dsh-background-by-model 0.10.0 → 0.12.0-test.1

package/lib/client.js

@@ -103,12 +103,14 @@ window.__ModuleLoader__.load({
 			id: "mid-autumn",
 			slot: "h-midautumn",
 			asset: "mid-autumn.webp",
+			source: "/bfs/new_dyn/42e22801827aff71267b03c95fcfd7834168597.png@1672w.webp",
 			color: "#384A77",
 			kind: "lunar"
 		}, {
 			id: "national-day",
 			slot: "h-nationalday",
 			asset: "national-day.webp",
+			source: "/bfs/new_dyn/30e97211189f7869dae83b909d2a3cc84168597.png@3456w.webp",
 			color: "#FFF6EB",
 			kind: "gregorian"
 		}];
@@ -472,7 +474,9 @@ window.__ModuleLoader__.load({
 				holidays: {
 					enabled: false,
 					items: defaultHolidayRules()
-				}
+				},
+				agentAccess: false,
+				rev: 0
 			};
 		}
 		/** Slot names reach the filesystem, so they are strictly whitelisted. */
@@ -738,7 +742,9 @@ window.__ModuleLoader__.load({
 				rightbarOpacity: normalizeRightbarOpacity(r.rightbarOpacity),
 				pageOpacity: clamp01(r.pageOpacity, 0),
 				autoExtract: r.autoExtract !== false,
-				holidays: normalizeHolidays(r.holidays)
+				holidays: normalizeHolidays(r.holidays),
+				agentAccess: r.agentAccess === true,
+				rev: typeof r.rev === "number" && isFinite(r.rev) && r.rev >= 0 ? Math.floor(r.rev) : 0
 			};
 		}
 		freshThemeConfig();
@@ -1027,12 +1033,23 @@ window.__ModuleLoader__.load({
 			}
 			rotIndex = 0;
 		}
-		function resetConfig() {
-			cfg = freshThemeConfig();
-			clearImages();
-			activeRuleId = null;
-			activeMatched = false;
-			rotIndex = 0;
+		/**
+		* Record the revision the host just wrote.
+		*
+		* Called after EVERY successful write, and it is load-bearing rather than
+		* bookkeeping: the next write names this number as the one it started from, so
+		* leaving it stale makes the very next save look like a lost race — the host
+		* refuses it, hands back the config it already has (which does not contain the
+		* edit), and the panel adopts that. That is the "click + twice" bug: the first
+		* click is refused as stale and rolled back, the second only works once a stale
+		* revision happens to match again.
+		*
+		* Mutated on the live object, never replaced: `cfg` is read through its binding
+		* everywhere, and swapping the reference would strand the modules that hold it.
+		*/
+		function setRev(rev) {
+			if (!isFinite(rev) || rev < 0) return;
+			cfg.rev = Math.floor(rev);
 		}
 		//#endregion
 		//#region src/client/rpc.ts
@@ -1081,6 +1098,124 @@ window.__ModuleLoader__.load({
 		}
 		const SAVE_DEBOUNCE_MS = 250;
 		let saveTimer;
+		/**
+		* Called when a write came back as a conflict, so the plugin can adopt the config
+		* that won and repaint. Set once by `apply()` in ./index.
+		*
+		* A callback rather than an import because `./rpc` owns no state: the memory copy,
+		* the repaint and the toast all live in the modules that own those, and this file
+		* would have to import half the plugin to reach them.
+		*/
+		let onConflict = null;
+		function setConflictHandler(handler) {
+			onConflict = handler;
+		}
+		/**
+		* One config write, with the conflict case handled rather than logged.
+		*
+		* The generic `rpcCall` answers `undefined` for anything that is not a plain
+		* success, which is right for reads but wrong here: a REFUSED write is not "no
+		* answer", it is an answer that carries the config which won. So this one goes
+		* through `rpcRaw` and unwraps the outcome itself.
+		*/
+		async function writeConfigNow(config) {
+			const res = await rpcRaw("writeConfig", {
+				config,
+				expectedRev: cfg.rev
+			});
+			if (res === void 0) return {
+				ok: false,
+				conflict: false,
+				rev: cfg.rev
+			};
+			if (res.ok !== true) return {
+				ok: false,
+				conflict: false,
+				rev: cfg.rev
+			};
+			const value = res.value;
+			if (value?.ok === true) return {
+				ok: true,
+				conflict: false,
+				rev: typeof value.rev === "number" ? value.rev : cfg.rev
+			};
+			if (value?.conflict === true) return {
+				ok: false,
+				conflict: true,
+				config: value.config,
+				rev: typeof value.rev === "number" ? value.rev : cfg.rev
+			};
+			return {
+				ok: false,
+				conflict: false,
+				rev: cfg.rev
+			};
+		}
+		/**
+		* Persist, and adopt the winner when the write was refused as stale.
+		*
+		* Deliberately NOT retried: the edit that lost was computed from a config that is
+		* no longer there, and replaying it on the winner would apply a change the user
+		* made against a different state. Adopting is the honest answer — the user sees
+		* the new configuration and can repeat the gesture if they still want it.
