@ninkch/dsh-infinite-canvas 0.17.3 → 0.17.4

package/README.md

@@ -76,7 +76,7 @@ Publishing runs through **npm Trusted Publishing** (OIDC) — no npm token exist
 
 ## Data & privacy
 
-- Canvas documents, projects, settings and the series bible live in browser `localStorage` (`dsh-ic:*`); assets live in IndexedDB (`dsh-infinite-canvas`).
+- Canvas documents, projects, settings and the series bible live in browser `localStorage` (`dsh-ic:*`); assets live in IndexedDB (`dsh-infinite-canvas`) — **or on disk** once a data root is set in Settings (per-project folders under the configured root, served by the plugin backend with HTTP Range support for video seeking).
 - AI text generation runs through the Harness host process (your configured models, no extra keys).
 - Image/video/TTS calls go directly from the browser to the endpoints you configure — mind CORS and key handling.
 - Nothing is uploaded anywhere by the plugin itself.

package/README.zh-CN.md

@@ -76,7 +76,7 @@ flowchart LR
 
 ## 数据与隐私
 
-- 画布文档、项目、设置与设定集存于浏览器 `localStorage`（`dsh-ic:*`）；资产存于 IndexedDB（`dsh-infinite-canvas`）。
+- 画布文档、项目、设置与设定集存于浏览器 `localStorage`（`dsh-ic:*`）；资产存于 IndexedDB（`dsh-infinite-canvas`）——**或在设置中配置数据根目录后落盘**（按项目分目录存放，由插件后台以 HTTP Range 方式服务，支持视频拖动进度条）。
 - AI 文本经 Harness 宿主进程调用（使用你已配置的模型，无需额外 Key）。
 - 图片/视频/TTS 请求由浏览器直连你配置的地址——请注意 CORS 与密钥保管。
 - 插件自身不向任何第三方上传数据。

