@linxin666/dsh-pet 0.2.8 → 0.3.0

package/lib/index.js

@@ -2774,9 +2774,14 @@ function resolveLive2dEntry(manifest, dir, options) {
 		record("error", "pet " + manifest.id + ": renderer live2d requires a live2d block");
 		return;
 	}
+	const modelFile = join(dir, block.model);
 	let model3;
 	try {
-		model3 = JSON.parse(readFileSync(join(dir, block.model), "utf8"));
+		if (guardedScannedJsonStat(modelFile, options, "live2d model " + block.model, 33554432) === void 0) {
+			statSync(modelFile);
+			return;
+		}
+		model3 = JSON.parse(readFileSync(modelFile, "utf8"));
 	} catch (error) {
 		record("error", "pet " + manifest.id + ": live2d model " + block.model + " is not readable: " + (error instanceof Error ? error.message : String(error)));
 		return;
@@ -2833,7 +2838,7 @@ function scanPetDir(dir, options) {
 	for (const name of names) {
 		const manifestFile = join(dir, name, "pet.json");
 		if (!existsSync(manifestFile)) continue;
-		const parsed = readPetJson(manifestFile, options.warnings);
+		const parsed = readPetJson(manifestFile, options);
 		if (parsed === void 0) continue;
 		const entryDir = join(dir, name);
 		const verdict = parsePetManifest(parsed, entryDir);
@@ -2871,22 +2876,38 @@ function scanPetDir(dir, options) {
 	}
 	return entries;
 }
-/** Read and parse one manifest file; undefined (warning recorded) on failure. */
-function readPetJson(file, warnings) {
+/**
+* Read and parse one pet.json manifest; undefined (warning recorded) on
+* failure. The descriptor stat guard applies first: a pathological file —
+* huge, or a FIFO/device — is skipped with a warning instead of stalling
+* or OOM-ing the host at scan time (same discipline as voice/decoration).
+*/
+function readPetJson(file, options) {
+	if (guardedScannedJsonStat(file, options, "pet manifest") === void 0) return void 0;
 	try {
 		return JSON.parse(readFileSync(file, "utf8"));
 	} catch (error) {
-		warnings?.push("skipping " + file + ": " + (error instanceof Error ? error.message : String(error)));
+		options.warnings?.push("skipping " + file + ": " + (error instanceof Error ? error.message : String(error)));
 		return;
 	}
 }
 /**
+* Scan-time read ceiling for user-authored JSON descriptors (voice.json,
+* .voice.json, decoration.json): the registry reads these synchronously at
+* plugin startup, and a pathological file — multi-GB, or a FIFO/device
+* symlink — must not hang or exhaust the host before the warn-and-drop
+* discipline can apply (review-spd follow-up, pet-center M4/M5).
+*/
+const PET_SCAN_JSON_CAP = 64 * 1024;
+/**
 * Stat one scanned JSON descriptor with a regular-file + size guard, so a
 * pathological user file is skipped with a warning instead of stalling or
 * OOM-ing the host at startup. Returns the Stats, or undefined when the
-* caller must skip the file (a warning was recorded).
+* caller must skip the file (a warning was recorded). 'cap' defaults to
+* the descriptor ceiling (PET_SCAN_JSON_CAP); model descriptors pass the
+* larger live2d ceiling.
 */
-function guardedScannedJsonStat(file, options, what) {
+function guardedScannedJsonStat(file, options, what, cap = PET_SCAN_JSON_CAP) {
 	let st;
 	try {
 		st = statSync(file);
@@ -2905,8 +2926,8 @@ function guardedScannedJsonStat(file, options, what) {
 		warn(what + " is not a regular file; ignored");
 		return;
 	}
-	if (st.size > 65536) {
-		warn(what + " exceeds the 65536-byte scan ceiling; ignored");
+	if (st.size > cap) {
+		warn(what + " exceeds the " + cap + "-byte scan ceiling; ignored");
 		return;
 	}
 	return st;
@@ -3203,6 +3224,12 @@ var PetService = class extends Service {
 	* disposed sessions are removed by the 'session/disposed' listener.
 	*/
 	sessionActivity = /* @__PURE__ */ new Map();
+	/**