+		*
+		* The SUCCESS path is the one that has to be careful: a write that lands advances
+		* the revision on disk, so this bundle's own copy must advance with it, or its next
+		* save names a revision that is already gone, gets refused, and adopts the config
+		* from BEFORE that save — which is the edit visibly undoing itself.
+		*/
+		/**
+		* ONE writer at a time, and this is load-bearing rather than tidy.
+		*
+		* Every save names the revision it started from, and a successful one ADVANCES that
+		* revision. Two saves fired back to back (a fast double delete, a drag followed by a
+		* click) therefore both name the SAME revision — the first is accepted, the second is
+		* refused as stale, and the refusal hands back the config from before the second
+		* edit. The panel adopts it, so the second edit disappears from the screen while its
+		* side effects (a picture's bytes, already deleted) do not: that is the card reading
+		* "这张图片还没有取到内容" next to a rule the user just deleted.
+		*
+		* Chaining the writes means the second one starts after the first has recorded its
+		* revision, which is the only state it can be correct against. It is a single chain
+		* for the whole config rather than one per key because the config IS one document —
+		* two concurrent writes to it can never both be right.
+		*/
+		let writeChain = Promise.resolve();
+		/**
+		* Work that must only happen once the config naming it has actually landed.
+		*
+		* Releasing a picture's bytes is the case: the bytes are what the config points AT,
+		* so deleting them first and then losing the config write leaves the rule on screen
+		* with nothing behind it. Queued here instead, a failed or superseded write simply
+		* never runs the delete — the file stays, which is wrong only in that it is
+		* unreferenced, and the cleanup card exists for exactly that.
+		*/
+		let deferredDeletes = [];
+		/**
+		* Delete one slot's bytes, but only after the config that stopped referencing it is
+		* on disk.
+		*/
+		function deleteImageAfterSave(slot) {
+			deferredDeletes.push(slot);
+		}
+		function persistAndResolve() {
+			writeChain = writeChain.then(async () => {
+				const outcome = await writeConfigNow(cfg);
+				if (outcome.ok) {
+					setRev(outcome.rev);
+					const releasing = deferredDeletes;
+					deferredDeletes = [];
+					for (const slot of releasing) deleteImage(slot);
+					return;
+				}
+				if (outcome.conflict && outcome.config !== void 0) {
+					deferredDeletes = [];
+					onConflict?.(outcome.config);
+				}
+			});
+			return writeChain;
+		}
+		/** Write the current config with the revision this bundle last saw. */
 		function saveConfig() {
 			if (!canWriteConfig()) {
 				holdWrite();
@@ -1089,7 +1224,7 @@ window.__ModuleLoader__.load({
 			if (saveTimer !== void 0) window.clearTimeout(saveTimer);
 			saveTimer = window.setTimeout(() => {
 				saveTimer = void 0;
-				rpcCall("writeConfig", { config: cfg });
+				persistAndResolve();
 			}, SAVE_DEBOUNCE_MS);
 		}
 		function flushSave() {
@@ -1100,7 +1235,7 @@ window.__ModuleLoader__.load({
 				holdWrite();
 				return;
 			}
-			rpcCall("writeConfig", { config: cfg });
+			persistAndResolve();
 		}
 		/** Persist the current config immediately (no debounce). */
 		function persistConfig() {
@@ -1108,7 +1243,19 @@ window.__ModuleLoader__.load({
 				holdWrite();
 				return;
 			}
-			rpcCall("writeConfig", { config: cfg });
+			persistAndResolve();
+		}
+		/**
+		* Run the queued byte deletions without writing anything.
+		*
+		* The queue is normally drained by the next successful write, and every path that
+		* queues one writes immediately afterwards — so this exists only for the page-hide
+		* flush, where a delete could otherwise outlive the tab that asked for it.
+		*/
+		function drainDeferredDeletes() {
+			const releasing = deferredDeletes;
+			deferredDeletes = [];
+			for (const slot of releasing) deleteImage(slot);
 		}
 		/** Load the persisted config plus the list of stored image slots. */
 		async function loadPersisted() {
@@ -1117,7 +1264,7 @@ window.__ModuleLoader__.load({
 			const d = data;
 			const slots = Array.isArray(d.slots) ? d.slots.filter((s) => typeof s === "string") : [];
 			const schema = typeof d.schema === "number" && isFinite(d.schema) ? d.schema : null;
-			hostShape = typeof schema === "number" && schema >= 10 ? "current" : "legacy";
+			hostShape = typeof schema === "number" && schema >= 11 ? "current" : "legacy";
 			if (hostShape === "legacy") holdWrite();
 			return {
 				config: d.config,
@@ -1125,30 +1272,68 @@ window.__ModuleLoader__.load({
 				schema
 			};
 		}
+		/**
+		* The revision of the config on disk, or null when the host could not be asked.
+		*
+		* The whole answer is one number: this runs on a timer, and pulling the config to
+		* find out whether it changed would cost a full read every few seconds for a
+		* question that is almost always "no".
+		*/
+		async function readRev() {
+			const data = await rpcCall("readRev", {});
+			if (data === null || typeof data !== "object") return null;
+			const rev = data.rev;
+			return typeof rev === "number" && isFinite(rev) ? rev : null;
+		}
+		/**
+		* Per-slot queue for the byte operations.