package/client.js

@@ -338,6 +338,20 @@ window.__ModuleLoader__.load({
       'updateInstalledHint': '重启 Harness 后生效（网页部分刷新页面即可）',
       'updateFailGuide': '自动安装未成功，请在 DSH 插件管理 中升级',
       'updatePolicySkipped': '（已按你的点击跳过 24 小时新版本冷却期）',
+      'dataRootLabel': '数据根目录',
+      'dataRootPlaceholder': '如 D:\\canvas-data',
+      'dataRootHint': '资产与视频按项目落盘到该目录（不再占用 C 盘 IndexedDB）。留空 = 浏览器 IndexedDB。',
+      'dataRootSave': '设置此目录',
+      'dataRootOpen': '打开目录',
+      'dataRootMigrate': '迁移历史资产',
+      'dataRootMigrated': '已迁移 {n} 个资产到数据根目录',
+      'dataRootMigratedDone': '已迁移',
+      'dataRootMigrating': '迁移中',
+      'dataRootUnsupported': '当前插件后台版本较旧（不支持数据根目录）：重启 Harness 后可用',
+      'dataRootSaved': '数据根目录已设置',
+      'dataRootBrowse': '浏览选择目录',
+      'dataRootPicking': '请在弹出的窗口中选择目录（可直接取消）…',
+      'dataRootPickUnsupported': '当前平台不支持目录选择器，请手动填写路径',
       'updateCurrent': '当前',
       'updateGo': '去升级',
       'npmUpgradeHint': '请在 DSH 插件管理 中升级到最新版（本插件绝不自动安装或重启）；安装完成后重启 Harness 生效',
@@ -600,6 +614,20 @@ window.__ModuleLoader__.load({
       'updateInstalledHint': 'restart Harness to take effect (refresh the page for the web part)',
       'updateFailGuide': 'Auto-install failed — please upgrade via the DSH Plugin Manager',
       'updatePolicySkipped': '(skipped the 24-hour release cool-down at your click)',
+      'dataRootLabel': 'Data root',
+      'dataRootPlaceholder': 'e.g. D:\\canvas-data',
+      'dataRootHint': 'Assets and videos are stored per project under this folder (no more C: IndexedDB). Empty = browser IndexedDB.',
+      'dataRootSave': 'Set directory',
+      'dataRootOpen': 'Open folder',
+      'dataRootMigrate': 'Migrate existing assets',
+      'dataRootMigrated': 'Migrated {n} assets to the data root',
+      'dataRootMigratedDone': 'Migrated',
+      'dataRootMigrating': 'Migrating',
+      'dataRootUnsupported': 'The plugin backend is older and lacks data-root support — restart Harness to enable',
+      'dataRootSaved': 'Data root set',
+      'dataRootBrowse': 'Browse for folder',
+      'dataRootPicking': 'Pick a folder in the dialog (cancel anytime)…',
+      'dataRootPickUnsupported': 'No folder picker on this platform — type the path instead',
       'updateCurrent': 'current',
       'updateGo': 'Upgrade',
       'npmUpgradeHint': 'Please upgrade via the DSH Plugin Manager (this plugin never auto-installs or restarts); restart Harness after installing',
@@ -1047,30 +1075,81 @@ window.__ModuleLoader__.load({
     }
     const assetUrlCache = new Map();
     const assetNameCache = new Map(); // assetId -> name（连线绑定的同步名称查询）
+    function fileUrlFor(rel) { return '/' + NS + '/api/file?rel=' + encodeURIComponent(rel); }
+    function extFromMime(mime) {
+      const sub = String(mime || '').split(';')[0].split('/')[1] || 'bin';
+      return /^[a-z0-9]{1,8}$/i.test(sub) ? sub : 'bin';
+    }
     async function assetUrl(id) {
       if (!id) return null;
       if (assetUrlCache.has(id)) return assetUrlCache.get(id);
       const rec = await idbGet(id);
-      if (!rec || !rec.blob) return null;
-      const url = URL.createObjectURL(rec.blob);
-      assetUrlCache.set(id, url);
+      if (!rec) return null;
+      let url = null;
+      if (rec.rel) url = fileUrlFor(rec.rel);              // 磁盘资产：Host 文件服务（支持 Range）
+      else if (rec.blob) url = URL.createObjectURL(rec.blob); // 旧资产：IndexedDB blob
+      if (url) assetUrlCache.set(id, url);
       return url;
     }
+    /** 取资产 Blob：磁盘资产经 Host 文件服务拉取，旧资产直接读 IndexedDB。 */
+    async function assetBlob(id) {
+      const rec = await idbGet(id);
+      if (!rec) return null;
+      if (rec.blob) return rec.blob;
+      if (rec.rel) {
+        const r = await fetch(fileUrlFor(rec.rel));
+        if (!r.ok) throw new Error('资产读取失败 HTTP ' + r.status);
+        return await r.blob();
+      }
+      return null;
+    }
     async function saveAssetRecord(projectId, kind, blob, meta) {
+      const id = uid('a');
+      const mime = blob.type || (kind === 'image' ? 'image/png' : 'video/webm');
       const rec = {
-        id: uid('a'), projectId, kind,
-        mime: blob.type || (kind === 'image' ? 'image/png' : 'video/webm'),
+        id, projectId, kind,
+        mime,
         name: (meta && meta.name) || (kind === 'image' ? 'image' : 'video') + '-' + Date.now().toString(36),
-        blob,
         createdAt: Date.now(),
         prompt: (meta && meta.prompt) || '',
         source: (meta && meta.source) || 'demo',
         category: (meta && meta.category) || 'general',
       };
+      if (S.dataRoot) {
+        // 数据根目录已配置：落盘到 <root>/projects/<项目>/<类型>/<id>.<ext>，IndexedDB 只存元数据
+        const rel = `projects/${projectId}/${kind}/${id}.${extFromMime(mime)}`;
+        const r = await fetch('/' + NS + '/api/asset?rel=' + encodeURIComponent(rel), { method: 'POST', body: blob });
+        if (!r.ok) throw new Error('资产落盘失败: ' + (await r.text()));
+        rec.rel = rel;
+        rec.size = blob.size;
+        rec.stored = 'disk';
+      } else {
+        rec.blob = blob;
+        rec.stored = 'idb';
+      }
       await idbPut(rec);
       assetNameCache.set(rec.id, rec.name);
       return rec;
     }
+    /** 一次性把 IndexedDB 里的历史资产迁移到数据根目录（保留元数据，移除 blob）。 */
+    async function migrateAssetsToDisk(onProgress) {
+      if (!S.dataRoot) throw new Error('请先设置数据根目录');
+      const all = await idbAll();
+      const targets = all.filter((r) => r.blob && !r.rel);
+      let done = 0;
+      for (const rec of targets) {
+        const rel = `projects/${rec.projectId}/${rec.kind}/${rec.id}.${extFromMime(rec.mime)}`;
+        const r = await fetch('/' + NS + '/api/asset?rel=' + encodeURIComponent(rel), { method: 'POST', body: rec.blob });
+        if (!r.ok) throw new Error('迁移失败: ' + rel + ' — ' + (await r.text()));
+        const next = { ...rec, rel, size: rec.blob.size, stored: 'disk' };
+        delete next.blob;
+        await idbPut(next);
+        assetUrlCache.delete(rec.id); // 旧 objectURL 失效，改走文件 URL
+        done++;
+        if (onProgress) onProgress(done, targets.length);
+      }
+      return { migrated: done, total: targets.length };
+    }
     function useAssetUrl(id) {
       const [url, setUrl] = useState(null);
       useEffect(() => {
@@ -1696,7 +1775,9 @@ window.__ModuleLoader__.load({
       const map = craftMapLoad(pid);
       if (!opts.force && map[rec.id]) return map[rec.id];
       const rel = craftProjectSlug() + '/media/' + rec.id + extForMime(rec.mime, rec.name);
-      await craft.write(rel, rec.blob);
+      const blob = rec.blob || await assetBlob(rec.id);
+      if (!blob) throw new Error('资产内容不可用: ' + rec.id);
+      await craft.write(rel, blob);
       craftMapSet(pid, rec.id, rel);
       return rel;
     }
@@ -1880,6 +1961,15 @@ window.__ModuleLoader__.load({
         update((s) => { s.updateBusy = false; s.updateMsg = T('npmUpgradeHint') + ((S.updateInfo && S.updateInfo.remoteVersion) ? ' → v' + S.updateInfo.remoteVersion : ''); });
       }
     }
+    /** 从 Host 拉取数据根目录配置（Host 旧版无此 RPC → 标记不支持）。 */
+    async function refreshDataRoot() {
+      try {
+        const r = await hostRpc('dataRootGet');
+        update((s) => { s.dataRoot = r.dataRoot || null; s.dataRootExists = !!r.exists; s.dataRootSupported = true; });
+      } catch (e) {
+        update((s) => { s.dataRoot = null; s.dataRootSupported = !/未知操作/.test(String((e && e.message) || e)); });
+      }
+    }
 