+	* Sessions whose reward source is the official event stream. This metadata
+	* outlives transient visual resets so a derived legacy `done` cannot reward
+	* the same turn again after the pet is disabled and re-enabled.
+	*/
+	officialEventSessions = /* @__PURE__ */ new WeakSet();
 	constructor(ctx, config = {}) {
 		super(ctx, "pet");
 		this.persistDir = config.persistDir ?? petHomeDir();
@@ -3316,6 +3343,7 @@ var PetService = class extends Service {
 	setEnabled(enabled) {
 		this.enabled = enabled;
 		this.syncActivity();
+		if (!enabled) this.resetActivity();
 	}
 	syncActivity() {
 		if (this.disposeActivity !== void 0) {
@@ -3340,10 +3368,12 @@ var PetService = class extends Service {
 				const transition = projectOfficialEvent(event, runtime);
 				if (transition === void 0) return;
 				runtime.officialEventsSeen = true;
+				this.officialEventSessions.add(session);
 				this.applyActivity(session, transition.input, transition.whisper);
 				if (transition.completedTurn !== void 0) this.rewardTurn(String(session.id), transition.completedTurn);
 			}), this.ctx.on("session/disposed", (session) => {
 				this.ledger.forgetSession(String(session.id));
+				this.officialEventSessions.delete(session);
 				this.sessionActivity.delete(session);
 				if (session !== this.displaySession) return;
 				this.displaySession = void 0;
@@ -3360,12 +3390,20 @@ var PetService = class extends Service {
 			};
 		})();
 	}
+	/** Drop transient activity because terminal events missed while disabled cannot be replayed safely. */
+	resetActivity() {
+		this.displaySession = void 0;
+		this.sessionActivity.clear();
+		this.machine.onSessionDisposed();
+	}
 	/** Return the per-session activity record, creating it on first sight. */
 	activityOf(session) {
 		let activity = this.sessionActivity.get(session);
 		if (activity === void 0) {
+			const runtime = emptyProjectionRuntime(this.voicePools());
+			runtime.officialEventsSeen = this.officialEventSessions.has(session);
 			activity = {
-				runtime: emptyProjectionRuntime(this.voicePools()),
+				runtime,
 				machine: new PetStateMachine(this.stateConfig)
 			};
 			this.sessionActivity.set(session, activity);
@@ -3604,6 +3642,63 @@ function isPairingAccess(value) {
 	return value !== void 0 && value !== null && typeof value.isPairedDevice === "function";
 }
 //#endregion
+//#region src/http.ts
+/** Default body cap for readJsonBody: 64 KiB. */
+const DEFAULT_JSON_BODY_MAX_BYTES = 64 * 1024;
+/** Family-default JSON response headers; callers may append or override. */
+const JSON_HEADERS = {
+	"content-type": "application/json; charset=utf-8",
+	"referrer-policy": "no-referrer"
+};
+/**
+* Lenient bounded body reader: parse a request body as JSON, or null on an
+* empty body, invalid JSON, or a body past maxBytes (default 64 KiB).
+* Overflow destroys the request instead of draining the remainder (no drain
+* call, matching the current repo-wide behavior); callers must not keep
+* reading the request afterwards. With objectOnly, non-JSON-object payloads
+* also yield null.
+*/
+async function readJsonBody(req, opts = {}) {
+	const maxBytes = opts.maxBytes ?? DEFAULT_JSON_BODY_MAX_BYTES;
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		const buffer = chunk;
+		size += buffer.length;
+		if (size > maxBytes) {
+			req.destroy();
+			return null;
+		}
+		chunks.push(buffer);
+	}
+	const text = Buffer.concat(chunks).toString("utf8");
+	if (text === "") return null;
+	try {
+		const parsed = JSON.parse(text);
+		if (opts.objectOnly && !isJsonObject(parsed)) return null;
+		return parsed;
+	} catch {
+		return null;
+	}
+}
+/** Whether a value is a JSON object: typeof object, not null, not an array. */
