beauticode-dsh 1.0.22 → 1.0.23

package/agent.mjs

@@ -124,6 +124,23 @@ function unwrapApply(result, fallbackMode, message) {
   };
 }
 
+// The raw manifest exposes a local source's absolute on-disk path. The status
+// tool result is surfaced to the model, so only forward a safe summary.
+function sanitizeBackground(background) {
+  if (!background) return null;
+  const safe = {
+    type: background.type,
+    ...(background.effects ? { effects: background.effects } : {}),
+  };
+  if (background.source) {
+    safe.source =
+      background.source.kind === "local"
+        ? { kind: "local" }
+        : { kind: "managed", file: background.source.file };
+  }
+  return safe;
+}
+
 function presentStatus(status) {
   const background = status.manifest?.background ?? status.background ?? null;
   return {
@@ -133,7 +150,7 @@ function presentStatus(status) {
     fish: status.fish === true,
     muted: status.muted !== false,
     tone: status.tone ?? "dark",
-    background,
+    background: sanitizeBackground(background),
     sourceMode: background
       ? background.source?.kind === "local"
         ? "local"
@@ -350,33 +367,36 @@ export function createBeauticodeActions(dataRootOrOptions) {
       const name = String(input?.name ?? "").trim();
       const imagePath = String(input?.imagePath ?? "").trim();
       if (!name || !imagePath) fail("导入皮肤必须提供名称和图片。");
-      const body = {
-        name,
-        imagePath,
-      };
-      if (typeof input.videoPath === "string" && input.videoPath.trim()) {
-        body.videoPath = input.videoPath.trim();
-      }
-      if (input.effects) body.effects = input.effects;
-      if (input.source) body.source = input.source;
+      const source = input?.source === "managed" ? "managed" : "local";
+      const hasVideo = typeof input.videoPath === "string" && Boolean(input.videoPath.trim());
+      const themeInput = hasVideo
+        ? {
+            type: "video",
+            videoPath: input.videoPath.trim(),
+            imagePath,
+            source,
+          }
+        : { type: "image", imagePath, source };
+      if (!hasVideo && input.effects) themeInput.effects = input.effects;
       const resolved = await backend();
-      if (resolved.kind === "tray") {
-        const result = await request({
-          method: "POST",
-          path: "/theme/import",
-          body,
-          signal,
-          timeoutMs: 30 * 60 * 1000,
-        });
-        if (!result || result.ok === false) fail(result?.error || "导入皮肤失败。");
-        return {
-          ok: true,
-          theme: result.theme,
-          message: `已保存皮肤「${result.theme.name}」。`,
-        };
-      }
-      const theme = await resolved.session.importSavedTheme(body);
-      return { ok: true, theme, message: `已保存皮肤「${theme.name}」。` };
+      // Gallery import applies-and-saves through the same atomic transaction as
+      // the normal image/video flow. There is no separate import-only endpoint:
+      // the tray exposes /theme/apply and DshSession exposes applyAndSaveTheme.
+      const result =
+        resolved.kind === "tray"
+          ? await request({
+              method: "POST",
+              path: "/theme/apply",
+              body: { name, input: themeInput },
+              signal,
+              timeoutMs: 30 * 60 * 1000,
+            })
+          : await resolved.session.applyAndSaveTheme(themeInput, name);
+      return unwrapApplyResult(
+        result,
+        hasVideo ? "video" : "image",
+        `已保存皮肤「${name}」。`,
+      );
     },
 
     async listThemes(signal) {

package/atmosphere.js

@@ -1,4 +1,4 @@
-(() => {
+(() => {
   "use strict";
 
   const STYLE_ID = "beauticode-atmosphere-style";
@@ -92,8 +92,8 @@ html[data-bc-resolved-tone="light"][data-bc-gallery="true"] body{
 }
 html[data-bc-gallery="true"] #root{position:relative;z-index:1;background:transparent!important}
 html[data-bc-gallery="true"] [class*="_fade"]{display:none!important}
-html[data-bc-gallery="true"] #beauticode-bg-stage img,
-html[data-bc-gallery="true"] #beauticode-bg-stage video{opacity:0!important}
+html[data-bc-gallery="true"] #beauticode-bg-stage img,
+html[data-bc-gallery="true"] #beauticode-bg-stage video{opacity:0!important}
 html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;pointer-events:none!important}
 `;
     return style;

package/cli.js

@@ -298,14 +298,26 @@ async function sameLinkTarget(link, dest) {
   return false;
 }
 