+		*
+		* Slots are RECYCLED — `nextSlot` hands out the first free `mN`, and deleting a
+		* rule frees its numbers immediately — so a fast delete-then-add can name the same
+		* slot twice within one round trip. Those two calls are independent requests on one
+		* connection, which means their order at the host is whatever the transport decides
+		* that moment: the delete can land AFTER the write, leaving the config naming a slot
+		* whose bytes were just removed. The panel then paints a card that reads "这张图片还没有
+		* 取到内容" — the rule is right there, the picture is not, and nothing reports an
+		* error because nothing failed.
+		*
+		* So the operations on ONE slot run in the order they were asked for. Different
+		* slots never wait for each other: a queue per slot, not one global one, because
+		* adding seven pictures at once must not serialise into seven round trips.
+		*/
+		const slotQueues = /* @__PURE__ */ new Map();
+		function enqueueForSlot(slot, run) {
+			const next = (slotQueues.get(slot) ?? Promise.resolve()).then(run, run);
+			slotQueues.set(slot, next);
+			next.finally(() => {
+				if (slotQueues.get(slot) === next) slotQueues.delete(slot);
+			});
+			return next;
+		}
 		/** Read one rule image as a data URL (null when the slot is empty). */
 		async function readImage(slot) {
-			const data = await rpcCall("readImage", { slot });
+			const data = await enqueueForSlot(slot, () => rpcCall("readImage", { slot }));
 			if (data === null || typeof data !== "object") return null;
 			const url = data.dataUrl;
 			return typeof url === "string" ? url : null;
 		}
 		/** Persist (or clear) one rule image; one-shot, no debounce. */
 		async function writeImage(slot, dataUrl) {
-			return await rpcCall("writeImage", {
+			return await enqueueForSlot(slot, () => rpcCall("writeImage", {
 				slot,
 				dataUrl
-			}) === true;
+			})) === true;
 		}
 		/** Remove one rule image from disk. */
 		async function deleteImage(slot) {
-			return await rpcCall("deleteImage", { slot }) === true;
+			return await enqueueForSlot(slot, () => rpcCall("deleteImage", { slot })) === true;
 		}
 		/** Download an image from a network URL into one slot, replacing its bytes. */
 		async function fetchImageUrl(slot, url) {
-			const res = await rpcRaw("fetchImageUrl", {
+			const res = await enqueueForSlot(slot, () => rpcRaw("fetchImageUrl", {
 				slot,
 				url
-			});
+			}));
 			if (!res) return {
 				ok: false,
 				error: "no response"
@@ -1167,17 +1352,13 @@ window.__ModuleLoader__.load({
 			};
 		}
 		/**
-		* The profile's manifest and config, in one answer. Reads nothing, writes nothing.
+		* One of the profile's wallpapers, addressed by the slot the built-in config names.
 		*
 		* Raw rather than `rpcCall` for the same reason `fetchImageUrl` is: the node half
-		* answers this one with a value that CARRIES its own failure, and the `error`
-		* inside it is the only thing worth showing the user — the generic "rpc failed"
-		* log would throw that distinction away.
+		* answers this one with a value that CARRIES its own failure, and the `error` inside
+		* it is the only thing worth showing the user — the generic "rpc failed" log would
+		* throw that distinction away.
 		*/
-		async function fetchPresetConfig() {
-			return unwrapPreset(await rpcRaw("fetchPresetConfig", {}));
-		}
-		/** One of the profile's wallpapers, addressed by the slot the config names. */
 		async function fetchPresetImage(slot) {
 			return unwrapPreset(await rpcRaw("fetchPresetImage", { slot }));
 		}
@@ -1202,15 +1383,24 @@ window.__ModuleLoader__.load({
 			};
 			return v;
 		}
-		/**
-		* Empty the store: the config and every rule image.
-		*
-		* Only the recommended profile uses this, and only after its download has
-		* already succeeded — see `applyRecommended`. Nothing else in the plugin deletes
-		* the user's configuration wholesale.
-		*/
-		async function resetStore() {
-			return await rpcCall("resetStore", {}) === true;
+		async function adoptRecommended() {
+			const res = await rpcRaw("adoptRecommended", {});
+			if (res === void 0 || res.ok !== true) return {
+				ok: false,
+				rev: cfg.rev
+			};
+			const value = res.value;
+			const base = {
+				ok: value?.ok === true,
+				rev: typeof value?.rev === "number" ? value.rev : cfg.rev
+			};
+			if (base.ok) return base;
+			return {
+				...base,
+				error: typeof value?.error === "string" ? value.error : void 0,
+				slot: typeof value?.slot === "string" ? value.slot : void 0,
+				wiped: value?.wiped === true
+			};
 		}
 		/** Host default model — used only when the per-session services are absent. */
 		async function readDefaultModel() {
@@ -3682,8 +3872,9 @@ window.__ModuleLoader__.load({
 		*
 		* Every interval the plugin owns is declared HERE rather than at its call site, so
 		* "what does this plugin poll, and how often" has one answer. The scheduler itself
-		* lives in ./watchdogs; the questions live in their own modules (boot restore and
-		* the theme watchdog in ./appearance, the holiday rollover in ./holiday-status).
