新增简易的8080面板😊

store/@{Falck}/html-render/SIGNATURE

@@ -0,0 +1,8 @@
+{
+  "signature": "SizmRKKsPO3WuOYi+GtSOvKwZb5UrwRbSlJNJ26RF7l7811PLQlrBPJ7Awx1SUwy50TLrDpwtqbRIdCnGVqI9yzghBhdkwz7dpaAQ//lZK6SM9ygMMtS4ADJ839/AHTuB4USQM5FlqOwTIBE6QGAMgQw+w4di7Rpyh/6VD4Fg3GoiLJi7Pte0Upuglr4oIfZwpEt1liAi0ZlnE+Qb1GkmEGfQYyNYDYQkLKS0KG113YxqMj7sef9WcRCaKJSm+FZ8rV7dA0pCj1jY5sKOdXO/3PYH9g6O/BdgP0XuAoAUgGWshB0Z/D4WwHyykOIRM3jRHmU8kUB4PjxCzFVoDnkYfvN7wBojMjb0F9POjfbSv40jjC3EDjeDusbAP1FGv+F7QaJyAWhNUBSlRUBcHZZ8icSqRAStwX9MHsBVZa5EGrvHFK4SP8b6X6gm01+3JuKpiSRPGkxyDuxlFLNNDipmUNuHh1byofE/oD48yLNh7nGofVIvaDdOn6bhnc3ZDd54onncDNEBaWAHrLvly1nzkP5VN1bFEax/jZPWbSrcntmQ0Ua+11D0Ot/FVFhhrJo1dBBECM9zkVBUkpYAAf1RN7f9IglBVhi5iK+LmbGXzTSUX695tMvnufwXEJsH4fu3Jkom/PUkEggWNHEgb4qm4IsO2wzMWns+ZbZi3PzXP0=",
+  "signer": "Falck",
+  "algorithm": "RSA-SHA256",
+  "timestamp": 1775964953.1502125,
+  "plugin_hash": "84d69d65913b62d156e13a22e09dfcc3a5b36e052ae0532c569ced1fb269bb11",
+  "author": "Falck"
+}

store/@{Falck}/html-render/main.py

@@ -1,9 +1,24 @@
 """HTML 渲染服务 - 通过 config.json 配置，统一文件入口"""
 import json
+import sys
 from pathlib import Path
 from oss.plugin.types import Plugin, register_plugin_type, Response
 
 
+class _Log:
+    _TTY = sys.stdout.isatty()
+    _C = {"reset": "\033[0m", "white": "\033[0;37m", "yellow": "\033[1;33m", "blue": "\033[1;34m", "red": "\033[1;31m"}
+    @classmethod
+    def _c(cls, t, c):
+        return f"{cls._C.get(c,'')}{t}{cls._C['reset']}" if cls._TTY else t
+    @classmethod
+    def info(cls, m): print(f"{cls._c('[html-render]', 'white')} {cls._c(m, 'white')}")
+    @classmethod
+    def warn(cls, m): print(f"{cls._c('[html-render]', 'yellow')} {cls._c('⚠', 'yellow')} {cls._c(m, 'yellow')}")
+    @classmethod
+    def error(cls, m): print(f"{cls._c('[html-render]', 'red')} {cls._c('✗', 'red')} {cls._c(m, 'red')}")
+
+
 class HtmlRenderPlugin(Plugin):
     """HTML 渲染插件 - 渲染服务由 html-render 提供"""
 
@@ -16,16 +31,16 @@ class HtmlRenderPlugin(Plugin):
     def init(self, deps: dict = None):
         """初始化 - 读取 config.json 并解析网站根目录"""
         self._load_config()
-        print(f"[html-render] 配置加载完成: root_dir={self.root_dir}")
+        _Log.info(f"配置加载完成: root_dir={self.root_dir}")
 
     def start(self):
         """启动 - 注册路由到 http-api，共享配置给 web-toolkit"""
         # 注册首页路由
         if self.http_api and hasattr(self.http_api, 'router'):
             self.http_api.router.get("/", self._serve_html)
-            print("[html-render] 已注册路由到 http-api")
+            _Log.info("已注册路由到 http-api")
         else:
-            print("[html-render] http-api 未加载")
+            _Log.warn("http-api 未加载")
 
         # 将配置共享给 web-toolkit（通过 plugin-storage 的 DCIM 共享存储）
         if self.storage:
@@ -35,7 +50,7 @@ class HtmlRenderPlugin(Plugin):
                 "index_file": self.config.get("index_file", "index.html"),
                 "static_prefix": self.config.get("static_prefix", "/static"),
             })
-            print("[html-render] 配置已共享到 DCIM")
+            _Log.info("配置已共享到 DCIM")
 
     def stop(self):
         """停止"""
@@ -53,7 +68,7 @@ class HtmlRenderPlugin(Plugin):
         """读取 config.json，解析根目录"""
         config_path = Path("./data/html-render/config.json")
         if not config_path.exists():
-            print("[html-render] 警告: config.json 不存在，使用默认配置")
+            _Log.warn("config.json 不存在，使用默认配置")
             self.config = {"root_dir": "../website", "index_file": "index.html"}
         else:
             with open(config_path, "r", encoding="utf-8") as f:
@@ -66,6 +81,11 @@ class HtmlRenderPlugin(Plugin):
     def _serve_html(self, request):
         """提供 HTML 页面 - 通过 plugin-storage 读取并注入静态资源路径"""
         index_file = self.config.get("index_file", "index.html")
+        
+        # 安全检查：防止路径穿越
+        if ".." in index_file or index_file.startswith("/"):
+            return Response(status=403, body="Forbidden")
+        
         if self.storage:
             storage = self.storage.get_storage("html-render")
             if storage.file_exists(index_file):