feat(web): REQ-305 整页快照静态内联档（自研规避 AGPL）

Author: Aparencia

app/src-tauri/src/commands_web.rs

@@ -173,3 +173,85 @@ pub(crate) fn web_session_to_note_core(db: &crate::db::Db, session_id: i64) -> R
 #[cfg(test)]
 #[path = "commands_web_tests.rs"]
 mod tests;
+
+// ── v0.20.4（REQ-305）整页快照（静态内联档——自研规避 SingleFile AGPL）──
+
+/// 快照预算（资源数量/单张/总量护栏——防拖垮与超大文件）。
+const SNAPSHOT_MAX_ASSETS: usize = 40;
+const SNAPSHOT_ASSET_CAP: usize = 2 * 1024 * 1024;
+const SNAPSHOT_TOTAL_CAP: usize = 24 * 1024 * 1024;
+
+fn fetch_bytes(url: &str, cap: usize) -> Option<Vec<u8>> {
+    let agent = ureq::AgentBuilder::new()
+        .timeout(std::time::Duration::from_secs(10))
+        .redirects(4)
+        .user_agent(UA)
+        .build();
+    let resp = agent.get(url).call().ok()?;
+    use std::io::Read;
+    let mut reader = resp.into_reader();
+    let mut body = Vec::new();
+    let mut chunk = [0u8; 8192];
+    loop {
+        let n = reader.read(&mut chunk).ok()?;
+        if n == 0 {
+            break;
+        }
+        body.extend_from_slice(&chunk[..n]);
+        if body.len() > cap {
+            return None;
+        }
+    }
+    Some(body)
+}
+
+/// 快照导出到用户选择路径（save 对话框授权；.html 白名单；快照=自研静态内联）。
+#[tauri::command]
+pub async fn web_snapshot_export(
+    state: State<'_, AppState>,
+    session_id: i64,
+    path: String,
+) -> Result<serde_json::Value, String> {
+    let p = std::path::Path::new(&path);
+    if p.extension().and_then(|e| e.to_str()).map(|e| e.to_ascii_lowercase()).as_deref() != Some("html") {
+        return Err("仅支持 .html 快照文件".to_string());
+    }
+    let st: AppState = (*state).clone();
+    tauri::async_runtime::spawn_blocking(move || {
+        let page = st
+            .db
+            .get_web_page(session_id)
+            .map_err(|e| e.to_string())?
+            .ok_or_else(|| "web 页面不存在".to_string())?;
+        // HTML 源：raw_html（抽取失败保留）> 原文重抓（静态页兜底）
+        let html = match page.raw_html.clone() {
+            Some(h) => h,
+            None => {
+                let bytes = fetch_bytes(&page.url, SNAPSHOT_TOTAL_CAP)
+                    .ok_or_else(|| "原文重抓失败（离线/站点拒绝？）".to_string())?;
+                String::from_utf8_lossy(&bytes).into_owned()
+            }
+        };
+        let mut assets = 0usize;
+        let mut total_bytes = 0usize;
+        let mut resolver = |url: &str| -> Option<String> {
+            if assets >= SNAPSHOT_MAX_ASSETS {
+                return None;
+            }
+            let bytes = fetch_bytes(url, SNAPSHOT_ASSET_CAP)?;
+            assets += 1;
+            total_bytes += bytes.len();
+            if total_bytes > SNAPSHOT_TOTAL_CAP {
+                return None;
+            }
+            use base64::Engine as _;
+            Some(base64::engine::general_purpose::STANDARD.encode(bytes))
+        };
+        let snap = crate::web_snapshot::inline_html(&page.url, &html, &mut resolver);
+        let chars = snap.chars().count();
+        std::fs::write(&path, snap.as_bytes()).map_err(|e| format!("快照写入失败: {}", e))?;
+        Ok(serde_json::json!({ "chars": chars, "assets": assets }))
+    })
+    .await
+    .map_err(|e| format!("任务调度失败: {}", e))?
+}

app/src-tauri/src/lib.rs

@@ -87,6 +87,7 @@ mod db_web;
 mod commands_web;
 mod web_inbox;
 mod commands_web_inbox;
+mod web_snapshot;
 mod asr_clean;
 mod asr_confusion;
 mod asr_dedupe;
@@ -976,6 +977,8 @@ pub fn run() {
             // v0.20.4（REQ-303）：web 采集阶段 1——URL 采集/页面读取
             commands_web::web_capture_url,
             commands_web::web_page_get,
+            // v0.20.4（REQ-305）：整页快照（静态内联档→用户文件）
+            commands_web::web_snapshot_export,
             // v0.20.4（REQ-304）：扩展收件服务——起停/状态
             commands_web_inbox::web_inbox_start,
             commands_web_inbox::web_inbox_status,