+function isJsonObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Write one JSON response. Default headers are the family defaults
+* (content-type and referrer-policy); caller headers are appended or
+* override them.
+*/
+function writeJson(res, status, body, headers = {}) {
+	const payload = JSON.stringify(body);
+	res.writeHead(status, {
+		...JSON_HEADERS,
+		...headers
+	});
+	res.end(payload);
+}
+//#endregion
 //#region src/routes.ts
 /**
 * Pet HTTP routes — the browser half talks to the host through plain
@@ -3679,52 +3774,19 @@ function mimeFor(file) {
 	if (dot < 0) return "application/octet-stream";
 	return MIME_BY_EXT[file.slice(dot).toLowerCase()] ?? "application/octet-stream";
 }
-/** Write one JSON response. */
-function json(res, status, body) {
-	res.writeHead(status, { "content-type": "application/json; charset=utf-8" });
-	res.end(JSON.stringify(body));
-}
 /** Require the method or answer 405. */
 function requireMethod(req, res, method) {
 	if (req.method === method) return true;
-	json(res, 405, {
+	writeJson(res, 405, {
 		ok: false,
 		error: "method-not-allowed"
 	});
 	return false;
 }
-/** Read a JSON request body (bounded). */
-function readJsonBody(req) {
-	return new Promise((resolve, reject) => {
-		let size = 0;
-		const chunks = [];
-		req.on("data", (chunk) => {
-			size += chunk.length;
-			if (size > 64 * 1024) {
-				reject(/* @__PURE__ */ new Error("body-too-large"));
-				queueMicrotask(() => req.destroy());
-				return;
-			}
-			chunks.push(chunk);
-		});
-		req.on("end", () => {
-			if (chunks.length === 0) {
-				resolve({});
-				return;
-			}
-			try {
-				resolve(JSON.parse(Buffer.concat(chunks).toString("utf8")));
-			} catch {
-				reject(/* @__PURE__ */ new Error("invalid-json"));
-			}
-		});
-		req.on("error", reject);
-	});
-}
 /** Shared route fence: loopback always passes; a live paired-device cookie is an extra allow path. */
 function guard(ctx, req, res) {
 	if (isPetAllowed(ctx, req)) return true;
-	json(res, 403, {
+	writeJson(res, 403, {
 		ok: false,
 		error: "forbidden: loopback-only"
 	});
@@ -3738,8 +3800,8 @@ function getRoute(ctx, path, run) {
 		handler: (req, res) => {
 			if (!guard(ctx, req, res)) return;
 			if (!requireMethod(req, res, "GET")) return;
-			run().then((value) => json(res, 200, value), (error) => {
-				json(res, 500, {
+			run().then((value) => writeJson(res, 200, value), (error) => {
+				writeJson(res, 500, {
 					ok: false,
 					error: error instanceof Error ? error.message : String(error)
 				});
@@ -3755,15 +3817,16 @@ function postRoute(ctx, path, run) {
 		handler: (req, res) => {
 			if (!guard(ctx, req, res)) return Promise.resolve();
 			if (!requireMethod(req, res, "POST")) return Promise.resolve();
-			return readJsonBody(req).then((body) => {
-				return run(typeof body === "object" && body !== null ? body : {}).then((value) => json(res, 200, value), (error) => {
-					json(res, 400, {
+			return readJsonBody(req, { maxBytes: 64 * 1024 }).then((parsed) => {
+				const payload = parsed ?? {};
+				return run(typeof payload === "object" && payload !== null ? payload : {}).then((value) => writeJson(res, 200, value), (error) => {
+					writeJson(res, 400, {
 						ok: false,
 						error: error instanceof Error ? error.message : String(error)
 					});
 				});
 			}, (error) => {
-				json(res, 400, {
+				writeJson(res, 400, {
 					ok: false,
 					error: error instanceof Error ? error.message : String(error)
 				});
@@ -3959,7 +4022,7 @@ function runtimeHandler(ctx, roots) {
 		const base = spec.root === "runtimeDir" ? roots.runtimeDir : roots.vendorDir;
 		const file = join(base, name);
 		if (!existsSync(file)) {
-			json(res, 404, {
+			writeJson(res, 404, {
 				ok: false,
 				error: "runtime-file-missing",
 				file: name

