@ninkch/dsh-infinite-canvas 0.17.2 → 0.17.4

package/README.md

@@ -76,7 +76,7 @@ Publishing runs through **npm Trusted Publishing** (OIDC) — no npm token exist
 
 ## Data & privacy
 
-- Canvas documents, projects, settings and the series bible live in browser `localStorage` (`dsh-ic:*`); assets live in IndexedDB (`dsh-infinite-canvas`).
+- Canvas documents, projects, settings and the series bible live in browser `localStorage` (`dsh-ic:*`); assets live in IndexedDB (`dsh-infinite-canvas`) — **or on disk** once a data root is set in Settings (per-project folders under the configured root, served by the plugin backend with HTTP Range support for video seeking).
 - AI text generation runs through the Harness host process (your configured models, no extra keys).
 - Image/video/TTS calls go directly from the browser to the endpoints you configure — mind CORS and key handling.
 - Nothing is uploaded anywhere by the plugin itself.

package/README.zh-CN.md

@@ -76,7 +76,7 @@ flowchart LR
 
 ## 数据与隐私
 
-- 画布文档、项目、设置与设定集存于浏览器 `localStorage`（`dsh-ic:*`）；资产存于 IndexedDB（`dsh-infinite-canvas`）。
+- 画布文档、项目、设置与设定集存于浏览器 `localStorage`（`dsh-ic:*`）；资产存于 IndexedDB（`dsh-infinite-canvas`）——**或在设置中配置数据根目录后落盘**（按项目分目录存放，由插件后台以 HTTP Range 方式服务，支持视频拖动进度条）。
 - AI 文本经 Harness 宿主进程调用（使用你已配置的模型，无需额外 Key）。
 - 图片/视频/TTS 请求由浏览器直连你配置的地址——请注意 CORS 与密钥保管。
 - 插件自身不向任何第三方上传数据。

package/client.js

@@ -333,6 +333,25 @@ window.__ModuleLoader__.load({
       'updateAvailable': '新版本可用',
       'updateNow': '一键更新',
       'updateUpToDate': '已是最新版本',
+      'updateInstalling': '正在安装更新…',
+      'updateInstalled': '已安装',
+      'updateInstalledHint': '重启 Harness 后生效（网页部分刷新页面即可）',
+      'updateFailGuide': '自动安装未成功，请在 DSH 插件管理 中升级',
+      'updatePolicySkipped': '（已按你的点击跳过 24 小时新版本冷却期）',
+      'dataRootLabel': '数据根目录',
+      'dataRootPlaceholder': '如 D:\\canvas-data',
+      'dataRootHint': '资产与视频按项目落盘到该目录（不再占用 C 盘 IndexedDB）。留空 = 浏览器 IndexedDB。',
+      'dataRootSave': '设置此目录',
+      'dataRootOpen': '打开目录',
+      'dataRootMigrate': '迁移历史资产',
+      'dataRootMigrated': '已迁移 {n} 个资产到数据根目录',
+      'dataRootMigratedDone': '已迁移',
+      'dataRootMigrating': '迁移中',
+      'dataRootUnsupported': '当前插件后台版本较旧（不支持数据根目录）：重启 Harness 后可用',
+      'dataRootSaved': '数据根目录已设置',
+      'dataRootBrowse': '浏览选择目录',
+      'dataRootPicking': '请在弹出的窗口中选择目录（可直接取消）…',
+      'dataRootPickUnsupported': '当前平台不支持目录选择器，请手动填写路径',
       'updateCurrent': '当前',
       'updateGo': '去升级',
       'npmUpgradeHint': '请在 DSH 插件管理 中升级到最新版（本插件绝不自动安装或重启）；安装完成后重启 Harness 生效',
@@ -590,6 +609,25 @@ window.__ModuleLoader__.load({
       'updateAvailable': 'New version available',
       'updateNow': 'Update now',
       'updateUpToDate': 'Up to date',
+      'updateInstalling': 'Installing update…',
+      'updateInstalled': 'Installed',
+      'updateInstalledHint': 'restart Harness to take effect (refresh the page for the web part)',
+      'updateFailGuide': 'Auto-install failed — please upgrade via the DSH Plugin Manager',
+      'updatePolicySkipped': '(skipped the 24-hour release cool-down at your click)',
+      'dataRootLabel': 'Data root',
+      'dataRootPlaceholder': 'e.g. D:\\canvas-data',
+      'dataRootHint': 'Assets and videos are stored per project under this folder (no more C: IndexedDB). Empty = browser IndexedDB.',
+      'dataRootSave': 'Set directory',
+      'dataRootOpen': 'Open folder',
+      'dataRootMigrate': 'Migrate existing assets',
+      'dataRootMigrated': 'Migrated {n} assets to the data root',
+      'dataRootMigratedDone': 'Migrated',
+      'dataRootMigrating': 'Migrating',
+      'dataRootUnsupported': 'The plugin backend is older and lacks data-root support — restart Harness to enable',
+      'dataRootSaved': 'Data root set',
+      'dataRootBrowse': 'Browse for folder',
+      'dataRootPicking': 'Pick a folder in the dialog (cancel anytime)…',
+      'dataRootPickUnsupported': 'No folder picker on this platform — type the path instead',
       'updateCurrent': 'current',
       'updateGo': 'Upgrade',
       'npmUpgradeHint': 'Please upgrade via the DSH Plugin Manager (this plugin never auto-installs or restarts); restart Harness after installing',
@@ -1037,30 +1075,81 @@ window.__ModuleLoader__.load({
     }
     const assetUrlCache = new Map();
     const assetNameCache = new Map(); // assetId -> name（连线绑定的同步名称查询）
+    function fileUrlFor(rel) { return '/' + NS + '/api/file?rel=' + encodeURIComponent(rel); }
+    function extFromMime(mime) {
+      const sub = String(mime || '').split(';')[0].split('/')[1] || 'bin';
+      return /^[a-z0-9]{1,8}$/i.test(sub) ? sub : 'bin';
+    }
     async function assetUrl(id) {
       if (!id) return null;
       if (assetUrlCache.has(id)) return assetUrlCache.get(id);
       const rec = await idbGet(id);
-      if (!rec || !rec.blob) return null;
-      const url = URL.createObjectURL(rec.blob);
-      assetUrlCache.set(id, url);
+      if (!rec) return null;
+      let url = null;
+      if (rec.rel) url = fileUrlFor(rec.rel);              // 磁盘资产：Host 文件服务（支持 Range）
+      else if (rec.blob) url = URL.createObjectURL(rec.blob); // 旧资产：IndexedDB blob
+      if (url) assetUrlCache.set(id, url);
       return url;
     }
+    /** 取资产 Blob：磁盘资产经 Host 文件服务拉取，旧资产直接读 IndexedDB。 */
+    async function assetBlob(id) {
+      const rec = await idbGet(id);
+      if (!rec) return null;
+      if (rec.blob) return rec.blob;
+      if (rec.rel) {
+        const r = await fetch(fileUrlFor(rec.rel));
+        if (!r.ok) throw new Error('资产读取失败 HTTP ' + r.status);
+        return await r.blob();
+      }
+      return null;
+    }
     async function saveAssetRecord(projectId, kind, blob, meta) {
+      const id = uid('a');
+      const mime = blob.type || (kind === 'image' ? 'image/png' : 'video/webm');
       const rec = {
-        id: uid('a'), projectId, kind,
-        mime: blob.type || (kind === 'image' ? 'image/png' : 'video/webm'),
+        id, projectId, kind,
+        mime,
         name: (meta && meta.name) || (kind === 'image' ? 'image' : 'video') + '-' + Date.now().toString(36),
-        blob,
         createdAt: Date.now(),
         prompt: (meta && meta.prompt) || '',
         source: (meta && meta.source) || 'demo',
         category: (meta && meta.category) || 'general',
       };
+      if (S.dataRoot) {
+        // 数据根目录已配置：落盘到 <root>/projects/<项目>/<类型>/<id>.<ext>，IndexedDB 只存元数据
+        const rel = `projects/${projectId}/${kind}/${id}.${extFromMime(mime)}`;
+        const r = await fetch('/' + NS + '/api/asset?rel=' + encodeURIComponent(rel), { method: 'POST', body: blob });
+        if (!r.ok) throw new Error('资产落盘失败: ' + (await r.text()));
+        rec.rel = rel;
+        rec.size = blob.size;
+        rec.stored = 'disk';
+      } else {
+        rec.blob = blob;
+        rec.stored = 'idb';
+      }
       await idbPut(rec);
       assetNameCache.set(rec.id, rec.name);
       return rec;
     }
+    /** 一次性把 IndexedDB 里的历史资产迁移到数据根目录（保留元数据，移除 blob）。 */
+    async function migrateAssetsToDisk(onProgress) {
+      if (!S.dataRoot) throw new Error('请先设置数据根目录');
+      const all = await idbAll();
+      const targets = all.filter((r) => r.blob && !r.rel);
+      let done = 0;
+      for (const rec of targets) {
+        const rel = `projects/${rec.projectId}/${rec.kind}/${rec.id}.${extFromMime(rec.mime)}`;
+        const r = await fetch('/' + NS + '/api/asset?rel=' + encodeURIComponent(rel), { method: 'POST', body: rec.blob });
+        if (!r.ok) throw new Error('迁移失败: ' + rel + ' — ' + (await r.text()));
+        const next = { ...rec, rel, size: rec.blob.size, stored: 'disk' };
+        delete next.blob;
+        await idbPut(next);
+        assetUrlCache.delete(rec.id); // 旧 objectURL 失效，改走文件 URL
+        done++;
+        if (onProgress) onProgress(done, targets.length);
+      }
+      return { migrated: done, total: targets.length };
+    }
     function useAssetUrl(id) {
       const [url, setUrl] = useState(null);
       useEffect(() => {
@@ -1686,7 +1775,9 @@ window.__ModuleLoader__.load({
       const map = craftMapLoad(pid);
       if (!opts.force && map[rec.id]) return map[rec.id];
       const rel = craftProjectSlug() + '/media/' + rec.id + extForMime(rec.mime, rec.name);
-      await craft.write(rel, rec.blob);
+      const blob = rec.blob || await assetBlob(rec.id);
+      if (!blob) throw new Error('资产内容不可用: ' + rec.id);
+      await craft.write(rel, blob);
       craftMapSet(pid, rec.id, rel);
       return rel;
     }
@@ -1834,12 +1925,16 @@ window.__ModuleLoader__.load({
 