+// A dangling symlink has a live directory entry even though fs.existsSync
+// (which follows the link) reports false. Use lstat so leftover plugin links
+// are detected and cleaned instead of making fsp.symlink fail with EEXIST.
+async function entryExists(p) {
+  try {
+    await fsp.lstat(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 async function linkPluginIntoProfile(webProfile, dest) {
   const link = pluginLinkPath(webProfile);
   const legacy = legacyPluginLinkPath(webProfile);
-  if (fs.existsSync(legacy)) {
+  if (await entryExists(legacy)) {
     await fsp.rm(legacy, { recursive: true, force: true });
   }
   await fsp.mkdir(path.dirname(link), { recursive: true });
-  if (fs.existsSync(link)) {
+  if (await entryExists(link)) {
     if (await sameLinkTarget(link, dest)) return;
     await fsp.rm(link, { recursive: true, force: true });
   }
@@ -403,7 +415,7 @@ async function uninstall(opts) {
     removed.push("web package.json");
   }
   for (const link of [pluginLinkPath(webProfile), legacyPluginLinkPath(webProfile)]) {
-    if (fs.existsSync(link)) {
+    if (await entryExists(link)) {
       await fsp.rm(link, { recursive: true, force: true });
       removed.push(link);
     }

package/client.js

@@ -1543,7 +1543,9 @@ html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;
         activePayload === committedPayload &&
         renderPhase === "ready"
       ) {
-        await acknowledgeRender(committedPayload, true, true);
+        await acknowledgeRender(committedPayload, true, true, null, {
+          videoReady: mountedCurrentSlot()?.dataset.bcVideoReady === "true",
+        });
       }
     } else {
       playbackBlocked = false;
@@ -1598,7 +1600,11 @@ html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;
       // A heartbeat is observational, not a second render verdict. Playback can
       // briefly pause while Chromium changes modes or refills an 8K buffer; do
       // not downgrade an already-rendered generation or fail a pending one.
-      void acknowledgeRender(committedPayload, true, true).catch(() => {});
+      // Report the real first-frame state: a committed video that still only
+      // shows its poster must not be acked as video-ready (see settleCommittedVideo).
+      void acknowledgeRender(committedPayload, true, true, null, {
+        videoReady: slot.dataset.bcVideoReady === "true",
+      }).catch(() => {});
     }
   }, 1_000);
 })();

package/console.js

@@ -128,12 +128,15 @@ body:not([data-ds-dark-theme]) #beauticode-console-pop{background:#f3f0e9;color:
 
   function place() {
     const settings = findSettingsTrigger();
-    if (!settings || !settings.parentElement) {
+    const row = settings?.parentElement;
+    const settingsArea = row?.parentElement;
+    const footArea = settingsArea?.parentElement;
+    if (!settings || !settingsArea || !footArea) {
       if (host.parentElement) host.remove();
       return;
     }
-    if (host.parentElement !== settings.parentElement || host.nextElementSibling !== settings) {
-      settings.parentElement.insertBefore(host, settings);
+    if (host.parentElement !== footArea || host.nextElementSibling !== settingsArea) {
+      footArea.insertBefore(host, settingsArea);
     }
     host.classList.toggle("rail", settings.getBoundingClientRect().width <= 40);
     if (!pop.hidden) placePop();
@@ -252,7 +255,12 @@ body:not([data-ds-dark-theme]) #beauticode-console-pop{background:#f3f0e9;color:
       return body;
     } catch (error) {
       if (controller?.signal.aborted) {
-        throw new Error("背景操作超时，控件已恢复。原背景保持不变，请重试。");
+        // The browser only cancels its own fetch; a slow backend transaction
+        // (managed-video copy or verify) may still commit afterwards. Don't
+        // claim the previous background was preserved — report honestly.
+        throw new Error(
+          "背景操作超时，控件已恢复。操作可能仍在后台进行，请先查看当前背景状态再重试。",
+        );
       }
       throw error;
     } finally {
@@ -427,7 +435,9 @@ body:not([data-ds-dark-theme]) #beauticode-console-pop{background:#f3f0e9;color:
     event.stopPropagation();
     setOpen(false);
     if (window.BeauticodeGallery) {
-      void window.BeauticodeGallery.open();
+      window.BeauticodeGallery.open().catch((error) => {
+        showMessage(error instanceof Error ? error.message : String(error));
+      });
       return;
     }
     showMessage("皮肤中心脚本尚未加载。");

package/gallery-host.mjs

@@ -12,6 +12,9 @@ const SKIN_ID = /^skin-[a-z0-9]{8,40}$/;
 const MAX_IMAGE_BYTES = 18 * 1024 * 1024;
 const MAX_VIDEO_BYTES = 800 * 1024 * 1024;
 const INSTALL_TIMEOUT_MS = 30 * 60 * 1000;
+// Small catalog/metadata requests get a tight budget; the media download uses
+// INSTALL_TIMEOUT_MS so a large video on a slow link can still finish.
+const REQUEST_TIMEOUT_MS = 30_000;
 const LOOPBACK = new Set(["127.0.0.1", "localhost", "::1"]);
 
 export function isSafeSkinId(id) {
@@ -58,12 +61,19 @@ export function skinUrl(center, id, part = "") {
   return part ? `${origin}/api/skins/${id}/${part}` : `${origin}/api/skins/${id}`;
 }
 
