin,
+      submitOrigin: workspaceOrigin,
+      uploadCount: 0,
+    });
   });
 });

packages/core/src/files/upload.ts

@@ -10,9 +10,49 @@ import { basename, extname } from "path";
 import { BailianError } from "../errors/base.ts";
 import { ExitCode } from "../errors/codes.ts";
 import { trackingHeaders, type TrackingIdentity } from "../client/headers.ts";
+import { getApiKeyLoginKind } from "../config/profile-presets.ts";
 import { REGIONS } from "../config/schema.ts";
 import { normalizeModelBaseUrl } from "../config/model-base-url.ts";
 
+const SUPPORTED_UPLOAD_REGIONS = ["cn-beijing", "ap-southeast-1"] as const;
+
+function unsupportedTemporaryUpload(target: string): BailianError {
+  return new BailianError(
+    `Local-file temporary upload is supported only in ${SUPPORTED_UPLOAD_REGIONS.join(", ")}; "${target}" is not supported.`,
+    ExitCode.USAGE,
+    "Use a reachable HTTPS media URL instead.",
+  );
+}
+
+/** Keep the configured origin when supported; reject known unsupported official regions. */
+function resolveUploadBaseUrl(baseUrl: string, apiKey: string): string {
+  const normalizedBaseUrl = normalizeModelBaseUrl(baseUrl);
+  const hostname = new URL(normalizedBaseUrl).hostname.toLowerCase();
+
+  if (
+    getApiKeyLoginKind(apiKey) === "token-plan" ||
+    /^token-plan\.[a-z0-9-]+\.maas\.aliyuncs\.com$/.test(hostname)
+  ) {
+    throw unsupportedTemporaryUpload("Token Plan");
+  }
+
+  if (hostname === new URL(REGIONS.cn).hostname) return normalizedBaseUrl;
+  if (hostname === new URL(REGIONS.intl).hostname) return normalizedBaseUrl;
+  if (hostname === new URL(REGIONS.us).hostname) {
+    throw unsupportedTemporaryUpload(hostname);
+  }
+
+  const maasMatch = /^[^.]+\.([a-z0-9-]+)\.maas\.aliyuncs\.com$/.exec(hostname);
+  const cloudRegion = maasMatch?.[1];
+  if (cloudRegion === "cn-beijing" || cloudRegion === "ap-southeast-1") {
+    return normalizedBaseUrl;
+  }
+  if (cloudRegion) throw unsupportedTemporaryUpload(cloudRegion);
+
+  // Explicit custom proxies are authoritative for their own upload routing.
+  return normalizedBaseUrl;
+}
+
 interface UploadPolicy {
   upload_host: string;
   upload_dir: string;
@@ -28,6 +68,12 @@ interface UploadPolicyResponse {
   request_id?: string;
 }
 
+interface UploadPolicyErrorResponse {
+  code?: unknown;
+  message?: unknown;
+  request_id?: unknown;
+}
+
 /**
  * Step 1: Fetch the upload policy (presigned credentials) from DashScope.
  */
@@ -38,7 +84,7 @@ async function getUploadPolicy(
   baseUrl: string,
   signal?: AbortSignal,
 ): Promise<UploadPolicy> {
-  const uploadApi = `${normalizeModelBaseUrl(baseUrl)}/api/v1/uploads`;
+  const uploadApi = `${resolveUploadBaseUrl(baseUrl, apiKey)}/api/v1/uploads`;
   const url = `${uploadApi}?action=getPolicy&model=${encodeURIComponent(model)}`;
   const policySignal = combineWithTimeout(15_000, signal);
   const res = await fetch(url, {
@@ -52,10 +98,35 @@ async function getUploadPolicy(
 
   if (!res.ok) {
     const text = await res.text().catch(() => "");
-    throw new BailianError(
-      `Failed to get upload policy (HTTP ${res.status}, ${uploadApi}): ${text}`,
-      ExitCode.GENERAL,
-    );
+    let serviceError: UploadPolicyErrorResponse | undefined;
+    try {
+      serviceError = JSON.parse(text) as UploadPolicyErrorResponse;
+    } catch {
+      // Non-JSON service responses pass through below.
+    }
+    const serviceMessage =
+      typeof serviceError?.message === "string" && serviceError.message
+        ? serviceError.message
+        : text || `${res.status} ${res.statusText}`;
+    const apiCode = typeof serviceError?.code === "string" ? serviceError.code : undefined;
+    const requestId =
+      typeof serviceError?.request_id === "string" ? serviceError.request_id : undefined;
+    const responseContext = [
+      `HTTP ${res.status}`,
+      apiCode ? `code=${apiCode}` : undefined,
+      requestId ? `request_id=${requestId}` : undefined,
+      `upload_endpoint=${uploadApi}`,
+    ]
+      .filter((item): item is string => item !== undefined)
+      .join("; ");
+    throw new BailianError(`${responseContext} - ${serviceMessage}`, ExitCode.GENERAL, undefined, {
+      api: {
+        httpStatus: res.status,
+        apiCode,
+        requestId,
+      },
+      rawResponse: text.slice(0, 500),
+    });
   }
 
   const body = (await res.json()) as UploadPolicyResponse;
@@ -108,7 +179,7 @@ async function uploadToOSS(
 
 export interface UploadOptions {
   apiKey: string;
-  /** Defaults to CN for direct SDK callers; Client supplies its resolved credential origin. */
+  /** Model origin used only to resolve the supported regional upload service. Defaults to CN. */
   baseUrl?: string;
   model: string;
   filePath: string;