     // ============================================================
     // 自动更新：当前副本版本 vs npm registry latest（与安装方式无关）
-    // 有新版本 → 横幅提示；安装一律引导到 DSH 插件管理，绝不自动安装/重启
+    // 有新版本 → 横幅 + "去升级"；点击后由 Host 在所属 profile 内
+    // pnpm add 精确版本（绝不自动重启/刷新）；旧 Host / 开发态 / 失败 → 回退为纯引导
     // ============================================================
     async function checkUpdate(silent) {
       update((s) => { s.updateInfo = null; s.updateChecking = true; s.updateMsg = null; });
       try {
         const info = await hostRpc('updateCheck');
+        // 兼容旧 Host（SHA 比较语义会给出 upToDate=false 但 behind=0）：
+        // 只要有 behind 数值，就统一按"落后 N 版"判定最新与否
+        if (info && typeof info.behind === 'number') info.upToDate = info.behind === 0;
         update((s) => { s.updateInfo = info; s.updateChecking = false; });
         return info;
       } catch (e) {
@@ -1848,10 +1943,32 @@ window.__ModuleLoader__.load({
         return null;
       }
     }
-    function applyUpdate() {
-      // 仅引导：插件不修改用户 profile、不执行任何安装动作、不刷新不重启
-      const target = S.updateInfo && S.updateInfo.remoteVersion ? S.updateInfo.remoteVersion : '';
-      update((s) => { s.updateBusy = false; s.updateMsg = T('npmUpgradeHint') + (target ? ' → v' + target : ''); });
+    async function applyUpdate() {
+      update((s) => { s.updateBusy = true; s.updateMsg = T('updateInstalling'); });
+      try {
+        const res = await hostRpc('updateInstall');
+        if (res && res.ok && res.changed) {
+          const relaxed = res.policyRelaxed ? ' ' + T('updatePolicySkipped') : '';
+          update((s) => { s.updateBusy = false; s.updateMsg = T('updateInstalled') + ' v' + res.version + ' — ' + T('updateInstalledHint') + relaxed; });
+        } else if (res && res.ok) {
+          update((s) => { s.updateBusy = false; s.updateMsg = T('updateUpToDate') + (res.version ? ' v' + res.version : ''); });
+        } else {
+          const reason = res && res.output ? '（' + String(res.output).slice(-120) + '）' : '';
+          update((s) => { s.updateBusy = false; s.updateMsg = T('updateFailGuide') + (res && res.version ? ' → v' + res.version : '') + reason; });
+        }
+      } catch (e) {
+        // 旧 Host 没有 updateInstall RPC → 回退为纯引导（方案 A 兜底）
+        update((s) => { s.updateBusy = false; s.updateMsg = T('npmUpgradeHint') + ((S.updateInfo && S.updateInfo.remoteVersion) ? ' → v' + S.updateInfo.remoteVersion : ''); });
+      }
+    }
+    /** 从 Host 拉取数据根目录配置（Host 旧版无此 RPC → 标记不支持）。 */
+    async function refreshDataRoot() {
+      try {
+        const r = await hostRpc('dataRootGet');
+        update((s) => { s.dataRoot = r.dataRoot || null; s.dataRootExists = !!r.exists; s.dataRootSupported = true; });
+      } catch (e) {
+        update((s) => { s.dataRoot = null; s.dataRootSupported = !/未知操作/.test(String((e && e.message) || e)); });
+      }
     }
 