package/lib/types/client/PetSettingsCard.d.ts

@@ -72,6 +72,9 @@ export declare class PetSettingsCardController {
     private diagnostics;
     private loaded;
     private attempts;
+    private disposed;
+    /** Pending deferred-load or retry timer; cancelled by dispose(). */
+    private pendingTimer;
     /** @param scope - the bound settings scope for the 'pet' namespace. */
     constructor(scope: SettingsScope<PetSettings>);
     /** Fetch registry diagnostics once (soft-fail: an empty list on error). */
@@ -85,8 +88,8 @@ export declare class PetSettingsCardController {
      */
     inject(): PetSettingsCardFace;
     /**
-     * Release the card's scope subscription and bound stores; the slot
-     * disposer calls this on teardown.
+     * Release the card's scope subscription, bound stores and pending load
+     * timers; the slot disposer calls this on teardown.
      */
     dispose(): void;
 }

package/lib/types/client/PetSettingsCard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PetSettingsCard.d.ts","sourceRoot":"","sources":["../../../src/client/PetSettingsCard.tsx"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACtC,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAA;AAC7F,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAI1F,OAAO,EAAoD,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,KAAK,UAAU,IAAI,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAG1J,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,oCAAoC;IACpC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB;IACrB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,6DAA6D;IAC7D,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,0CAA0C;AAC1C,MAAM,WAAW,oBAAqB,SAAQ,SAAS;IACrD,4BAA4B;IAC5B,OAAO,EAAE,cAAc,CAAA;IACvB,qBAAqB;IACrB,OAAO,EAAE,cAAc,CAAA;IACvB,iBAAiB;IACjB,IAAI,EAAE,cAAc,CAAA;IACpB,mBAAmB;IACnB,KAAK,EAAE,cAAc,CAAA;IACrB,oBAAoB;IACpB,MAAM,EAAE,cAAc,CAAA;IACtB,oBAAoB;IACpB,KAAK,EAAE,cAAc,CAAA;IACrB,uCAAuC;IACvC,iBAAiB,EAAE,cAAc,CAAA;IACjC,wEAAwE;IACxE,UAAU,EAAE,SAAS;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACvD,+EAA+E;IAC/E,cAAc,EAAE,SAAS,iBAAiB,EAAE,CAAA;CAC7C;AAED,gEAAgE;AAChE,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD,KAAK,EAAE;QACL,iEAAiE;QACjE,eAAe,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAA;KACrD,CAAA;CACF;AAQD,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,GAAG,SAAS,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;CAChB;AAiBD,2DAA2D;AAC3D,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAI3D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAe;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4B;IACtD,OAAO,CAAC,WAAW,CAA0B;IAC7C,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,QAAQ,CAAI;IAEpB,uEAAuE;gBAC3D,KAAK,EAAE,aAAa,CAAC,WAAW,CAAC;IAqB7C,2EAA2E;YAC7D,eAAe;IAS7B,0EAA0E;YAC5D,QAAQ;IAgBtB,OAAO,CAAC,UAAU;IAelB;;;OAGG;IACH,MAAM,IAAI,mBAAmB;IAI7B;;;OAGG;IACH,OAAO,IAAI,IAAI;CAGhB;AAED,0DAA0D;AAC1D,MAAM,MAAM,oBAAoB,GAC9B,WAAW,CAAC,KAAK,CAAC,GAChB,UAAU,CAAC,mBAAmB,CAAC,CAAA;AAEnC;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,+BA6G1D;AAED,8DAA8D;AAC9D,MAAM,MAAM,uBAAuB,GACjC,YAAY,CAAC,kBAAkB,CAAC,GAC9B,WAAW,CAAC,KAAK,CAAC,GAClB,UAAU,CAAC,mBAAmB,CAAC,CAAA;AAEnC,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,SAAS,CAO5E"}
+{"version":3,"file":"PetSettingsCard.d.ts","sourceRoot":"","sources":["../../../src/client/PetSettingsCard.tsx"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACtC,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAA;AAC7F,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAI1F,OAAO,EAAoD,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,KAAK,UAAU,IAAI,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAG1J,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,oCAAoC;IACpC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB;IACrB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,6DAA6D;IAC7D,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,0CAA0C;AAC1C,MAAM,WAAW,oBAAqB,SAAQ,SAAS;IACrD,4BAA4B;IAC5B,OAAO,EAAE,cAAc,CAAA;IACvB,qBAAqB;IACrB,OAAO,EAAE,cAAc,CAAA;IACvB,iBAAiB;IACjB,IAAI,EAAE,cAAc,CAAA;IACpB,mBAAmB;IACnB,KAAK,EAAE,cAAc,CAAA;IACrB,oBAAoB;IACpB,MAAM,EAAE,cAAc,CAAA;IACtB,oBAAoB;IACpB,KAAK,EAAE,cAAc,CAAA;IACrB,uCAAuC;IACvC,iBAAiB,EAAE,cAAc,CAAA;IACjC,wEAAwE;IACxE,UAAU,EAAE,SAAS;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACvD,+EAA+E;IAC/E,cAAc,EAAE,SAAS,iBAAiB,EAAE,CAAA;CAC7C;AAED,gEAAgE;AAChE,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD,KAAK,EAAE;QACL,iEAAiE;QACjE,eAAe,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAA;KACrD,CAAA;CACF;AAQD,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,GAAG,SAAS,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;CAChB;AAiBD,2DAA2D;AAC3D,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAI3D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAe;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4B;IACtD,OAAO,CAAC,WAAW,CAA0B;IAC7C,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,QAAQ,CAAI;IACpB,OAAO,CAAC,QAAQ,CAAQ;IACxB,oEAAoE;IACpE,OAAO,CAAC,YAAY,CAAoB;IAExC,uEAAuE;gBAC3D,KAAK,EAAE,aAAa,CAAC,WAAW,CAAC;IAuB7C,2EAA2E;YAC7D,eAAe;IAU7B,0EAA0E;YAC5D,QAAQ;IAsBtB,OAAO,CAAC,UAAU;IAelB;;;OAGG;IACH,MAAM,IAAI,mBAAmB;IAI7B;;;OAGG;IACH,OAAO,IAAI,IAAI;CAShB;AAED,0DAA0D;AAC1D,MAAM,MAAM,oBAAoB,GAC9B,WAAW,CAAC,KAAK,CAAC,GAChB,UAAU,CAAC,mBAAmB,CAAC,CAAA;AAEnC;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,+BA6G1D;AAED,8DAA8D;AAC9D,MAAM,MAAM,uBAAuB,GACjC,YAAY,CAAC,kBAAkB,CAAC,GAC9B,WAAW,CAAC,KAAK,CAAC,GAClB,UAAU,CAAC,mBAAmB,CAAC,CAAA;AAEnC,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,SAAS,CAO5E"}

