beauticode-dsh 1.0.25 → 1.0.27

package/README.zh-CN.md

@@ -1,8 +1,24 @@
 # DeepSeek Harness 桥接插件
 
-该 Cordis 插件向 DSH Web 注入 beautiCode 浏览器客户端，并提供本机鉴权接口。支持图片、MP4、播放位置、静音、摸鱼模式以及清除背景。
+该 Cordis 插件向 DSH Web 和官方 Desktop 注入 beautiCode 浏览器客户端，并提供本机鉴权接口。支持图片、MP4 / MOV、播放位置、静音、摸鱼模式以及清除背景。Web 和 Desktop 使用同一组结构化页面注入；Desktop 的页面请求经原生壳转发，回执由每次 Host 启动生成的页面密钥验证。
 
-装好插件并运行 `dsh web` 后，侧栏「设置」上方会出现「背景」：在 Windows 上点击图片或视频会打开系统文件选择器，选好后在页面内命名，背景立即应用并进入已保存主题；也可以清除、开关声音、用阴影滑条调节背景明暗（恢复默认则回到对话自动纱）、切换或删除主题，以及打开「皮肤中心」安装已审核的社区皮肤。本地导入只在 Node 端保存绝对路径，并通过带 Range 支持的回环媒体服务读取原文件，不复制用户选择的图片或整段视频主文件。Windows 强制使用本地引用；原生选择器不可用时会明确报错，不会静默上传或复制媒体。非 Windows 环境保留兼容上传，并明确提示该模式会保存托管副本。网页控制台没有摸鱼；浅色/深色跟 DSH 自己的外观走。下次打开会恢复上次背景。设置 `BEAUTICODE_SKIN_CENTER` 或填写 `skin-center.json` 后，皮肤中心才会显示远程目录。
+## 官方 Desktop
+
+先启动 Desktop 一次，让它创建 `desktop` profile，然后从系统托盘明确退出（关闭窗口通常只会隐藏）。可在 Desktop 的插件页面安装 `beauticode-dsh`，或使用 **Desktop 安装的** `dsh` 命令：
+
+```sh
+dsh plugin --profile desktop add beauticode-dsh
+```
+
+要试当前仓库源码，可先在仓库根目录运行 `npm run plugin:pack`，再将上面命令的包名换成 `file:<仓库绝对路径>/artifacts/dsh-plugin`。
+
+重新打开 Desktop，在「设置」中使用「背景」。Desktop 默认 Host 端口是 `19387`；如果还使用 beautiCode 托盘，将托盘的 `-DshUrl` 指向 `http://127.0.0.1:19387`（若 Desktop profile 改过 `webserver.config.port`，请使用实际端口）。Desktop 插件由 Desktop 自己管理；下方的 `npx beauticode-dsh` 安装器针对 Web profile。
+
+「设置 → 背景」默认开启「功能面板不透明」，保证设置、弹层、菜单与消息编辑栏遮住后方内容。关闭后恢复原有透明效果；选择会保存在当前应用的本地偏好中，不受背景阴影、会话阶段或画窗模式影响。
+
+## Web
+
+装好插件并运行 `dsh web` 后，打开「设置」，左侧导航里会多出一项「背景」：在 Windows 上点击图片或视频会打开系统文件选择器，选好后在页面内命名，背景立即应用并进入已保存主题；也可以清除、开关声音、切换或删除主题，进入全屏把浏览器的标签页和地址栏收起来，以及打开「皮肤中心」安装已审核的社区皮肤。本地导入只在 Node 端保存绝对路径，并通过带 Range 支持的回环媒体服务读取原文件，不复制用户选择的图片或整段视频主文件。Windows 强制使用本地引用；原生选择器不可用时会明确报错，不会静默上传或复制媒体。非 Windows 环境保留兼容上传，并明确提示该模式会保存托管副本。网页控制台没有摸鱼；浅色/深色跟 DSH 自己的外观走。下次打开会恢复上次背景。设置 `BEAUTICODE_SKIN_CENTER` 或填写 `skin-center.json` 后，皮肤中心才会显示远程目录。
 
