@linxin666/dsh-client-ui-skin-center 0.3.2 → 0.3.4

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   node scripts/verify-docs.mjs --write <dir>
-README.md: 42f90dbff0368a591f28ced7509f7fe522ee0f64
-README.zh.md: f617359c4750785da8f0731aec2cca9cacf77e7f
+README.md: 04b1c524d8222926a64008329b4fb9454ab2f0c0
+README.zh.md: 56cd3679ad66705e5543409086911be3bf723fbd

package/README.md

@@ -22,9 +22,9 @@ dsh plugin --profile web add @linxin666/dsh-client-ui-skin-center
 # From the repo (dev): dsh plugin --profile web add link:$(pwd)/packages/skins/skin-center
 ```
 
-`$(pwd)` is your clone of the dsh-web-ui monorepo. Only the default skin (blue-fantasy) ships inside this package; every other skin installs on demand from dsh-market.com into `$DSH_HOME/skins/<id>/`, and community skins are plain directories in the same place (no install command, no restart — reopen the card or reload to pick them up). A fresh install activates blue-fantasy by default (host seed); an update whose active skin is no longer available falls back to the stock look. The package ships `skins/blue-fantasy` only; the remaining skins stay in the repository under `skins/` as the market-build and gallery source and are never published in the package.
+`$(pwd)` is your clone of the dsh-web monorepo. Only the default skin (blue-fantasy) ships inside this package; every other skin installs on demand from dsh-market.com into `$DSH_HOME/skins/<id>/`, and community skins are plain directories in the same place (no install command, no restart — reopen the card or reload to pick them up). A fresh install activates blue-fantasy by default (host seed); an update whose active skin is no longer available falls back to the stock look. The package ships `skins/blue-fantasy` only; the remaining skins stay in the repository under `skins/` as the market-build and gallery source and are never published in the package.
 
-skin-center is a self-contained bundle meeting the official DSH plugin standard (`dsh.bundle.patch` points to `cordis.patch.yml`); it can also be installed via git: `dsh plugin --profile web add github:<org>/dsh-web-ui#<sha>` (the `prepare` script builds `lib/` in place). pnpm ≥10 requires authorizing `allowBuilds` before installing a git dependency; a local `link:` install has no such requirement.
+skin-center is a self-contained bundle meeting the official DSH plugin standard (`dsh.bundle.patch` points to `cordis.patch.yml`); it can also be installed via git: `dsh plugin --profile web add github:<org>/dsh-web#<sha>` (the `prepare` script builds `lib/` in place). pnpm ≥10 requires authorizing `allowBuilds` before installing a git dependency; a local `link:` install has no such requirement.
 
 ## Configuration
 
@@ -40,7 +40,7 @@ skin-center is a self-contained bundle meeting the official DSH plugin standard
 - All `/api/skin-center/*` routes are same-origin only: writes reject cross-site requests (Sec-Fetch-Site / Origin fence), and asset reads are contained inside each skin directory (path escapes fail closed).
 - Skin CSS is sanitized (whitelist) before serving; `patches.css` (L3) is arbitrary CSS by design and disclosed as such — it runs with full page styling power and is not a security boundary.
 - The custom-theme editor emits only fixed declarations from `CUSTOM_THEME_ALLOWED_TOKENS`, each verified against the official token registry. User input is normalized color/contrast data and never becomes a selector, URL or free-form CSS payload.
-- `hooks.mjs` is trusted code that shares this repository's review and release; it is served same-origin only and its import/apply errors can never take the static skin down.
+- `hooks.mjs` is trusted code that shares this repository's review and release; it is served same-origin only and its import/apply errors can never take the static skin down. Hooks run for built-in skins, and for user-directory skins installed from the official DSH Market whose `dsh-market.provenance.json` sha256-pins the on-disk `skin.json` and hooks entry to the market-served bytes (verified by `src/provenance.ts`, issue #1073); a missing or mismatched provenance — hand-dropped or tampered directories — keeps the hooks facet refused while the declarative parts still load.
 
 ## Known limitations
 
@@ -48,6 +48,10 @@ skin-center is a self-contained bundle meeting the official DSH plugin standard
 - Plugins that do not output semantic attributes (and have no stable DOM anchors) receive L1 token coverage only.
 - A skin video background keeps playing regardless of the wallpaper pause-on-hidden setting; pause-on-hidden applies to the Wallpaper Engine bridge only.
 
+## Telemetry
+
+The browser half sends one anonymous install heartbeat per UTC day to dsh-market.com: a random localStorage id plus this package's name, nothing else. The server stores only a salted hash of that id, never IP addresses, and exposes aggregate counts only. See [docs/telemetry.md](../../../docs/telemetry.md) for the full contract.
+
 ## Directory structure
 
