beauticode-dsh 1.0.21 → 1.0.23

package/agent.mjs

@@ -124,6 +124,23 @@ function unwrapApply(result, fallbackMode, message) {
   };
 }
 
+// The raw manifest exposes a local source's absolute on-disk path. The status
+// tool result is surfaced to the model, so only forward a safe summary.
+function sanitizeBackground(background) {
+  if (!background) return null;
+  const safe = {
+    type: background.type,
+    ...(background.effects ? { effects: background.effects } : {}),
+  };
+  if (background.source) {
+    safe.source =
+      background.source.kind === "local"
+        ? { kind: "local" }
+        : { kind: "managed", file: background.source.file };
+  }
+  return safe;
+}
+
 function presentStatus(status) {
   const background = status.manifest?.background ?? status.background ?? null;
   return {
@@ -133,7 +150,7 @@ function presentStatus(status) {
     fish: status.fish === true,
     muted: status.muted !== false,
     tone: status.tone ?? "dark",
-    background,
+    background: sanitizeBackground(background),
     sourceMode: background
       ? background.source?.kind === "local"
         ? "local"
@@ -350,33 +367,36 @@ export function createBeauticodeActions(dataRootOrOptions) {
       const name = String(input?.name ?? "").trim();
       const imagePath = String(input?.imagePath ?? "").trim();
       if (!name || !imagePath) fail("导入皮肤必须提供名称和图片。");
-      const body = {
-        name,
-        imagePath,
-      };
-      if (typeof input.videoPath === "string" && input.videoPath.trim()) {
-        body.videoPath = input.videoPath.trim();
-      }
-      if (input.effects) body.effects = input.effects;
-      if (input.source) body.source = input.source;
+      const source = input?.source === "managed" ? "managed" : "local";
+      const hasVideo = typeof input.videoPath === "string" && Boolean(input.videoPath.trim());
+      const themeInput = hasVideo
+        ? {
+            type: "video",
+            videoPath: input.videoPath.trim(),
+            imagePath,
+            source,
+          }
+        : { type: "image", imagePath, source };
+      if (!hasVideo && input.effects) themeInput.effects = input.effects;
       const resolved = await backend();
-      if (resolved.kind === "tray") {
-        const result = await request({
-          method: "POST",
-          path: "/theme/import",
-          body,
-          signal,
-          timeoutMs: 30 * 60 * 1000,
-        });
-        if (!result || result.ok === false) fail(result?.error || "导入皮肤失败。");
-        return {
-          ok: true,
-          theme: result.theme,
-          message: `已保存皮肤「${result.theme.name}」。`,
-        };
-      }
-      const theme = await resolved.session.importSavedTheme(body);
-      return { ok: true, theme, message: `已保存皮肤「${theme.name}」。` };
+      // Gallery import applies-and-saves through the same atomic transaction as
+      // the normal image/video flow. There is no separate import-only endpoint:
+      // the tray exposes /theme/apply and DshSession exposes applyAndSaveTheme.
+      const result =
+        resolved.kind === "tray"
+          ? await request({
+              method: "POST",
+              path: "/theme/apply",
+              body: { name, input: themeInput },
+              signal,
+              timeoutMs: 30 * 60 * 1000,
+            })
+          : await resolved.session.applyAndSaveTheme(themeInput, name);
+      return unwrapApplyResult(
+        result,
+        hasVideo ? "video" : "image",
+        `已保存皮肤「${name}」。`,
+      );
     },
 
     async listThemes(signal) {

package/atmosphere.js

@@ -1,4 +1,4 @@
-(() => {
+(() => {
   "use strict";
 
   const STYLE_ID = "beauticode-atmosphere-style";
@@ -92,8 +92,8 @@ html[data-bc-resolved-tone="light"][data-bc-gallery="true"] body{
 }
 html[data-bc-gallery="true"] #root{position:relative;z-index:1;background:transparent!important}
 html[data-bc-gallery="true"] [class*="_fade"]{display:none!important}
-html[data-bc-gallery="true"] #beauticode-bg-stage img,
-html[data-bc-gallery="true"] #beauticode-bg-stage video{opacity:0!important}
+html[data-bc-gallery="true"] #beauticode-bg-stage img,
+html[data-bc-gallery="true"] #beauticode-bg-stage video{opacity:0!important}
 html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;pointer-events:none!important}
 `;
     return style;

package/cli.js

@@ -298,14 +298,26 @@ async function sameLinkTarget(link, dest) {
   return false;
 }
 
+// A dangling symlink has a live directory entry even though fs.existsSync
+// (which follows the link) reports false. Use lstat so leftover plugin links
+// are detected and cleaned instead of making fsp.symlink fail with EEXIST.
+async function entryExists(p) {
+  try {
+    await fsp.lstat(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 async function linkPluginIntoProfile(webProfile, dest) {
   const link = pluginLinkPath(webProfile);
   const legacy = legacyPluginLinkPath(webProfile);
-  if (fs.existsSync(legacy)) {
+  if (await entryExists(legacy)) {
     await fsp.rm(legacy, { recursive: true, force: true });
   }
   await fsp.mkdir(path.dirname(link), { recursive: true });
-  if (fs.existsSync(link)) {
+  if (await entryExists(link)) {
     if (await sameLinkTarget(link, dest)) return;
     await fsp.rm(link, { recursive: true, force: true });
   }
@@ -403,7 +415,7 @@ async function uninstall(opts) {
     removed.push("web package.json");
   }
   for (const link of [pluginLinkPath(webProfile), legacyPluginLinkPath(webProfile)]) {
-    if (fs.existsSync(link)) {
+    if (await entryExists(link)) {
       await fsp.rm(link, { recursive: true, force: true });
       removed.push(link);
     }

package/client.js

@@ -17,6 +17,13 @@
   const IMAGE_MAX_ATTEMPTS = 2;
   const VIDEO_STARTUP_TIMEOUT_MS = CLIENT_APPLY_DEADLINE_MS;
   const VIDEO_PROBE_TIMEOUT_MS = 2_000;
+  // Phase-one playback acceptance window. A muted play() that is still pending
+  // after this only means the decoder is warming; the settle phase owns it.
+  const PLAY_ACCEPT_TIMEOUT_MS = 1_500;
+  // Phase-two budget for the committed video to present its first frame. It is
+  // deliberately far beyond any host deadline: a poster already committed, so
+  // slow first frames upgrade in place instead of failing the transaction.
+  const VIDEO_SETTLE_TIMEOUT_MS = 60_000;
   const DSH_STRUCTURE_TIMEOUT_MS = CLIENT_APPLY_DEADLINE_MS;
   const FRAME_FALLBACK_MS = 120;
   const VIDEO_FIRST_FRAME_PROGRESS_SEC = 0.03;
@@ -32,6 +39,7 @@
   let playbackBlocked = false;
   let currentSlot = null;
   let applyController = null;
+  let videoSettleController = null;
   const systemDarkMedia = globalThis.matchMedia?.("(prefers-color-scheme: dark)") ?? null;
   const reducedMotionMedia =
     globalThis.matchMedia?.("(prefers-reduced-motion: reduce)") ?? null;
@@ -298,10 +306,14 @@ html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;
     };
   }
 