-export async function downloadToFile(url, dest, { maxBytes, expectedOrigin, onProgress } = {}) {
+export async function downloadToFile(url, dest, { maxBytes, expectedOrigin, onProgress, signal } = {}) {
   const expected = new URL(url);
   if (expectedOrigin && expected.origin !== expectedOrigin) {
     throw new Error("Skin media download host mismatch.");
   }
-  const response = await fetch(url, { redirect: "follow" });
+  // Bound every media download; a stalling skin center must not leave the
+  // gallery request open forever. Callers may pass an AbortSignal to cancel
+  // early when the browser client disconnects.
+  const timeoutSignal = AbortSignal.timeout(INSTALL_TIMEOUT_MS);
+  const response = await fetch(url, {
+    redirect: "follow",
+    signal: signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal,
+  });
   if (!response.ok || !response.body) {
     throw new Error("Skin media download failed.");
   }
@@ -77,6 +87,8 @@ export async function downloadToFile(url, dest, { maxBytes, expectedOrigin, onPr
   }
   await fsp.mkdir(path.dirname(dest), { recursive: true });
   let size = 0;
+  let lastReportedAt = 0;
+  let lastReportedBytes = 0;
   const limiter = new Transform({
     transform(chunk, _enc, callback) {
       size += chunk.length;
@@ -84,12 +96,26 @@ export async function downloadToFile(url, dest, { maxBytes, expectedOrigin, onPr
         callback(new Error("Skin media download exceeded the size limit."));
         return;
       }
-      onProgress?.(size, Number.isFinite(length) ? length : 0);
+      // Throttle progress frames: one every 250 ms or every 1 MiB, whichever
+      // comes first. A chunk-level frame floods the NDJSON stream on large
+      // videos and forces a DOM write per chunk in the browser client.
+      const now = Date.now();
+      if (now - lastReportedAt >= 250 || size - lastReportedBytes >= 1024 * 1024) {
+        lastReportedAt = now;
+        lastReportedBytes = size;
+        onProgress?.(size, Number.isFinite(length) ? length : 0);
+      }
       callback(null, chunk);
     },
+    flush(callback) {
+      if (size !== lastReportedBytes) {
+        onProgress?.(size, Number.isFinite(length) ? length : 0);
+      }
+      callback();
+    },
   });
   await pipeline(Readable.fromWeb(response.body), limiter, fs.createWriteStream(dest));
-  return { bytes: size };
+  return { bytes: size, contentType: response.headers.get("content-type") ?? null };
 }
 
 function extensionOf(url, fallback) {
@@ -102,6 +128,38 @@ function extensionOf(url, fallback) {
   return fallback;
 }
 