     // ============================================================
     // 尺寸 / 比例（Toonflow 式：清晰度 × 比例 → 像素）
@@ -2138,6 +2228,9 @@ window.__ModuleLoader__.load({
       assetsTick: 0,
       tick: 0,
       craftStatus: null, // {at, data} | {at, error}
+      dataRoot: null,        // 数据根目录（Host 配置）；null = 未设置（资产走 IndexedDB）
+      dataRootExists: false,
+      dataRootSupported: true,
       updateInfo: null,      // Host updateCheck 结果
       updateChecking: false,
       updateBusy: false,
@@ -2483,8 +2576,7 @@ window.__ModuleLoader__.load({
       if (!src) return null;
       const aid = servedAssetId(src, e.fromPort);
       if (!aid) return null;
-      const rec = await idbGet(aid);
-      return rec ? rec.blob : null;
+      return await assetBlob(aid);
     }
     // 多参考图：按节点上的显式顺序（refOrder，未排序时按连线先后）解析，带名称/分类供 [图N] 绑定
     async function resolveRefMetas(nodeId, portId) {
@@ -2501,7 +2593,8 @@ window.__ModuleLoader__.load({
         if (!aid) continue;
         try {
           const rec = await idbGet(aid);
-          if (rec && rec.blob) metas.push({ blob: rec.blob, name: rec.name || '', category: rec.category || 'general' });
+          const blob = await assetBlob(aid);
+          if (blob) metas.push({ blob, name: (rec && rec.name) || '', category: (rec && rec.category) || 'general' });
         } catch { /* 单个参考图读取失败不影响其余 */ }
       }
       return metas;
@@ -3894,10 +3987,11 @@ window.__ModuleLoader__.load({
           if (!x.nd.data.assetId) continue;
           try {
             const rec = await idbGet(x.nd.data.assetId);
-            if (rec && rec.blob) {
+            const blob = await assetBlob(x.nd.data.assetId);
+            if (blob) {
               const ttsId = n.data.tts && n.data.tts[x.e.id] && n.data.tts[x.e.id].assetId;
               const ttsUrl = ttsId ? await assetUrl(ttsId) : null;
-              metas.push({ url: URL.createObjectURL(rec.blob), name: rec.name || 'seg', sub: getSub(x), ttsUrl });
+              metas.push({ url: URL.createObjectURL(blob), name: (rec && rec.name) || 'seg', sub: getSub(x), ttsUrl });
             }
           } catch { /* 跳过加载失败的片段 */ }
         }
@@ -3933,9 +4027,10 @@ window.__ModuleLoader__.load({
           if (!x.nd.data.assetId) continue;
           try {
             const rec = await idbGet(x.nd.data.assetId);
-            if (!(rec && rec.blob)) continue;
-            const rel = await ensureAssetOnDisk(rec);
-            items.push({ rel, name: rec.name || 'seg', sub: getSub(x), dur: await videoDurationOf(rec.blob) });
+            const blob = await assetBlob(x.nd.data.assetId);
+            if (!blob) continue;
+            const rel = await ensureAssetOnDisk({ ...(rec || {}), id: x.nd.data.assetId, blob });
+            items.push({ rel, name: (rec && rec.name) || 'seg', sub: getSub(x), dur: await videoDurationOf(blob) });
           } catch (e) { toast('Craft: ' + (e.message || e)); return; }
         }
         if (!items.length) { toast(T('noSegments')); return; }
@@ -4297,7 +4392,12 @@ window.__ModuleLoader__.load({
         lsSet(LS_ACTIVE, S.activeId);
         try {
           const recs = await idbByProject(pid);
-          for (const r of recs) { try { await idbDelete(r.id); } catch { /* 逐个容错 */ } }
+          for (const r of recs) {
+            try {
+              if (r.rel) { try { await hostRpc('assetDelete', { rel: r.rel }); } catch { /* 磁盘清理失败不阻塞 */ } }
+              await idbDelete(r.id);
+            } catch { /* 逐个容错 */ }
+          }
         } catch { /* 资产清理失败不影响项目删除 */ }
         setDelTarget(null);
       };
@@ -4455,6 +4555,7 @@ window.__ModuleLoader__.load({
         if (files.length) setTick((x) => x + 1);
       };
       const del = async (a) => {
+        if (a.rel) { try { await hostRpc('assetDelete', { rel: a.rel }); } catch { /* 磁盘清理失败不阻塞 */ } }
         await idbDelete(a.id);
         update((s) => {
           for (const nd of Object.values(s.graph.nodes)) {
@@ -4468,7 +4569,7 @@ window.__ModuleLoader__.load({
       const syncAll = async () => {
         const st = await craftStatusSafe();
         if (!st) return;
-        const recs = assets.filter((a) => a.blob);
+        const recs = assets.filter((a) => a.blob || a.rel);
         let okN = 0, failN = 0;
         for (const a of recs) {
           try { await syncAssetToDisk(a, { force: true }); okN++; } catch { failN++; }
@@ -4838,7 +4939,7 @@ window.__ModuleLoader__.load({
         if (!(st.bins && st.bins.photocraft && st.bins.photocraft.found)) { toast(T('craftCliMissing').replace('{name}', 'photocraft')); return; }
         let paramsObj;
         try { paramsObj = JSON.parse(paramsText || '{}'); } catch { toast(T('craftInvalidJson')); return; }
-        if (!rec || !rec.blob) { toast(T('noResult')); return; }
+        if (!rec || (!rec.blob && !rec.rel)) { toast(T('noResult')); return; }
         setRunning(true); setErr(null); setProgress('…');
         try {
           const mediaRel = await ensureAssetOnDisk(rec);
@@ -4945,6 +5046,77 @@ window.__ModuleLoader__.load({
         ));
     }
 