     // ============================================================
@@ -2111,6 +2228,9 @@ window.__ModuleLoader__.load({
       assetsTick: 0,
       tick: 0,
       craftStatus: null, // {at, data} | {at, error}
+      dataRoot: null,        // 数据根目录（Host 配置）；null = 未设置（资产走 IndexedDB）
+      dataRootExists: false,
+      dataRootSupported: true,
       updateInfo: null,      // Host updateCheck 结果
       updateChecking: false,
       updateBusy: false,
@@ -2456,8 +2576,7 @@ window.__ModuleLoader__.load({
       if (!src) return null;
       const aid = servedAssetId(src, e.fromPort);
       if (!aid) return null;
-      const rec = await idbGet(aid);
-      return rec ? rec.blob : null;
+      return await assetBlob(aid);
     }
     // 多参考图：按节点上的显式顺序（refOrder，未排序时按连线先后）解析，带名称/分类供 [图N] 绑定
     async function resolveRefMetas(nodeId, portId) {
@@ -2474,7 +2593,8 @@ window.__ModuleLoader__.load({
         if (!aid) continue;
         try {
           const rec = await idbGet(aid);
-          if (rec && rec.blob) metas.push({ blob: rec.blob, name: rec.name || '', category: rec.category || 'general' });
+          const blob = await assetBlob(aid);
+          if (blob) metas.push({ blob, name: (rec && rec.name) || '', category: (rec && rec.category) || 'general' });
         } catch { /* 单个参考图读取失败不影响其余 */ }
       }
       return metas;
@@ -3867,10 +3987,11 @@ window.__ModuleLoader__.load({
           if (!x.nd.data.assetId) continue;
           try {
             const rec = await idbGet(x.nd.data.assetId);
-            if (rec && rec.blob) {
+            const blob = await assetBlob(x.nd.data.assetId);
+            if (blob) {
               const ttsId = n.data.tts && n.data.tts[x.e.id] && n.data.tts[x.e.id].assetId;
               const ttsUrl = ttsId ? await assetUrl(ttsId) : null;
-              metas.push({ url: URL.createObjectURL(rec.blob), name: rec.name || 'seg', sub: getSub(x), ttsUrl });
+              metas.push({ url: URL.createObjectURL(blob), name: (rec && rec.name) || 'seg', sub: getSub(x), ttsUrl });
             }
           } catch { /* 跳过加载失败的片段 */ }
         }
@@ -3906,9 +4027,10 @@ window.__ModuleLoader__.load({
           if (!x.nd.data.assetId) continue;
           try {
             const rec = await idbGet(x.nd.data.assetId);
-            if (!(rec && rec.blob)) continue;
-            const rel = await ensureAssetOnDisk(rec);
-            items.push({ rel, name: rec.name || 'seg', sub: getSub(x), dur: await videoDurationOf(rec.blob) });
+            const blob = await assetBlob(x.nd.data.assetId);
+            if (!blob) continue;
+            const rel = await ensureAssetOnDisk({ ...(rec || {}), id: x.nd.data.assetId, blob });
+            items.push({ rel, name: (rec && rec.name) || 'seg', sub: getSub(x), dur: await videoDurationOf(blob) });
           } catch (e) { toast('Craft: ' + (e.message || e)); return; }
         }
         if (!items.length) { toast(T('noSegments')); return; }
@@ -4194,7 +4316,7 @@ window.__ModuleLoader__.load({
         h('button', {
           type: 'button', className: cls('dshic-btn'), style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary)', gap: 4 },
           title: T('updateBtn') + ((S.updateInfo && S.updateInfo.runningVersion) ? '（当前 v' + S.updateInfo.runningVersion + '）' : ''), disabled: S.updateChecking,
-          onClick: () => { checkUpdate(false).then((info) => { if (info && info.upToDate) toast(T('updateUpToDate')); }); },
+          onClick: () => { checkUpdate(false).then((info) => { if (info && info.upToDate) toast(T('updateUpToDate') + (info.runningVersion ? ' v' + info.runningVersion : '')); }); },
         }, T('updateBtn'), S.updateChecking ? h('span', { className: 'dshic-spin' }) : ((S.updateInfo && !S.updateInfo.upToDate) ? ' ⬆' : '')),
         h('div', { className: 'dshic-toolbar-sep' }),
         h(Btn, {
@@ -4270,7 +4392,12 @@ window.__ModuleLoader__.load({
         lsSet(LS_ACTIVE, S.activeId);
         try {
           const recs = await idbByProject(pid);
-          for (const r of recs) { try { await idbDelete(r.id); } catch { /* 逐个容错 */ } }
+          for (const r of recs) {
+            try {
+              if (r.rel) { try { await hostRpc('assetDelete', { rel: r.rel }); } catch { /* 磁盘清理失败不阻塞 */ } }
+              await idbDelete(r.id);
+            } catch { /* 逐个容错 */ }
+          }
         } catch { /* 资产清理失败不影响项目删除 */ }
         setDelTarget(null);
       };
@@ -4428,6 +4555,7 @@ window.__ModuleLoader__.load({
         if (files.length) setTick((x) => x + 1);
       };
       const del = async (a) => {
+        if (a.rel) { try { await hostRpc('assetDelete', { rel: a.rel }); } catch { /* 磁盘清理失败不阻塞 */ } }
         await idbDelete(a.id);
         update((s) => {
           for (const nd of Object.values(s.graph.nodes)) {
@@ -4441,7 +4569,7 @@ window.__ModuleLoader__.load({
       const syncAll = async () => {
         const st = await craftStatusSafe();
         if (!st) return;
-        const recs = assets.filter((a) => a.blob);
+        const recs = assets.filter((a) => a.blob || a.rel);
         let okN = 0, failN = 0;
         for (const a of recs) {
           try { await syncAssetToDisk(a, { force: true }); okN++; } catch { failN++; }
@@ -4811,7 +4939,7 @@ window.__ModuleLoader__.load({
         if (!(st.bins && st.bins.photocraft && st.bins.photocraft.found)) { toast(T('craftCliMissing').replace('{name}', 'photocraft')); return; }
         let paramsObj;
         try { paramsObj = JSON.parse(paramsText || '{}'); } catch { toast(T('craftInvalidJson')); return; }
-        if (!rec || !rec.blob) { toast(T('noResult')); return; }
+        if (!rec || (!rec.blob && !rec.rel)) { toast(T('noResult')); return; }
         setRunning(true); setErr(null); setProgress('…');
         try {
           const mediaRel = await ensureAssetOnDisk(rec);
@@ -4918,6 +5046,77 @@ window.__ModuleLoader__.load({
         ));
     }
 