 ```
@@ -57,6 +61,7 @@ skins/skin-center/
   src/core/css-safety/                      # lightningcss scoping + whitelist pipeline
   src/index.ts                              # host entry: routes, tapIndex adapter, legacy bridge
   src/skin-repo.ts                          # dual-source skin catalog (built-in + $DSH_HOME/skins)
+  src/provenance.ts                         # official-market install provenance verification (hooks trust)
   src/routes-v2.ts                          # /api/skin-center/v2/* routes
   src/tap-index-adapter.ts                  # the single tapIndex adapter (anti-FOUC)
   src/active-state.ts                       # active-skin selection persistence

package/README.zh.md

@@ -22,9 +22,9 @@ dsh plugin --profile web add @linxin666/dsh-client-ui-skin-center
 # 仓库开发：dsh plugin --profile web add link:$(pwd)/packages/skins/skin-center
 ```
 
-`$(pwd)` 是 dsh-web-ui monorepo 的本地克隆。只有默认皮肤（蓝色幻想）随这个包发布；其余皮肤在 dsh-market.com 按需安装到 `$DSH_HOME/skins/<id>/`，社区皮肤同样是放进该目录的普通目录（均无安装命令、无需重启——重开卡片或刷新页面即收录）。新装默认激活蓝色幻想（宿主种子）；升级后原激活皮肤已不可用时回退官方主题。包内只发布 `skins/blue-fantasy`；其余皮肤保留在仓库 `skins/` 下，作为市场构建与画廊的目录来源，绝不进入 npm 包。
+`$(pwd)` 是 dsh-web monorepo 的本地克隆。只有默认皮肤（蓝色幻想）随这个包发布；其余皮肤在 dsh-market.com 按需安装到 `$DSH_HOME/skins/<id>/`，社区皮肤同样是放进该目录的普通目录（均无安装命令、无需重启——重开卡片或刷新页面即收录）。新装默认激活蓝色幻想（宿主种子）；升级后原激活皮肤已不可用时回退官方主题。包内只发布 `skins/blue-fantasy`；其余皮肤保留在仓库 `skins/` 下，作为市场构建与画廊的目录来源，绝不进入 npm 包。
 
-皮肤中心是符合官方 DSH 插件标准的自包含 bundle（`dsh.bundle.patch` 指向 `cordis.patch.yml`）；也可经 git 安装：`dsh plugin --profile web add github:<org>/dsh-web-ui#<sha>`（`prepare` 脚本就地构建 `lib/`）。pnpm ≥10 安装 git 依赖前需授权 `allowBuilds`；本地 `link:` 安装无此要求。
+皮肤中心是符合官方 DSH 插件标准的自包含 bundle（`dsh.bundle.patch` 指向 `cordis.patch.yml`）；也可经 git 安装：`dsh plugin --profile web add github:<org>/dsh-web#<sha>`（`prepare` 脚本就地构建 `lib/`）。pnpm ≥10 安装 git 依赖前需授权 `allowBuilds`；本地 `link:` 安装无此要求。
 
 ## 配置
 
@@ -40,7 +40,7 @@ dsh plugin --profile web add @linxin666/dsh-client-ui-skin-center
 - 所有 `/api/skin-center/*` 路由仅接受同源请求：写操作拒绝跨站请求（Sec-Fetch-Site / Origin 围栏），资产读取限定在各皮肤目录之内（路径逃逸 fail-closed）。
 - 皮肤 CSS 在服务前经白名单净化；`patches.css`（L3）按设计就是任意 CSS 并如实公示——它拥有完整页面样式能力，不构成安全边界。
 - 自定义主题编辑器只会从 `CUSTOM_THEME_ALLOWED_TOKENS` 生成固定声明，且每个 token 都对照官方 token 注册表校验。用户输入只作为规范化后的颜色/对比度数据，不会成为选择器、URL 或自由 CSS 载荷。
-- `hooks.mjs` 是与本仓库同审同发的受信代码，仅同源 serve，其 import/apply 错误永远不会拖垮静态皮肤。
+- `hooks.mjs` 是与本仓库同审同发的受信代码，仅同源 serve，其 import/apply 错误永远不会拖垮静态皮肤。hooks 对内置皮肤放行；对用户目录皮肤，仅当其从官方 DSH 市场安装且 `dsh-market.provenance.json` 以 sha256 钉住磁盘上的 `skin.json` 与 hooks 入口字节时放行（由 `src/provenance.ts` 校验，issue #1073）；provenance 缺失或不匹配——手工投放或被篡改的目录——hooks facet 保持拒绝，声明式部分仍正常加载。
 
 ## 已知限制
 
@@ -48,6 +48,10 @@ dsh plugin --profile web add @linxin666/dsh-client-ui-skin-center
 - 不输出语义属性（且无稳定 DOM 锚点）的插件只享受 L1 token 覆盖。
 - 皮肤视频背景不受壁纸「隐藏时暂停」设置影响；该设置仅作用于 Wallpaper Engine 桥。
 
+## 数据遥测
+
+浏览器半区每个 UTC 日向 dsh-market.com 发送一次匿名安装心跳：仅含一个 localStorage 随机 ID 与本包名，无其他数据。服务端只存储该 ID 的加盐哈希，不存 IP，且只暴露聚合计数。完整契约见 [docs/telemetry.md](../../../docs/telemetry.md)。
+
 ## 目录结构
 
