host
1dc2f7dc21
2026-10-30 端到端再测：web_search 已通，但 web_fetch 4 次全败于 Tinyproxy 403 Filtered——模型要 fetch 的 一级来源域名都不在白名单里，搜索摘要又无可靠数字， 故按技能规则未报数字。加：worldtimeapi.org、timeapi.io （时间 API）、open-meteo.com（免费天气 API，无 key）、 weather.com.cn（中国气象局英文站）、meteoblue.com、 accuweather.com（搜索结果里的天气一级来源）。 刻意不加 time.is/time.org.cn/time.ms（次级时间站）与 任何新闻/社交域名，白名单仍 fail-closed。 主机 /etc/tinyproxy/tinyproxy-filter 须同步此文件并 reload tinyproxy 才能生效，仓库文件是下次部署不被 revert 的依据。
48 lines
2.1 KiB
Plaintext
48 lines
2.1 KiB
Plaintext
# Tinyproxy Filter: ONE regex per line, matched against the bare
|
|
# domain for CONNECT requests (the log shows e.g. filtered domain
|
|
# "xcmapi.org" -- no scheme, no :port suffix).
|
|
#
|
|
# CRITICAL: Tinyproxy compiles these as POSIX BASIC regex, not
|
|
# extended regex. Extended syntax (+ ? ( ) |) does NOT work here:
|
|
# an extended-style anchored pattern (^(.+\.)?xcmapi\.org$) was
|
|
# verified on 2026-10-26 to deny even xcmapi.org itself, while the
|
|
# basic-syntax equivalent below allows it. In basic regex, groups
|
|
# are \(...\), repetition of a group is \(...\)*, and + ? ( ) are
|
|
# literal characters. Do NOT "modernize" these patterns.
|
|
#
|
|
# Each entry is anchored (^...$) to the domain and its subdomains
|
|
# only: a bare substring "github.com" would also match
|
|
# "evilgithub.com". The \(.*\.\)* prefix matches zero or more
|
|
# "label." segments, so xcmapi.org and api.xcmapi.org match, while
|
|
# notxcmapi.org and xcmapi.org.evil.com do not.
|
|
^\(.*\.\)*xcmapi\.org$
|
|
^\(.*\.\)*github\.com$
|
|
^\(.*\.\)*githubusercontent\.com$
|
|
^\(.*\.\)*pypi\.org$
|
|
^\(.*\.\)*pythonhosted\.org$
|
|
^\(.*\.\)*npmjs\.org$
|
|
# Web search MCP v1 (see docs/web-search-mcp.md). Each line is the
|
|
# API host's domain, subdomains included, in the same BASIC form.
|
|
# searx.diante.me is exact-only on purpose: a \(.*\.\)*diante.me$
|
|
# line would also let tasks reach api.diante.me (the control plane).
|
|
^\(.*\.\)*perplexity\.ai$
|
|
^\(.*\.\)*exa\.ai$
|
|
^\(.*\.\)*tavily\.com$
|
|
^\(.*\.\)*search\.brave\.com$
|
|
^\(.*\.\)*duckduckgo\.com$
|
|
^searx\.diante\.me$
|
|
# live-info primary sources (2026-10-30, user-approved): time
|
|
# APIs + weather primary sources only, so web_fetch can verify
|
|
# numbers instead of failing 403 Filtered. Deliberately NOT
|
|
# included: time.is / time.org.cn / time.ms (commercial or
|
|
# secondary time sites; worldtimeapi + timeapi cover time),
|
|
# and no general news/social domains -- the whitelist stays
|
|
# fail-closed, these are the only fetch destinations live-info
|
|
# needs. Each line is domain + subdomains, same BASIC form.
|
|
^\(.*\.\)*worldtimeapi\.org$
|
|
^\(.*\.\)*timeapi\.io$
|
|
^\(.*\.\)*open-meteo\.com$
|
|
^\(.*\.\)*weather\.com\.cn$
|
|
^\(.*\.\)*meteoblue\.com$
|
|
^\(.*\.\)*accuweather\.com$
|