+    /** 数据根目录卡片：设置/打开/迁移历史资产。 */
+    function DataRootCard() {
+      const [val, setVal] = useState('');
+      const [busy, setBusy] = useState(false);
+      const [picking, setPicking] = useState(false);
+      const [mig, setMig] = useState(null); // null | {done,total} | 'done'
+      useEffect(() => { if (S.dataRoot) setVal(S.dataRoot); }, [S.dataRoot]);
+      const save = async () => {
+        if (busy) return;
+        setBusy(true);
+        try {
+          await hostRpc('dataRootSet', { root: val.trim() });
+          await refreshDataRoot();
+          toast(T('dataRootSaved') + (S.dataRoot ? '：' + S.dataRoot : ''));
+        } catch (e) { toast('设置失败：' + ((e && e.message) || e)); }
+        setBusy(false);
+      };
+      const applyRoot = async (root) => {
+        await hostRpc('dataRootSet', { root });
+        await refreshDataRoot();
+        setVal(S.dataRoot || root);
+        toast(T('dataRootSaved') + '：' + S.dataRoot);
+      };
+      const browse = async () => {
+        if (busy || picking) return;
+        setBusy(true); setPicking(true);
+        try {
+          const r = await hostRpc('pickFolder');
+          if (r && r.ok && r.path) await applyRoot(r.path);
+          else if (r && r.unsupported) toast(T('dataRootPickUnsupported'));
+          // cancelled → 静默
+        } catch (e) {
+          const msg = String((e && e.message) || e);
+          toast(/未知操作/.test(msg) ? T('dataRootUnsupported') : '目录选择失败：' + msg);
+        }
+        setPicking(false); setBusy(false);
+      };
+      const openDir = async () => { try { await hostRpc('dataRootReveal'); } catch (e) { toast((e && e.message) || e); } };
+      const migrate = async () => {
+        if (busy || picking || mig) return;
+        setBusy(true); setMig({ done: 0, total: 0 });
+        try {
+          const r = await migrateAssetsToDisk((done, total) => setMig({ done, total }));
+          setMig('done');
+          toast(T('dataRootMigrated').replace('{n}', String(r.migrated)));
+        } catch (e) { setMig(null); toast('迁移失败：' + ((e && e.message) || e)); }
+        setBusy(false);
+      };
+      return h('div', { key: 'dataroot', className: 'dshic-card' },
+        h('div', { className: 'dshic-row' }, Ic('image', 12), h('strong', { style: { fontSize: 12 } }, T('dataRootLabel'))),
+        S.dataRootSupported === false
+          ? h('div', { className: 'dshic-hint' }, T('dataRootUnsupported'))
+          : [
+              h('div', { className: 'dshic-row', key: 'row1' },
+                h('input', {
+                  className: 'dshic-input', value: val, placeholder: T('dataRootPlaceholder'),
+                  onChange: (e) => setVal(e.target.value), onPointerDown: (e) => e.stopPropagation(),
+                }),
+                h('button', { type: 'button', className: 'dshic-mini', title: T('dataRootBrowse'), disabled: busy || picking, onPointerDown: (e) => e.stopPropagation(), onClick: browse }, Ic('folder', 12)),
+                h('button', { type: 'button', className: 'dshic-mini', disabled: busy || picking, onPointerDown: (e) => e.stopPropagation(), onClick: save }, T('dataRootSave')),
+              ),
+              picking ? h('div', { className: 'dshic-hint', key: 'picking' }, T('dataRootPicking')) : null,
+              h('div', { className: 'dshic-hint', key: 'hint' }, T('dataRootHint')),
+              h('div', { className: 'dshic-row', key: 'row2' },
+                S.dataRoot ? h('button', { type: 'button', className: 'dshic-mini', onPointerDown: (e) => e.stopPropagation(), onClick: openDir }, T('dataRootOpen')) : null,
+                S.dataRoot ? h('button', { type: 'button', className: 'dshic-mini', disabled: busy || picking || !!mig, onPointerDown: (e) => e.stopPropagation(), onClick: migrate }, mig === 'done' ? T('dataRootMigratedDone') : T('dataRootMigrate')) : null,
+                (mig && mig !== 'done') ? h('span', { style: { fontSize: 11, opacity: 0.85 } }, T('dataRootMigrating') + ' ' + mig.done + '/' + mig.total) : null,
+              ),
+            ],
+      );
+    }
     function SettingsTab() {
       const [s, setS] = useState(loadSettings);
       const apply = (fn) => {
@@ -4931,6 +5130,7 @@ window.__ModuleLoader__.load({
       const field = (label, value, onChange, placeholder, password) => h(Field, { label, value, onChange, placeholder, password });
       return [
         h(CraftCard, { key: 'craft' }),
+        h(DataRootCard, { key: 'dataroot' }),
         h('div', { key: 'lang', className: 'dshic-card' },
           h('div', { className: 'dshic-row' }, Ic('text', 12), h('strong', { style: { fontSize: 12 } }, T('langLabel'))),
           h('select', {
@@ -4956,7 +5156,7 @@ window.__ModuleLoader__.load({
         h(ApiListEditor, { key: 'imglist', kind: 'image' }),
         h(ApiListEditor, { key: 'vidlist', kind: 'video' }),
         h(ApiListEditor, { key: 'ttslist', kind: 'tts' }),
-        h('div', { key: 'note', className: 'dshic-hint' }, 'DeepSeek Harness · dsh-infinite-canvas v0.17.1'),
+        h('div', { key: 'note', className: 'dshic-hint' }, 'DeepSeek Harness · dsh-infinite-canvas' + ((S.updateInfo && S.updateInfo.runningVersion) ? ' v' + S.updateInfo.runningVersion : '')),
       ];
     }
 