+    /** 数据根目录卡片：设置/打开/迁移历史资产。 */
+    function DataRootCard() {
+      const [val, setVal] = useState('');
+      const [busy, setBusy] = useState(false);
+      const [picking, setPicking] = useState(false);
+      const [mig, setMig] = useState(null); // null | {done,total} | 'done'
+      useEffect(() => { if (S.dataRoot) setVal(S.dataRoot); }, [S.dataRoot]);
+      const save = async () => {
+        if (busy) return;
+        setBusy(true);
+        try {
+          await hostRpc('dataRootSet', { root: val.trim() });
+          await refreshDataRoot();
+          toast(T('dataRootSaved') + (S.dataRoot ? '：' + S.dataRoot : ''));
+        } catch (e) { toast('设置失败：' + ((e && e.message) || e)); }
+        setBusy(false);
+      };
+      const applyRoot = async (root) => {
+        await hostRpc('dataRootSet', { root });
+        await refreshDataRoot();
+        setVal(S.dataRoot || root);
+        toast(T('dataRootSaved') + '：' + S.dataRoot);
+      };
+      const browse = async () => {
+        if (busy || picking) return;
+        setBusy(true); setPicking(true);
+        try {
+          const r = await hostRpc('pickFolder');
+          if (r && r.ok && r.path) await applyRoot(r.path);
+          else if (r && r.unsupported) toast(T('dataRootPickUnsupported'));
+          // cancelled → 静默
+        } catch (e) {
+          const msg = String((e && e.message) || e);
+          toast(/未知操作/.test(msg) ? T('dataRootUnsupported') : '目录选择失败：' + msg);
+        }
+        setPicking(false); setBusy(false);
+      };
+      const openDir = async () => { try { await hostRpc('dataRootReveal'); } catch (e) { toast((e && e.message) || e); } };
+      const migrate = async () => {
+        if (busy || picking || mig) return;
+        setBusy(true); setMig({ done: 0, total: 0 });
+        try {
+          const r = await migrateAssetsToDisk((done, total) => setMig({ done, total }));
+          setMig('done');
+          toast(T('dataRootMigrated').replace('{n}', String(r.migrated)));
+        } catch (e) { setMig(null); toast('迁移失败：' + ((e && e.message) || e)); }
+        setBusy(false);
+      };
+      return h('div', { key: 'dataroot', className: 'dshic-card' },
+        h('div', { className: 'dshic-row' }, Ic('image', 12), h('strong', { style: { fontSize: 12 } }, T('dataRootLabel'))),
+        S.dataRootSupported === false
+          ? h('div', { className: 'dshic-hint' }, T('dataRootUnsupported'))
+          : [
+              h('div', { className: 'dshic-row', key: 'row1' },
+                h('input', {
+                  className: 'dshic-input', value: val, placeholder: T('dataRootPlaceholder'),
+                  onChange: (e) => setVal(e.target.value), onPointerDown: (e) => e.stopPropagation(),
+                }),
+                h('button', { type: 'button', className: 'dshic-mini', title: T('dataRootBrowse'), disabled: busy || picking, onPointerDown: (e) => e.stopPropagation(), onClick: browse }, Ic('folder', 12)),
+                h('button', { type: 'button', className: 'dshic-mini', disabled: busy || picking, onPointerDown: (e) => e.stopPropagation(), onClick: save }, T('dataRootSave')),
+              ),
+              picking ? h('div', { className: 'dshic-hint', key: 'picking' }, T('dataRootPicking')) : null,
+              h('div', { className: 'dshic-hint', key: 'hint' }, T('dataRootHint')),
+              h('div', { className: 'dshic-row', key: 'row2' },
+                S.dataRoot ? h('button', { type: 'button', className: 'dshic-mini', onPointerDown: (e) => e.stopPropagation(), onClick: openDir }, T('dataRootOpen')) : null,
+                S.dataRoot ? h('button', { type: 'button', className: 'dshic-mini', disabled: busy || picking || !!mig, onPointerDown: (e) => e.stopPropagation(), onClick: migrate }, mig === 'done' ? T('dataRootMigratedDone') : T('dataRootMigrate')) : null,
+                (mig && mig !== 'done') ? h('span', { style: { fontSize: 11, opacity: 0.85 } }, T('dataRootMigrating') + ' ' + mig.done + '/' + mig.total) : null,
+              ),
+            ],
+      );
+    }
     function SettingsTab() {
       const [s, setS] = useState(loadSettings);
       const apply = (fn) => {
@@ -4958,6 +5130,7 @@ window.__ModuleLoader__.load({
       const field = (label, value, onChange, placeholder, password) => h(Field, { label, value, onChange, placeholder, password });
       return [
         h(CraftCard, { key: 'craft' }),
+        h(DataRootCard, { key: 'dataroot' }),
         h('div', { key: 'lang', className: 'dshic-card' },
           h('div', { className: 'dshic-row' }, Ic('text', 12), h('strong', { style: { fontSize: 12 } }, T('langLabel'))),
           h('select', {
@@ -4983,7 +5156,7 @@ window.__ModuleLoader__.load({
         h(ApiListEditor, { key: 'imglist', kind: 'image' }),
         h(ApiListEditor, { key: 'vidlist', kind: 'video' }),
         h(ApiListEditor, { key: 'ttslist', kind: 'tts' }),
-        h('div', { key: 'note', className: 'dshic-hint' }, 'DeepSeek Harness · dsh-infinite-canvas v0.17.1'),
+        h('div', { key: 'note', className: 'dshic-hint' }, 'DeepSeek Harness · dsh-infinite-canvas' + ((S.updateInfo && S.updateInfo.runningVersion) ? ' v' + S.updateInfo.runningVersion : '')),
       ];
     }
 