package/lib/types/client/PetSettingsCard.js

@@ -29,6 +29,9 @@ export class PetSettingsCardController {
     diagnostics = [];
     loaded = false;
     attempts = 0;
+    disposed = false;
+    /** Pending deferred-load or retry timer; cancelled by dispose(). */
+    pendingTimer;
     /** @param scope - the bound settings scope for the 'pet' namespace. */
     constructor(scope) {
         this.form = new CardForm(scope, [
@@ -45,7 +48,10 @@ export class PetSettingsCardController {
         // the first registry request until that pass completes so transport
         // plugins (notably remote-web-ui on a paired non-loopback origin) can
         // install their fetch channel before /api/pet/pets is issued.
-        window.setTimeout(() => {
+        this.pendingTimer = window.setTimeout(() => {
+            this.pendingTimer = undefined;
+            if (this.disposed)
+                return;
             void this.loadPets();
             void this.loadDiagnostics();
         }, 0);
@@ -54,6 +60,8 @@ export class PetSettingsCardController {
     async loadDiagnostics() {
         try {
             this.diagnostics = await fetchPetDiagnostics();
+            if (this.disposed)
+                return;
             this.store.set(this.projection());
         }
         catch {
@@ -62,10 +70,12 @@ export class PetSettingsCardController {
     }
     /** Resolve the registry choices once (retried a few times on failure). */
     async loadPets() {
-        if (this.loaded)
+        if (this.loaded || this.disposed)
             return;
         try {
             const list = await fetchPetChoices();
+            if (this.disposed)
+                return;
             this.petChoices.splice(0, this.petChoices.length, ...list.map(choice => choice.id));
             for (const choice of list)
                 this.petLabels.set(choice.id, choice.displayName);
@@ -73,9 +83,16 @@ export class PetSettingsCardController {
             this.store.set(this.projection());
         }
         catch {
+            if (this.disposed)
+                return;
             this.attempts += 1;
             if (this.attempts < 3) {
-                window.setTimeout(() => { void this.loadPets(); }, 3000);
+                this.pendingTimer = window.setTimeout(() => {
+                    this.pendingTimer = undefined;
+                    if (this.disposed)
+                        return;
+                    void this.loadPets();
+                }, 3000);
             }
         }
     }
@@ -101,10 +118,17 @@ export class PetSettingsCardController {
         return { hooks: { petSettingsCard: this.store }, ...this.form.actions() };
     }
     /**
-     * Release the card's scope subscription and bound stores; the slot
-     * disposer calls this on teardown.
+     * Release the card's scope subscription, bound stores and pending load
+     * timers; the slot disposer calls this on teardown.
      */
     dispose() {
+        if (this.disposed)
+            return;
+        this.disposed = true;
+        if (this.pendingTimer !== undefined) {
+            window.clearTimeout(this.pendingTimer);
+            this.pendingTimer = undefined;
+        }
         this.form.dispose();
     }
 }