app/src-tauri/src/web_snapshot.rs

@@ -0,0 +1,177 @@
+//! 整页静态快照（v0.20.4 / REQ-305——自研 core 内联，规避 SingleFile AGPL）。
+//!
+//! @ai-context: 渲染型整页 DOM+子资源内联需要隐藏 wry 窗口（tauri WebView2
+//!              无 MHTML API——已否决，Foresight §二）；本模块提供**静态降级档**
+//!              （monolith CC0 同思路自研：纯函数规则内联 <link>/<img>/样式块，
+//!              外链脚本剔除防快照 XSS——快照是可离线查看的文档存档，不执行
+//!              原文 JS）。渲染档（wry eval 注入）与截图兜底链登记后置。
+//! @ai-context: 纯函数 + 注入 resolver（测试传假数据；生产=ureq 拉取），
+//!              相对 URL 按页面 base 解析；资源数量/单个体量/总预算护栏。
+
+/// 资源解析器：绝对 URL → data URI（None=拉取失败，保留原引用降级）。
+pub type Resolver<'a> = &'a mut dyn FnMut(&str) -> Option<String>;
+
+/// 相对引用按 base 解析（纯函数；仅 http(s)/同页锚/相对路径）。
+pub fn resolve_url(base: &str, href: &str) -> Option<String> {
+    let href = href.trim();
+    if href.is_empty() {
+        return None;
+    }
+    if href.starts_with("data:") || href.starts_with('#') {
+        return Some(href.to_string());
+    }
+    if href.starts_with("http://") || href.starts_with("https://") {
+        return Some(href.to_string());
+    }
+    if href.starts_with("//") {
+        return Some(format!("https:{}", href)); // 协议相对
+    }
+    let scheme_split = base.find("://")?;
+    let scheme_end = scheme_split + 3;
+    let rest = &base[scheme_end..];
+    let authority = rest.split('/').next().unwrap_or("");
+    if href.starts_with('/') {
+        return Some(format!("{}://{}{}", &base[..scheme_split], authority, href));
+    }
+    // 目录相对：取 base 目录（最后一个 / 之前，保留 authority）
+    let dir = match rest.rfind('/') {
+        Some(i) => rest[..=i].to_string(),
+        None => format!("{}/", rest),
+    };
+    Some(format!("{}://{}{}", &base[..scheme_split], dir, href))
+}
+
+/// 内联单资源占位（style/img 空档——防空串替换破坏结构）。
+fn data_or_keep(
+    kind: &str,
+    resolved: Option<String>,
+    resolver: &mut dyn FnMut(&str) -> Option<String>,
+) -> Option<String> {
+    let url = resolved?;
+    let data = resolver(&url)?;
+    let mime = kind_mime(kind, &url);
+    Some(format!("data:{};base64,{}", mime, data))
+}
+
+fn kind_mime(kind: &str, url: &str) -> String {
+    if kind == "style" {
+        return "text/css".to_string();
+    }
+    let lower = url.to_ascii_lowercase();
+    if lower.contains(".png") || lower.contains(".apng") {
+        "image/png".to_string()
+    } else if lower.contains(".webp") {
+        "image/webp".to_string()
+    } else if lower.contains(".svg") {
+        "image/svg+xml".to_string()
+    } else if lower.contains(".gif") {
+        "image/gif".to_string()
+    } else {
+        "image/jpeg".to_string()
+    }
+}
+
+/// HTML → 静态内联快照（纯函数；返回内联后 HTML）。
+///
+/// @ai-context: 处理 <link rel=stylesheet href>、<img src>、外链 <script src>
+///              （剔除并注释——不执行原文脚本，快照 XSS 面归零）；
+///              行内 <style>/<script> 保持原文（行内 script 属原文内容，
+///              快照只存不开——由打开方语境保证）。
+pub fn inline_html(base: &str, html: &str, resolver: Resolver) -> String {
+    let mut out = String::new();
+    let mut rest = html;
+    while let Some(pos) = rest.find('<') {
+        out.push_str(&rest[..pos]);
+        rest = &rest[pos..];
+        let end = rest.find('>').map(|e| e + 1).unwrap_or(rest.len());
+        let tag = &rest[..end];
+        rest = &rest[end..];
+        let lower = tag.to_ascii_lowercase();
+        if lower.starts_with("<link") {