 插件也会注册对话工具（`beauticode_*`）和斜杠命令（`/bg`、`/bg-theme`、`/bg-clear`）。不需要托盘；托盘若已在跑则复用它。
 
@@ -43,6 +59,6 @@ npx @deepseek-ai/dsh web
 1. 修改 `cordis.patch.yml` 中的插件接入项；优先使用上面的安装命令自动完成接线。
 2. 确保 DSH 和 beautiCode 使用相同的 `BEAUTICODE_DATA_ROOT`。
 3. 自己运行 `dsh web`（或带 `--patch`）。
-4. 打开页面后用侧栏「背景」，或输入 `/bg <本机绝对路径>`，或直接跟 AI 说把某个视频/图片设为背景。
+4. 打开页面后在「设置」里点「背景」，或输入 `/bg <本机绝对路径>`，或直接跟 AI 说把某个视频/图片设为背景。
 
 安全边界：DSH Web 必须绑定本机回环地址；控制端点需要随机令牌；媒体 URL 仅允许带令牌的回环 HTTP 地址；浏览器回执只接受同源请求。

package/agent.mjs

@@ -275,7 +275,7 @@ export function createBeauticodeActions(dataRootOrOptions) {
       const inspected = await inspectLocalMedia(input.path);
       if (!inspected.ok) fail(inspected.error);
       if (inspected.kind !== "video") {
-        fail("beauticode_apply_video 只接受 .mp4 文件。");
+        fail("beauticode_apply_video 只接受 .mp4 / .mov 文件。");
       }
       const persistTheme = input?.persistTheme !== false;
       const themeName =

package/atmosphere.js

@@ -82,14 +82,14 @@ html[data-bc-gallery="true"] body{
   --dsw-alias-bg-layer-1:rgba(26,30,39,.28);
   --dsw-alias-bg-layer-2:rgba(35,40,51,.32);
   --dsw-alias-bg-overlay:rgba(17,20,27,.12);
-  --dsw-specific-sidebar-fill:rgba(23,27,35,.28);
+  --dsw-specific-sidebar-fill:rgba(23,27,35,.36);
 }
 html[data-bc-resolved-tone="light"][data-bc-gallery="true"] body{
   --dsw-alias-bg-base:rgba(248,250,252,.12);
   --dsw-alias-bg-layer-1:rgba(255,255,255,.28);
   --dsw-alias-bg-layer-2:rgba(248,250,252,.32);
   --dsw-alias-bg-overlay:rgba(255,255,255,.14);
-  --dsw-specific-sidebar-fill:rgba(255,255,255,.28);
+  --dsw-specific-sidebar-fill:rgba(255,255,255,.36);
 }
 html[data-bc-gallery="true"] #root{position:relative;z-index:1;background:transparent!important}
 html[data-bc-gallery="true"] [class*="_fade"]{display:none!important}

package/browser-injection.mjs

@@ -0,0 +1,31 @@
+import crypto from "node:crypto";
+
+const SCRIPT_PATHS = [
+  "/__beauticode/transport.js",
+  "/__beauticode/atmosphere.js",
+  "/__beauticode/client.js",
+  "/__beauticode/console.js",
+  "/__beauticode/gallery.js",
+];
+
+/** The desktop shell forwards requests after removing browser Origin headers. */
+export function createBrowserInjection() {
+  const desktopKey = crypto.randomBytes(32).toString("hex");
+
+  return {
+    contribute(table) {
+      table.push({ kind: "global", name: "__BEAUTICODE_DESKTOP_KEY__", value: desktopKey });
+      for (const src of SCRIPT_PATHS) {
+        table.push({ kind: "script-src", placement: "body", src });
+      }
+    },
+    isSameOrigin(req) {
+      const origin = req.headers.origin;
+      if (typeof origin === "string") return origin === `http://${req.headers.host}`;
+      if (req.headers["sec-fetch-site"] === "same-origin") return true;
+      const supplied = req.headers["x-beauticode-desktop-key"];
+      if (typeof supplied !== "string" || !/^[a-f0-9]{64}$/.test(supplied)) return false;
+      return crypto.timingSafeEqual(Buffer.from(supplied), Buffer.from(desktopKey));
+    },
+  };
+}