+		* lives in ./watchdogs; the questions live in their own modules — the theme
+		* watchdog and the holiday rollover in ./appearance-checks, the delayed boot
+		* restores in ./appearance.
 		*/
 		/** The theme skin / host palette re-assert, once a second while a colour is live. */
 		const THEME_WATCH_MS = 1e3;
@@ -3695,6 +3886,16 @@ window.__ModuleLoader__.load({
 		const RESTORE_DELAYS_MS = [300, 1500];
 		/** The holiday rollover: the answer only moves at Beijing midnight, a whole day wide. */
 		const HOLIDAY_WATCH_MS = 3e4;
+		/**
+		* How often the panel checks whether the config on disk moved under it.
+		*
+		* Only matters once agent access is on (the tools are the other writer), so the
+		* check is a conditional no-op the rest of the time: it asks the host for one
+		* number and stops. 3 s is the compromise between noticing an agent's edit while
+		* the user is still looking at the screen and not paying a request per second for
+		* a file that usually has not changed.
+		*/
+		const REV_POLL_MS = 3e3;
 		//#endregion
 		//#region src/client/appearance.ts
 		function createAppearance(host) {
@@ -4689,9 +4890,13 @@ window.__ModuleLoader__.load({
 				if (url !== null) images[slot] = url;
 			}
 			return {
-				version: 10,
+				version: 11,
 				exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
-				config: cfg,
+				config: {
+					...cfg,
+					agentAccess: false,
+					rev: 0
+				},
 				images
 			};
 		}
@@ -4721,20 +4926,24 @@ window.__ModuleLoader__.load({
 		* Write a whole theme file into the store: its rules, its wallpapers, nothing
 		* else.
 		*
-		* `wipeFirst` is the entire difference between the two imports, and it belongs to
-		* the recommended profile alone: `nextSlot` hands slots out as `m1`, `m2`, … — a
-		* counter, not a random token — so a downloaded profile and the store it lands in
-		* collide on those names as a matter of course. Emptying first is what makes
-		* "replace everything with this" literally true.
+		* The recommended profile no longer comes through here. It used to, as a
+		* `wipeFirst` variant of this function, and that was the shape of a real bug: the
+		* wipe is a separate round trip that empties the config ON DISK, so the write this
+		* function then made named a revision the emptied store had never heard of, was
+		* refused as stale, and adopted the config it had just replaced — the button had to
+		* be pressed twice. Installing the profile is now one node-half operation
+		* (`adoptRecommended`), and this path only ever imports a file over a live store.
 		*/
-		async function applyThemeFile(host, data, wipeFirst) {
-			if (typeof data.version === "number" && data.version > 10) return false;
+		async function applyThemeFile(host, data) {
+			if (typeof data.version === "number" && data.version > 11) return false;
 			if (typeof data.config !== "object" || data.config === null) return false;
-			if (wipeFirst) {
-				await resetStore();
-				resetConfig();
-			}
-			adoptConfig(data.config);
+			const ownRev = cfg.rev;
+			const ownAccess = cfg.agentAccess;
+			adoptConfig({
+				...data.config,
+				agentAccess: ownAccess,
+				rev: ownRev
+			});
 			const incoming = data.images ?? {};
 			const keep = /* @__PURE__ */ new Set();
 			for (const slot of cfg.rules.flatMap(ruleSlots)) {
@@ -4745,10 +4954,10 @@ window.__ModuleLoader__.load({
 					writeImage(slot, raw);
 				} else {
 					setImage(slot, null);
-					deleteImage(slot);
+					deleteImageAfterSave(slot);
 				}
 			}
-			for (const slot of Object.keys(incoming)) if (!keep.has(slot) && SLOT_RE.test(slot)) deleteImage(slot);
+			for (const slot of Object.keys(incoming)) if (!keep.has(slot) && SLOT_RE.test(slot)) deleteImageAfterSave(slot);
 			persistConfig();
 			host.applyActive();
 			return true;
@@ -4970,7 +5179,7 @@ window.__ModuleLoader__.load({
 			importDone: "已导入配置",
 			importFail: "导入失败，文件格式不正确",
 			recCardTitle: "推荐配置",
-			recCardDesc: "从项目素材库下载作者维护的一整套配置（规则、壁纸与接口设置），一键替换当前的全部内容",
+			recCardDesc: "换上作者维护的一整套配置（规则与界面数值随插件内置，壁纸从图床下载），一键替换当前的全部内容",
 			recAdopt: "采用推荐配置",
 			recBusy: "正在下载",
 			recConfirmTitle: "替换当前的全部配置？",
@@ -4980,13 +5189,12 @@ window.__ModuleLoader__.load({
 			recConfirmOk: "删除并替换",
 			recConfirmCancel: "取消",
 			recDone: "已采用推荐配置",
-			recFailNetwork: "推荐配置下载失败，请检查网络后重试",
-			recFailNotProfile: "素材库返回的内容不是配置，请稍后重试",
-			recFailNewer: "这份推荐配置需要更新的插件版本，未做任何改动",
-			recFailTooMany: "这份推荐配置列出的图片数量超出限制，未做任何改动",
