fix(canvas): 画布智能体 - 严格校验模型选择并修正任务与 DNS 错误诊断

backend/internal/outbound/dns_test.go

@@ -0,0 +1,52 @@
+package outbound
+
+import (
+	"context"
+	"errors"
+	"net"
+	"net/http"
+	"strings"
+	"testing"
+
+	"infinite-canvas/backend/internal/kernel"
+)
+
+func TestOutboundDNSFailurePreservesCauseWithoutExposingHost(t *testing.T) {
+	previous := net.DefaultResolver
+	net.DefaultResolver = &net.Resolver{PreferGo: true, Dial: func(context.Context, string, string) (net.Conn, error) {
+		return nil, errors.New("private-sentinel DNS transport unavailable")
+	}}
+	t.Cleanup(func() { net.DefaultResolver = previous })
+
+	for _, validate := range []func(string) error{ValidateOutboundHost, validateCustomRelayHost} {
+		err := validate("private-sentinel.invalid")
+		var appErr *kernel.AppError
+		var dnsErr *net.DNSError
+		if !errors.As(err, &appErr) || appErr.Status != http.StatusBadGateway || appErr.Reason != kernel.ReasonUpstreamDNSFailed || appErr.Retryable {
+			t.Fatalf("incorrect DNS failure classification: %#v", err)
+		}
+		if !errors.As(err, &dnsErr) {
+			t.Fatal("DNS cause was discarded")
+		}
+		if strings.Contains(err.Error(), "private-sentinel") {
+			t.Fatal("DNS details leaked into safe message")
+		}
+	}
+	// Invalid destinations remain policy failures, never DNS/network failures.
+	for _, host := range []string{"", "localhost", "127.0.0.1", "10.0.0.1"} {
+		_, err := resolveOutboundHostWithPolicy(context.Background(), host, false)
+		var badRequest *BadRequestError
+		if !errors.As(err, &badRequest) {
+			t.Fatalf("SSRF validation weakened for %q: %v", host, err)
+		}
+	}
+}
+
+func TestOutboundDNSCancellationKeepsCancellationSemantics(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	_, err := resolveOutboundHostWithPolicy(ctx, "cancelled.invalid", false)
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("cancellation became a DNS failure: %v", err)
+	}
+}

backend/internal/outbound/outbound.go

@@ -14,6 +14,8 @@ import (
 	"strings"
 	"time"
 
+	"infinite-canvas/backend/internal/kernel"
+
 	"golang.org/x/net/http/httpproxy"
 )
 
@@ -341,10 +343,17 @@ func resolveOutboundHostWithPolicy(ctx context.Context, host string, allowPrivat
 	}
 	addresses, err := net.DefaultResolver.LookupIP(ctx, "ip", host)
 	if err != nil {
-		return nil, BadAuthRequest("外部服务域名解析失败")
+		if ctx.Err() != nil {
+			return nil, ctx.Err()
+		}
+		failure := kernel.WrapAppError(http.StatusBadGateway, "外部服务域名解析失败，请检查渠道域名和后端 DNS 配置", err)
+		failure.Reason = kernel.ReasonUpstreamDNSFailed
+		return nil, failure
 	}
 	if len(addresses) == 0 {
-		return nil, BadAuthRequest("外部服务域名没有可用地址")
+		failure := kernel.NewAppError(http.StatusBadGateway, "外部服务域名没有可用地址，请检查渠道域名和后端 DNS 配置")
+		failure.Reason = kernel.ReasonUpstreamDNSFailed
+		return nil, failure
 	}
 	if !allowPrivateHost {
 		for _, ip := range addresses {