package/client.js

@@ -1,6 +1,9 @@
 (() => {
   "use strict";
   if (window.__beauticodeBridgeLoaded) return;
+  if (globalThis.location?.protocol === "dsh-app:" && !globalThis.__beauticodeTransport) {
+    throw new Error("beautiCode Desktop transport did not load.");
+  }
   window.__beauticodeBridgeLoaded = true;
   window.__beauticodeBridgeVersion = 4;
 
@@ -49,27 +52,97 @@
   style.dataset.beauticodeBridge = "true";
   style.textContent = `
 html[data-bc-active="true"],html[data-bc-active="true"] body{background:transparent!important}
+/* Every surface DSH ships opaque is re-expressed as its own static palette
+   color at an alpha tier, so the whole UI is one translucent material instead
+   of a few translucent panels around solid blocks. Two knobs, both percentages:
+   --bc-surface-mix for chrome (columns, composer card, dropdowns, popovers,
+   chips) and --bc-content-mix for transcript content (user bubble, the colored
+   highlight blocks, code and diff blocks). A token declared here recomputes
+   whenever a phase / dim block below re-aliases its tier, so nothing has to be
+   repeated per state. */
 html[data-bc-active="true"] body{
+  --bc-surface-mix:36%;
+  --bc-content-mix:36%;
   --dsw-alias-bg-base:rgba(17,20,27,.10);
   --dsw-alias-bg-layer-1:rgba(26,30,39,.28);
   --dsw-alias-bg-layer-2:rgba(35,40,51,.32);
   --dsw-alias-bg-overlay:rgba(17,20,27,.12);
-  --dsw-specific-sidebar-fill:rgba(23,27,35,.28);
+  --dsw-specific-sidebar-fill:color-mix(in srgb,var(--dsw-static-neutral-bluish-900) var(--bc-surface-mix),transparent);
+  --dsw-specific-input-major:var(--dsw-specific-sidebar-fill);
+  --dsw-alias-bg-layer-3:color-mix(in srgb,var(--dsw-static-neutral-bluish-800) var(--bc-surface-mix),transparent);
+  --dsw-specific-tip:color-mix(in srgb,var(--dsw-static-neutral-bluish-800) var(--bc-surface-mix),transparent);
+  --dsw-alias-bg-module-platform:color-mix(in srgb,var(--dsw-static-neutral-bluish-800) var(--bc-surface-mix),transparent);
+  --dsw-specific-selector:color-mix(in srgb,var(--dsw-static-neutral-bluish-800) var(--bc-surface-mix),transparent);
+  --dsw-alias-interactive-bg-hover-solid:color-mix(in srgb,var(--dsw-static-neutral-bluish-800) var(--bc-surface-mix),transparent);
+  --dsw-alias-tooltip-bg:color-mix(in srgb,var(--dsw-static-neutral-bluish-750) var(--bc-surface-mix),transparent);
+  --dsw-alias-toast-bg:color-mix(in srgb,var(--dsw-static-neutral-bluish-750) var(--bc-surface-mix),transparent);
+  --dsw-alias-button-floating-fill:color-mix(in srgb,var(--dsw-static-neutral-bluish-850) var(--bc-surface-mix),transparent);
+  --dsw-specific-bubble:color-mix(in srgb,var(--dsw-static-neutral-bluish-850) var(--bc-content-mix),transparent);
+  --dsw-specific-bubble-highlight:color-mix(in srgb,var(--dsw-static-neutral-bluish-750) var(--bc-content-mix),transparent);
+  --dsw-alias-state-warn-tertiary:color-mix(in srgb,var(--dsw-static-amber-900) var(--bc-content-mix),transparent);
+  --dsw-alias-state-success-tertiary:color-mix(in srgb,var(--dsw-static-green-900) var(--bc-content-mix),transparent);
+  --dsw-alias-state-business-tertiary:color-mix(in srgb,var(--dsw-static-deepseek-800) var(--bc-content-mix),transparent);
+  --dsw-alias-markdown-code-block:color-mix(in srgb,var(--dsw-static-neutral-bluish-900) var(--bc-content-mix),transparent);
+  --dsw-alias-markdown-code-block-banner:color-mix(in srgb,var(--dsw-static-neutral-bluish-850) var(--bc-content-mix),transparent);
+  --dsw-alias-markdown-inline-code:color-mix(in srgb,var(--dsw-static-neutral-800) var(--bc-content-mix),transparent);
+  --dsw-alias-markdown-tag:color-mix(in srgb,var(--dsw-static-neutral-bluish-850) var(--bc-content-mix),transparent);
+  --dsw-alias-markdown-citation:color-mix(in srgb,var(--dsw-static-neutral-bluish-800) var(--bc-content-mix),transparent);
+  --dsw-alias-markdown-placeholder:color-mix(in srgb,var(--dsw-static-neutral-bluish-850) var(--bc-content-mix),transparent);
+  --dsw-alias-markdown-code-segment-selected:color-mix(in srgb,var(--dsw-static-neutral-bluish-800) var(--bc-content-mix),transparent);
+  --dsw-alias-markdown-code-segment-unselected:color-mix(in srgb,var(--dsw-static-neutral-bluish-900) var(--bc-content-mix),transparent);
 }
 html[data-bc-resolved-tone="light"][data-bc-active="true"] body{
   --dsw-alias-bg-base:rgba(248,250,252,.12);
   --dsw-alias-bg-layer-1:rgba(255,255,255,.28);
   --dsw-alias-bg-layer-2:rgba(248,250,252,.32);
   --dsw-alias-bg-overlay:rgba(255,255,255,.14);