+			recFailNetwork: "壁纸下载失败，请检查网络后重试（已下到的会留到下一次）",
 			recFailTooLarge: "这份推荐配置体积过大，未做任何改动",
-			recFailImage: "这张壁纸没拿到（素材库里缺这个文件）：",
+			recFailImage: "这张壁纸没拿到（图床上这个地址没有回应）：",
 			recFailApply: "未能写入推荐配置，你原来的配置没有被改动",
+			recFailAfterWipe: "推荐配置写了一半就失败了，你原来的规则已经被清空（图片也一起没了）。再点一次「使用推荐配置」可以重来，图片是重新下载的",
+			recFailNoStore: "壁纸没能下载，推荐配置尚未开始，你原来的配置没有被改动",
 			storeCardTitle: "图片存储",
 			storeCardDesc: "因意外导致的孤儿图片这里可以清掉",
 			storeOrphans: "可清理",
@@ -5003,6 +5211,9 @@ window.__ModuleLoader__.load({
 			repoLink: "在 GitHub 上打开仓库",
 			holidayTitle: "节日特殊背景",
 			holidayEnable: "启用节日特殊背景（中秋当天、国庆 10 月 1–7 日）",
+			agentTitle: "允许 AI 修改背景",
+			agentEnable: "打开后，AI 可以调用工具增删改规则、切图、调透明度/颜色/模糊/布局。关闭时这些工具对 AI 完全不可见，不占用上下文。",
+			agentOn: "已开启：AI 可以修改这套外观，改动会即时生效。",
 			trTitle: "切换效果",
 			trEffect: "切换方式",
 			trEffectFade: "淡入淡出",
@@ -5154,7 +5365,7 @@ window.__ModuleLoader__.load({
 			importDone: "Profile imported",
 			importFail: "Import failed — invalid file",
 			recCardTitle: "Recommended profile",
-			recCardDesc: "Download the author's own full setup — rules, wallpapers and interface settings — and replace everything with it",
+			recCardDesc: "Install the author's own full setup — rules and interface numbers ship with the plugin, wallpapers are downloaded from the image host — replacing everything you have",
 			recAdopt: "Use recommended profile",
 			recBusy: "Downloading",
 			recConfirmTitle: "Replace your entire profile?",
@@ -5164,13 +5375,12 @@ window.__ModuleLoader__.load({
 			recConfirmOk: "Delete and replace",
 			recConfirmCancel: "Cancel",
 			recDone: "Recommended profile applied",
-			recFailNetwork: "Could not download the recommended profile — check your connection and retry",
-			recFailNotProfile: "The asset host answered with something that is not a profile — try again later",
-			recFailNewer: "This profile needs a newer plugin version. Nothing was changed.",
-			recFailTooMany: "The recommended profile names more images than the plugin will fetch. Nothing was changed.",
+			recFailNetwork: "Could not download the wallpapers — check your connection and retry (what arrived is kept for the next try)",
 			recFailTooLarge: "The recommended profile is too large. Nothing was changed.",
-			recFailImage: "Could not fetch this wallpaper — the asset host has no such file:",
+			recFailImage: "Could not fetch this wallpaper — the image host does not answer for that address:",
 			recFailApply: "Could not write the recommended profile — your own is untouched",
+			recFailAfterWipe: "The recommended profile failed halfway, after your own rules had already been cleared (their pictures too). Pressing it again starts over, and the wallpapers are re-downloaded",
+			recFailNoStore: "The wallpapers could not be downloaded, so nothing was installed — your own config is untouched",
 			storeCardTitle: "Image storage",
 			storeCardDesc: "Orphaned image files left behind by an accident can be cleared here",
 			storeOrphans: "Cleanable",
@@ -5187,6 +5397,9 @@ window.__ModuleLoader__.load({
 			repoLink: "Open the repository on GitHub",
 			holidayTitle: "Holiday backgrounds",
 			holidayEnable: "Enable holiday backgrounds (Mid-Autumn day, Oct 1–7)",
+			agentTitle: "Let the AI change the background",
+			agentEnable: "When on, the AI can add, edit and remove rules, switch images, and set opacity, colour, blur and layout. When off these tools are entirely absent from the AI, costing no context.",
+			agentOn: "On: the AI can change this appearance, and edits take effect immediately.",
 			trTitle: "Switch effect",
 			trEffect: "Transition",
 			trEffectFade: "Cross-fade",
@@ -5206,41 +5419,6 @@ window.__ModuleLoader__.load({
 		//#endregion
 		//#region src/preset.ts
 		/**
-		* JSON with object keys in a fixed (sorted) order — the same string for the same
-		* value, whatever order the object that carried it happened to build its keys in.
-		*
-		* `JSON.stringify` alone is not an identity for a value that came off the wire and
-		* through a sanitizer: key order is an accident of how the object was assembled,
-		* and a resume that missed on it would silently re-download everything (the safe
-		* direction) while a resume that MATCHED on a value it should not have would be
-		* the unsafe one — so this is deliberately total as well: anything JSON cannot
-		* carry (a function, a `Symbol`, `undefined`) serializes as `null` and an
-		* `undefined` property is skipped, exactly as `JSON.stringify` treats it.