 ```
@@ -57,6 +61,7 @@ skins/skin-center/
   src/core/css-safety/                      # lightningcss 作用域限定 + 白名单管线
   src/index.ts                              # host 入口：路由、tapIndex 适配器、旧版迁移桥
   src/skin-repo.ts                          # 双来源皮肤目录册（内置 + $DSH_HOME/skins）
+  src/provenance.ts                         # 官方市场安装 provenance 校验（hooks 信任）
   src/routes-v2.ts                          # /api/skin-center/v2/* 路由
   src/tap-index-adapter.ts                  # 单一 tapIndex 适配器（防 FOUC）
   src/active-state.ts                       # 活动皮肤选择持久化

package/contracts/README.md

@@ -37,6 +37,24 @@ manifests would be rejected by their own validator. Optional legal metadata
 (`license`, `licenseUrl`, `noticeUrl`, `sourceUrl`, `attribution`) is
 first-class in v2.
 
+## Hooks trust model
+
+`hooks.mjs` is trusted executable code that shares this repository's review
+and release. It is served verbatim over `GET /skins/<id>/hooks.mjs` only for:
+
+- **built-in skins** — shipped inside the skin-center npm package, same
+  review and release by definition;
+- **official-market installs** — user-directory skins carrying a
+  `dsh-market.provenance.json` whose sha256 pins the on-disk `skin.json`
+  and hooks entry to the bytes the official DSH Market served (the market
+  content is built from this repository, so a hash match means the bytes
+  are the reviewed ones). Verification lives in `src/provenance.ts` and
+  fails closed: any missing, foreign-source or mismatched provenance keeps
+  the hooks facet refused with a catalog warning while the declarative
+  parts (skin.css / patches.css / assets) still load (issue #1073).
+
+Locally dropped or third-party skin directories never run hooks.
+
 ## Loader-side rules (pinned here, enforced in M2)
 
 - All skin CSS is force-scoped under `html[data-dsh-skin="<id>"]` by the

package/contracts/semantic-attrs-v1.md

@@ -45,7 +45,7 @@
 | `data-dsh-wallpaper-active` | html + body（body/html 级，另行管理） | WE 壁纸挂载期间置 `true`，卸载 / 禁用清除；供皮肤 CSS 与壁纸中和规则锚定（#734） |
 | `data-dsh-wallpaper-surface` | 官方 shell 全视口背景元素 + 侧栏工作区淡化条（元素级） | `WallpaperController.markWallpaperSurfaces()` 在 WE 壁纸挂载期间打标（全视口 bg-base 背景 + `data-slot="sidebar.workspaces"` 内渐变淡化条），命中 `html[data-dsh-wallpaper-active] [data-dsh-wallpaper-surface]` 中和；卸载清除，不含哈希类依赖（#734） |
 
