fix(files): let Token Plan keys reach explicit upload proxies

Author: hopelynd

docs/agents/url-change.md

@@ -35,11 +35,11 @@ Prime 视频命令通过 `Client.uploadFile` / `resolveImageInput` 的 `defaultB
 复用 `resolvePrimeEndpoint` 推导 model Workspace origin;上传策略与模型提交均保持该
 Workspace origin。显式配置的 model origin 仍优先;已有媒体 URL 不触发上传或求值上传默认地址。
 
-官方临时文件上传当前只支持 `cn-beijing` 与 `ap-southeast-1`;其他已知官方地域与
-Token Plan 在发送 API Key 前失败。显式自定义代理视为自身路由的权威来源,保持同源并由
-代理/服务决定能力。任何路径都不得回退公共站或跨 origin 重试;不支持时用户可改用服务
-可访问的 HTTPS 媒体 URL。服务端错误保留 message/code/request ID/raw response,并在
-message 的结构化上下文中展示本次有效上传 endpoint。
+官方临时文件上传当前只支持 `cn-beijing` 与 `ap-southeast-1`。Token Plan 主机,以及这些官方
+endpoint 上的 `sk-sp-` 密钥,在发送 API Key 前失败。显式自定义代理视为自身路由的权威来源,
+保持同源且不按密钥前缀拦截,由代理/服务决定能力。任何路径都不得回退公共站或跨 origin 重试;
+不支持时用户可改用服务可访问的 HTTPS 媒体 URL。服务端错误保留 message/code/request ID/raw
+response,并在 message 的结构化上下文中展示本次有效上传 endpoint。
 
 ## 必查清单
 

packages/core/src/files/upload.ts

@@ -24,32 +24,39 @@ function unsupportedTemporaryUpload(target: string): BailianError {
   );
 }
 
-/** Keep the configured origin when supported; reject known unsupported official regions. */
+/** Reject Token Plan keys only after the endpoint is recognized as official. */
+function rejectOfficialTokenPlanKey(apiKey: string): void {
+  if (getApiKeyLoginKind(apiKey) === "token-plan") {
+    throw unsupportedTemporaryUpload("Token Plan");
+  }
+}
+
+/** Keep supported official origins; reject known unsupported official regions. Custom proxies skip key-prefix checks. */
 function resolveUploadBaseUrl(baseUrl: string, apiKey: string): string {
   const normalizedBaseUrl = normalizeModelBaseUrl(baseUrl);
   const hostname = new URL(normalizedBaseUrl).hostname.toLowerCase();
 
-  if (
-    getApiKeyLoginKind(apiKey) === "token-plan" ||
-    /^token-plan\.[a-z0-9-]+\.maas\.aliyuncs\.com$/.test(hostname)
-  ) {
+  if (/^token-plan\.[a-z0-9-]+\.maas\.aliyuncs\.com$/.test(hostname)) {
     throw unsupportedTemporaryUpload("Token Plan");
   }
 
-  if (hostname === new URL(REGIONS.cn).hostname) return normalizedBaseUrl;
-  if (hostname === new URL(REGIONS.intl).hostname) return normalizedBaseUrl;
+  if (hostname === new URL(REGIONS.cn).hostname || hostname === new URL(REGIONS.intl).hostname) {
+    rejectOfficialTokenPlanKey(apiKey);
+    return normalizedBaseUrl;
+  }
   if (hostname === new URL(REGIONS.us).hostname) {
     throw unsupportedTemporaryUpload(hostname);
   }
 
   const maasMatch = /^[^.]+\.([a-z0-9-]+)\.maas\.aliyuncs\.com$/.exec(hostname);
   const cloudRegion = maasMatch?.[1];
   if (cloudRegion === "cn-beijing" || cloudRegion === "ap-southeast-1") {
+    rejectOfficialTokenPlanKey(apiKey);
     return normalizedBaseUrl;
   }
   if (cloudRegion) throw unsupportedTemporaryUpload(cloudRegion);
 
-  // Explicit custom proxies are authoritative for their own upload routing.
+  // Explicit custom proxies decide temporary-upload support themselves; do not gate on key prefix.
   return normalizedBaseUrl;
 }
 

packages/core/tests/file-upload.test.ts

@@ -60,13 +60,11 @@ function makeClient(baseUrl: string, token = "sk-synthetic-profile-key"): Client
   });
 }
 
-function expectSuccessfulUpload(uploadOrigin: string): void {
+function expectSuccessfulUpload(uploadOrigin: string, token = "sk-synthetic-profile-key"): void {
   expect(fetchMock).toHaveBeenCalledTimes(2);
   const [policyUrl, policyOptions] = fetchMock.mock.calls[0]!;
   expect(policyUrl).toBe(`${uploadOrigin}/api/v1/uploads?action=getPolicy&model=wan3.0-video`);
-  expect(new Headers(policyOptions?.headers).get("Authorization")).toBe(
-    "Bearer sk-synthetic-profile-key",
-  );
+  expect(new Headers(policyOptions?.headers).get("Authorization")).toBe(`Bearer ${token}`);
   const [uploadUrl, uploadOptions] = fetchMock.mock.calls[1]!;
   expect(uploadUrl).toBe(policy.upload_host);
   expect(uploadOptions).toBeDefined();
@@ -131,14 +129,30 @@ describe("regional temporary file uploads", () => {
     expect(fetchMock).not.toHaveBeenCalled();
   });
 
-  test("rejects Token Plan keys before requesting a policy", async () => {
+  test.each([
+    REGIONS.cn,
+    REGIONS.intl,
+    "https://ws-example.cn-beijing.maas.aliyuncs.com",
+    "https://ws-example.ap-southeast-1.maas.aliyuncs.com",
+  ])(
+    "rejects Token Plan keys on official endpoint %s before requesting a policy",
+    async (baseUrl) => {
+      await expect(
+        makeClient(baseUrl, "sk-sp-synthetic-plan-key").uploadFile(fixturePath, "wan3.0-video"),
+      ).rejects.toMatchObject({
+        exitCode: ExitCode.USAGE,
+        message: expect.stringContaining("Token Plan"),
+      });
+      expect(fetchMock).not.toHaveBeenCalled();
+    },
+  );
+
+  test("lets a Token Plan key reach an explicit custom proxy", async () => {
+    const proxy = "https://proxy.example.test";
     await expect(
-      makeClient(REGIONS.cn, "sk-sp-synthetic-plan-key").uploadFile(fixturePath, "wan3.0-video"),
-    ).rejects.toMatchObject({
-      exitCode: ExitCode.USAGE,
-      message: expect.stringContaining("Token Plan"),
-    });
-    expect(fetchMock).not.toHaveBeenCalled();
+      makeClient(proxy, "sk-sp-synthetic-plan-key").uploadFile(fixturePath, "wan3.0-video"),
+    ).resolves.toBe("oss://temporary/sample.mp4");
+    expectSuccessfulUpload(proxy, "sk-sp-synthetic-plan-key");
   });
 
   test("preserves upload-policy service errors without retrying another region", async () => {