@@ -5290,6 +5490,8 @@ window.__ModuleLoader__.load({
           probeCraft();
           // 检查更新（Host RPC；Host 旧版未带此方法时静默）
           checkUpdate(true);
+          // 数据根目录（Host 旧版静默降级为 IndexedDB 模式）
+          refreshDataRoot();
           // 后台路由探活：失败时在画布顶部给出可操作的提示
           hostRpc('ping').then(() => { S.hostOk = true; S.hostError = null; notify(); }).catch((e) => {
             S.hostOk = false;

package/docs/release.md

@@ -9,7 +9,8 @@
 2. **绝不自动重启 Harness、绝不自动刷新页面。** 更新/安装后只提示（横幅/文案），何时生效由用户决定。
 3. **beta 版本号绝不复用**（npm 本身也禁止覆盖已发布版本）；**正式版本号只在 main 上诞生**。
 4. **版本单一来源 = `package.json`**。改版本一律用 `npm version …`，不手改；Host 运行时读取它，禁止在代码里硬编码版本号。
-5. npm token 只通过命令行注入，**绝不写入任何文件**。
+5. **版本号一律按 0.0.x（patch）递增**（如 0.17.3 → 0.17.4），不做 minor/major 升级——新功能同样走 patch 号。
+6. npm token 只通过命令行注入，**绝不写入任何文件**。
 
 ## 1. 测试三层漏斗
 
@@ -107,10 +108,11 @@ GET /infinite-canvas/api/rpc ping               # 安装重启后 version 应为
 - **当前版本** = 当前加载副本的 `package.json`（Host 启动时读取）
 - **最新版本** = npm registry `…/@ninkch%2Fdsh-infinite-canvas/latest`（即 `latest` dist-tag，beta 不会出现）
 - 本地版本 ≥ 远端 → 视为最新；仅真正落后 → 画布顶部横幅"新版本可用 vX（当前 vY）"
-- 横幅"去升级"按钮 → **仅提示**："请在 DSH 插件管理 中升级…重启 Harness 生效"
-- **绝不自动安装、绝不自动刷新、绝不自动重启**；网络失败静默（手动点击才提示错误）
+- 横幅"去升级"按钮 → **真实安装**：Host 在所属 profile 内执行 `pnpm add <pkg>@<精确版本> --save-exact` 并同步 bundles 列表；完成后仅提示"已安装 vX — 重启 Harness 后生效"
+- **降级为纯引导**的情形：开发态（link/.git）、找不到 pnpm、安装失败、旧 Host 无 `updateInstall` RPC
+- **绝不自动刷新、绝不自动重启**；网络失败静默（手动点击才提示错误）
 
-实现位置：`index.js` `updateCheck()`（RPC `updateCheck`）；文案 key：`updateGo` / `npmUpgradeHint` / `updateCurrent`。
+实现位置：`index.js` `updateCheck()` / `updateInstall()`（RPC 同名）；文案 key：`updateGo` / `updateInstalling` / `updateInstalled` / `updateInstalledHint` / `updateFailGuide` / `updateCurrent`。
 