-		*/
-		function canonical(value) {
-			if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
-			if (value !== null && typeof value === "object") return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(",")}}`;
-			return JSON.stringify(value) ?? "null";
-		}
-		/**
-		* The identity of one revision of the profile: the manifest's shape version plus
-		* the config, in canonical form.
-		*
-		* The profile is served at ONE version of the assets repository, but a version
-		* reference is only as fixed as the tag behind it: re-point the tag and every
-		* edge that has not been purged keeps answering with the previous bytes of the
-		* same URL. So "the profile" is still not guaranteed to be one fixed thing, and
-		* the bytes a previous attempt is holding are only known to belong to what is
-		* being installed when that config comes back the same. Order-insensitivity is
-		* what lets this be a comparison of VALUES rather than of spellings —
-		* `normalizeConfig` (./schema) rebuilds the config it reads, so pinning the key
-		* to the exact key order the wire happened to use would make the hold useless
-		* the moment anything upstream normalized differently.
-		*/
-		function presetKey(version, config) {
-			return `${version}\n${canonical(config)}`;
-		}
-		/**
 		* The bytes of a failed attempt that may be reused for the revision `key` names.
 		*
 		* A fresh object every time, never the held record itself: the caller fills it in
@@ -5264,6 +5442,147 @@ window.__ModuleLoader__.load({
 		function presetMissing(slots, images) {
 			return slots.filter((slot) => images[slot] === void 0);
 		}
+		/** Every slot the profile installs, in list order — the download set. */
+		const PROFILE_SLOTS = [
+			{
+				slot: "m1",
+				path: "/bfs/new_dyn/e4565384e7e5b2d75756e577f505534b4168597.png"
+			},
+			{
+				slot: "m2",
+				path: "/bfs/new_dyn/aa6e8649701c91e5ac8f43ff28b97a924168597.png"
+			},
+			{
+				slot: "m3",
+				path: "/bfs/new_dyn/5da92b31df5ee2a20b17ec6be353cf5c4168597.png"
+			},
+			{
+				slot: "m4",
+				path: "/bfs/new_dyn/14bb1e53cb2c13ca80bd23e3c1d2a04e4168597.png"
+			},
+			{
+				slot: "m5",
+				path: "/bfs/new_dyn/f51fff40de2d6eaa5a73d177f7bbfa794168597.png"
+			},
+			{
+				slot: "m6",
+				path: "/bfs/new_dyn/cfa71d4e60a2f12aaeec3efe1aa680b34168597.png"
+			},
+			{
+				slot: "m7",
+				path: "/bfs/new_dyn/c09d34b79d9b447d7db98da68b97afc54168597.png"
+			}
+		].map((i) => i.slot);
+		/**
+		* Identity of this generation of the built-in profile.
+		*
+		* Only one thing reads it: what a failed download KEEPS for the next press
+		* (`PresetHeld.key` in ./preset). Editing the rules or the pictures below must bump
+		* it, or a retry could staple a wallpaper from the old set to a config from the new
+		* one — the same reason the remote profile was compared by value rather than
+		* assumed. Nothing else in the plugin persists it.
+		*/
+		const RECOMMENDED_REVISION = "builtin-1";
+		/**
+		* One rule of the profile: the match string, its picture and that picture's color.
+		*
+		* The color is a per-image value (schema 10), and the triple here is the one the
+		* profile has always carried — an HSL accent per model, used to tint the interface
+		* while its wallpaper is on screen.
+		*/
+		function profileRule(id, match, slot, color) {
+			return {
+				id,
+				images: [defaultImage(slot, color, "fill")],
+				match,
+				enabled: true,
+				color: null,
+				rotate: defaultRotation()
+			};
+		}
+		/**
+		* The profile, as a fresh config every call.
+		*
+		* ORDER IS THE FALLBACK: matching runs top→bottom and the first usable rule is what
+		* an unmatched model gets, so `deepseek` leads — the model this plugin was written
+		* for. Everything below the rules is the interface numbers a fresh install already
+		* starts on (`DEFAULT_PART_OPACITIES` and friends), which is what makes installing
+		* the profile "add the rules and the pictures" on a clean store.
+		*
+		* Deliberately NOT taken from `freshThemeConfig()`: that one seeds a single BLANK
+		* rule, and this one must not inherit it.