-  async function acknowledgeRender(payload, ok, visible, error = null) {
+  async function acknowledgeRender(payload, ok, visible, error = null, extra = {}) {
     if (activePayload === payload) {
       renderPhase = ok ? "ready" : "failed";
     }
+    // A committed video apply may still be settling: ok=true with
+    // videoReady=false means the poster is live and the first frame upgrades
+    // in place. Only ok=false is a renderer verdict the host will act on.
+    const videoReady = extra.videoReady !== false;
     await postAck({
       kind: "render",
       generation: payload.generation,
@@ -309,8 +321,9 @@ html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;
       ok,
       visible,
       error,
+      ...(payload.media === "video" ? { videoReady } : {}),
       playback:
-        ok && committedPayload === payload && payload.media === "video"
+        ok && committedPayload === payload && payload.media === "video" && videoReady
           ? playbackSnapshot(activeVideo())
           : null,
     });
@@ -672,6 +685,13 @@ html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;
   function waitForVideo(video, signal, timeoutMs = VIDEO_STARTUP_TIMEOUT_MS) {
     const frameReadyState = HTMLMediaElement.HAVE_CURRENT_DATA ?? 2;
     if (video.readyState >= frameReadyState) return Promise.resolve();
+    // A decoder error may fire before this waiter attaches — most notably
+    // between the poster commit's crossfade and the settle start. Honoring an
+    // already-set error keeps the settle phase from waiting out its full
+    // budget on media that has already failed.
+    if (video.error) {
+      return Promise.reject(new Error(describeVideoState(video, "MP4 加载或解码失败")));
+    }
     return new Promise((resolve, reject) => {
       let settled = false;
       const done = () => finish();
@@ -990,36 +1010,32 @@ html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;
     return blocked;
   }
 
+  // Phase one only needs playback initiated. On a cold machine the muted
+  // play() promise can stay pending well past the apply deadline while the
+  // decoder warms; that is not a failure — the poster-first commit tolerates
+  // it and the settle phase owns the eventual outcome. Only an outright
+  // rejection (autoplay policy, detached element) fails the apply.
   async function startCandidatePlayback(video, signal, timeoutMs) {
     const playbackController = new AbortController();
     const parentAborted = () => playbackController.abort();
     signal?.addEventListener?.("abort", parentAborted, { once: true });
-    let timer = null;
+    let acceptTimer = null;
     let abortListener = null;
-    const playback = playWithPreference(video, playbackController.signal);
-    const deadline = new Promise((_, reject) => {
-      timer = setTimeout(() => {
-        reject(new Error(describeVideoState(video, "等待视频开始播放超时")));
-        playbackController.abort();
-      }, timeoutMs);
-      abortListener = () => reject(abortError());
+    const accepted = new Promise((resolve) => {
+      acceptTimer = setTimeout(() => resolve("accepted"), Math.max(1, timeoutMs));
+      abortListener = () => resolve("aborted");
       playbackController.signal.addEventListener("abort", abortListener, { once: true });
     });
     if (signal?.aborted) parentAborted();
+    const playback = playWithPreference(video, playbackController.signal);
+    // The settle phase owns late outcomes of an accepted-but-unresolved play().
+    void playback.catch?.(() => {});
     try {
-      // The play() promise itself resolves only after playback has started, so
-      // a second playing-event waiter would create an orphaned promise race.
-      return await Promise.race([playback, deadline]);
-    } catch (error) {
-      playbackController.abort();
-      try {
-        video.pause();
-      } catch {
-        /* best effort: disposeSlot will release src as the final guard */
-      }
-      throw error;
+      const outcome = await Promise.race([playback.then(() => "started"), accepted]);
+      if (outcome === "aborted") throw abortError();
+      return outcome;
     } finally {
-      if (timer) clearTimeout(timer);
+      clearTimeout(acceptTimer);
       signal?.removeEventListener?.("abort", parentAborted);
       if (abortListener) {
         playbackController.signal.removeEventListener("abort", abortListener);
@@ -1111,7 +1127,7 @@ html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;
     return true;
   }
 
-  function updateCommittedDom(payload) {
+  function updateCommittedDom(payload, videoReady = true) {
     document.documentElement.dataset.bcGeneration = String(payload.generation);
     document.documentElement.removeAttribute("data-bc-pending-generation");
     if (payload.media === "clear") {
@@ -1122,8 +1138,13 @@ html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;
     }
     document.documentElement.dataset.bcActive = "true";
     document.documentElement.dataset.bcMedia = payload.media;
-    if (payload.media === "video") document.documentElement.dataset.bcVideoReady = "true";
-    else document.documentElement.removeAttribute("data-bc-video-ready");
+    if (payload.media === "video") {
+      // "false" keeps the poster as the committed visual until the settle
+      // phase flips it after the first presented frame.
+      document.documentElement.dataset.bcVideoReady = videoReady ? "true" : "false";
+    } else {
+      document.documentElement.removeAttribute("data-bc-video-ready");
+    }
   }
 
   function discardCandidates() {
@@ -1240,7 +1261,7 @@ html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;
     committedPayload = payload;
     const video = activeVideo();
     playbackBlocked = video?.dataset?.bcPlaybackBlocked === "true";
-    updateCommittedDom(payload);
+    updateCommittedDom(payload, slot.dataset.bcVideoReady === "true");
     syncGallery(payload);
   }
 
@@ -1249,7 +1270,7 @@ html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;
     node?.removeAttribute("data-bc-transitioning");
     node?.removeAttribute("data-bc-empty");
     if (committedPayload && mountedCurrentSlot()) {
-      updateCommittedDom(committedPayload);
+      updateCommittedDom(committedPayload, currentSlot.dataset.bcVideoReady === "true");
       playbackBlocked = activeVideo()?.dataset?.bcPlaybackBlocked === "true";
       return;
     }
@@ -1369,40 +1390,29 @@ html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;
       candidateVideo = video;
       video.src = payload.videoUrl;
       video.load();
-      // Start the real media request before the diagnostic Range probe. During
-      // a cold Chromium/decoder start, serial probing used part of the same
-      // eight-second budget without advancing the frame that users can see.
+      // Phase one gates only what the poster commit needs: the media source
+      // answers Range requests, the poster decodes, and playback was
+      // initiated. A cold decoder no longer fails the transaction here — the
+      // video upgrades from the committed poster in the settle phase, so a
+      // fresh machine that merely loads slowly can never time out.
       const sourceProbe = probeVideoSource(
         payload.videoUrl,
         signal,
         Math.min(VIDEO_PROBE_TIMEOUT_MS, remaining()),
       );
       const imageReady = loadImage(candidate, payload.imageUrl, signal, remaining());
-      // play() is deliberately started alongside media readiness. Chromium is
-      // allowed to ignore preload=auto for hidden/background media; waiting for
-      // canplay before play() creates a circular stall at readyState=0.
       await Promise.all([
         sourceProbe,
         imageReady,
-        waitForVideo(video, signal, remaining()),
-        startCandidatePlayback(video, signal, remaining()),
+        startCandidatePlayback(video, signal, Math.min(PLAY_ACCEPT_TIMEOUT_MS, remaining())),
       ]);
       throwIfAborted(signal);
-      const appliedStartAt = seekVideo(video, payload.startAt);
-      candidate.dataset.bcStartAt = String(appliedStartAt);
-      await waitForSeek(video, signal, remaining());
-      await waitForVideo(video, signal, remaining());
-      // Transaction success means one frame was actually presented. Longer
-      // three-frame stability remains useful for reusing an existing slot, but
-      // must not turn a healthy cold decoder into a false first-frame failure.
-      await waitForPresentedFrame(video, signal, remaining());
-      throwIfAborted(signal);
-      candidate.dataset.bcVideoReady = "true";
       await commitCandidate(payload, candidate, signal, remaining);
       committed = true;
-      const visible = video.readyState >= HTMLMediaElement.HAVE_CURRENT_DATA && !video.paused;
-      await acknowledgeRender(payload, visible, visible, visible ? null : "视频未开始播放");
+      await acknowledgeRender(payload, true, true, null, { videoReady: false });
       await acknowledgeMode();
+      settleCommittedVideo(video, candidate, payload);
+      return;
     } catch (error) {
       if (candidateVideo && candidateVideo.parentElement !== candidate) {
         disposeVideo(candidateVideo);
@@ -1420,6 +1430,48 @@ html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;
     }
   }
 
