@linxin666/dsh-pet 0.2.4 → 0.2.5

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   node scripts/verify-docs.mjs --write <dir>
-README.md: a0adc3fe2cb2767a8e372ed32cec6e8f7bb74660
-README.zh.md: e048ab6aece36283648b95ceddf705b3c6783f7e
+README.md: 5b33a914b3a373385771a4526c5129ca91dd71db
+README.zh.md: 4ce92ac1d90ca1a667edc058996ddc9dd7504584

package/README.md

@@ -288,7 +288,7 @@ The two built-in whale-girl atlases use the same 9-state × 8-column contract: `
 
 ## Security model
 
-- All pet API and asset routes are fenced to loopback clients.
+- Every `/api/pet/*` and `/pet/<id>/*` route is loopback-only by default (the shared plugin-family fence: loopback socket + Host header + browser same-origin markers): unpaired LAN clients get `403 forbidden: loopback-only` before any pet state or atlas is served. When `dsh-remote-web-ui` is also loaded, a live paired-device cookie is an additional allow path (the same cookie `api/gate` already checks); unpaired and revoked devices stay 403. The pet does not depend on the remote plugin.
 - Asset serving resolves both the pet directory and the candidate file through `realpath`; symlink escapes are refused (403). Files are size-capped before being read into memory (manifest 64 KB, imagery 20 MB; over-cap answers 413).
 - Live2D models are served by closure: only the manifest, the declared primary assets, and the files the `.model3.json` references (each screened against traversal, absolute and URL forms).
 - The plugin never downloads executables and never bundles the Live2D Cubism Core.

package/README.zh.md

@@ -288,7 +288,7 @@ pnpm typecheck    # 仅类型检查
 
 ## 安全模型
 
-- 全部宠物 API 与资产路由仅服务回环客户端。
+- 全部 `/api/pet/*` 与 `/pet/<id>/*` 路由默认仅限 loopback（插件家族共享围栏：loopback 套接字 + Host 头 + 浏览器同源标记）：未配对的局域网客户端在任何宠物状态或图集下发前即收到 `403 forbidden: loopback-only`。同时装了 `dsh-remote-web-ui` 时，有效的已配对设备 cookie 是额外放行路径（与 `api/gate` 检查同一枚 cookie）；未配对与已撤销设备仍 403。宠物插件不硬依赖远程插件。
 - 资产服务对宠物目录与目标文件双双做 `realpath` 解析；symlink 越界一律拒绝（403）。文件读入内存前按类限大小（清单 64 KB、图像 20 MB；超限 413）。
 - Live2D 模型按闭包放行：仅清单、声明的主资产与 `.model3.json` 引用到的文件（引用先经穿越/绝对路径/URL 形态筛查）。
 - 插件从不下载可执行文件，也从不内置 Live2D Cubism Core。