package/lib/types/client/PetSprite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PetSprite.d.ts","sourceRoot":"","sources":["../../../src/client/PetSprite.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAkE,SAAS,EAAE,WAAW,EAAE,MAAM,OAAO,CAAA;AAGnH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAEnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAIjD,OAAO,EAAE,EAAE,EAAE,MAAM,cAAc,CAAA;AAGjC,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,gDAAgD;IAChD,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAA;IAC7B,8EAA8E;IAC9E,UAAU,EAAE,aAAa,CAAA;IACzB,qDAAqD;IACrD,OAAO,EAAE,gBAAgB,CAAA;IACzB,sCAAsC;IACtC,QAAQ,EAAE,WAAW,GAAG,IAAI,CAAA;IAC5B,8BAA8B;IAC9B,KAAK,EAAE,MAAM,IAAI,CAAA;IACjB,sCAAsC;IACtC,MAAM,EAAE,MAAM,IAAI,CAAA;IAClB,sCAAsC;IACtC,MAAM,EAAE,MAAM,IAAI,CAAA;IAClB,+BAA+B;IAC/B,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAA;IAClD,uDAAuD;IACvD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAChC,4DAA4D;IAC5D,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAA;IAC1C,2DAA2D;IAC3D,cAAc,EAAE,MAAM,IAAI,CAAA;IAC1B;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,CAAA;IAClB,+CAA+C;IAC/C,CAAC,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAA;CAC1B;AAgGD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,WAAW,CAygB5D"}
+{"version":3,"file":"PetSprite.d.ts","sourceRoot":"","sources":["../../../src/client/PetSprite.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAkE,SAAS,EAAE,WAAW,EAAE,MAAM,OAAO,CAAA;AAGnH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAEnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAIjD,OAAO,EAAE,EAAE,EAAE,MAAM,cAAc,CAAA;AAGjC,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,gDAAgD;IAChD,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAA;IAC7B,8EAA8E;IAC9E,UAAU,EAAE,aAAa,CAAA;IACzB,qDAAqD;IACrD,OAAO,EAAE,gBAAgB,CAAA;IACzB,sCAAsC;IACtC,QAAQ,EAAE,WAAW,GAAG,IAAI,CAAA;IAC5B,8BAA8B;IAC9B,KAAK,EAAE,MAAM,IAAI,CAAA;IACjB,sCAAsC;IACtC,MAAM,EAAE,MAAM,IAAI,CAAA;IAClB,sCAAsC;IACtC,MAAM,EAAE,MAAM,IAAI,CAAA;IAClB,+BAA+B;IAC/B,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAA;IAClD,uDAAuD;IACvD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAChC,4DAA4D;IAC5D,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAA;IAC1C,2DAA2D;IAC3D,cAAc,EAAE,MAAM,IAAI,CAAA;IAC1B;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,CAAA;IAClB,+CAA+C;IAC/C,CAAC,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAA;CAC1B;AAgGD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,WAAW,CAiiB5D"}

package/lib/types/client/PetSprite.js

@@ -407,25 +407,33 @@ export function PetSprite(props) {
                 return;
             clearHideTimer();
             hideTimerRef.current = window.setTimeout(() => setHovered(false), 300);
-        }, children: [_jsx("div", { ref: spriteRef, className: styles.sprite, style: {
-                    width: spriteWidth,
-                    height: spriteHeight,
-                    ...(props.visual === undefined
-                        ? {
-                            backgroundImage: imageReady ? 'url(' + definition.atlasUrl + ')' : undefined,
-                            backgroundSize: (cell.width * columns * spriteScale) + 'px ' + (cell.height * (definition.atlasRows ?? rows.length) * spriteScale) + 'px',
-                            backgroundRepeat: 'no-repeat',
-                            backgroundPosition: '0 0',
-                        }
-                        : {}),
-                    cursor: dragRef.current === null ? 'grab' : 'grabbing',
-                }, onPointerDown: onPointerDown, onPointerMove: onPointerMove, onPointerUp: onPointerUp, onClick: () => {
-                    // A pointer sequence that moved (dragged) still fires a trailing
-                    // click; skip the pet when that happened.
-                    if (draggedRef.current)
-                        return;
-                    props.onPet();
-                }, role: "button", "aria-label": definition.displayName, children: props.visual }), feedback !== null && (_jsx("div", { ref: bubbleRef, className: clsx(styles.bubble, feedback.kind === 'feed' ? styles.bubbleFeed : styles.bubblePet), children: feedback.text }, feedback.at)), feedback === null && (sessionBubbles.length > 0 || statusBubble !== undefined || whisper !== undefined) && (_jsxs("div", { ref: bubbleRef, className: styles.bubbleStack, onPointerEnter: () => setStackPeek(true), onPointerLeave: () => setStackPeek(false), children: [visibleSessions.map((session, index) => {
+        }, children: [_jsxs("div", { className: styles.spriteWrap, style: { width: spriteWidth, height: spriteHeight }, children: [_jsx("div", { ref: spriteRef, className: styles.sprite, style: {
+                            width: spriteWidth,
+                            height: spriteHeight,
+                            ...(props.visual === undefined
+                                ? {
+                                    backgroundImage: imageReady ? 'url(' + definition.atlasUrl + ')' : undefined,
+                                    backgroundSize: (cell.width * columns * spriteScale) + 'px ' + (cell.height * (definition.atlasRows ?? rows.length) * spriteScale) + 'px',
+                                    backgroundRepeat: 'no-repeat',
+                                    backgroundPosition: '0 0',
+                                }
+                                : {}),
+                            cursor: dragRef.current === null ? 'grab' : 'grabbing',
+                        }, onPointerDown: onPointerDown, onPointerMove: onPointerMove, onPointerUp: onPointerUp, onClick: () => {
+                            // A pointer sequence that moved (dragged) still fires a trailing
+                            // click; skip the pet when that happened.
+                            if (draggedRef.current)
+                                return;
+                            props.onPet();
+                        }, role: "button", "aria-label": definition.displayName, children: props.visual }), _jsx("button", { type: "button", className: styles.closeButton, "aria-label": panelLabel('hide', props.t('pet.hide')), title: panelLabel('hide', props.t('pet.hide')), "data-testid": "pet-close", onPointerDown: (e) => {
+                            // Keep the close control from starting a drag on the sprite.
+                            e.stopPropagation();
+                        }, onClick: (e) => {
+                            // The close control sits beside the pet button; do not pet as a
+                            // side effect of closing the overlay.
+                            e.stopPropagation();
+                            props.onHide();
+                        }, children: "\u00D7" })] }), feedback !== null && (_jsx("div", { ref: bubbleRef, className: clsx(styles.bubble, feedback.kind === 'feed' ? styles.bubbleFeed : styles.bubblePet), children: feedback.text }, feedback.at)), feedback === null && (sessionBubbles.length > 0 || statusBubble !== undefined || whisper !== undefined) && (_jsxs("div", { ref: bubbleRef, className: styles.bubbleStack, onPointerEnter: () => setStackPeek(true), onPointerLeave: () => setStackPeek(false), children: [visibleSessions.map((session, index) => {
                         // The whisper rides the display session's bubble — the stack's
                         // primary entry (DOM-first, rendered bottom-most by the reversed
                         // column so it stays glued to the sprite when extras open above).