@@ -5317,6 +5490,8 @@ window.__ModuleLoader__.load({
           probeCraft();
           // 检查更新（Host RPC；Host 旧版未带此方法时静默）
           checkUpdate(true);
+          // 数据根目录（Host 旧版静默降级为 IndexedDB 模式）
+          refreshDataRoot();
           // 后台路由探活：失败时在画布顶部给出可操作的提示
           hostRpc('ping').then(() => { S.hostOk = true; S.hostError = null; notify(); }).catch((e) => {
             S.hostOk = false;

package/docs/release.md

@@ -9,7 +9,8 @@
 2. **绝不自动重启 Harness、绝不自动刷新页面。** 更新/安装后只提示（横幅/文案），何时生效由用户决定。
 3. **beta 版本号绝不复用**（npm 本身也禁止覆盖已发布版本）；**正式版本号只在 main 上诞生**。
 4. **版本单一来源 = `package.json`**。改版本一律用 `npm version …`，不手改；Host 运行时读取它，禁止在代码里硬编码版本号。
-5. npm token 只通过命令行注入，**绝不写入任何文件**。
+5. **版本号一律按 0.0.x（patch）递增**（如 0.17.3 → 0.17.4），不做 minor/major 升级——新功能同样走 patch 号。
+6. npm token 只通过命令行注入，**绝不写入任何文件**。
 