+// Theme names are persisted via saveCurrentTheme, which rejects characters that
+// are illegal in filenames. Normalize gallery skin display names the same way
+// local filenames are normalized so a name like "Cyberpunk: Neon" still installs.
+function normalizeThemeName(value, fallback = "主题") {
+  const name = String(value ?? "")
+    .replace(/[<>:"/\\|?*]/g, " ")
+    .replace(/[\u0000-\u001f]/g, "")
+    .replace(/\s+/g, " ")
+    .trim()
+    .slice(0, 80);
+  return name || fallback;
+}
+
+// The /image endpoint is extensionless; derive the on-disk suffix from the
+// response content-type so JPEG/WebP are not mislabeled as .png (which the
+// image validator would then reject on a magic-byte mismatch).
+function extensionForContentType(contentType) {
+  const mime = String(contentType ?? "").split(";")[0].trim().toLowerCase();
+  switch (mime) {
+    case "image/jpeg":
+      return ".jpg";
+    case "image/png":
+      return ".png";
+    case "image/webp":
+      return ".webp";
+    case "image/avif":
+      return ".avif";
+    default:
+      return null;
+  }
+}
+
 export function createGalleryHandlers({ dataRoot, actions }) {
   async function importTheme(input) {
     if (typeof actions.importTheme === "function") {
@@ -143,9 +201,24 @@ export function createGalleryHandlers({ dataRoot, actions }) {
         return;
       }
       const incoming = new URL(req.url || "/", "http://127.0.0.1");
-      const target = new URL("/api/catalog", `${center}/`);
+      // Resolve relative to the center's own path so a base like
+      // https://host/beauticode keeps its prefix (skinUrl already does).
+      const target = new URL("api/catalog", `${center}/`);
       target.search = incoming.search;
-      const response = await fetch(target, { headers: { accept: "application/json" } });
+      let response;
+      try {
+        response = await fetch(target, {
+          headers: { accept: "application/json" },
+          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+      } catch (error) {
+        sendJson(res, 502, {
+          ok: false,
+          error: "无法连接皮肤中心，请稍后重试。",
+          skins: [],
+        });
+        return;
+      }
       const body = await response.json().catch(() => null);
       if (!response.ok || !body || body.ok === false) {
         sendJson(res, 422, {
@@ -192,9 +265,18 @@ export function createGalleryHandlers({ dataRoot, actions }) {
         if (!res.writableEnded) res.write(`${JSON.stringify(payload)}\n`);
       };
       const tmpDir = path.join(dataRoot, "tmp", "gallery", `${Date.now()}-${crypto.randomBytes(4).toString("hex")}`);
+      // Cancel the download when the browser client disconnects (e.g. the UI
+      // timeout aborts its fetch); otherwise a slow skin download keeps going
+      // and can still commit a background after the controls recovered.
+      const clientAbort = new AbortController();
+      const onClose = () => clientAbort.abort(new Error("客户端已断开。"));
+      res.once("close", onClose);
       try {
         write({ phase: "fetch" });
-        const metaRes = await fetch(skinUrl(center, id), { headers: { accept: "application/json" } });
+        const metaRes = await fetch(skinUrl(center, id), {
+          headers: { accept: "application/json" },
+          signal: AbortSignal.any([clientAbort.signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)]),
+        });
         const meta = await metaRes.json().catch(() => null);
         const skin = meta?.skin;
         if (!metaRes.ok || !skin || skin.status && skin.status !== "approved") {
@@ -202,13 +284,19 @@ export function createGalleryHandlers({ dataRoot, actions }) {
         }
         await fsp.mkdir(tmpDir, { recursive: true });
         const imageUrl = skinUrl(center, id, "image");
-        const imagePath = path.join(tmpDir, `image${extensionOf(imageUrl, ".png")}`);
+        const imageTmp = path.join(tmpDir, "image.download");
         write({ phase: "download", part: "image" });
-        await downloadToFile(imageUrl, imagePath, {
+        const imageDownload = await downloadToFile(imageUrl, imageTmp, {
           maxBytes: MAX_IMAGE_BYTES,
           expectedOrigin: origin,
+          signal: clientAbort.signal,
           onProgress: (done, total) => write({ phase: "download", part: "image", done, total }),
         });
+        const imagePath = path.join(
+          tmpDir,
+          `image${extensionForContentType(imageDownload.contentType) ?? extensionOf(imageUrl, ".png")}`,
+        );
+        await fsp.rename(imageTmp, imagePath);
         let videoPath;
         if (skin.type === "video") {
           const videoUrl = skinUrl(center, id, "video");
@@ -217,25 +305,34 @@ export function createGalleryHandlers({ dataRoot, actions }) {
           await downloadToFile(videoUrl, videoPath, {
             maxBytes: MAX_VIDEO_BYTES,
             expectedOrigin: origin,
+            signal: clientAbort.signal,
             onProgress: (done, total) => write({ phase: "download", part: "video", done, total }),
           });
         }
-        write({ phase: "import" });
+        // Skin-center media is downloaded into the store, so it is a managed
+        // import. importTheme applies-and-saves atomically; the media is copied
+        // before it returns, so tmpDir is safe to remove in finally.
+        write({ phase: "apply" });
+        // The apply/save step is atomic and cannot be interrupted; refuse to
+        // start it when the client already went away so a disconnected UI does
+        // not still commit and apply a background after the controls recovered.
+        if (clientAbort.signal.aborted) throw new Error("客户端已断开。");
         const imported = await importTheme({
-          name: String(skin.name || id).slice(0, 80),
+          name: normalizeThemeName(skin.name || id),
           imagePath,
           ...(videoPath ? { videoPath } : {}),
           ...(skin.effects ? { effects: skin.effects } : {}),
-          source: { kind: "skin-center", skinId: id, centerUrl: center },
+          source: "managed",
         });
-        write({ phase: "apply" });
-        const applied = await actions.useTheme(imported.theme?.id || imported.id, undefined);
-        fetch(skinUrl(center, id, "download"), { method: "POST" }).catch(() => {});
+        fetch(skinUrl(center, id, "download"), {
+          method: "POST",
+          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        }).catch(() => {});
         write({
           ok: true,
           phase: "done",
           theme: imported.theme || imported,
-          message: applied.message || `已安装并应用「${skin.name}」。`,
+          message: imported.message || `已安装并应用「${skin.name}」。`,
         });
       } catch (error) {
         write({
@@ -243,6 +340,7 @@ export function createGalleryHandlers({ dataRoot, actions }) {
           error: error instanceof Error ? error.message : String(error),
         });
       } finally {
+        res.off("close", onClose);
         await fsp.rm(tmpDir, { recursive: true, force: true }).catch(() => {});
         res.end();
       }