+  // Phase two of a video apply. The poster is already committed and acked, so
+  // nothing here can roll the transaction back: a decoder that needs longer
+  // than any host deadline simply keeps the poster until the first frame
+  // presents, then upgrades the committed slot in place without a flash.
+  function settleCommittedVideo(video, slot, payload) {
+    videoSettleController?.abort();
+    const controller = new AbortController();
+    videoSettleController = controller;
+    const stillSettling = () => !controller.signal.aborted && mountedCurrentSlot() === slot;
+    void (async () => {
+      try {
+        await waitForVideo(video, controller.signal, VIDEO_SETTLE_TIMEOUT_MS);
+        throwIfAborted(controller.signal);
+        if (!stillSettling()) return;
+        const appliedStartAt = seekVideo(video, payload.startAt);
+        slot.dataset.bcStartAt = String(appliedStartAt);
+        await waitForSeek(video, controller.signal, VIDEO_SETTLE_TIMEOUT_MS);
+        await waitForVideo(video, controller.signal, VIDEO_SETTLE_TIMEOUT_MS);
+        await waitForPresentedFrame(video, controller.signal, VIDEO_SETTLE_TIMEOUT_MS);
+        if (!stillSettling()) return;
+        slot.dataset.bcVideoReady = "true";
+        updateCommittedDom(payload, true);
+        playbackBlocked = video.dataset?.bcPlaybackBlocked === "true";
+        await acknowledgeRender(payload, true, true, null, { videoReady: true });
+      } catch (error) {
+        if (isAbortError(error) || controller.signal.aborted || !stillSettling()) return;
+        // Keep the committed poster; drop the stalled decoder so a later apply
+        // or re-import starts from a clean media element.
+        disposeVideo(video);
+        video.remove?.();
+        slot.removeAttribute("data-bc-video-ready");
+        await acknowledgeRender(
+          payload,
+          true,
+          true,
+          `视频预热未完成（已保留封面）：${error instanceof Error ? error.message : String(error)}`,
+          { videoReady: false },
+        );
+      }
+    })();
+  }
+
   function scheduleBackground(payload) {
     if (!Number.isSafeInteger(payload?.generation)) return;
     // EventSource reconnects can replay the current frame while its first
@@ -1439,6 +1491,8 @@ html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;
       return;
     }
     applyController?.abort();
+    videoSettleController?.abort();
+    videoSettleController = null;
     discardCandidates();
     const controller = new AbortController();
     applyController = controller;
@@ -1489,7 +1543,9 @@ html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;
         activePayload === committedPayload &&
         renderPhase === "ready"
       ) {
-        await acknowledgeRender(committedPayload, true, true);
+        await acknowledgeRender(committedPayload, true, true, null, {
+          videoReady: mountedCurrentSlot()?.dataset.bcVideoReady === "true",
+        });
       }
     } else {
       playbackBlocked = false;
@@ -1544,7 +1600,11 @@ html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;
       // A heartbeat is observational, not a second render verdict. Playback can
       // briefly pause while Chromium changes modes or refills an 8K buffer; do
       // not downgrade an already-rendered generation or fail a pending one.
-      void acknowledgeRender(committedPayload, true, true).catch(() => {});
+      // Report the real first-frame state: a committed video that still only
+      // shows its poster must not be acked as video-ready (see settleCommittedVideo).
+      void acknowledgeRender(committedPayload, true, true, null, {
+        videoReady: slot.dataset.bcVideoReady === "true",
+      }).catch(() => {});
     }
   }, 1_000);
 })();

package/console.js

@@ -128,12 +128,15 @@ body:not([data-ds-dark-theme]) #beauticode-console-pop{background:#f3f0e9;color:
 
   function place() {
     const settings = findSettingsTrigger();
-    if (!settings || !settings.parentElement) {
+    const row = settings?.parentElement;
+    const settingsArea = row?.parentElement;
+    const footArea = settingsArea?.parentElement;
+    if (!settings || !settingsArea || !footArea) {
       if (host.parentElement) host.remove();
       return;
     }
-    if (host.parentElement !== settings.parentElement || host.nextElementSibling !== settings) {
-      settings.parentElement.insertBefore(host, settings);
+    if (host.parentElement !== footArea || host.nextElementSibling !== settingsArea) {
+      footArea.insertBefore(host, settingsArea);
     }
     host.classList.toggle("rail", settings.getBoundingClientRect().width <= 40);
     if (!pop.hidden) placePop();
@@ -252,7 +255,12 @@ body:not([data-ds-dark-theme]) #beauticode-console-pop{background:#f3f0e9;color:
       return body;
     } catch (error) {
       if (controller?.signal.aborted) {
-        throw new Error("背景操作超时，控件已恢复。原背景保持不变，请重试。");
+        // The browser only cancels its own fetch; a slow backend transaction
+        // (managed-video copy or verify) may still commit afterwards. Don't
+        // claim the previous background was preserved — report honestly.
+        throw new Error(
+          "背景操作超时，控件已恢复。操作可能仍在后台进行，请先查看当前背景状态再重试。",
+        );
       }
       throw error;
     } finally {
@@ -427,7 +435,9 @@ body:not([data-ds-dark-theme]) #beauticode-console-pop{background:#f3f0e9;color:
     event.stopPropagation();
     setOpen(false);
     if (window.BeauticodeGallery) {
-      void window.BeauticodeGallery.open();
+      window.BeauticodeGallery.open().catch((error) => {
+        showMessage(error instanceof Error ? error.message : String(error));
+      });
       return;
     }
     showMessage("皮肤中心脚本尚未加载。");

package/gallery-host.mjs

@@ -12,6 +12,9 @@ const SKIN_ID = /^skin-[a-z0-9]{8,40}$/;
 const MAX_IMAGE_BYTES = 18 * 1024 * 1024;
 const MAX_VIDEO_BYTES = 800 * 1024 * 1024;
 const INSTALL_TIMEOUT_MS = 30 * 60 * 1000;
+// Small catalog/metadata requests get a tight budget; the media download uses
+// INSTALL_TIMEOUT_MS so a large video on a slow link can still finish.
+const REQUEST_TIMEOUT_MS = 30_000;
 const LOOPBACK = new Set(["127.0.0.1", "localhost", "::1"]);
 
 export function isSafeSkinId(id) {
@@ -58,12 +61,19 @@ export function skinUrl(center, id, part = "") {
   return part ? `${origin}/api/skins/${id}/${part}` : `${origin}/api/skins/${id}`;
 }
 