package/lib/client.js

@@ -244,7 +244,7 @@ window.__ModuleLoader__.load({
 				const position = (index) => -index * frameWidth + "px 0px";
 				const reduceMotion = window.matchMedia?.("(prefers-reduced-motion: reduce)")?.matches === true;
 				el.style.backgroundPosition = position(segment.from);
-				if (reduceMotion) return;
+				if (reduceMotion || segment.from === segment.to) return;
 				let raf = 0;
 				let index = segment.from;
 				let elapsed = 0;
@@ -258,8 +258,8 @@ window.__ModuleLoader__.load({
 						elapsed = 0;
 						if (index < segment.to) index += 1;
 						else if (decoration.loop) index = segment.from;
+						el.style.backgroundPosition = position(index);
 					}
-					el.style.backgroundPosition = position(index);
 					if (!decoration.loop && index === segment.to) return;
 					raf = requestAnimationFrame(tick);
 				};
@@ -789,6 +789,7 @@ window.__ModuleLoader__.load({
 			const downRef = (0, react.useRef)(null);
 			const [error, setError] = (0, react.useState)(null);
 			(0, react.useEffect)(() => {
+				setError(null);
 				const container = containerRef.current;
 				const live2d = props.definition.live2d;
 				if (container === null || live2d === void 0) return void 0;
@@ -1019,6 +1020,25 @@ window.__ModuleLoader__.load({
 		* downsampled atlas only when the effective on-screen scale warrants it.
 		*/
 		const TEXTURE_OPTIONS = { lod: "single-auto" };
+		/** Recursively release the activation without invalidating shared texture caches. */
+		const DESTROY_OPTIONS = { children: true };
+		/** Remove only this activation's canvas; `true` would release Pixi globals. */
+		const RENDERER_DESTROY_OPTIONS = { removeView: true };
+		/** Ignore hidden/zero boxes and keep Pixi dimensions stable and integral. */
+		function normalizeRendererSize(width, height) {
+			if (!Number.isFinite(width) || !Number.isFinite(height) || width <= 0 || height <= 0) return void 0;
+			return {
+				width: Math.max(1, Math.round(width)),
+				height: Math.max(1, Math.round(height))
+			};
+		}
+		/** Fit the model from its unscaled dimensions into the current Pixi screen. */
+		function layoutModel(app, model, sourceSize, config) {
+			const fit = Math.min(app.renderer.width / sourceSize.width, app.renderer.height / sourceSize.height) * .92;
+			model.scale.set(fit * (config.scale ?? 1));
+			model.anchor.set(.5);
+			model.position.set(app.renderer.width / 2 + (config.translate?.x ?? 0), app.renderer.height / 2 + (config.translate?.y ?? 0));
+		}
 		let vendorConfigured = false;
 		/** Configure pixi extensions + the Cubism SDK once per page. */
 		function configureOnce(vendor) {
@@ -1045,11 +1065,56 @@ window.__ModuleLoader__.load({
 				let disposed = false;
 				let app;
 				let model;
+				let modelAttached = false;
+				let modelSourceSize;
+				let resizeObserver;
+				let resizeTracking = false;
 				let errorListener;
 				let unsubscribe;
 				/** The motion group the current phase maps to (resume target after taps). */
 				let phaseGroup = config.motions.idle;
 				let tapPlaying = false;
+				const stopResizeTracking = () => {
+					resizeTracking = false;
+					resizeObserver?.disconnect();
+					resizeObserver = void 0;
+				};
+				const resizeRenderer = (pixiApp, width, height) => {
+					const next = normalizeRendererSize(width, height);
+					if (disposed || !resizeTracking || next === void 0) return;
+					if (pixiApp.renderer.width === next.width && pixiApp.renderer.height === next.height) return;
+					pixiApp.renderer.resize(next.width, next.height);
+					if (model !== void 0 && modelSourceSize !== void 0) layoutModel(pixiApp, model, modelSourceSize, config);
+				};
+				const trackContainerSize = (pixiApp) => {
+					if (typeof ResizeObserver === "undefined") return;
+					resizeTracking = true;
+					resizeObserver = new ResizeObserver((entries) => {
+						const entry = entries.find((candidate) => candidate.target === ctx.container);
+						if (entry === void 0) return;
+						resizeRenderer(pixiApp, entry.contentRect.width, entry.contentRect.height);
+					});
+					resizeObserver.observe(ctx.container);
+					resizeRenderer(pixiApp, ctx.container.clientWidth, ctx.container.clientHeight);
+				};
+				/** Release every resource currently owned by this activation exactly once. */