package/gallery.js

@@ -48,6 +48,10 @@ body:not([data-ds-dark-theme]) #beauticode-gallery .bcg-panel{background:#fff;co
   let centerUrl = "";
   let busy = false;
 
+  // Mirrors gallery-host.mjs::isSafeSkinId — catalog ids are only safe to
+  // render when they match the skin-<hex> shape the backend already validates.
+  const SKIN_ID = /^skin-[a-z0-9]{8,40}$/;
+
   function escapeText(value) {
     return String(value ?? "")
       .replaceAll("&", "&amp;")
@@ -55,6 +59,12 @@ body:not([data-ds-dark-theme]) #beauticode-gallery .bcg-panel{background:#fff;co
       .replaceAll(">", "&gt;");
   }
 
+  // Attribute context additionally needs quote escaping; escapeText alone lets
+  // a malicious catalog id break out of data-id/src and inject handlers.
+  function escapeAttr(value) {
+    return escapeText(value).replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+  }
+
   async function request(path, init) {
     const response = await fetch(path, init);
     if ((response.headers.get("content-type") || "").includes("ndjson")) {
@@ -98,36 +108,48 @@ body:not([data-ds-dark-theme]) #beauticode-gallery .bcg-panel{background:#fff;co
 
   async function load() {
     msg.textContent = "正在读取目录…";
-    const params = new URLSearchParams();
-    if (queryInput.value.trim()) params.set("q", queryInput.value.trim());
-    if (typeSelect.value) params.set("type", typeSelect.value);
-    const data = await request(`/__beauticode/ui/gallery/catalog?${params}`);
-    centerUrl = data.url || centerUrl;
-    grid.innerHTML = (data.skins || [])
-      .map(
-        (skin) =>
-          `<button type="button" class="bcg-card" data-id="${escapeText(skin.id)}">` +
-          `<img alt="" src="${escapeText(centerUrl)}/api/skins/${escapeText(skin.id)}/card">` +
-          `<span>${escapeText(skin.name)}${skin.type === "video" ? " · 视频" : ""}</span></button>`,
-      )
-      .join("");
-    msg.textContent = data.skins?.length ? "" : "目录是空的。";
-    foot.innerHTML = centerUrl
-      ? `上传与审核在 <a href="${escapeText(centerUrl)}" target="_blank" rel="noreferrer">皮肤中心网站</a>。安装会下载到本机后再应用。`
-      : "未配置皮肤中心地址。在插件的 skin-center.json 或环境变量 BEAUTICODE_SKIN_CENTER 里填入你的域名。";
+    try {
+      const params = new URLSearchParams();
+      if (queryInput.value.trim()) params.set("q", queryInput.value.trim());
+      if (typeSelect.value) params.set("type", typeSelect.value);
+      const data = await request(`/__beauticode/ui/gallery/catalog?${params}`);
+      centerUrl = data.url || centerUrl;
+      grid.innerHTML = (data.skins || [])
+        .filter((skin) => SKIN_ID.test(String(skin.id ?? "")))
+        .map(
+          (skin) =>
+            `<button type="button" class="bcg-card" data-id="${escapeAttr(skin.id)}">` +
+            `<img alt="" src="${escapeAttr(centerUrl)}/api/skins/${escapeAttr(skin.id)}/card">` +
+            `<span>${escapeText(skin.name)}${skin.type === "video" ? " · 视频" : ""}</span></button>`,
+        )
+        .join("");
+      msg.textContent = data.skins?.length ? "" : "目录是空的。";
+      foot.innerHTML = centerUrl
+        ? `上传与审核在 <a href="${escapeAttr(centerUrl)}" target="_blank" rel="noreferrer">皮肤中心网站</a>。安装会下载到本机后再应用。`
+        : "未配置皮肤中心地址。在插件的 skin-center.json 或环境变量 BEAUTICODE_SKIN_CENTER 里填入你的域名。";
+    } catch (error) {
+      grid.innerHTML = "";
+      msg.textContent = error instanceof Error ? error.message : String(error);
+    }
   }
 