-export async function downloadToFile(url, dest, { maxBytes, expectedOrigin, onProgress } = {}) {
+export async function downloadToFile(url, dest, { maxBytes, expectedOrigin, onProgress, signal } = {}) {
   const expected = new URL(url);
   if (expectedOrigin && expected.origin !== expectedOrigin) {
     throw new Error("Skin media download host mismatch.");
   }
-  const response = await fetch(url, { redirect: "follow" });
+  // Bound every media download; a stalling skin center must not leave the
+  // gallery request open forever. Callers may pass an AbortSignal to cancel
+  // early when the browser client disconnects.
+  const timeoutSignal = AbortSignal.timeout(INSTALL_TIMEOUT_MS);
+  const response = await fetch(url, {
+    redirect: "follow",
+    signal: signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal,
+  });
   if (!response.ok || !response.body) {
     throw new Error("Skin media download failed.");
   }
@@ -77,6 +87,8 @@ export async function downloadToFile(url, dest, { maxBytes, expectedOrigin, onPr
   }
   await fsp.mkdir(path.dirname(dest), { recursive: true });
   let size = 0;
+  let lastReportedAt = 0;
+  let lastReportedBytes = 0;
   const limiter = new Transform({
     transform(chunk, _enc, callback) {
       size += chunk.length;
@@ -84,12 +96,26 @@ export async function downloadToFile(url, dest, { maxBytes, expectedOrigin, onPr
         callback(new Error("Skin media download exceeded the size limit."));
         return;
       }
-      onProgress?.(size, Number.isFinite(length) ? length : 0);
+      // Throttle progress frames: one every 250 ms or every 1 MiB, whichever
+      // comes first. A chunk-level frame floods the NDJSON stream on large
+      // videos and forces a DOM write per chunk in the browser client.
+      const now = Date.now();
+      if (now - lastReportedAt >= 250 || size - lastReportedBytes >= 1024 * 1024) {
+        lastReportedAt = now;
+        lastReportedBytes = size;
+        onProgress?.(size, Number.isFinite(length) ? length : 0);
+      }
       callback(null, chunk);
     },
+    flush(callback) {
+      if (size !== lastReportedBytes) {
+        onProgress?.(size, Number.isFinite(length) ? length : 0);
+      }
+      callback();
+    },
   });
   await pipeline(Readable.fromWeb(response.body), limiter, fs.createWriteStream(dest));
-  return { bytes: size };
+  return { bytes: size, contentType: response.headers.get("content-type") ?? null };
 }
 
 function extensionOf(url, fallback) {
@@ -102,6 +128,38 @@ function extensionOf(url, fallback) {
   return fallback;
 }
 
+// Theme names are persisted via saveCurrentTheme, which rejects characters that
+// are illegal in filenames. Normalize gallery skin display names the same way
+// local filenames are normalized so a name like "Cyberpunk: Neon" still installs.
+function normalizeThemeName(value, fallback = "主题") {
+  const name = String(value ?? "")
+    .replace(/[<>:"/\\|?*]/g, " ")
+    .replace(/[\u0000-\u001f]/g, "")
+    .replace(/\s+/g, " ")
+    .trim()
+    .slice(0, 80);
+  return name || fallback;
+}
+
+// The /image endpoint is extensionless; derive the on-disk suffix from the
+// response content-type so JPEG/WebP are not mislabeled as .png (which the
+// image validator would then reject on a magic-byte mismatch).
+function extensionForContentType(contentType) {
+  const mime = String(contentType ?? "").split(";")[0].trim().toLowerCase();
+  switch (mime) {
+    case "image/jpeg":
+      return ".jpg";
+    case "image/png":
+      return ".png";
+    case "image/webp":
+      return ".webp";
+    case "image/avif":
+      return ".avif";
+    default:
+      return null;
+  }
+}
+
 export function createGalleryHandlers({ dataRoot, actions }) {
   async function importTheme(input) {
     if (typeof actions.importTheme === "function") {
@@ -143,9 +201,24 @@ export function createGalleryHandlers({ dataRoot, actions }) {
         return;
       }
       const incoming = new URL(req.url || "/", "http://127.0.0.1");
-      const target = new URL("/api/catalog", `${center}/`);
+      // Resolve relative to the center's own path so a base like
+      // https://host/beauticode keeps its prefix (skinUrl already does).
+      const target = new URL("api/catalog", `${center}/`);
       target.search = incoming.search;
-      const response = await fetch(target, { headers: { accept: "application/json" } });
+      let response;
+      try {
+        response = await fetch(target, {
+          headers: { accept: "application/json" },
+          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+      } catch (error) {
+        sendJson(res, 502, {
+          ok: false,
+          error: "无法连接皮肤中心，请稍后重试。",
+          skins: [],
+        });
+        return;
+      }
       const body = await response.json().catch(() => null);
       if (!response.ok || !body || body.ok === false) {
         sendJson(res, 422, {
@@ -192,9 +265,18 @@ export function createGalleryHandlers({ dataRoot, actions }) {
         if (!res.writableEnded) res.write(`${JSON.stringify(payload)}\n`);
       };
       const tmpDir = path.join(dataRoot, "tmp", "gallery", `${Date.now()}-${crypto.randomBytes(4).toString("hex")}`);
+      // Cancel the download when the browser client disconnects (e.g. the UI
+      // timeout aborts its fetch); otherwise a slow skin download keeps going
+      // and can still commit a background after the controls recovered.
+      const clientAbort = new AbortController();
+      const onClose = () => clientAbort.abort(new Error("客户端已断开。"));
+      res.once("close", onClose);
       try {
         write({ phase: "fetch" });
-        const metaRes = await fetch(skinUrl(center, id), { headers: { accept: "application/json" } });
+        const metaRes = await fetch(skinUrl(center, id), {
+          headers: { accept: "application/json" },
+          signal: AbortSignal.any([clientAbort.signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)]),
+        });
         const meta = await metaRes.json().catch(() => null);
         const skin = meta?.skin;
         if (!metaRes.ok || !skin || skin.status && skin.status !== "approved") {
@@ -202,13 +284,19 @@ export function createGalleryHandlers({ dataRoot, actions }) {
         }
         await fsp.mkdir(tmpDir, { recursive: true });
         const imageUrl = skinUrl(center, id, "image");
-        const imagePath = path.join(tmpDir, `image${extensionOf(imageUrl, ".png")}`);
+        const imageTmp = path.join(tmpDir, "image.download");
         write({ phase: "download", part: "image" });
-        await downloadToFile(imageUrl, imagePath, {
+        const imageDownload = await downloadToFile(imageUrl, imageTmp, {
           maxBytes: MAX_IMAGE_BYTES,
           expectedOrigin: origin,
+          signal: clientAbort.signal,
           onProgress: (done, total) => write({ phase: "download", part: "image", done, total }),
         });
+        const imagePath = path.join(
+          tmpDir,
+          `image${extensionForContentType(imageDownload.contentType) ?? extensionOf(imageUrl, ".png")}`,
+        );
+        await fsp.rename(imageTmp, imagePath);
         let videoPath;
         if (skin.type === "video") {
           const videoUrl = skinUrl(center, id, "video");
@@ -217,25 +305,34 @@ export function createGalleryHandlers({ dataRoot, actions }) {
           await downloadToFile(videoUrl, videoPath, {
             maxBytes: MAX_VIDEO_BYTES,
             expectedOrigin: origin,
+            signal: clientAbort.signal,
             onProgress: (done, total) => write({ phase: "download", part: "video", done, total }),
           });
         }
-        write({ phase: "import" });
+        // Skin-center media is downloaded into the store, so it is a managed
+        // import. importTheme applies-and-saves atomically; the media is copied
+        // before it returns, so tmpDir is safe to remove in finally.
+        write({ phase: "apply" });
+        // The apply/save step is atomic and cannot be interrupted; refuse to
+        // start it when the client already went away so a disconnected UI does
+        // not still commit and apply a background after the controls recovered.
+        if (clientAbort.signal.aborted) throw new Error("客户端已断开。");
         const imported = await importTheme({
-          name: String(skin.name || id).slice(0, 80),
+          name: normalizeThemeName(skin.name || id),
           imagePath,
           ...(videoPath ? { videoPath } : {}),
           ...(skin.effects ? { effects: skin.effects } : {}),
-          source: { kind: "skin-center", skinId: id, centerUrl: center },
+          source: "managed",
         });
-        write({ phase: "apply" });
-        const applied = await actions.useTheme(imported.theme?.id || imported.id, undefined);
-        fetch(skinUrl(center, id, "download"), { method: "POST" }).catch(() => {});
+        fetch(skinUrl(center, id, "download"), {
+          method: "POST",
+          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        }).catch(() => {});
         write({
           ok: true,
           phase: "done",
           theme: imported.theme || imported,
-          message: applied.message || `已安装并应用「${skin.name}」。`,
+          message: imported.message || `已安装并应用「${skin.name}」。`,
         });
       } catch (error) {
         write({
@@ -243,6 +340,7 @@ export function createGalleryHandlers({ dataRoot, actions }) {
           error: error instanceof Error ? error.message : String(error),
         });
       } finally {
+        res.off("close", onClose);
         await fsp.rm(tmpDir, { recursive: true, force: true }).catch(() => {});
         res.end();
       }