 ## 7. 发布日检查清单
 

package/index.js

@@ -6,7 +6,10 @@
  * through the Harness `llm` Service — the same providers/models the user has
  * configured for the Harness itself, no extra API key handling here.
  */
-import { readFileSync } from 'node:fs';
+import { spawn } from 'node:child_process';
+import fs from 'node:fs/promises';
+import { createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -22,6 +25,167 @@ try {
 // 更新检查的唯一信息源 = npm registry latest（与安装方式无关：
 // npm 在线安装 / 本地 link 开发态 / 其它方式，一律走同一条逻辑）。
 const NPM_LATEST_URL = 'https://registry.npmjs.org/' + encodeURIComponent('@ninkch/dsh-infinite-canvas') + '/latest';
+const PKG_NAME = '@ninkch/dsh-infinite-canvas';
+
+// ---------- 安装形态探测（用于"点击即更新"） ----------
+// 受管安装 = 本副本位于某个 DSH profile 的 node_modules 下（向上找带 dsh.profile.bundles 的 package.json）。
+// 开发态（目录含 .git）不受管 → 点击更新时降级为纯引导。
+const PROFILE_DIR = (() => {
+  if (existsSync(path.join(HERE, '.git'))) return null;
+  let dir = HERE;
+  for (let i = 0; i < 6; i++) {
+    dir = path.dirname(dir);
+    try {
+      const m = JSON.parse(readFileSync(path.join(dir, 'package.json'), 'utf8'));
+      if (m && m.dsh && m.dsh.profile && Array.isArray(m.dsh.profile.bundles)) return dir;
+    } catch { /* 继续向上 */ }
+  }
+  return null;
+})();
+
+/** 定位 pnpm：Desktop 安装布局 → 用户运行时目录 → PATH。返回 { execPath, args 前缀 } 或 null。 */
+function findPnpm() {
+  const candidates = [];
+  try {
+    candidates.push(path.join(path.dirname(process.execPath), 'resources', 'runtime', 'pnpm', 'bin', 'pnpm.mjs'));
+  } catch { /* execPath 不可用 */ }
+  try {
+    const runtimes = path.join(os.homedir(), '.dsh', 'dsh-runtimes');
+    for (const entry of readdirSync(runtimes)) {
+      candidates.push(path.join(runtimes, entry, 'dependencies', 'pnpm', 'bin', 'pnpm.mjs'));
+    }
+  } catch { /* 无运行时目录 */ }
+  for (const c of candidates) {
+    try { if (existsSync(c)) return { kind: 'script', node: process.execPath, script: c }; } catch { /* 跳过 */ }
+  }
+  try { if (existsSync('C:\\Program Files\\nodejs\\pnpm.cmd')) return { kind: 'path', command: 'pnpm' }; } catch { /* 跳过 */ }
+  return { kind: 'path', command: 'pnpm' }; // 交给 spawn 兜底（PATH 上有就用）
+}
+
+/** 在 profile 目录执行 pnpm add <spec> --save-exact。opts.relaxReleaseAge → 跳过 24h 新版本冷却期。 */
+function runPnpmAdd(pnpm, spec, opts = {}) {
+  return new Promise((resolve) => {
+    const started = Date.now();
+    const stdout = [];
+    const stderr = [];
+    let child;
+    const relax = opts.relaxReleaseAge ? ['--config.minimum-release-age=0'] : [];
+    const args = pnpm.kind === 'script'
+      ? ['--expose-internals', pnpm.script, 'add', spec, '--save-exact', ...relax]
+      : ['add', spec, '--save-exact', ...relax];
+    try {
+      child = pnpm.kind === 'script'
+        ? spawn(pnpm.node, args, { cwd: PROFILE_DIR, windowsHide: true, env: { ...process.env, ELECTRON_RUN_AS_NODE: '1' } })
+        : spawn(pnpm.command, args, { cwd: PROFILE_DIR, windowsHide: true, shell: process.platform === 'win32' });
+    } catch (e) {
+      resolve({ ok: false, stdout: '', stderr: String(e?.message ?? e) });
+      return;
+    }
+    const timer = setTimeout(() => { try { child.kill(); } catch { /* 忽略 */ } }, 240000);
+    child.stdout?.setEncoding('utf8');
+    child.stderr?.setEncoding('utf8');
+    child.stdout?.on('data', (d) => stdout.push(String(d)));
+    child.stderr?.on('data', (d) => stderr.push(String(d)));
+    child.on('error', (e) => { clearTimeout(timer); resolve({ ok: false, stdout: stdout.join(''), stderr: String(e?.message ?? e) }); });
+    child.on('close', (code) => {
+      clearTimeout(timer);
+      resolve({ ok: code === 0, code, stdout: stdout.join(''), stderr: stderr.join(''), ms: Date.now() - started });
+    });
+  });
+}
+
+/** pnpm add 成功后同步 bundles 列表（等价 DSH reconcile 的 add 分支：新依赖必须成为 bundle 层）。 */
+async function ensureBundleEntry(profileDir, pkg) {
+  const manifestPath = path.join(profileDir, 'package.json');
+  const m = JSON.parse(await fs.readFile(manifestPath, 'utf8'));
+  const bundles = (m.dsh && m.dsh.profile && m.dsh.profile.bundles) || [];
+  if (bundles.includes(pkg)) return false;
+  bundles.push(pkg);
+  m.dsh = { ...(m.dsh || {}), profile: { ...(m.dsh.profile || {}), bundles } };
+  await fs.writeFile(manifestPath, JSON.stringify(m, null, 2) + '\n', 'utf8');
+  return true;
+}
+
+// ---------- 数据根目录（资产落盘）----------
+// 配置存在 ~/.dsh/infinite-canvas/config.json：跨重装/重启稳定，绝不放进包目录。
+const CONFIG_PATH = path.join(os.homedir(), '.dsh', 'infinite-canvas', 'config.json');
+
+function readIcConfig() {
+  try { return JSON.parse(readFileSync(CONFIG_PATH, 'utf8')) || {}; } catch { return {}; }
+}
+function writeIcConfig(cfg) {
+  mkdirSync(path.dirname(CONFIG_PATH), { recursive: true });
+  writeFileSync(CONFIG_PATH, JSON.stringify(cfg, null, 2) + '\n', 'utf8');
+}
+function dataRoot() {
+  const r = readIcConfig().dataRoot;
+  return (typeof r === 'string' && r.trim()) ? path.resolve(r.trim()) : null;
+}
+/** rel 限定在 dataRoot 之内：拒绝绝对路径 / 盘符 / 上级跳转，返回 { abs, clean }。 */
+function safeJoin(root, rel) {
+  const clean = String(rel || '').replace(/\\/g, '/').replace(/^\/+/, '').trim();
+  if (!clean) throw new Error('缺少相对路径');
+  if (/(^|\/)\.\.(\/|$)/.test(clean) || /^[a-z]:/i.test(clean)) throw new Error('非法路径: ' + rel);
+  const rootAbs = path.resolve(root);
+  const abs = path.resolve(rootAbs, ...clean.split('/'));
+  if (abs !== rootAbs && !abs.startsWith(rootAbs + path.sep)) throw new Error('路径越界');
+  return { abs, clean };
+}
+const MIME_BY_EXT = {
+  png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', webp: 'image/webp', gif: 'image/gif', svg: 'image/svg+xml',
+  webm: 'video/webm', mp4: 'video/mp4', mov: 'video/quicktime', mkv: 'video/x-matroska',
+  wav: 'audio/wav', mp3: 'audio/mpeg', m4a: 'audio/mp4', ogg: 'audio/ogg',
+  json: 'application/json', srt: 'text/plain; charset=utf-8', txt: 'text/plain; charset=utf-8',
+};
+function mimeOf(p) {
+  const m = /\.([a-z0-9]+)$/i.exec(p);
+  return m ? (MIME_BY_EXT[m[1].toLowerCase()] || 'application/octet-stream') : 'application/octet-stream';
+}
+
+/**
+ * 弹出系统"选择目录"对话框（阻塞至用户选择/取消）。
+ * Windows = PowerShell + WinForms FolderBrowserDialog（TopMost，可新建文件夹）；
+ * macOS = osascript choose folder；Linux = zenity（若安装）。均不可用 → { ok:false, unsupported:true }。
+ */
+function pickFolderDialog() {
+  return new Promise((resolve) => {
+    const collect = (child) => {
+      const stdout = [];
+      child.stdout?.setEncoding('utf8');
+      child.stdout?.on('data', (d) => stdout.push(String(d)));
+      const timer = setTimeout(() => { try { child.kill(); } catch { /* 忽略 */ } }, 600000);
+      child.on('error', (e) => { clearTimeout(timer); resolve({ ok: false, unsupported: e.code === 'ENOENT', error: String(e?.message ?? e) }); });
+      child.on('close', (code) => {
+        clearTimeout(timer);
+        const picked = stdout.join('').trim().split(/\r?\n/).filter(Boolean).pop() || '';
+        if (code === 0 && picked) resolve({ ok: true, path: picked });
+        else resolve({ ok: false, cancelled: true });
+      });
+    };
+    try {
+      if (process.platform === 'win32') {
+        const script = [
+          '$ErrorActionPreference="Stop"',
+          '[Console]::OutputEncoding=[System.Text.Encoding]::UTF8',
+          'Add-Type -AssemblyName System.Windows.Forms | Out-Null',
+          '$o = New-Object System.Windows.Forms.Form',
+          '$o.TopMost = $true',
+          '$d = New-Object System.Windows.Forms.FolderBrowserDialog',
+          "$d.Description = '选择数据根目录（资产与视频将存到该目录）'",
+          '$d.ShowNewFolderButton = $true',
+          'if ($d.ShowDialog($o) -eq [System.Windows.Forms.DialogResult]::OK) { Write-Output $d.SelectedPath }',
+        ].join('; ');
+        collect(spawn('powershell.exe', ['-NoProfile', '-STA', '-ExecutionPolicy', 'Bypass', '-WindowStyle', 'Hidden', '-Command', script], { windowsHide: true }));
+      } else if (process.platform === 'darwin') {
+        collect(spawn('osascript', ['-e', 'POSIX path of (choose folder with prompt "选择数据根目录")'], { windowsHide: true }));
+      } else {
+        collect(spawn('zenity', ['--file-selection', '--directory', '--title=选择数据根目录'], { windowsHide: true }));
+      }
+    } catch (e) {
+      resolve({ ok: false, unsupported: true, error: String((e && e.message) || e) });
+    }
+  });
+}
 