   async function open() {
     host.hidden = false;
-    const config = await request("/__beauticode/ui/gallery/config");
-    centerUrl = config.url || "";
-    if (!config.enabled) {
+    try {
+      const config = await request("/__beauticode/ui/gallery/config");
+      centerUrl = config.url || "";
+      if (!config.enabled) {
+        grid.innerHTML = "";
+        msg.textContent = "尚未配置皮肤中心地址。";
+        foot.textContent = "设置 BEAUTICODE_SKIN_CENTER，或在 skin-center.json 填写站点 URL。";
+        return;
+      }
+      await load();
+    } catch (error) {
       grid.innerHTML = "";
-      msg.textContent = "尚未配置皮肤中心地址。";
-      foot.textContent = "设置 BEAUTICODE_SKIN_CENTER，或在 skin-center.json 填写站点 URL。";
-      return;
+      msg.textContent = error instanceof Error ? error.message : String(error);
+      throw error;
     }
-    await load();
   }
 
   function close() {

package/host-apply.mjs

@@ -7,8 +7,8 @@ import {
 } from "./control-client.mjs";
 import { canvasImagePath } from "./presets.mjs";
 
-const sessions = new Map();
-const DSH_VERIFY_DEADLINE_MS = 10_000;
+const sessions = new Map();
+const DSH_VERIFY_DEADLINE_MS = 10_000;
 
 export const ENGINE_MISSING_MESSAGE =
   "beautiCode 插件未能加载本机导入引擎。请执行 npx beauticode-dsh，或从完整安装目录加载桥接。";
@@ -93,7 +93,7 @@ export async function ensureInProcessSession(options) {
     const session = new adapter.DshSession({
       dataRoot,
       baseUrl,
-      verifyDeadlineMs: DSH_VERIFY_DEADLINE_MS,
+      verifyDeadlineMs: DSH_VERIFY_DEADLINE_MS,
       bundledGalleryImagePath: canvasImagePath() || undefined,
     });
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "beauticode-dsh",
-  "version": "1.0.22",
+  "version": "1.0.23",
   "description": "Cordis plugin: image/video backgrounds for DeepSeek Harness web.",
   "type": "module",
   "main": "./index.mjs",

package/themes/internal-beyond/NOTICE.md

@@ -1,9 +1,9 @@
-# Internal / Infernal atmosphere assets
-
-`bg-internal.jpg`, `bg-infernal.jpg`, `bg-canvas.png`, and the local
-`bg-canvas-4k.png` (Real-ESRGAN 4x then 3840×2160) are visual materials
-from [Internal Beyond](https://github.com/Sui-IB/InternalBeyond) by Sui.
-
-They remain under that project's CC BY-NC-SA 4.0 terms for visual assets.
-BeautiCode ships them as bundled workspace themes for local, non-commercial use.
-The project name, logo, and character identity are not licensed here.
+# Internal / Infernal atmosphere assets
+
+`bg-internal.jpg`, `bg-infernal.jpg`, `bg-canvas.png`, and the local
+`bg-canvas-4k.png` (Real-ESRGAN 4x then 3840×2160) are visual materials
+from [Internal Beyond](https://github.com/Sui-IB/InternalBeyond) by Sui.
+
+They remain under that project's CC BY-NC-SA 4.0 terms for visual assets.
+BeautiCode ships them as bundled workspace themes for local, non-commercial use.
+The project name, logo, and character identity are not licensed here.

package/ui-host.mjs

@@ -20,6 +20,10 @@ const NATIVE_PICKER_UNAVAILABLE = "native_picker_unavailable";
 const NATIVE_PICKER_REQUIRED = "native_picker_required";
 const PICKER_REQUEST_ABORTED = "picker_request_aborted";
 const IMPORT_TIMING_LOG = "import-timing.jsonl";
+// /reapply runs a full apply transaction (import + stage + verify + commit),
+// which has no total deadline of its own; give it headroom beyond the 30s that
+// the two-verify video path can already approach (~26s).
+const REAPPLY_TIMEOUT_MS = 60_000;
 
 function elapsedMs(startedAt) {
   return Math.round((performance.now() - startedAt) * 10) / 10;
@@ -369,7 +373,7 @@ export function createBeauticodeUi({
         method: "POST",
         path: "/reapply",
         body: {},
-        timeoutMs: 30_000,
+        timeoutMs: REAPPLY_TIMEOUT_MS,
       });
     }
     if (!(await canReachBridge(options.baseUrl))) return;
@@ -379,7 +383,7 @@ export function createBeauticodeUi({
         method: "POST",
         path: "/reapply",
         body: {},
-        timeoutMs: 30_000,
+        timeoutMs: REAPPLY_TIMEOUT_MS,
       });
     }
     return resolved.session.reapply();