package/lib/types/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAwB,aAAa,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAA;AAgEnI,wEAAwE;AACxE,eAAO,MAAM,MAAM,UAA2E,CAAA;AAE9F,qEAAqE;AACrE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACxE,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACrD,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC7D,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AACtF,YAAY,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AACpE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAEnD,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf;;;;WAIG;QACH,aAAa,CAAC,EAAE;YAAE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;SAAE,CAAA;KAC1E;CACF;AAED;;;;;GAKG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAqQ9C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAwB,aAAa,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAA;AAgEnI,wEAAwE;AACxE,eAAO,MAAM,MAAM,UAA2E,CAAA;AAE9F,qEAAqE;AACrE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACxE,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACrD,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC7D,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AACtF,YAAY,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AACpE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAEnD,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf;;;;WAIG;QACH,aAAa,CAAC,EAAE;YAAE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;SAAE,CAAA;KAC1E;CACF;AAED;;;;;GAKG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CA0Q9C"}

package/lib/types/client/index.js

@@ -70,8 +70,13 @@ export function apply(ctx) {
     };
     // First-level settings section: one staged form over the 'pet' settings
     // namespace, registered as a top-level settings page. The controller loads
-    // the petId choices from the registry endpoint itself.
+    // the petId choices from the registry endpoint itself — the registry lists
+    // the available pets (built-in assets plus user dirs), so the section only
+    // ever shows installed pets. Installing new pets happens in the Workshop
+    // store.
     const petSettings = new PetSettingsCardController(settingsScope);
+    // The section entry owns the controller: unregistering it (fiber disposal,
+    // hot reload) releases the scope subscription through petSettings.dispose.
     ctx.slots.inject('settings.section', () => {
         const unregister = ctx.slots.register({
             name: 'settings.section',
@@ -82,8 +87,8 @@ export function apply(ctx) {
             inject: () => petSettings.inject(),
         }, PetSettingsSection);
         return () => {
-            petSettings.dispose();
             unregister();
+            petSettings.dispose();
         };
     });
     // The global pet entry, its store, and the poll loop live while the plugin