 ## 1. 测试三层漏斗
 

package/index.js

@@ -8,7 +8,7 @@
  */
 import { spawn } from 'node:child_process';
 import fs from 'node:fs/promises';
-import { readFileSync, existsSync, readdirSync } from 'node:fs';
+import { createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -106,6 +106,87 @@ async function ensureBundleEntry(profileDir, pkg) {
   return true;
 }
 
+// ---------- 数据根目录（资产落盘）----------
+// 配置存在 ~/.dsh/infinite-canvas/config.json：跨重装/重启稳定，绝不放进包目录。
+const CONFIG_PATH = path.join(os.homedir(), '.dsh', 'infinite-canvas', 'config.json');
+
+function readIcConfig() {
+  try { return JSON.parse(readFileSync(CONFIG_PATH, 'utf8')) || {}; } catch { return {}; }
+}
+function writeIcConfig(cfg) {
+  mkdirSync(path.dirname(CONFIG_PATH), { recursive: true });
+  writeFileSync(CONFIG_PATH, JSON.stringify(cfg, null, 2) + '\n', 'utf8');
+}
+function dataRoot() {
+  const r = readIcConfig().dataRoot;
+  return (typeof r === 'string' && r.trim()) ? path.resolve(r.trim()) : null;
+}
+/** rel 限定在 dataRoot 之内：拒绝绝对路径 / 盘符 / 上级跳转，返回 { abs, clean }。 */
+function safeJoin(root, rel) {
+  const clean = String(rel || '').replace(/\\/g, '/').replace(/^\/+/, '').trim();
+  if (!clean) throw new Error('缺少相对路径');
+  if (/(^|\/)\.\.(\/|$)/.test(clean) || /^[a-z]:/i.test(clean)) throw new Error('非法路径: ' + rel);
+  const rootAbs = path.resolve(root);
+  const abs = path.resolve(rootAbs, ...clean.split('/'));
+  if (abs !== rootAbs && !abs.startsWith(rootAbs + path.sep)) throw new Error('路径越界');
+  return { abs, clean };
+}
+const MIME_BY_EXT = {
+  png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', webp: 'image/webp', gif: 'image/gif', svg: 'image/svg+xml',
+  webm: 'video/webm', mp4: 'video/mp4', mov: 'video/quicktime', mkv: 'video/x-matroska',
+  wav: 'audio/wav', mp3: 'audio/mpeg', m4a: 'audio/mp4', ogg: 'audio/ogg',
+  json: 'application/json', srt: 'text/plain; charset=utf-8', txt: 'text/plain; charset=utf-8',
+};
+function mimeOf(p) {
+  const m = /\.([a-z0-9]+)$/i.exec(p);
+  return m ? (MIME_BY_EXT[m[1].toLowerCase()] || 'application/octet-stream') : 'application/octet-stream';
+}
+
+/**
+ * 弹出系统"选择目录"对话框（阻塞至用户选择/取消）。
+ * Windows = PowerShell + WinForms FolderBrowserDialog（TopMost，可新建文件夹）；
+ * macOS = osascript choose folder；Linux = zenity（若安装）。均不可用 → { ok:false, unsupported:true }。
+ */
+function pickFolderDialog() {
+  return new Promise((resolve) => {
+    const collect = (child) => {
+      const stdout = [];
+      child.stdout?.setEncoding('utf8');
+      child.stdout?.on('data', (d) => stdout.push(String(d)));
+      const timer = setTimeout(() => { try { child.kill(); } catch { /* 忽略 */ } }, 600000);
+      child.on('error', (e) => { clearTimeout(timer); resolve({ ok: false, unsupported: e.code === 'ENOENT', error: String(e?.message ?? e) }); });
+      child.on('close', (code) => {
+        clearTimeout(timer);
+        const picked = stdout.join('').trim().split(/\r?\n/).filter(Boolean).pop() || '';
+        if (code === 0 && picked) resolve({ ok: true, path: picked });
+        else resolve({ ok: false, cancelled: true });
+      });
+    };
+    try {
+      if (process.platform === 'win32') {
+        const script = [
+          '$ErrorActionPreference="Stop"',
+          '[Console]::OutputEncoding=[System.Text.Encoding]::UTF8',
+          'Add-Type -AssemblyName System.Windows.Forms | Out-Null',
+          '$o = New-Object System.Windows.Forms.Form',
+          '$o.TopMost = $true',
+          '$d = New-Object System.Windows.Forms.FolderBrowserDialog',
+          "$d.Description = '选择数据根目录（资产与视频将存到该目录）'",
+          '$d.ShowNewFolderButton = $true',
+          'if ($d.ShowDialog($o) -eq [System.Windows.Forms.DialogResult]::OK) { Write-Output $d.SelectedPath }',
+        ].join('; ');
+        collect(spawn('powershell.exe', ['-NoProfile', '-STA', '-ExecutionPolicy', 'Bypass', '-WindowStyle', 'Hidden', '-Command', script], { windowsHide: true }));
+      } else if (process.platform === 'darwin') {
+        collect(spawn('osascript', ['-e', 'POSIX path of (choose folder with prompt "选择数据根目录")'], { windowsHide: true }));
+      } else {
+        collect(spawn('zenity', ['--file-selection', '--directory', '--title=选择数据根目录'], { windowsHide: true }));
+      }
+    } catch (e) {
+      resolve({ ok: false, unsupported: true, error: String((e && e.message) || e) });
+    }
+  });
+}
+
 /** 读取 npm registry 上 latest dist-tag 的版本号。 */
 async function npmLatestVersion() {
   const res = await fetch(NPM_LATEST_URL, {
@@ -195,7 +276,7 @@ async function updateInstall() {
 export const inject = ['webServer'];
 