-  --dsw-specific-sidebar-fill:rgba(255,255,255,.28);
+  --dsw-specific-sidebar-fill:color-mix(in srgb,var(--dsw-static-neutral-bluish-50) var(--bc-surface-mix),transparent);
+  --dsw-alias-bg-layer-3:color-mix(in srgb,var(--dsw-static-neutral-bluish-00) var(--bc-surface-mix),transparent);
+  --dsw-specific-tip:color-mix(in srgb,var(--dsw-static-neutral-bluish-60) var(--bc-surface-mix),transparent);
+  --dsw-alias-bg-module-platform:color-mix(in srgb,var(--dsw-static-neutral-bluish-60) var(--bc-surface-mix),transparent);
+  --dsw-specific-selector:color-mix(in srgb,var(--dsw-static-neutral-bluish-60) var(--bc-surface-mix),transparent);
+  --dsw-alias-interactive-bg-hover-solid:color-mix(in srgb,var(--dsw-static-neutral-bluish-75) var(--bc-surface-mix),transparent);
+  --dsw-alias-tooltip-bg:color-mix(in srgb,var(--dsw-static-neutral-bluish-850) var(--bc-surface-mix),transparent);
+  --dsw-alias-toast-bg:color-mix(in srgb,var(--dsw-static-neutral-bluish-800) var(--bc-surface-mix),transparent);
+  --dsw-alias-button-floating-fill:color-mix(in srgb,var(--dsw-static-neutral-bluish-00) var(--bc-surface-mix),transparent);
+  --dsw-specific-bubble:color-mix(in srgb,var(--dsw-static-deepseek-50) var(--bc-content-mix),transparent);
+  --dsw-specific-bubble-highlight:color-mix(in srgb,var(--dsw-static-deepseek-200) var(--bc-content-mix),transparent);
+  --dsw-alias-state-warn-tertiary:color-mix(in srgb,var(--dsw-static-amber-100) var(--bc-content-mix),transparent);
+  --dsw-alias-state-success-tertiary:color-mix(in srgb,var(--dsw-static-green-100) var(--bc-content-mix),transparent);
+  --dsw-alias-state-business-tertiary:color-mix(in srgb,var(--dsw-static-deepseek-100) var(--bc-content-mix),transparent);
+  --dsw-alias-markdown-code-block:color-mix(in srgb,var(--dsw-static-neutral-bluish-50) var(--bc-content-mix),transparent);
+  --dsw-alias-markdown-code-block-banner:color-mix(in srgb,var(--dsw-static-neutral-bluish-50) var(--bc-content-mix),transparent);
+  --dsw-alias-markdown-inline-code:color-mix(in srgb,var(--dsw-static-neutral-50) var(--bc-content-mix),transparent);
+  --dsw-alias-markdown-tag:color-mix(in srgb,var(--dsw-static-neutral-bluish-75) var(--bc-content-mix),transparent);
+  --dsw-alias-markdown-citation:color-mix(in srgb,var(--dsw-static-neutral-bluish-100) var(--bc-content-mix),transparent);
+  --dsw-alias-markdown-placeholder:color-mix(in srgb,var(--dsw-static-neutral-bluish-60) var(--bc-content-mix),transparent);
+  --dsw-alias-markdown-code-segment-selected:color-mix(in srgb,var(--dsw-static-neutral-bluish-00) var(--bc-content-mix),transparent);
+  --dsw-alias-markdown-code-segment-unselected:color-mix(in srgb,var(--dsw-static-neutral-bluish-75) var(--bc-content-mix),transparent);
+}
+/* The cards listed under 本轮文件改动 (the deliverables grid) do not read an
+   alias token: the module root derives its own --deliverable-fill /
+   --deliverable-hover pair from the static palette, so no body-level override
+   reaches them. Declaring the pair on the card element itself wins over the
+   value it would otherwise inherit from that root. */
+html[data-bc-active="true"] [data-presented-file]{
+  --deliverable-fill:color-mix(in srgb,var(--dsw-static-neutral-850) var(--bc-content-mix),transparent);
+  --deliverable-hover:color-mix(in srgb,var(--dsw-static-neutral-800) var(--bc-content-mix),transparent);
+}
+html[data-bc-resolved-tone="light"][data-bc-active="true"] [data-presented-file]{
+  --deliverable-fill:color-mix(in srgb,var(--dsw-static-neutral-50) var(--bc-content-mix),transparent);
+  --deliverable-hover:color-mix(in srgb,var(--dsw-static-neutral-100) var(--bc-content-mix),transparent);
 }
+/* DSH renders the dropdown menus through --dsw-specific-menu, which it defines
+   as var(--dsw-alias-bg-layer-3), so the layer override above already carries
+   them onto the same tier. */
 html[data-bc-active="true"]:has(#root [data-phase="active"]) body,
 html[data-bc-active="true"]:has(#root [data-phase="settling"]) body{
+  --bc-surface-mix:86%;
+  --bc-content-mix:72%;
   --dsw-alias-bg-base:rgba(17,20,27,.42);
   --dsw-alias-bg-layer-1:rgba(26,30,39,.72);
   --dsw-alias-bg-layer-2:rgba(35,40,51,.80);
   --dsw-alias-bg-overlay:rgba(17,20,27,.86);
-  --dsw-specific-sidebar-fill:rgba(23,27,35,.78);
 }
 html[data-bc-resolved-tone="light"][data-bc-active="true"]:has(#root [data-phase="active"]) body,
 html[data-bc-resolved-tone="light"][data-bc-active="true"]:has(#root [data-phase="settling"]) body{