package/gallery.js

@@ -48,6 +48,10 @@ body:not([data-ds-dark-theme]) #beauticode-gallery .bcg-panel{background:#fff;co
   let centerUrl = "";
   let busy = false;
 
+  // Mirrors gallery-host.mjs::isSafeSkinId — catalog ids are only safe to
+  // render when they match the skin-<hex> shape the backend already validates.
+  const SKIN_ID = /^skin-[a-z0-9]{8,40}$/;
+
   function escapeText(value) {
     return String(value ?? "")
       .replaceAll("&", "&amp;")
@@ -55,6 +59,12 @@ body:not([data-ds-dark-theme]) #beauticode-gallery .bcg-panel{background:#fff;co
       .replaceAll(">", "&gt;");
   }
 
+  // Attribute context additionally needs quote escaping; escapeText alone lets
+  // a malicious catalog id break out of data-id/src and inject handlers.
+  function escapeAttr(value) {
+    return escapeText(value).replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+  }
+
   async function request(path, init) {
     const response = await fetch(path, init);
     if ((response.headers.get("content-type") || "").includes("ndjson")) {
@@ -98,36 +108,48 @@ body:not([data-ds-dark-theme]) #beauticode-gallery .bcg-panel{background:#fff;co
 
   async function load() {
     msg.textContent = "正在读取目录…";
-    const params = new URLSearchParams();
-    if (queryInput.value.trim()) params.set("q", queryInput.value.trim());
-    if (typeSelect.value) params.set("type", typeSelect.value);
-    const data = await request(`/__beauticode/ui/gallery/catalog?${params}`);
-    centerUrl = data.url || centerUrl;
-    grid.innerHTML = (data.skins || [])
-      .map(
-        (skin) =>
-          `<button type="button" class="bcg-card" data-id="${escapeText(skin.id)}">` +
-          `<img alt="" src="${escapeText(centerUrl)}/api/skins/${escapeText(skin.id)}/card">` +
-          `<span>${escapeText(skin.name)}${skin.type === "video" ? " · 视频" : ""}</span></button>`,
-      )
-      .join("");
-    msg.textContent = data.skins?.length ? "" : "目录是空的。";
-    foot.innerHTML = centerUrl
-      ? `上传与审核在 <a href="${escapeText(centerUrl)}" target="_blank" rel="noreferrer">皮肤中心网站</a>。安装会下载到本机后再应用。`
-      : "未配置皮肤中心地址。在插件的 skin-center.json 或环境变量 BEAUTICODE_SKIN_CENTER 里填入你的域名。";
+    try {
+      const params = new URLSearchParams();
+      if (queryInput.value.trim()) params.set("q", queryInput.value.trim());
+      if (typeSelect.value) params.set("type", typeSelect.value);
+      const data = await request(`/__beauticode/ui/gallery/catalog?${params}`);
+      centerUrl = data.url || centerUrl;
+      grid.innerHTML = (data.skins || [])
+        .filter((skin) => SKIN_ID.test(String(skin.id ?? "")))
+        .map(
+          (skin) =>
+            `<button type="button" class="bcg-card" data-id="${escapeAttr(skin.id)}">` +
+            `<img alt="" src="${escapeAttr(centerUrl)}/api/skins/${escapeAttr(skin.id)}/card">` +
+            `<span>${escapeText(skin.name)}${skin.type === "video" ? " · 视频" : ""}</span></button>`,
+        )
+        .join("");
+      msg.textContent = data.skins?.length ? "" : "目录是空的。";
+      foot.innerHTML = centerUrl
+        ? `上传与审核在 <a href="${escapeAttr(centerUrl)}" target="_blank" rel="noreferrer">皮肤中心网站</a>。安装会下载到本机后再应用。`
+        : "未配置皮肤中心地址。在插件的 skin-center.json 或环境变量 BEAUTICODE_SKIN_CENTER 里填入你的域名。";
+    } catch (error) {
+      grid.innerHTML = "";
+      msg.textContent = error instanceof Error ? error.message : String(error);
+    }
   }
 
   async function open() {
     host.hidden = false;
-    const config = await request("/__beauticode/ui/gallery/config");
-    centerUrl = config.url || "";
-    if (!config.enabled) {
+    try {
+      const config = await request("/__beauticode/ui/gallery/config");
+      centerUrl = config.url || "";
+      if (!config.enabled) {
+        grid.innerHTML = "";
+        msg.textContent = "尚未配置皮肤中心地址。";
+        foot.textContent = "设置 BEAUTICODE_SKIN_CENTER，或在 skin-center.json 填写站点 URL。";
+        return;
+      }
+      await load();
+    } catch (error) {
       grid.innerHTML = "";
-      msg.textContent = "尚未配置皮肤中心地址。";
-      foot.textContent = "设置 BEAUTICODE_SKIN_CENTER，或在 skin-center.json 填写站点 URL。";
-      return;
+      msg.textContent = error instanceof Error ? error.message : String(error);
+      throw error;
     }
-    await load();
   }
 
   function close() {

package/host-apply.mjs

@@ -7,8 +7,8 @@ import {
 } from "./control-client.mjs";
 import { canvasImagePath } from "./presets.mjs";
 