+		*/
+		function recommendedConfig() {
+			return {
+				rules: [
+					profileRule("r1", "deepseek", "m3", [
+						191.88931210132625,
+						.5046198735613555,
+						.82
+					]),
+					profileRule("r2", "gpt", "m1", [
+						263.5122459614382,
+						.31076923076923096,
+						.82
+					]),
+					profileRule("r3", "claude", "m2", [
+						18.923814597762384,
+						.5486699795381468,
+						.6
+					]),
+					profileRule("r4", "qwen", "m4", [
+						26.25977410947,
+						.6228354978354975,
+						.82
+					]),
+					profileRule("r5", "glm", "m5", [
+						30.15559737458117,
+						.6552284141830319,
+						.7646280172718907
+					]),
+					profileRule("r6", "kimi", "m6", [
+						229.39645097591443,
+						.5752269829617896,
+						.2
+					]),
+					profileRule("r7", "grok", "m7", [
+						217.3791348600509,
+						.7702645947081058,
+						.2
+					])
+				],
+				opacities: { ...DEFAULT_PART_OPACITIES },
+				transition: defaultTransition(),
+				settingsOpacity: 1,
+				chatTextOpacity: DEFAULT_CHAT_TEXT_OPACITY,
+				trajectoryOpacity: DEFAULT_TRAJECTORY_OPACITY,
+				rightbarOpacity: DEFAULT_RIGHTBAR_OPACITY,
+				pageOpacity: 0,
+				autoExtract: true,
+				holidays: {
+					enabled: true,
+					items: defaultHolidayRules()
+				},
+				agentAccess: false,
+				rev: 0
+			};
+		}
+		/**
+		* The profile as the document both imports consume — the same shape `exportTheme`
+		* writes, so everything downstream (the wipe, the slot loop) is the hand-picked
+		* file's path.
+		*
+		* `images` is filled by the caller as the downloads land, which is what makes a
+		* partially downloaded profile a resumable one rather than an all-or-nothing press.
+		*/
+		function recommendedThemeFile(images = {}) {
+			return {
+				version: 11,
+				exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+				config: recommendedConfig(),
+				images
+			};
+		}
 		//#endregion
 		//#region src/client/repaint.ts
 		/**
@@ -7722,19 +8041,15 @@ window.__ModuleLoader__.load({
 		/**
 		* The ways the recommended-profile download can fail, mapped to their copy.
 		*
-		* They are worth telling apart because they ask different things of the user and
-		* of whoever maintains the assets repository: nothing answering is a network to
-		* retry, a mirror that answered with something that is not a profile is not
-		* going to start working on a retry, a profile written for a newer plugin is a
-		* "update this build", and too many images is a profile nobody should install.
-		* A failure that names a SLOT is a fifth case and is rendered separately — that
-		* one is the author's file naming, and only the slot tells them which.
+		* Two cases, because the profile is now only PICTURES: the rules and their numbers
+		* are compiled in, so there is no manifest to be malformed, no shape to be too new
+		* and no config to name too many slots. What is left is the network ("retry") and
+		* the cap on the total ("nobody should install this"). A failure that names a SLOT
+		* is rendered separately — that one is about one BFS address, and the slot is what
+		* says which.
 		*/
 		const REC_ERROR_KEYS = {
 			"download failed": "recFailNetwork",
-			"not a profile": "recFailNotProfile",
-			"newer version": "recFailNewer",
-			"too many images": "recFailTooMany",
 			"too large": "recFailTooLarge"
 		};
 		function ProfilePage({ p, notify }) {
@@ -7742,6 +8057,7 @@ window.__ModuleLoader__.load({
 			const importRef = (0, react.useRef)(null);
 			p.useStore((s) => s.rev + s.rulesRev);
 			const holidays = cfg.holidays;
+			const agentAccess = cfg.agentAccess;
 			const tr = cfg.transition;
 			const store = p.useStore((s) => s);
 			const [text, setText] = (0, react.useState)("");
@@ -7825,7 +8141,7 @@ window.__ModuleLoader__.load({
 				});
 				setRecBusy(false);
 				if (!res.ok) {
-					notify(res.slot === void 0 ? t(REC_ERROR_KEYS[res.error] ?? "recFailNetwork") : `${t("recFailImage")} ${res.slot}`, false);
+					notify(res.slot === void 0 ? `${t(REC_ERROR_KEYS[res.error] ?? "recFailNetwork")} ${t("recFailNoStore")}` : `${t("recFailImage")} ${res.slot} ${t("recFailNoStore")}`, false);
 					return;
 				}
 				setPending(res.preset);
@@ -7834,10 +8150,14 @@ window.__ModuleLoader__.load({
 				const preset = pending;
 				if (preset === null) return;
 				setRecBusy(true);
-				const ok = await p.applyRecommended(preset);
+				const res = await p.applyRecommended(preset);
 				setRecBusy(false);
 				setPending(null);
-				notify(ok ? t("recDone") : t("recFailApply"), ok);
+				if (res.ok) {
+					notify(t("recDone"));
+					return;
+				}
+				notify(res.wiped ? t("recFailAfterWipe") : t("recFailApply"), false);
 			};
 			const [usage, setUsage] = (0, react.useState)(null);
 			/** Distinguishes "not asked yet" from "asked, and the host cannot answer". */
@@ -7898,6 +8218,30 @@ window.__ModuleLoader__.load({
 						})
 					]
 				}),
+				/* @__PURE__ */ (0, react_jsx_runtime.jsx)("section", {
+					className: "dab-card dab-rise",
+					style: { "--d": 1 },
+					children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "dab-chip-row",
+						style: { alignItems: "center" },
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							type: "button",
+							className: `dab-toggle${agentAccess ? " is-on" : ""}`,
+							role: "switch",
+							"aria-checked": agentAccess,
+							title: t("agentEnable"),
+							onClick: () => {
+								const next = !agentAccess;
+								p.setAgentAccess(next);
+								if (next) notify(t("agentOn"));
+							},
+							children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { className: "dab-toggle-knob" })
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "dab-holiday-label",
+							children: t("agentTitle")
+						})]
+					})
+				}),
 				/* @__PURE__ */ (0, react_jsx_runtime.jsx)("section", {
 					className: "dab-card dab-rise",
 					style: { "--d": 1 },
@@ -8418,12 +8762,12 @@ window.__ModuleLoader__.load({
 		/**
 		* Ceiling on what one recommended profile may add up to, across every wallpaper.