+				const destroyResources = () => {
+					stopResizeTracking();
+					unsubscribe?.();
+					unsubscribe = void 0;
+					const currentApp = app;
+					const currentModel = model;
+					const modelOwnedByApp = currentApp !== void 0 && modelAttached;
+					app = void 0;
+					model = void 0;
+					modelSourceSize = void 0;
+					modelAttached = false;
+					try {
+						if (currentModel !== void 0 && !modelOwnedByApp) currentModel.destroy(DESTROY_OPTIONS);
+					} finally {
+						currentApp?.destroy(RENDERER_DESTROY_OPTIONS, DESTROY_OPTIONS);
+					}
+				};
 				const playGroup = (group) => {
 					if (model === void 0) return;
 					const groups = model.internalModel.settings.motions ?? {};
@@ -1079,38 +1144,54 @@ window.__ModuleLoader__.load({
 					}
 					configureOnce(vendor);
 					const pixiApp = new vendor.Application();
-					await pixiApp.init({
-						width: Math.max(1, ctx.container.clientWidth || 160),
-						height: Math.max(1, ctx.container.clientHeight || 174),
-						backgroundAlpha: 0,
-						antialias: true,
-						autoDensity: true,
-						preference: "webgl"
-					});
+					const initialSize = normalizeRendererSize(ctx.container.clientWidth, ctx.container.clientHeight) ?? {
+						width: 160,
+						height: 174
+					};
+					try {
+						await pixiApp.init({
+							width: initialSize.width,
+							height: initialSize.height,
+							backgroundAlpha: 0,
+							antialias: true,
+							autoDensity: true,
+							preference: "webgl"
+						});
+					} catch (error) {
+						try {
+							pixiApp.destroy(RENDERER_DESTROY_OPTIONS, DESTROY_OPTIONS);
+						} catch {}
+						throw error;
+					}
 					if (disposed) {
-						pixiApp.destroy(true, { children: true });
+						pixiApp.destroy(RENDERER_DESTROY_OPTIONS, DESTROY_OPTIONS);
 						return;
 					}
+					app = pixiApp;
 					pixiApp.canvas.style.display = "block";
 					pixiApp.canvas.style.width = "100%";
 					pixiApp.canvas.style.height = "100%";
 					ctx.container.appendChild(pixiApp.canvas);
+					trackContainerSize(pixiApp);
 					const loaded = await vendor.Live2DModel.from(config.modelUrl, {
+						autoUpdate: false,
 						autoHitTest: false,
 						autoFocus: false,
 						textureOptions: TEXTURE_OPTIONS
 					});
+					model = loaded;
 					if (disposed) {
-						pixiApp.destroy(true, { children: true });
+						destroyResources();
 						return;
 					}
-					app = pixiApp;
-					model = loaded;
-					const fit = Math.min(pixiApp.renderer.width / Math.max(1, loaded.width), pixiApp.renderer.height / Math.max(1, loaded.height)) * .92;
-					loaded.scale.set(fit * (config.scale ?? 1));
-					loaded.anchor.set(.5);
-					loaded.position.set(pixiApp.renderer.width / 2 + (config.translate?.x ?? 0), pixiApp.renderer.height / 2 + (config.translate?.y ?? 0));
+					modelSourceSize = {
+						width: Math.max(1, loaded.width),
+						height: Math.max(1, loaded.height)
+					};
+					layoutModel(pixiApp, loaded, modelSourceSize, config);
 					pixiApp.stage.addChild(loaded);
+					modelAttached = true;
+					loaded.automator.autoUpdate = true;
 					loaded.on("motionFinish", () => {
 						if (tapPlaying) {
 							tapPlaying = false;
@@ -1121,18 +1202,17 @@ window.__ModuleLoader__.load({
 					unsubscribe = ctx.phase.subscribe(applyPhase);
 				};
 				boot().catch(() => {
-					if (!disposed) errorListener?.("load-failed");
+					try {
+						destroyResources();
+					} finally {
+						if (!disposed) errorListener?.("load-failed");
+					}
 				});
 				return {
 					dispose() {
 						if (disposed) return;
 						disposed = true;
-						unsubscribe?.();
-						model = void 0;
-						if (app !== void 0) {
-							app.destroy(true, { children: true });
-							app = void 0;
-						}
+						destroyResources();
 					},
 					tap(x, y) {
 						const current = model;
@@ -1987,8 +2067,10 @@ window.__ModuleLoader__.load({
 					choiceField("petId", this.petChoices)
 				]);
 				this.store = this.form.bind(() => this.projection());
-				this.loadPets();
-				this.loadDiagnostics();
+				window.setTimeout(() => {
+					this.loadPets();
+					this.loadDiagnostics();
+				}, 0);
 			}
 			/** Fetch registry diagnostics once (soft-fail: an empty list on error). */
 			async loadDiagnostics() {