+            if let Some(href) = extract_attr(tag, "href") {
+                if lower.contains("stylesheet") {
+                    if let Some(data) = data_or_keep("style", resolve_url(base, &href), &mut *resolver) {
+                        out.push_str(&format!("<style data-inlined=\"{}\">{}</style>", escape_attr(&href), data));
+                        continue;
+                    }
+                }
+            }
+            out.push_str(tag);
+        } else if lower.starts_with("<img") {
+            if let Some(src) = extract_attr(tag, "src") {
+                let data = data_or_keep("img", resolve_url(base, &src), &mut *resolver);
+                if let Some(d) = data {
+                    let replaced = replace_attr(tag, "src", &d);
+                    out.push_str(&replaced);
+                    continue;
+                }
+            }
+            out.push_str(tag);
+        } else if lower.starts_with("<script") && tag.contains("src=") {
+            // 外链脚本剔除（防快照执行第三方 JS——只存档不执行），连同闭合标签
+            out.push_str("<!-- entropy-snapshot: external script removed -->");
+            let lower_rest = rest.to_ascii_lowercase();
+            if let Some(close_idx) = lower_rest.find("</script") {
+                if let Some(gt) = rest[close_idx..].find('>') {
+                    rest = &rest[close_idx + gt + 1..];
+                    continue;
+                }
+            }
+            // 无闭合标签的畸形脚本：继续正常扫描
+        } else {
+            out.push_str(tag);
+        }
+    }
+    out.push_str(rest);
+    out
+}
+
+fn extract_attr(tag: &str, name: &str) -> Option<String> {
+    let mut search = tag;
+    while let Some(p) = search.find(name) {
+        let after = &search[p + name.len()..];
+        let after = after.trim_start();
+        if let Some(after_eq) = after.strip_prefix('=') {
+            let v = after_eq.trim_start();
+            let value = if let Some(q) = v.strip_prefix('"') {
+                q.split('"').next().unwrap_or("").to_string()
+            } else if let Some(q) = v.strip_prefix('\'') {
+                q.split('\'').next().unwrap_or("").to_string()
+            } else {
+                v.split_whitespace().next().unwrap_or("").to_string()
+            };
+            return Some(value);
+        }
+        search = after;
+    }
+    None
+}
+
+fn replace_attr(tag: &str, name: &str, new_value: &str) -> String {
+    if let Some(p) = tag.find(name) {
+        let after = &tag[p + name.len()..];
+        let after = after.trim_start();
+        if let Some(after_eq) = after.strip_prefix('=') {
+            let v = after_eq.trim_start();
+            if let Some(first) = v.chars().next() {
+                if first == '"' || first == '\'' {
+                    let rest = &v[first.len_utf8()..];
+                    if let Some(end) = rest.find(first) {
+                        let head = format!("{}{}={}", &tag[..p], name, first);
+                        let tail = &rest[end..];
+                        return format!("{}{}{}", head, new_value, tail);
+                    }
+                }
+            }
+        }
+    }
+    tag.to_string()
+}
+
+fn escape_attr(s: &str) -> String {
+    s.replace('"', "&quot;")
+}
+
+#[cfg(test)]
+#[path = "web_snapshot_tests.rs"]
+mod tests;