-const sessions = new Map();
-const DSH_VERIFY_DEADLINE_MS = 10_000;
+const sessions = new Map();
+const DSH_VERIFY_DEADLINE_MS = 10_000;
 
 export const ENGINE_MISSING_MESSAGE =
   "beautiCode 插件未能加载本机导入引擎。请执行 npx beauticode-dsh，或从完整安装目录加载桥接。";
@@ -93,7 +93,7 @@ export async function ensureInProcessSession(options) {
     const session = new adapter.DshSession({
       dataRoot,
       baseUrl,
-      verifyDeadlineMs: DSH_VERIFY_DEADLINE_MS,
+      verifyDeadlineMs: DSH_VERIFY_DEADLINE_MS,
       bundledGalleryImagePath: canvasImagePath() || undefined,
     });
     try {

package/index.mjs

@@ -1,8 +1,8 @@
 import crypto from "node:crypto";
-import fs from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
 import { registerAgentSurfaces } from "./agent.mjs";
 import { resolvePluginBaseUrl } from "./host-apply.mjs";
 import { createBeauticodeUi } from "./ui-host.mjs";
@@ -12,10 +12,10 @@ export const name = "beauticode-bridge";
 export const inject = ["webServer"];
 export const bridgeProtocol = 4;
 
-const here = path.dirname(fileURLToPath(import.meta.url));
-const TOKEN_PATTERN = /^[a-f0-9]{64}$/;
-const REVISION_PATTERN = /^[a-f0-9]{64}$/;
-const MAX_BODY_BYTES = 64 * 1024;
+const here = path.dirname(fileURLToPath(import.meta.url));
+const TOKEN_PATTERN = /^[a-f0-9]{64}$/;
+const REVISION_PATTERN = /^[a-f0-9]{64}$/;
+const MAX_BODY_BYTES = 64 * 1024;
 
 async function readBridgeIdentity() {
   try {
@@ -111,7 +111,7 @@ function isSameOrigin(req) {
   return req.headers["sec-fetch-site"] === "same-origin";
 }
 
-function validLoopbackMediaUrl(value) {
+function validLoopbackMediaUrl(value) {
   if (typeof value !== "string") return false;
   try {
     const url = new URL(value);
@@ -123,9 +123,9 @@ function validLoopbackMediaUrl(value) {
   } catch {
     return false;
   }
-}
-
-function validApplyPayload(body) {
+}
+
+function validApplyPayload(body) {
   if (!Number.isSafeInteger(body.generation) || body.generation < 0) return false;
   if (!["image", "video", "clear"].includes(body.media)) return false;
   if (body.atmosphere != null && !normalizeAtmosphere(body.atmosphere)) return false;
@@ -173,12 +173,22 @@ function publicStatus(current, modes, clients, clientStates) {
   const failedAcks = activeAcks.filter(
     (ack) => ack.ok === false && typeof ack.error === "string" && ack.error,
   );
+  const readyAcks = activeAcks.filter((ack) => ack.ok === true);
+  // Poster-first video commits ack ok while the first frame still settles.
+  const videoPendingAcks = readyAcks.filter(
+    (ack) => ack.media === "video" && ack.videoReady === false,
+  );
   return {
     ok: true,
     connectedClients: clients.size,
     current,
-    readyClients: activeAcks.filter((ack) => ack.ok === true).length,
+    readyClients: readyAcks.length,
     failedClients: failedAcks.length,
+    videoReadyClients: readyAcks.length - videoPendingAcks.length,
+    videoPendingClients: videoPendingAcks.length,
+    lastVideoError:
+      videoPendingAcks.find((ack) => typeof ack.error === "string" && ack.error)?.error ??
+      null,
     lastRenderError:
       failedAcks.find((ack) => typeof ack.error === "string" && ack.error)?.error ??
       null,
@@ -192,10 +202,10 @@ function publicStatus(current, modes, clients, clientStates) {
 }
 