@@ -77,22 +150,25 @@ html[data-bc-resolved-tone="light"][data-bc-active="true"]:has(#root [data-phase
   --dsw-alias-bg-layer-1:rgba(255,255,255,.74);
   --dsw-alias-bg-layer-2:rgba(248,250,252,.82);
   --dsw-alias-bg-overlay:rgba(255,255,255,.86);
-  --dsw-specific-sidebar-fill:rgba(255,255,255,.78);
 }
 #beauticode-bg-stage{position:fixed;inset:0;z-index:0;overflow:hidden;pointer-events:none;background:#11141b}
 #beauticode-bg-stage::after{content:"";position:absolute;inset:0;z-index:3;background:transparent;pointer-events:none}
 html[data-bc-resolved-tone="light"] #beauticode-bg-stage{background:#f8fafc}
+/* The background shadow defaults to zero, so the wallpaper keeps its own
+   brightness until someone moves the 背景阴影 slider — that writes --bc-dim and
+   takes over through the data-bc-dim-user rules below. */
 html[data-bc-active="true"]:has(#root [data-phase="active"]) #beauticode-bg-stage::after,
-html[data-bc-active="true"]:has(#root [data-phase="settling"]) #beauticode-bg-stage::after{background:rgba(0,0,0,.42)}
+html[data-bc-active="true"]:has(#root [data-phase="settling"]) #beauticode-bg-stage::after{background:rgba(0,0,0,0)}
 html[data-bc-resolved-tone="light"][data-bc-active="true"]:has(#root [data-phase="active"]) #beauticode-bg-stage::after,
-html[data-bc-resolved-tone="light"][data-bc-active="true"]:has(#root [data-phase="settling"]) #beauticode-bg-stage::after{background:rgba(255,255,255,.22)}
+html[data-bc-resolved-tone="light"][data-bc-active="true"]:has(#root [data-phase="settling"]) #beauticode-bg-stage::after{background:rgba(255,255,255,0)}
 html[data-bc-dim-user="true"][data-bc-active="true"]:has(#root [data-phase="active"]) body,
 html[data-bc-dim-user="true"][data-bc-active="true"]:has(#root [data-phase="settling"]) body{
   --dsw-alias-bg-base:rgba(17,20,27,.10);
   --dsw-alias-bg-layer-1:rgba(26,30,39,.28);
   --dsw-alias-bg-layer-2:rgba(35,40,51,.32);
   --dsw-alias-bg-overlay:rgba(17,20,27,.12);
-  --dsw-specific-sidebar-fill:rgba(23,27,35,.28);
+  --bc-surface-mix:36%;
+  --bc-content-mix:36%;
 }
 html[data-bc-resolved-tone="light"][data-bc-dim-user="true"][data-bc-active="true"]:has(#root [data-phase="active"]) body,
 html[data-bc-resolved-tone="light"][data-bc-dim-user="true"][data-bc-active="true"]:has(#root [data-phase="settling"]) body{
@@ -100,7 +176,6 @@ html[data-bc-resolved-tone="light"][data-bc-dim-user="true"][data-bc-active="tru
   --dsw-alias-bg-layer-1:rgba(255,255,255,.28);
   --dsw-alias-bg-layer-2:rgba(248,250,252,.32);
   --dsw-alias-bg-overlay:rgba(255,255,255,.14);
-  --dsw-specific-sidebar-fill:rgba(255,255,255,.28);
 }
 html[data-bc-dim-user="true"][data-bc-active="true"] #beauticode-bg-stage::after{background:rgba(0,0,0,var(--bc-dim))!important}
 html[data-bc-resolved-tone="light"][data-bc-dim-user="true"][data-bc-active="true"] #beauticode-bg-stage::after{background:rgba(255,255,255,var(--bc-dim))!important}
@@ -119,6 +194,20 @@ html[data-bc-fish="true"] #beauticode-bg-stage::after{background:transparent!imp
 #beauticode-bg-stage .beauticode-media-slot video{z-index:1;opacity:1}
 #beauticode-bg-stage .beauticode-media-slot[data-bc-video-ready="true"] img{opacity:0}
 #beauticode-bg-stage .beauticode-media-slot[data-bc-video-ready="true"] video{opacity:1}
+/* Background blur (磨砂). Applied to the background media element itself with a
+   plain CSS filter, never to the stage or the app:
+
+     - no backdrop-filter  -> no containing block, so settings dialog and every
+                              fixed/absolute control keeps its position
+     - no extra DOM node   -> nothing to stack, nothing to isolate
+
+   The media is NOT scaled: an earlier revision grew it slightly to hide the soft
+   border a blur leaves at the viewport edge, but a growing picture is a worse
+   artefact than the soft edge, so the picture keeps its framing. */
+html[data-bc-bg-blur="true"] #beauticode-bg-stage .beauticode-media-slot img,
+html[data-bc-bg-blur="true"] #beauticode-bg-stage .beauticode-media-slot video{
+  filter:blur(var(--bc-bg-blur,0px));
+}
 @media (prefers-reduced-motion:reduce){#beauticode-bg-stage .beauticode-media-slot,#beauticode-bg-stage .beauticode-media-slot img,#beauticode-bg-stage .beauticode-media-slot video{transition:none!important}}
 html[data-bc-active="true"] #root{position:relative;z-index:1;background:transparent!important}
 html[data-bc-active="true"] [class*="_fade"]{display:none!important}
@@ -195,6 +284,70 @@ html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;
     clear: clearUserDim,
   };
 