 /** 读取 npm registry 上 latest dist-tag 的版本号。 */
 async function npmLatestVersion() {
@@ -62,7 +226,6 @@ function readLocalVersion() {
 /**
  * 更新检查（与安装方式无关）：当前副本版本 vs npm registry latest。
  * 本地版本 ≥ 远端 → 最新；仅真正落后才提示。
- * 插件绝不自动安装、绝不自动重启/刷新 —— 安装一律引导到 DSH 插件管理。
  */
 async function updateCheck() {
   const runningVersion = readLocalVersion();
@@ -71,10 +234,49 @@ async function updateCheck() {
   return { source: 'npm', runningVersion, remoteVersion, behind, upToDate: behind === 0 };
 }
 
+/**
+ * 点击即更新（仅在用户显式点击时由客户端调用，无 RPC 参数）：
+ * 安装 registry latest 的精确版本到所属 profile，绝不自动重启/刷新。
+ * - 已是最新 → { ok:true, changed:false }
+ * - 受管安装 + pnpm 可用 → pnpm add <pkg>@<exact> --save-exact + 同步 bundles 列表
+ * - 开发态 / pnpm 不可用 / 安装失败 → { ok:false, guide:true }（客户端回退为纯引导文案）
+ */
+async function updateInstall() {
+  const runningVersion = readLocalVersion();
+  const latest = await npmLatestVersion();
+  if (cmpVer(runningVersion, latest) >= 0) {
+    return { ok: true, changed: false, version: runningVersion };
+  }
+  if (!PROFILE_DIR) {
+    return { ok: false, guide: true, version: latest, output: '开发态安装，请自行更新工作区' };
+  }
+  const pnpm = findPnpm();
+  const spec = PKG_NAME + '@' + latest;
+  let res = await runPnpmAdd(pnpm, spec);
+  let policyRelaxed = false;
+  if (!res.ok && /MINIMUM_RELEASE_AGE_VIOLATION/.test((res.stdout || '') + (res.stderr || ''))) {
+    // pnpm 11 供应链保护对 24h 内新发布间歇性拦截；用户点击已是明确同意 → 放宽重试一次
+    policyRelaxed = true;
+    res = await runPnpmAdd(pnpm, spec, { relaxReleaseAge: true });
+  }
+  const output = ((res.stdout || '') + '\n' + (res.stderr || '')).trim().slice(-1500);
+  if (!res.ok) {
+    return { ok: false, guide: true, version: latest, output };
+  }
+  try {
+    await ensureBundleEntry(PROFILE_DIR, PKG_NAME);
+  } catch { /* bundles 同步失败不阻塞安装结果 */ }
+  let installed = latest;
+  try {
+    installed = JSON.parse(readFileSync(path.join(PROFILE_DIR, 'node_modules', ...PKG_NAME.split('/'), 'package.json'), 'utf8')).version || latest;
+  } catch { /* 保留 latest */ }
+  return { ok: true, changed: true, version: installed, output, policyRelaxed };
+}
+
 export const inject = ['webServer'];
 
 // 仅供诊断 / 自动化测试（不属于 RPC 面，运行时行为不受影响）
-export const _internals = { updateCheck, npmLatestVersion, cmpVer, getVersion: () => VERSION };
+export const _internals = { updateCheck, updateInstall, npmLatestVersion, cmpVer, findPnpm, getProfileDir: () => PROFILE_DIR, getVersion: () => VERSION, dataRoot, safeJoin, mimeOf, getIcConfigPath: () => CONFIG_PATH };
 
 function resolveModel(providers, want) {
   const byProvider = want && want.provider
@@ -156,6 +358,43 @@ export function apply(ctx) {
       async llmOptions() { return listLlmOptions(); },
       async llmComplete(args) { return complete(args); },
       async updateCheck() { return updateCheck(); },
+      async updateInstall() { return updateInstall(); },
+      async dataRootGet() {
+        const root = dataRoot();
+        let exists = false;
+        if (root) { try { exists = statSync(root).isDirectory(); } catch { /* 不存在 */ } }
+        return { dataRoot: root, exists, configPath: CONFIG_PATH };
+      },
+      async dataRootSet(args) {
+        const raw = String((args && args.root) ?? '').trim();
+        if (!raw) throw new Error('需要数据根目录路径');
+        const root = path.resolve(raw);
+        if (!path.isAbsolute(root)) throw new Error('需要绝对路径（如 D:\\canvas-data）');
+        mkdirSync(root, { recursive: true });
+        const cfg = readIcConfig();
+        cfg.dataRoot = root;
+        writeIcConfig(cfg);
+        return { ok: true, dataRoot: root };
+      },
+      async dataRootReveal() {
+        const root = dataRoot();
+        if (!root) throw new Error('未设置数据根目录');
+        mkdirSync(root, { recursive: true });
+        const open = process.platform === 'win32' ? 'explorer.exe' : process.platform === 'darwin' ? 'open' : 'xdg-open';
+        try { spawn(open, [root], { detached: true, stdio: 'ignore' }).unref(); } catch { /* 打开失败不阻塞 */ }
+        return { ok: true, dataRoot: root };
+      },
+      async pickFolder() {
+        const r = await pickFolderDialog();
+        return r; // { ok, path } | { ok:false, cancelled } | { ok:false, unsupported }
+      },
+      async assetDelete(args) {
+        const root = dataRoot();
+        if (!root) throw new Error('未设置数据根目录');
+        const { abs } = safeJoin(root, (args && args.rel) || '');
+        try { unlinkSync(abs); } catch { /* 已不存在视为成功 */ }
+        return { ok: true };
+      },
       async listSkills() {
         const skills = ctx.get('skills');
         if (!skills) return { skills: [], error: 'skills 服务不可用' };
@@ -185,31 +424,108 @@ export function apply(ctx) {
       },
     };
 