package/lib/types/http.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Shared JSON body/response helpers for the host route families: one strict
+ * bounded body reader, one lenient bounded body reader, one JSON object
+ * narrow, and one JSON writer. Previously these were copy-pasted across the
+ * package route files (routes.ts, update-routes.ts, mobile-api.ts, and each
+ * family's route module) with drifting contracts: body caps ranging 4 KiB to
+ * 1 MiB and four distinct overflow behaviors (reject, undefined, null, throw).
+ *
+ * Packages receive this file as a generated copy via scripts/sync-shared.mjs;
+ * edit this shared source and re-run the sync instead of editing a copy.
+ * Consumer code is migrated onto it in follow-up waves; no call site changes
+ * belong in the same change as its introduction.
+ * @module dsh-web-ui-shared/host/http
+ */
+import type { IncomingMessage, OutgoingHttpHeaders, ServerResponse } from 'node:http';
+/**
+ * Strict bounded body reader: parse a request body of at most maxBytes as
+ * JSON.
+ * @throws 'body too large' past the cap, or the JSON.parse error for an
+ *   invalid or empty payload.
+ */
+export declare function readBoundedJson(req: IncomingMessage, maxBytes: number): Promise<unknown>;
+/**
+ * Lenient bounded body reader: parse a request body as JSON, or null on an
+ * empty body, invalid JSON, or a body past maxBytes (default 64 KiB).
+ * Overflow destroys the request instead of draining the remainder (no drain
+ * call, matching the current repo-wide behavior); callers must not keep
+ * reading the request afterwards. With objectOnly, non-JSON-object payloads
+ * also yield null.
+ */
+export declare function readJsonBody(req: IncomingMessage, opts?: {
+    maxBytes?: number;
+    objectOnly?: boolean;
+}): Promise<unknown | null>;
+/** Narrow a value to a JSON object, or undefined when it is not one. */
+export declare function asJsonObject(value: unknown): Record<string, unknown> | undefined;
+/**
+ * Write one JSON response. Default headers are the family defaults
+ * (content-type and referrer-policy); caller headers are appended or
+ * override them.
+ */
+export declare function writeJson(res: ServerResponse, status: number, body: unknown, headers?: OutgoingHttpHeaders): void;
+//# sourceMappingURL=http.d.ts.map

package/lib/types/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/http.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAWrF;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU9F;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,eAAe,EACpB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAO,GACrD,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAsBzB;AAOD,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAEhF;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,OAAO,GAAE,mBAAwB,GAChC,IAAI,CAIN"}

package/lib/types/http.js

@@ -0,0 +1,92 @@
+// Generated by scripts/sync-shared.mjs from shared/host/http.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Shared JSON body/response helpers for the host route families: one strict
+ * bounded body reader, one lenient bounded body reader, one JSON object
+ * narrow, and one JSON writer. Previously these were copy-pasted across the
+ * package route files (routes.ts, update-routes.ts, mobile-api.ts, and each
+ * family's route module) with drifting contracts: body caps ranging 4 KiB to
+ * 1 MiB and four distinct overflow behaviors (reject, undefined, null, throw).
+ *
+ * Packages receive this file as a generated copy via scripts/sync-shared.mjs;
+ * edit this shared source and re-run the sync instead of editing a copy.
+ * Consumer code is migrated onto it in follow-up waves; no call site changes
+ * belong in the same change as its introduction.
+ * @module dsh-web-ui-shared/host/http
+ */
+/** Default body cap for readJsonBody: 64 KiB. */
+const DEFAULT_JSON_BODY_MAX_BYTES = 64 * 1024;
+/** Family-default JSON response headers; callers may append or override. */
+const JSON_HEADERS = {
+    'content-type': 'application/json; charset=utf-8',
+    'referrer-policy': 'no-referrer',
+};
+/**
+ * Strict bounded body reader: parse a request body of at most maxBytes as
+ * JSON.
+ * @throws 'body too large' past the cap, or the JSON.parse error for an
+ *   invalid or empty payload.
+ */
+export async function readBoundedJson(req, maxBytes) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const buffer = chunk;
+        size += buffer.length;
+        if (size > maxBytes)
+            throw new Error('body too large');
+        chunks.push(buffer);
+    }
+    return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+}
+/**
+ * Lenient bounded body reader: parse a request body as JSON, or null on an
+ * empty body, invalid JSON, or a body past maxBytes (default 64 KiB).
+ * Overflow destroys the request instead of draining the remainder (no drain
+ * call, matching the current repo-wide behavior); callers must not keep
+ * reading the request afterwards. With objectOnly, non-JSON-object payloads
+ * also yield null.
+ */
+export async function readJsonBody(req, opts = {}) {
+    const maxBytes = opts.maxBytes ?? DEFAULT_JSON_BODY_MAX_BYTES;
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const buffer = chunk;
+        size += buffer.length;
+        if (size > maxBytes) {
+            req.destroy();
+            return null;
+        }
+        chunks.push(buffer);
+    }
+    const text = Buffer.concat(chunks).toString('utf8');
+    if (text === '')
+        return null;
+    try {
+        const parsed = JSON.parse(text);
+        if (opts.objectOnly && !isJsonObject(parsed))
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/** Whether a value is a JSON object: typeof object, not null, not an array. */
+function isJsonObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Narrow a value to a JSON object, or undefined when it is not one. */
+export function asJsonObject(value) {
+    return isJsonObject(value) ? value : undefined;
+}
+/**
+ * Write one JSON response. Default headers are the family defaults
+ * (content-type and referrer-policy); caller headers are appended or
+ * override them.
+ */
+export function writeJson(res, status, body, headers = {}) {
+    const payload = JSON.stringify(body);
+    res.writeHead(status, { ...JSON_HEADERS, ...headers });
+    res.end(payload);
+}