+
+  // ---------------------------------------------------------------------------
+  // Background blur (磨砂程度, 0-100%).
+  //
+  // Publishes a percentage and writes two things on <html>: the --bc-bg-blur
+  // length the stylesheet applies to the media, and a data attribute so the rule
+  // only matches while the value is above zero. 0% therefore means "no rule
+  // matches at all", which is exactly the previous appearance.
+  // ---------------------------------------------------------------------------
+  const BG_BLUR_KEY = "beauticode-bg-blur";
+  // 100% on the slider maps to this radius. Chosen from the rendered result:
+  // the previous 30px cap was already heavy at 30%, so 9px is the new ceiling.
+  const BG_BLUR_MAX_PX = 9;
+  let bgBlurPercent = 0;
+
+  function clampBlurPercent(value) {
+    if (value == null || value === "") return null;
+    const n = Number(value);
+    if (!Number.isFinite(n)) return null;
+    return Math.min(100, Math.max(0, Math.round(n)));
+  }
+
+  function applyBgBlur() {
+    const root = document.documentElement;
+    if (!root?.dataset || !root.style) return;
+    const setVar = typeof root.style.setProperty === "function"
+      ? root.style.setProperty.bind(root.style)
+      : null;
+    const px = (bgBlurPercent / 100) * BG_BLUR_MAX_PX;
+    setVar?.("--bc-bg-blur", `${px.toFixed(2)}px`);
+    if (bgBlurPercent > 0) root.dataset.bcBgBlur = "true";
+    else if (root.dataset) delete root.dataset.bcBgBlur;
+  }
+
+  function getBgBlur() {
+    return bgBlurPercent;
+  }
+
+  function setBgBlur(value) {
+    const percent = clampBlurPercent(value);
+    if (percent == null) return bgBlurPercent;
+    bgBlurPercent = percent;
+    try {
+      globalThis.localStorage?.setItem(BG_BLUR_KEY, String(percent));
+    } catch {
+      /* private mode / quota */
+    }
+    applyBgBlur();
+    return percent;
+  }
+
+  try {
+    const stored = clampBlurPercent(globalThis.localStorage?.getItem(BG_BLUR_KEY));
+    if (stored != null) bgBlurPercent = stored;
+  } catch {
+    /* private mode */
+  }
+  globalThis.BeauticodeBackgroundBlur = { get: getBgBlur, set: setBgBlur };
+  try {
+    applyBgBlur();
+  } catch {
+    /* a cosmetic extra must never take the background down with it */
+  }
+
   // Chromium builds its media stack lazily; the first <video> of a fresh
   // profile pays decoder/GPU/audio init inside the first import's verify
   // deadline. One muted playback of the bundled frame pays that cost early.
@@ -373,10 +526,20 @@ html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;
     return video instanceof HTMLVideoElement ? video : null;
   }
 