app/src-tauri/src/web_snapshot_tests.rs

@@ -0,0 +1,44 @@
+//! web_snapshot 纯逻辑单测（v0.20.4 / REQ-305）。
+
+use super::*;
+
+#[test]
+fn resolve_url_forms() {
+    assert_eq!(resolve_url("https://a.com/x/y.html", "/css/s.css").as_deref(), Some("https://a.com/css/s.css"));
+    assert_eq!(resolve_url("https://a.com/x/y.html", "img/1.png").as_deref(), Some("https://a.com/x/img/1.png"));
+    assert_eq!(resolve_url("https://a.com", "//cdn.e/x.js").as_deref(), Some("https://cdn.e/x.js"));
+    assert_eq!(resolve_url("https://a.com/x", "https://b.com/z").as_deref(), Some("https://b.com/z"));
+    assert!(resolve_url("https://a.com", "").is_none());
+    assert!(resolve_url("not-a-url", "x").is_none());
+}
+
+#[test]
+fn inline_styles_imgs_and_strip_external_scripts() {
+    let html = r#"<html><head><link rel="stylesheet" href="/css/main.css">
+<script src="https://evil.example/x.js"></script></head>
+<body><img src="pic/logo.png" alt="logo"><script>var ok=1;</script><p>正文</p></body></html>"#;
+    let mut resolver = |url: &str| match url {
+        "https://a.com/css/main.css" => Some("aGFzaA==".to_string()), // base64('hash')
+        "https://a.com/x/pic/logo.png" => Some("aWNvbg==".to_string()),
+        _ => None,
+    };
+    let out = inline_html("https://a.com/x/y.html", html, &mut resolver);
+    assert!(out.contains("data:text/css;base64,aGFzaA=="), "{}", out);
+    assert!(out.contains("data:image/png;base64,aWNvbg=="), "{}", out);
+    assert!(!out.contains("evil.example"), "外链脚本剔除");
+    assert!(out.contains("var ok=1"), "行内脚本保持原文（快照只存不开）");
+    assert!(out.contains("<p>正文</p>"));
+}
+
+#[test]
+fn unresolvable_assets_keep_original_reference() {
+    let html = r#"<img src="missing.png"><link rel="stylesheet" href="/gone.css">"#;
+    let mut calls = 0;
+    let out = inline_html("https://a.com/x/", html, &mut |_url: &str| {
+        calls += 1;
+        None
+    });
+    assert!(out.contains("missing.png"));
+    assert!(out.contains("gone.css"));
+    assert_eq!(calls, 2, "拉取失败保留原引用（降级链语义）");
+}

app/src/components/WebArticleView.tsx

@@ -8,6 +8,7 @@
  */
 import { useEffect, useState } from "react";
 import { invoke } from "@tauri-apps/api/core";
+import { save } from "@tauri-apps/plugin-dialog";
 
 interface WebPageView {
   session_id: number;
@@ -32,6 +33,29 @@ const btn: React.CSSProperties = { padding: "5px 10px", cursor: "pointer", fontS
 export default function WebArticleView({ sessionId, onToNote, onRemove }: Props) {
   const [page, setPage] = useState<WebPageView | null>(null);
   const [err, setErr] = useState("");
+  const [snapMsg, setSnapMsg] = useState("");
+  const [snapBusy, setSnapBusy] = useState(false);
+
+  /** REQ-305：整页快照（静态内联档——样式/图内联，外链脚本剔除防 XSS） */
+  const doSnapshot = async () => {
+    if (!page) return;
+    setSnapBusy(true);
+    setSnapMsg("");
+    setErr("");
+    try {
+      const path = await save({
+        defaultPath: `${(page.site ?? "page")}-snapshot.html`,
+        filters: [{ name: "HTML", extensions: ["html"] }],
+      });
+      if (!path) return;
+      const r = await invoke<{ chars: number; assets: number }>("web_snapshot_export", { sessionId, path });
+      setSnapMsg(`✓ 快照已保存（${r.chars} 字符 · 内联 ${r.assets} 项资源）——离线可开（不执行原文脚本）`);
+    } catch (e) {
+      setErr(String(e));
+    } finally {
+      setSnapBusy(false);
+    }
+  };
 
   useEffect(() => {
     void invoke<WebPageView | null>("web_page_get", { sessionId })
@@ -57,11 +81,20 @@ export default function WebArticleView({ sessionId, onToNote, onRemove }: Props)
           >
             📝 转为笔记
           </button>
+          <button
+            style={{ ...btn, borderRadius: 6 }}
+            disabled={snapBusy}
+            title="整页快照（静态内联 HTML——样式/图内联，外链脚本剔除）"
+            onClick={() => void doSnapshot()}
+          >
+            {snapBusy ? "快照中…" : "📸 整页快照"}
+          </button>
           <button style={btn} onClick={() => onRemove(sessionId)}>
             删除
           </button>
         </span>
       </div>
+      {snapMsg && <div style={{ fontSize: 12, color: "#047857", marginBottom: 8 }}>{snapMsg}</div>}
       <div style={{ fontSize: 11, marginBottom: 8 }}>
         🔗 <a href={page.url} target="_blank" rel="noreferrer" style={{ color: "#2563eb", wordBreak: "break-all" }}>{page.url}</a>
       </div>