 // 仅供诊断 / 自动化测试（不属于 RPC 面，运行时行为不受影响）
-export const _internals = { updateCheck, updateInstall, npmLatestVersion, cmpVer, findPnpm, getProfileDir: () => PROFILE_DIR, getVersion: () => VERSION };
+export const _internals = { updateCheck, updateInstall, npmLatestVersion, cmpVer, findPnpm, getProfileDir: () => PROFILE_DIR, getVersion: () => VERSION, dataRoot, safeJoin, mimeOf, getIcConfigPath: () => CONFIG_PATH };
 
 function resolveModel(providers, want) {
   const byProvider = want && want.provider
@@ -278,6 +359,42 @@ export function apply(ctx) {
       async llmComplete(args) { return complete(args); },
       async updateCheck() { return updateCheck(); },
       async updateInstall() { return updateInstall(); },
+      async dataRootGet() {
+        const root = dataRoot();
+        let exists = false;
+        if (root) { try { exists = statSync(root).isDirectory(); } catch { /* 不存在 */ } }
+        return { dataRoot: root, exists, configPath: CONFIG_PATH };
+      },
+      async dataRootSet(args) {
+        const raw = String((args && args.root) ?? '').trim();
+        if (!raw) throw new Error('需要数据根目录路径');
+        const root = path.resolve(raw);
+        if (!path.isAbsolute(root)) throw new Error('需要绝对路径（如 D:\\canvas-data）');
+        mkdirSync(root, { recursive: true });
+        const cfg = readIcConfig();
+        cfg.dataRoot = root;
+        writeIcConfig(cfg);
+        return { ok: true, dataRoot: root };
+      },
+      async dataRootReveal() {
+        const root = dataRoot();
+        if (!root) throw new Error('未设置数据根目录');
+        mkdirSync(root, { recursive: true });
+        const open = process.platform === 'win32' ? 'explorer.exe' : process.platform === 'darwin' ? 'open' : 'xdg-open';
+        try { spawn(open, [root], { detached: true, stdio: 'ignore' }).unref(); } catch { /* 打开失败不阻塞 */ }
+        return { ok: true, dataRoot: root };
+      },
+      async pickFolder() {
+        const r = await pickFolderDialog();
+        return r; // { ok, path } | { ok:false, cancelled } | { ok:false, unsupported }
+      },
+      async assetDelete(args) {
+        const root = dataRoot();
+        if (!root) throw new Error('未设置数据根目录');
+        const { abs } = safeJoin(root, (args && args.rel) || '');
+        try { unlinkSync(abs); } catch { /* 已不存在视为成功 */ }
+        return { ok: true };
+      },
       async listSkills() {
         const skills = ctx.get('skills');
         if (!skills) return { skills: [], error: 'skills 服务不可用' };
@@ -307,31 +424,108 @@ export function apply(ctx) {
       },
     };
 