package/vendor/adapter-dsh/session.js

@@ -145,7 +145,33 @@ export class DshSession {
             const result = await tx.run(input, themeName
                 ? {
                     beforeFinalize: async () => {
-                        saved.theme = await this.store.saveCurrentTheme(themeName);
+                        // Persist the initial seek so a restore before the periodic
+                        // progress writer runs still resumes at the requested position.
+                        let videoPositionSec = null;
+                        if (input.type === "video") {
+                            if (this.host) {
+                                try {
+                                    const position = await this.host.getPlaybackPosition();
+                                    if (position.ok &&
+                                        position.hasVideo &&
+                                        Number.isFinite(position.currentTime)) {
+                                        videoPositionSec = position.currentTime;
+                                    }
+                                }
+                                catch {
+                                    /* fall back to input.startAt below */
+                                }
+                            }
+                            const startAt = typeof input.startAt === "number" && Number.isFinite(input.startAt)
+                                ? input.startAt
+                                : null;
+                            if (videoPositionSec == null && startAt != null) {
+                                videoPositionSec = Math.max(0, startAt);
+                            }
+                        }
+                        saved.theme = await this.store.saveCurrentTheme(themeName, {
+                            ...(videoPositionSec != null ? { videoPositionSec } : {}),
+                        });
                     },
                     onRollback: async () => {
                         if (saved.theme) {
@@ -155,7 +181,10 @@ export class DshSession {
                 }
                 : undefined);
             if (result.ok) {
-                this.activeThemeId = saved.theme?.type === "video" ? saved.theme.id : null;
+                // Retain the saved theme id for image themes too: status.themeId marks
+                // the current selection in the console, and video-position tracking is
+                // already gated on hasVideo / "Not a video theme" downstream.
+                this.activeThemeId = saved.theme?.id ?? null;
                 this.lastProgressWriteSec = -1;
                 if (input.type === "clear") {
                     this.fishMode = false;
@@ -297,6 +326,7 @@ export class DshSession {
             fish: this.fishMode,
             muted: this.videoMuted,
             tone: this.backgroundTone,
+            themeId: this.activeThemeId,
         };
     }
     async saveCurrentTheme(name) {
@@ -313,13 +343,8 @@ export class DshSession {
             }
         }
         const theme = await this.store.saveCurrentTheme(name, { videoPositionSec });
-        if (theme.type === "video") {
-            this.activeThemeId = theme.id;
-            this.lastProgressWriteSec = -1;
-        }
-        else {
-            this.activeThemeId = null;
-        }
+        this.activeThemeId = theme.id;
+        this.lastProgressWriteSec = -1;
         return theme;
     }
     async listSavedThemes() {
@@ -338,7 +363,7 @@ export class DshSession {
             const saved = await this.store.loadSavedTheme(themeId);
             const result = await this.apply(saved.input);
             if (result.ok) {
-                this.activeThemeId = saved.input.type === "video" ? saved.themeId : null;
+                this.activeThemeId = saved.themeId;
                 this.lastProgressWriteSec = -1;
             }
             return result;

package/vendor/core/apply-transaction.js

@@ -1,6 +1,6 @@
 import fs from "node:fs/promises";
 import path from "node:path";
-import { MAX_INLINE_DATA_URL_BYTES } from "./constants.js";
+import { MAX_INLINE_DATA_URL_BYTES, MAX_VIDEO_POSTER_INLINE_BYTES, } from "./constants.js";
 import { isLocalBackgroundSource, resolveBackgroundImagePath, resolveBackgroundVideoPath, } from "./media-source.js";
 import { detectImageMime } from "./media-validation.js";
 // Cold-first-access symptoms reported by the renderer while the OS is still
@@ -286,7 +286,13 @@ export async function buildHostApplyPayload(store, manifest, staged, cssText, vi
     const imagePath = resolveBackgroundImagePath(store.paths.activeDir, manifest.background);
     if (!imagePath)
         throw new Error("Background has no image source.");
-    const imageDataUrl = opts.includeImageDataUrl === false ? null : await fileToDataUrl(imagePath);
+    const imageStat = await fs.stat(imagePath).catch(() => null);
+    const skipInlinePoster = manifest.background.type === "video" &&
+        imageStat != null &&
+        imageStat.size > MAX_VIDEO_POSTER_INLINE_BYTES;
+    const imageDataUrl = opts.includeImageDataUrl === false || skipInlinePoster
+        ? null
+        : await fileToDataUrl(imagePath);
     const imageUrl = staged?.image?.srcUrl ?? null;
     if (manifest.background.type === "image") {
         return {