+  // Same-origin receipt only — NOT an authenticated control API. clientId is
+  // a client-generated correlation id (see top of file), not a credential.
+  // The server enforces same-origin and binds this to a live SSE session for
+  // the clientId; it intentionally does not use authorized()/tokenFile,
+  // which is reserved for /apply, /mode, /status.
   async function postAck(body) {
     await fetch("/__beauticode/ack", {
       method: "POST",
-      headers: { "content-type": "application/json" },
+      mode: "same-origin",
+      credentials: "same-origin",
+      headers: {
+        "content-type": "application/json",
+        ...(globalThis.__beauticodeTransport?.headers() ?? {}),
+      },
       body: JSON.stringify({ clientId, ...body }),
     }).catch(() => {});
   }
@@ -777,7 +940,7 @@ html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;
     // already-set error keeps the settle phase from waiting out its full
     // budget on media that has already failed.
     if (video.error) {
-      return Promise.reject(new Error(describeVideoState(video, "MP4 加载或解码失败")));
+      return Promise.reject(new Error(describeVideoState(video, "视频加载或解码失败")));
     }
     return new Promise((resolve, reject) => {
       let settled = false;
@@ -786,7 +949,7 @@ html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;
         if (video.readyState >= frameReadyState) done();
       };
       const failed = () => {
-        finish(new Error(describeVideoState(video, "MP4 加载或解码失败")));
+        finish(new Error(describeVideoState(video, "视频加载或解码失败")));
       };
       const aborted = () => {
         finish(signal?.aborted ? abortError() : new Error(describeVideoState(video, "视频加载已中止")));
@@ -1640,18 +1803,22 @@ html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;
     await acknowledgeMode();
   }
 