-    return ctx.webServer.register({
-      kind: 'exact',
-      path: `/${NAME}/api/rpc`,
-      async handler(req, res) {
-        res.setHeader('content-type', 'application/json; charset=utf-8');
-        try {
-          if (req.method !== 'POST') {
-            res.statusCode = 405;
-            res.end(JSON.stringify({ error: '仅接受 POST' }));
-            return;
+    const registrations = [
+      ctx.webServer.register({
+        kind: 'exact',
+        path: `/${NAME}/api/rpc`,
+        async handler(req, res) {
+          res.setHeader('content-type', 'application/json; charset=utf-8');
+          try {
+            if (req.method !== 'POST') {
+              res.statusCode = 405;
+              res.end(JSON.stringify({ error: '仅接受 POST' }));
+              return;
+            }
+            let raw = '';
+            for await (const chunk of req) {
+              raw += chunk;
+              if (raw.length > 2e6) throw new Error('请求过大');
+            }
+            const { method, args } = JSON.parse(raw);
+            const fn = methods[method];
+            if (!fn) throw new Error('未知操作: ' + method);
+            res.end(JSON.stringify(await fn(args ?? {})));
+          } catch (e) {
+            res.statusCode = 400;
+            res.end(JSON.stringify({ error: String((e && e.message) || e) }));
           }
-          let raw = '';
-          for await (const chunk of req) {
-            raw += chunk;
-            if (raw.length > 2e6) throw new Error('请求过大');
+        },
+      }),
+      ctx.webServer.register({
+        kind: 'exact',
+        path: `/${NAME}/api/asset`,
+        async handler(req, res) {
+          res.setHeader('content-type', 'application/json; charset=utf-8');
+          try {
+            if (req.method !== 'POST' && req.method !== 'PUT') {
+              res.statusCode = 405;
+              res.end(JSON.stringify({ error: '仅接受 POST/PUT' }));
+              return;
+            }
+            const root = dataRoot();
+            if (!root) throw new Error('未设置数据根目录');
+            const u = new URL(req.url, 'http://localhost');
+            const { abs, clean } = safeJoin(root, u.searchParams.get('rel') || '');
+            mkdirSync(path.dirname(abs), { recursive: true });
+            let size = 0;
+            await new Promise((resolve, reject) => {
+              const ws = createWriteStream(abs);
+              req.on('data', (c) => { size += c.length; });
+              req.on('error', reject);
+              ws.on('error', reject);
+              ws.on('finish', resolve);
+              req.pipe(ws);
+            });
+            res.end(JSON.stringify({ ok: true, rel: clean, size }));
+          } catch (e) {
+            res.statusCode = 400;
+            res.end(JSON.stringify({ error: String((e && e.message) || e) }));
           }
-          const { method, args } = JSON.parse(raw);
-          const fn = methods[method];
-          if (!fn) throw new Error('未知操作: ' + method);
-          res.end(JSON.stringify(await fn(args ?? {})));
-        } catch (e) {
-          res.statusCode = 400;
-          res.end(JSON.stringify({ error: String((e && e.message) || e) }));
-        }
-      },
-    });
-  }, `${NAME}: api route`);
+        },
+      }),
+      ctx.webServer.register({
+        kind: 'exact',
+        path: `/${NAME}/api/file`,
+        async handler(req, res) {
+          try {
+            if (req.method !== 'GET') { res.statusCode = 405; res.end('仅接受 GET'); return; }
+            const root = dataRoot();
+            if (!root) { res.statusCode = 404; res.end('未设置数据根目录'); return; }
+            const u = new URL(req.url, 'http://localhost');
+            const { abs } = safeJoin(root, u.searchParams.get('rel') || '');
+            let st;
+            try { st = statSync(abs); } catch { res.statusCode = 404; res.end('not found'); return; }
+            if (!st.isFile()) { res.statusCode = 404; res.end('not found'); return; }
+            res.setHeader('content-type', mimeOf(abs));
+            res.setHeader('accept-ranges', 'bytes');
+            res.setHeader('cache-control', 'no-cache');
+            const m = /^bytes=(\d*)-(\d*)$/.exec(String(req.headers.range || ''));
+            if (m && (m[1] !== '' || m[2] !== '')) {
+              let start;
+              let end;
+              if (m[1] === '') { start = Math.max(0, st.size - Number(m[2])); end = st.size - 1; }
+              else { start = parseInt(m[1], 10); end = m[2] === '' ? st.size - 1 : Math.min(parseInt(m[2], 10), st.size - 1); }
+              if (!Number.isFinite(start) || !Number.isFinite(end) || start > end || start >= st.size) {
+                res.statusCode = 416;
+                res.setHeader('content-range', 'bytes */' + st.size);
+                res.end();
+                return;
+              }
+              res.statusCode = 206;
+              res.setHeader('content-range', `bytes ${start}-${end}/${st.size}`);
+              res.setHeader('content-length', String(end - start + 1));
+              createReadStream(abs, { start, end }).pipe(res);
+            } else {
+              res.setHeader('content-length', String(st.size));
+              createReadStream(abs).pipe(res);
+            }
+          } catch (e) {
+            res.statusCode = 400;
+            res.end(String((e && e.message) || e));
+          }
+        },
+      }),
+    ];
+    return () => { for (const off of registrations) { try { if (off) off(); } catch { /* 忽略 */ } } };
+  }, `${NAME}: api routes`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ninkch/dsh-infinite-canvas",
-  "version": "0.17.3",
+  "version": "0.17.4",
   "description": "Node-based short-drama studio for DeepSeek Harness: script → storyboard → assets → shots → voiced, subtitled final cut on an infinite canvas.",
   "keywords": [
     "dsh",