-    return ctx.webServer.register({
-      kind: 'exact',
-      path: `/${NAME}/api/rpc`,
-      async handler(req, res) {
-        res.setHeader('content-type', 'application/json; charset=utf-8');
-        try {
-          if (req.method !== 'POST') {
-            res.statusCode = 405;
-            res.end(JSON.stringify({ error: '仅接受 POST' }));
-            return;
+    const registrations = [
+      ctx.webServer.register({
+        kind: 'exact',
+        path: `/${NAME}/api/rpc`,
+        async handler(req, res) {
+          res.setHeader('content-type', 'application/json; charset=utf-8');
+          try {
+            if (req.method !== 'POST') {
+              res.statusCode = 405;
+              res.end(JSON.stringify({ error: '仅接受 POST' }));
+              return;
+            }
+            let raw = '';
+            for await (const chunk of req) {
+              raw += chunk;
+              if (raw.length > 2e6) throw new Error('请求过大');
+            }
+            const { method, args } = JSON.parse(raw);
+            const fn = methods[method];
+            if (!fn) throw new Error('未知操作: ' + method);
+            res.end(JSON.stringify(await fn(args ?? {})));
+          } catch (e) {
+            res.statusCode = 400;
+            res.end(JSON.stringify({ error: String((e && e.message) || e) }));
           }
-          let raw = '';
-          for await (const chunk of req) {
-            raw += chunk;
-            if (raw.length > 2e6) throw new Error('请求过大');
+        },
+      }),
+      ctx.webServer.register({
+        kind: 'exact',
+        path: `/${NAME}/api/asset`,
+        async handler(req, res) {
+          res.setHeader('content-type', 'application/json; charset=utf-8');
+          try {
+            if (req.method !== 'POST' && req.method !== 'PUT') {
+              res.statusCode = 405;
+              res.end(JSON.stringify({ error: '仅接受 POST/PUT' }));
+              return;
+            }
+            const root = dataRoot();
+            if (!root) throw new Error('未设置数据根目录');
+            const u = new URL(req.url, 'http://localhost');
+            const { abs, clean } = safeJoin(root, u.searchParams.get('rel') || '');
+            mkdirSync(path.dirname(abs), { recursive: true });
+            let size = 0;
+            await new Promise((resolve, reject) => {
+              const ws = createWriteStream(abs);
+              req.on('data', (c) => { size += c.length; });
+              req.on('error', reject);
+              ws.on('error', reject);
+              ws.on('finish', resolve);
+              req.pipe(ws);
+            });
+            res.end(JSON.stringify({ ok: true, rel: clean, size }));
+          } catch (e) {
+            res.statusCode = 400;
+            res.end(JSON.stringify({ error: String((e && e.message) || e) }));
           }
-          const { method, args } = JSON.parse(raw);
-          const fn = methods[method];
-          if (!fn) throw new Error('未知操作: ' + method);
-          res.end(JSON.stringify(await fn(args ?? {})));
-        } catch (e) {
-          res.statusCode = 400;
-          res.end(JSON.stringify({ error: String((e && e.message) || e) }));
-        }
-      },
-    });
-  }, `${NAME}: api route`);
+        },
+      }),
+      ctx.webServer.register({
+        kind: 'exact',
+        path: `/${NAME}/api/file`,
+        async handler(req, res) {
+          try {
+            if (req.method !== 'GET') { res.statusCode = 405; res.end('仅接受 GET'); return; }
+            const root = dataRoot();
+            if (!root) { res.statusCode = 404; res.end('未设置数据根目录'); return; }
+            const u = new URL(req.url, 'http://localhost');
+            const { abs } = safeJoin(root, u.searchParams.get('rel') || '');
+            let st;
+            try { st = statSync(abs); } catch { res.statusCode = 404; res.end('not found'); return; }
+            if (!st.isFile()) { res.statusCode = 404; res.end('not found'); return; }
+            res.setHeader('content-type', mimeOf(abs));
+            res.setHeader('accept-ranges', 'bytes');
+            res.setHeader('cache-control', 'no-cache');
+            const m = /^bytes=(\d*)-(\d*)$/.exec(String(req.headers.range || ''));
+            if (m && (m[1] !== '' || m[2] !== '')) {
+              let start;
+              let end;
+              if (m[1] === '') { start = Math.max(0, st.size - Number(m[2])); end = st.size - 1; }
+              else { start = parseInt(m[1], 10); end = m[2] === '' ? st.size - 1 : Math.min(parseInt(m[2], 10), st.size - 1); }
+              if (!Number.isFinite(start) || !Number.isFinite(end) || start > end || start >= st.size) {
+                res.statusCode = 416;
+                res.setHeader('content-range', 'bytes */' + st.size);
+                res.end();
+                return;
+              }
+              res.statusCode = 206;
+              res.setHeader('content-range', `bytes ${start}-${end}/${st.size}`);
+              res.setHeader('content-length', String(end - start + 1));
+              createReadStream(abs, { start, end }).pipe(res);
+            } else {
+              res.setHeader('content-length', String(st.size));
+              createReadStream(abs).pipe(res);
+            }
+          } catch (e) {
+            res.statusCode = 400;
+            res.end(String((e && e.message) || e));
+          }
+        },
+      }),
+    ];
+    return () => { for (const off of registrations) { try { if (off) off(); } catch { /* 忽略 */ } } };
+  }, `${NAME}: api routes`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ninkch/dsh-infinite-canvas",
-  "version": "0.17.2",
+  "version": "0.17.4",
   "description": "Node-based short-drama studio for DeepSeek Harness: script → storyboard → assets → shots → voiced, subtitled final cut on an infinite canvas.",
   "keywords": [
     "dsh",