 export function apply(ctx, config = {}) {
-  const tokenFile = path.resolve(config.tokenFile || defaultTokenFile());
-  const clients = new Map();
-  const clientStates = new Map();
-  let current = null;
+  const tokenFile = path.resolve(config.tokenFile || defaultTokenFile());
+  const clients = new Map();
+  const clientStates = new Map();
+  let current = null;
   const modes = { fish: false, muted: true, tone: "auto" };
   const dataRoot = path.dirname(tokenFile);
   const baseUrl = resolvePluginBaseUrl(ctx);
@@ -308,9 +318,9 @@ export function apply(ctx, config = {}) {
           res.end(req.method === "HEAD" ? undefined : source);
         },
       }),
-      ctx.webServer.register({
-        kind: "exact",
-        path: "/__beauticode/client.js",
+      ctx.webServer.register({
+        kind: "exact",
+        path: "/__beauticode/client.js",
         handler: async (req, res) => {
           if (req.method !== "GET" && req.method !== "HEAD") {
             res.writeHead(405).end();
@@ -322,10 +332,10 @@ export function apply(ctx, config = {}) {
             "cache-control": "no-store",
             "content-length": source.length,
           });
-          res.end(req.method === "HEAD" ? undefined : source);
-        },
-      }),
-      ctx.webServer.register({
+          res.end(req.method === "HEAD" ? undefined : source);
+        },
+      }),
+      ctx.webServer.register({
         kind: "exact",
         path: "/__beauticode/gallery.js",
         handler: async (req, res) => {
@@ -442,8 +452,8 @@ export function apply(ctx, config = {}) {
           clients.get(clientId)?.destroy();
           clients.set(clientId, res);
           clientStates.set(clientId, { render: null, mode: null });
-          if (current) {
-            res.write(`data: ${JSON.stringify({ type: "apply", ...current })}\n\n`);
+          if (current) {
+            res.write(`data: ${JSON.stringify({ type: "apply", ...current })}\n\n`);
           }
           res.write(`data: ${JSON.stringify({ type: "mode", ...modes })}\n\n`);
           ui.scheduleRestore();
@@ -472,18 +482,18 @@ export function apply(ctx, config = {}) {
             sendJson(res, 400, { ok: false, error: "背景载荷无效。" });
             return;
           }
-          current = {
-            generation: body.generation,
-            media: body.media,
-            imageUrl: body.media === "clear" ? null : body.imageUrl,
-            videoUrl: body.media === "video" ? body.videoUrl : null,
-            startAt: body.media === "video" ? body.startAt ?? null : null,
-          };
-          const atmosphere = normalizeAtmosphere(body.atmosphere);
-          if (atmosphere) current.atmosphere = atmosphere;
-          if (body.media === "clear") modes.fish = false;
-          for (const state of clientStates.values()) state.render = null;
-          broadcast({ type: "apply", ...current });
+          current = {
+            generation: body.generation,
+            media: body.media,
+            imageUrl: body.media === "clear" ? null : body.imageUrl,
+            videoUrl: body.media === "video" ? body.videoUrl : null,
+            startAt: body.media === "video" ? body.startAt ?? null : null,
+          };
+          const atmosphere = normalizeAtmosphere(body.atmosphere);
+          if (atmosphere) current.atmosphere = atmosphere;
+          if (body.media === "clear") modes.fish = false;
+          for (const state of clientStates.values()) state.render = null;
+          broadcast({ type: "apply", ...current });
           if (body.media === "clear") broadcast({ type: "mode", ...modes });
           sendJson(res, 200, { ok: true });
         },
@@ -555,7 +565,8 @@ export function apply(ctx, config = {}) {
               body.generation !== current.generation ||
               body.media !== current.media ||
               typeof body.ok !== "boolean" ||
-              typeof body.visible !== "boolean"
+              typeof body.visible !== "boolean" ||
+              (body.videoReady != null && typeof body.videoReady !== "boolean")
             ) {
               sendJson(res, 400, { ok: false, error: "渲染回执无效。" });
               return;
@@ -587,6 +598,9 @@ export function apply(ctx, config = {}) {
               ok: body.ok,
               visible: body.visible,
               error: typeof body.error === "string" ? body.error.slice(0, 300) : null,
+              // Poster-first commits ack ok with videoReady=false while the
+              // first frame still settles; absent means a legacy ready client.
+              videoReady: body.media !== "video" || body.videoReady !== false,
               playback,
             };
           } else if (body.kind === "mode") {
@@ -621,10 +635,10 @@ export function apply(ctx, config = {}) {
     return () => {
       disposeTap();
       for (const dispose of disposers) dispose();
-      for (const response of clients.values()) response.destroy();
-      clients.clear();
-      clientStates.clear();
-      void ui.dispose();
+      for (const response of clients.values()) response.destroy();
+      clients.clear();
+      clientStates.clear();
+      void ui.dispose();
     };
   }, "beauticode-bridge: routes and browser injection");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "beauticode-dsh",
-  "version": "1.0.21",
+  "version": "1.0.23",
   "description": "Cordis plugin: image/video backgrounds for DeepSeek Harness web.",
   "type": "module",
   "main": "./index.mjs",

package/themes/internal-beyond/NOTICE.md

@@ -1,9 +1,9 @@
-# Internal / Infernal atmosphere assets
-
-`bg-internal.jpg`, `bg-infernal.jpg`, `bg-canvas.png`, and the local
-`bg-canvas-4k.png` (Real-ESRGAN 4x then 3840×2160) are visual materials
-from [Internal Beyond](https://github.com/Sui-IB/InternalBeyond) by Sui.
-
-They remain under that project's CC BY-NC-SA 4.0 terms for visual assets.
-BeautiCode ships them as bundled workspace themes for local, non-commercial use.
-The project name, logo, and character identity are not licensed here.
+# Internal / Infernal atmosphere assets
+
+`bg-internal.jpg`, `bg-infernal.jpg`, `bg-canvas.png`, and the local
+`bg-canvas-4k.png` (Real-ESRGAN 4x then 3840×2160) are visual materials
+from [Internal Beyond](https://github.com/Sui-IB/InternalBeyond) by Sui.
+
+They remain under that project's CC BY-NC-SA 4.0 terms for visual assets.
+BeautiCode ships them as bundled workspace themes for local, non-commercial use.
+The project name, logo, and character identity are not licensed here.

package/ui-host.mjs

@@ -20,6 +20,10 @@ const NATIVE_PICKER_UNAVAILABLE = "native_picker_unavailable";
 const NATIVE_PICKER_REQUIRED = "native_picker_required";
 const PICKER_REQUEST_ABORTED = "picker_request_aborted";
 const IMPORT_TIMING_LOG = "import-timing.jsonl";
+// /reapply runs a full apply transaction (import + stage + verify + commit),
+// which has no total deadline of its own; give it headroom beyond the 30s that
+// the two-verify video path can already approach (~26s).
+const REAPPLY_TIMEOUT_MS = 60_000;
 
 function elapsedMs(startedAt) {
   return Math.round((performance.now() - startedAt) * 10) / 10;
@@ -369,7 +373,7 @@ export function createBeauticodeUi({
         method: "POST",
         path: "/reapply",
         body: {},
-        timeoutMs: 30_000,
+        timeoutMs: REAPPLY_TIMEOUT_MS,
       });
     }
     if (!(await canReachBridge(options.baseUrl))) return;
@@ -379,7 +383,7 @@ export function createBeauticodeUi({
         method: "POST",
         path: "/reapply",
         body: {},
-        timeoutMs: 30_000,
+        timeoutMs: REAPPLY_TIMEOUT_MS,
       });
     }
     return resolved.session.reapply();

package/vendor/adapter-dsh/session.js

@@ -145,7 +145,33 @@ export class DshSession {
             const result = await tx.run(input, themeName
                 ? {
                     beforeFinalize: async () => {
-                        saved.theme = await this.store.saveCurrentTheme(themeName);
+                        // Persist the initial seek so a restore before the periodic
+                        // progress writer runs still resumes at the requested position.
+                        let videoPositionSec = null;
+                        if (input.type === "video") {
+                            if (this.host) {
+                                try {
+                                    const position = await this.host.getPlaybackPosition();
+                                    if (position.ok &&
+                                        position.hasVideo &&
+                                        Number.isFinite(position.currentTime)) {
+                                        videoPositionSec = position.currentTime;
+                                    }
+                                }
+                                catch {
+                                    /* fall back to input.startAt below */
+                                }
+                            }
+                            const startAt = typeof input.startAt === "number" && Number.isFinite(input.startAt)
+                                ? input.startAt
+                                : null;
+                            if (videoPositionSec == null && startAt != null) {
+                                videoPositionSec = Math.max(0, startAt);
+                            }
+                        }
+                        saved.theme = await this.store.saveCurrentTheme(themeName, {
+                            ...(videoPositionSec != null ? { videoPositionSec } : {}),
+                        });
                     },
                     onRollback: async () => {
                         if (saved.theme) {
@@ -155,7 +181,10 @@ export class DshSession {
                 }
                 : undefined);
             if (result.ok) {
-                this.activeThemeId = saved.theme?.type === "video" ? saved.theme.id : null;
+                // Retain the saved theme id for image themes too: status.themeId marks
+                // the current selection in the console, and video-position tracking is
+                // already gated on hasVideo / "Not a video theme" downstream.
+                this.activeThemeId = saved.theme?.id ?? null;
                 this.lastProgressWriteSec = -1;
                 if (input.type === "clear") {
                     this.fishMode = false;
@@ -297,6 +326,7 @@ export class DshSession {
             fish: this.fishMode,
             muted: this.videoMuted,
             tone: this.backgroundTone,
+            themeId: this.activeThemeId,
         };
     }
     async saveCurrentTheme(name) {
@@ -313,13 +343,8 @@ export class DshSession {
             }
         }
         const theme = await this.store.saveCurrentTheme(name, { videoPositionSec });
-        if (theme.type === "video") {
-            this.activeThemeId = theme.id;
-            this.lastProgressWriteSec = -1;
-        }
-        else {
-            this.activeThemeId = null;
-        }
+        this.activeThemeId = theme.id;
+        this.lastProgressWriteSec = -1;
         return theme;
     }
     async listSavedThemes() {
@@ -338,7 +363,7 @@ export class DshSession {
             const saved = await this.store.loadSavedTheme(themeId);
             const result = await this.apply(saved.input);
             if (result.ok) {
-                this.activeThemeId = saved.input.type === "video" ? saved.themeId : null;
+                this.activeThemeId = saved.themeId;
                 this.lastProgressWriteSec = -1;
             }
             return result;