package/vendor/core/constants.js

@@ -9,6 +9,11 @@ export const MAX_VIDEO_BYTES = 800 * 1024 * 1024;
  * Keep this equal to MAX_IMAGE_BYTES so every accepted image can publish.
  */
 export const MAX_INLINE_DATA_URL_BYTES = MAX_IMAGE_BYTES;
+/**
+ * Keep a large video poster out of the Codex Runtime.evaluate payload.
+ * The first decoded video frame replaces the poster after the blob attaches.
+ */
+export const MAX_VIDEO_POSTER_INLINE_BYTES = 1024 * 1024;
 export const COMMIT_MARKER_NAME = ".beauticode-commit-in-progress";
 export const COMMIT_MARKER_STALE_MS = 120_000;
 export const MEDIA_TOKEN_HEADER = "x-beauticode-media-token";

package/vendor/core/index.js

@@ -10,4 +10,5 @@ export * from "./error-message.js";
 export * from "./background-store.js";
 export * from "./bundled-gallery.js";
 export * from "./apply-transaction.js";
+export * from "./process-liveness.js";
 //# sourceMappingURL=index.js.map

package/vendor/core/media-source.js

@@ -1,8 +1,10 @@
 import path from "node:path";
+import { assertSafeBasename } from "./media-validation.js";
 /** Resolve a manifest source against the directory that owns managed files. */
 export function resolveMediaSource(source, ownerDir) {
     if (source.kind === "local")
         return path.resolve(source.path);
+    assertSafeBasename(source.file, "background.source.file");
     return path.join(ownerDir, source.file);
 }
 /** Resolve the primary image source, including legacy v1 manifests. */

package/vendor/core/process-liveness.js

@@ -0,0 +1,81 @@
+import { execFile } from "node:child_process";
+/**
+ * How close a process's actual start time must be to the recorded start time
+ * before we treat them as the same process. PID reuse yields a completely
+ * different start time, so a generous window is safe while still rejecting
+ * recycled PIDs.
+ */
+const START_TIME_TOLERANCE_MS = 30_000;
+/**
+ * True when `pid` refers to a process that still exists. Mirrors the PID check
+ * callers perform before consulting a recorded process identity.
+ */
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return (Boolean(error) &&
+            typeof error === "object" &&
+            error.code === "EPERM");
+    }
+}
+/**
+ * Resolve the actual process start time as an epoch millisecond value.
+ * Returns null when the process does not exist or the platform helper fails.
+ */
+function processStartTimeMs(pid) {
+    return new Promise((resolve) => {
+        if (process.platform === "win32") {
+            const script = `(Get-Process -Id ${pid}).StartTime.ToUniversalTime().ToString('o')`;
+            execFile("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { timeout: 3_000, windowsHide: true }, (error, stdout) => {
+                if (error)
+                    return resolve(null);
+                const value = Date.parse(String(stdout).trim());
+                resolve(Number.isFinite(value) ? value : null);
+            });
+            return;
+        }
+        // Linux / macOS: ps -o lstart= prints the start time in local time with no
+        // timezone suffix, which Date.parse interprets as the host's local time.
+        execFile("ps", ["-o", "lstart=", "-p", String(pid)], { timeout: 3_000 }, (error, stdout) => {
+            if (error)
+                return resolve(null);
+            const value = Date.parse(String(stdout).trim());
+            resolve(Number.isFinite(value) ? value : null);
+        });
+    });
+}
+/**
+ * True when `pid` is alive AND its real start time matches `recordedIso` (the
+ * startedAt value a control/claim file captured when the process launched).
+ *
+ * Falls back to optimistic `true` when there is no recorded timestamp or the
+ * platform helper is unavailable, so an unverifiable check never marks a live
+ * tray/session as dead. Returns `false` when the PID no longer exists or its
+ * start time clearly differs (PID reuse).
+ */
+export async function isRecordedPidLive(pid, recordedIso) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    if (!isPidAlive(pid))
+        return false;
+    if (typeof recordedIso !== "string" || !recordedIso)
+        return true;
+    const recordedMs = Date.parse(recordedIso);
+    if (!Number.isFinite(recordedMs))
+        return true;
+    let actualMs;
+    try {
+        actualMs = await processStartTimeMs(pid);
+    }
+    catch {
+        actualMs = null;
+    }
+    // No helper result means "cannot verify" — keep the optimistic PID check.
+    if (actualMs == null)
+        return true;
+    return Math.abs(actualMs - recordedMs) <= START_TIME_TOLERANCE_MS;
+}
+//# sourceMappingURL=process-liveness.js.map