-## part 组（31 行，含各 owner 行）
+## part 组（38 行，含各 owner 行）
 
 shell 区域（owner: shell）：
 
@@ -59,6 +59,7 @@ shell 区域（owner: shell）：
 | `queue-dock` | 排队条；`[data-queue-dock]` |
 | `turn-tail` | turn 尾行；`[data-turn-tail]` |
 | `resize-handle` | 列宽手柄；`[data-side]` |
+| `new-session` | 侧栏新会话按钮；官方稳定属性落地前由兼容适配器从 `button[class*="newSession"]` 补打，皮肤不得依赖本地化文案 |
 
 family / 插件区域：
 
@@ -101,8 +102,14 @@ family / 插件区域：
 | `row` | session-id | 会话列表行；面板内行容器（`[data-dsh-part="row"]`） |
 | `copy` | session-id | 每行复制按钮；`button[data-dsh-part="copy"]` |
 | `search` | session-id | 面板搜索输入框；`input[type="search"][data-dsh-part="search"]` |
+| `sprite` | miku-pet | 宠物帧舞台；`[data-dsh-plugin="miku-pet"] [data-dsh-part="sprite"]` |
+| `menu` | miku-pet | 悬停菜单（两级）；`[data-dsh-part="menu"]` |
+| `stats` | miku-pet | 左侧属性彩条；`[data-dsh-part="stats"]` |
+| `shop` | miku-pet | 商店居中窗口；`[data-dsh-part="shop"]` |
+| `bubble` | miku-pet | 对话气泡；`[data-dsh-part="bubble"]` |
+| `float` | miku-pet | 互动飘字；`[data-dsh-part="float"]` |
 
-## plugin 组（12 个，含停更 aionui-panel）
+## plugin 组（13 个，含停更 aionui-panel）
 
 | data-dsh-plugin | owner | 锚定方式 |
 | --- | --- | --- |
@@ -111,13 +118,14 @@ family / 插件区域：
 | `git-graph` | dsh-git-graph | slot entry id `git-graph`；`[data-gitgraph-chip-anchor]` / `[data-gitgraph-dialog]` |
 | `pet` | dsh-pet | `[data-dsh-pet-root]`；一级设置分区 settings.section id `pet`（只列内置与已安装宠物） |
 | `remote-web-ui` | dsh-remote-web-ui | slot entry id `remote-web-ui` |
-| `web-ui-settings` | dsh-web-ui-settings | settings.section id `web-ui-plugins` |
+| `web-ui-settings` | dsh-web-settings | settings.section id `web-ui-plugins` |
 | `skill-explorer` | dsh-skill-explorer | `[data-dsh-skill-explorer-view]` / `[data-dsh-skill-explorer-entry]` |
 | `doctor` | dsh-doctor | web-ui.plugin.item 槽 entry id `doctor`（设置 → Web UI 插件 → Doctor 卡片）；卡片内 `[data-dsh-plugin="doctor"]` |
 | `aionui-panel` | dsh-aionui-panel（停更） | dock entry id `aionui-*` |
 | `dsh-web-ui-market` | dsh-market | 创意工坊商店一级页（settings.section id `dsh-web-ui-market`），商店卡与目录条目容器 |
 | `skin-center` | skins/skin-center | 一级设置分区 settings.section id `skin-center`（列已安装皮肤，属内置源时显式标记） |
 | `session-id` | dsh-session-id | footer action slot entry id `session-id`；`[data-dsh-plugin="session-id"]`（面板 overlay 根 + 入口触发器） |
+| `miku-pet` | dsh-miku-pet | 宠物浮层根 `[data-dsh-plugin="miku-pet"]`；host 路由前缀 `/miku-pet/*`；设置页 settings.section id `miku-pet-config` |
 
 ## 已知脆弱点（上游主题缝 PR 诉求）
 

package/contracts/skin-manifest-v2.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://schemas.linxin666.org/dsh-skin/v2.json",
   "title": "DSH Skin Manifest v2",
-  "description": "Declarative manifest for a dsh-web-ui skin asset directory. Skins are pure assets; the skin-center package is the only loader/renderer. Validators must use this local schema copy and never fetch the $id URL.",
+  "description": "Declarative manifest for a dsh-web skin asset directory. Skins are pure assets; the skin-center package is the only loader/renderer. Validators must use this local schema copy and never fetch the $id URL.",
   "type": "object",
   "additionalProperties": false,
   "required": [