package/vendor/core/apply-transaction.js

@@ -1,6 +1,6 @@
 import fs from "node:fs/promises";
 import path from "node:path";
-import { MAX_INLINE_DATA_URL_BYTES } from "./constants.js";
+import { MAX_INLINE_DATA_URL_BYTES, MAX_VIDEO_POSTER_INLINE_BYTES, } from "./constants.js";
 import { isLocalBackgroundSource, resolveBackgroundImagePath, resolveBackgroundVideoPath, } from "./media-source.js";
 import { detectImageMime } from "./media-validation.js";
 // Cold-first-access symptoms reported by the renderer while the OS is still
@@ -286,7 +286,13 @@ export async function buildHostApplyPayload(store, manifest, staged, cssText, vi
     const imagePath = resolveBackgroundImagePath(store.paths.activeDir, manifest.background);
     if (!imagePath)
         throw new Error("Background has no image source.");
-    const imageDataUrl = opts.includeImageDataUrl === false ? null : await fileToDataUrl(imagePath);
+    const imageStat = await fs.stat(imagePath).catch(() => null);
+    const skipInlinePoster = manifest.background.type === "video" &&
+        imageStat != null &&
+        imageStat.size > MAX_VIDEO_POSTER_INLINE_BYTES;
+    const imageDataUrl = opts.includeImageDataUrl === false || skipInlinePoster
+        ? null
+        : await fileToDataUrl(imagePath);
     const imageUrl = staged?.image?.srcUrl ?? null;
     if (manifest.background.type === "image") {
         return {

package/vendor/core/constants.js

@@ -9,6 +9,11 @@ export const MAX_VIDEO_BYTES = 800 * 1024 * 1024;
  * Keep this equal to MAX_IMAGE_BYTES so every accepted image can publish.
  */
 export const MAX_INLINE_DATA_URL_BYTES = MAX_IMAGE_BYTES;
+/**
+ * Keep a large video poster out of the Codex Runtime.evaluate payload.
+ * The first decoded video frame replaces the poster after the blob attaches.
+ */
+export const MAX_VIDEO_POSTER_INLINE_BYTES = 1024 * 1024;
 export const COMMIT_MARKER_NAME = ".beauticode-commit-in-progress";
 export const COMMIT_MARKER_STALE_MS = 120_000;
 export const MEDIA_TOKEN_HEADER = "x-beauticode-media-token";

package/vendor/core/index.js

@@ -10,4 +10,5 @@ export * from "./error-message.js";
 export * from "./background-store.js";
 export * from "./bundled-gallery.js";
 export * from "./apply-transaction.js";
+export * from "./process-liveness.js";
 //# sourceMappingURL=index.js.map

package/vendor/core/media-source.js

@@ -1,8 +1,10 @@
 import path from "node:path";
+import { assertSafeBasename } from "./media-validation.js";
 /** Resolve a manifest source against the directory that owns managed files. */
 export function resolveMediaSource(source, ownerDir) {
     if (source.kind === "local")
         return path.resolve(source.path);
+    assertSafeBasename(source.file, "background.source.file");
     return path.join(ownerDir, source.file);
 }
 /** Resolve the primary image source, including legacy v1 manifests. */

package/vendor/core/process-liveness.js

@@ -0,0 +1,81 @@
+import { execFile } from "node:child_process";
+/**
+ * How close a process's actual start time must be to the recorded start time
+ * before we treat them as the same process. PID reuse yields a completely
+ * different start time, so a generous window is safe while still rejecting
+ * recycled PIDs.
+ */
+const START_TIME_TOLERANCE_MS = 30_000;
+/**
+ * True when `pid` refers to a process that still exists. Mirrors the PID check
+ * callers perform before consulting a recorded process identity.
+ */
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return (Boolean(error) &&
+            typeof error === "object" &&
+            error.code === "EPERM");
+    }
+}
+/**
+ * Resolve the actual process start time as an epoch millisecond value.
+ * Returns null when the process does not exist or the platform helper fails.
+ */
+function processStartTimeMs(pid) {
+    return new Promise((resolve) => {
+        if (process.platform === "win32") {
+            const script = `(Get-Process -Id ${pid}).StartTime.ToUniversalTime().ToString('o')`;
+            execFile("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { timeout: 3_000, windowsHide: true }, (error, stdout) => {
+                if (error)
+                    return resolve(null);
+                const value = Date.parse(String(stdout).trim());
+                resolve(Number.isFinite(value) ? value : null);
+            });
+            return;
+        }
+        // Linux / macOS: ps -o lstart= prints the start time in local time with no
+        // timezone suffix, which Date.parse interprets as the host's local time.
+        execFile("ps", ["-o", "lstart=", "-p", String(pid)], { timeout: 3_000 }, (error, stdout) => {
+            if (error)
+                return resolve(null);
+            const value = Date.parse(String(stdout).trim());
+            resolve(Number.isFinite(value) ? value : null);
+        });
+    });
+}
+/**
+ * True when `pid` is alive AND its real start time matches `recordedIso` (the
+ * startedAt value a control/claim file captured when the process launched).
+ *
+ * Falls back to optimistic `true` when there is no recorded timestamp or the
+ * platform helper is unavailable, so an unverifiable check never marks a live
+ * tray/session as dead. Returns `false` when the PID no longer exists or its
+ * start time clearly differs (PID reuse).
+ */
+export async function isRecordedPidLive(pid, recordedIso) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    if (!isPidAlive(pid))
+        return false;
+    if (typeof recordedIso !== "string" || !recordedIso)
+        return true;
+    const recordedMs = Date.parse(recordedIso);
+    if (!Number.isFinite(recordedMs))
+        return true;
+    let actualMs;
+    try {
+        actualMs = await processStartTimeMs(pid);
+    }
+    catch {
+        actualMs = null;
+    }
+    // No helper result means "cannot verify" — keep the optimistic PID check.
+    if (actualMs == null)
+        return true;
+    return Math.abs(actualMs - recordedMs) <= START_TIME_TOLERANCE_MS;
+}
+//# sourceMappingURL=process-liveness.js.map