-  const events = new EventSource(
-    `/__beauticode/events?clientId=${encodeURIComponent(clientId)}`,
-  );
-  events.onmessage = (event) => {
-    try {
-      const payload = JSON.parse(event.data);
-      if (payload?.type === "mode") void applyModes(payload).catch(() => {});
-      else if (payload?.type === "apply") scheduleBackground(payload);
-    } catch {
-      /* EventSource will continue with the next valid frame. */
-    }
+  const onEvent = (event) => {
+      try {
+        const payload = JSON.parse(event.data);
+        if (payload?.type === "mode") void applyModes(payload).catch(() => {});
+        else if (payload?.type === "apply") scheduleBackground(payload);
+      } catch {
+        /* The stream continues with the next valid frame. */
+      }
   };
+  const eventsUrl = `/__beauticode/events?clientId=${encodeURIComponent(clientId)}`;
+  if (globalThis.__beauticodeTransport) {
+    globalThis.__beauticodeTransport.events(eventsUrl, onEvent);
+  } else {
+    const events = new EventSource(eventsUrl);
+    events.onmessage = onEvent;
+  }
 
   setInterval(() => {
     if (
@@ -1694,4 +1861,50 @@ html[data-bc-fish="true"] #root{opacity:0!important;visibility:hidden!important;
       }).catch(() => {});
     }
   }, 1_000);
+
+  // Fullscreen by default. A browser only grants fullscreen from inside a user
+  // gesture, so a page cannot open in it; the closest honest reading of
+  // "starts fullscreen" is the first click after load. Typing in the composer
+  // must not count: DSH's main action is a keydown. Escape or the settings row
+  // still exits. Stay armed until the request actually succeeds — a rejected
+  // first gesture used to spend the listener and leave the page windowed.
+  function armFullscreenDefault() {
+    const root = document.documentElement;
+    if (typeof root?.requestFullscreen !== "function" &&
+        typeof root?.webkitRequestFullscreen !== "function") {
+      return;
+    }
+    let spent = false;
+    const enter = () => {
+      if (spent) return;
+      if (document.fullscreenElement || document.webkitFullscreenElement) {
+        spent = true;
+        document.removeEventListener?.("pointerdown", enter, true);
+        return;
+      }
+      for (const name of ["requestFullscreen", "webkitRequestFullscreen"]) {
+        const request = root?.[name];
+        if (typeof request !== "function") continue;
+        let started;
+        try {
+          started = request.call(root, { navigationUI: "hide" });
+        } catch {
+          continue;
+        }
+        Promise.resolve(started).then(
+          () => {
+            spent = true;
+            document.removeEventListener?.("pointerdown", enter, true);
+          },
+          () => {
+            /* gesture rejected — stay armed for the next click */
+          },
+        );
+        return;
+      }
+    };
+    document.addEventListener?.("pointerdown", enter, { capture: true });
+  }
+
+  armFullscreenDefault();
 })();