 		*
-		* The node half caps each file and the number of files, but it answers one
-		* independent call at a time and never sees a running total — the client is the
-		* only side that does, so the total is bounded here. The real profile is 2.2 MB
-		* of images across seven of them, so this is generous by design: it exists to
-		* stop a config that names sixty-four eight-megabyte slots from turning one
-		* button press into half a gigabyte, not to second-guess the author.
+		* The node half caps ONE file, but it answers one independent call at a time and
+		* never sees a running total — the client is the only side that does, so the total
+		* is bounded here. The real profile is 2.2 MB of images across seven of them, so
+		* this is generous by design: it exists so that a build which grew a wrong URL
+		* (or an edge that served an upload instead of the transform) cannot turn one
+		* button press into half a gigabyte.
 		*/
 		const PRESET_TOTAL_MAX = 33554432;
 		/**
@@ -8434,7 +8778,8 @@ window.__ModuleLoader__.load({
 		* CDN edge was still cold). What is being paid is per-request latency, and the
 		* host speaks HTTP/2 — the bytes are identical either way and the connection is
 		* reused — so overlapping them buys wall-clock time and risks nothing but a
-		* little contention.
+		* little contention. The same holds for the Bilibili edges the pictures come from
+		* now (see `PROFILE_HOSTS` in ../profile).
 		*
 		* Four rather than all seven: a burst that wide competes for the same bandwidth
 		* and makes the per-file timeout harder to reason about, and four already hides
@@ -8669,6 +9014,22 @@ window.__ModuleLoader__.load({
 			};
 			schedule.add(themeWatchdog(checkHost));
 			schedule.add(holidayRollover(checkHost));
+			schedule.add({
+				name: "rev",
+				everyMs: REV_POLL_MS,
+				run() {
+					if (!cfg.agentAccess) return;
+					(async () => {
+						const rev = await readRev();
+						if (rev === null || rev === cfg.rev) return;
+						const persisted = await loadPersisted();
+						if (persisted === null) return;
+						adoptConfig(persisted.config);
+						for (const slot of cfg.rules.flatMap(ruleSlots)) if (displayImageOf(slot) === null) await loadSlot(slot);
+						applyActive();
+					})();
+				}
+			});
 			(async () => {
 				const persisted = await loadPersisted();
 				if (persisted !== null) {
@@ -8680,6 +9041,13 @@ window.__ModuleLoader__.load({
 				}
 				applyActive();
 			})();
+			setConflictHandler((config) => {
+				adoptConfig(config);
+				(async () => {
+					for (const slot of cfg.rules.flatMap(ruleSlots)) if (displayImageOf(slot) === null) await loadSlot(slot);
+					applyActive();
+				})();
+			});
 			ctx.effect(() => () => {
 				teardownWp();
 			}, "dsh-background-by-model: wp cleanup");
@@ -8778,7 +9146,7 @@ window.__ModuleLoader__.load({
 							for (const slot of ruleSlots(rule)) {
 								if (stillUsed.has(slot)) continue;
 								setImage(slot, null);
-								deleteImage(slot);
+								deleteImageAfterSave(slot);
 							}
 						}
 						rulesRev++;
@@ -8836,7 +9204,7 @@ window.__ModuleLoader__.load({
 						persistConfig();
 						if (!takenSlots().has(slot)) {
 							setImage(slot, null);
-							deleteImage(slot);
+							deleteImageAfterSave(slot);
 						}
 						repaintIfMoved(id, winner);
 					},
@@ -9040,6 +9408,11 @@ window.__ModuleLoader__.load({
 						sync();
 						saveConfig();
 					},
+					setAgentAccess: (v) => {
+						cfg.agentAccess = v;
+						sync();
+						persistConfig();
+					},
 					setHolidaysEnabled: (v) => {
 						cfg.holidays.enabled = v;
 						persistConfig();
@@ -9054,36 +9427,34 @@ window.__ModuleLoader__.load({
 						try {
 							const data = JSON.parse(await file.text());
 							if (!data || typeof data !== "object") return false;
-							return await applyThemeFile({ applyActive }, data, false);
+							return await applyThemeFile({ applyActive }, data);
 						} catch {
 							return false;
 						}
 					},
 					/**
-					* Fetch the project's recommended profile. Downloads only — applying it is
-					* separate, because the page has to ask before anything is destroyed and the
-					* question should describe what is actually in hand.
+					* Fetch the recommended profile's wallpapers. Downloads only — applying them
+					* is separate, because the page has to ask before anything is destroyed and
+					* the question should describe what is actually in hand.
 					*
-					* The profile is a DIRECTORY, so this is a pool rather than one call: the
-					* config names the slots and each wallpaper is one request, up to
-					* `PRESET_CONCURRENCY` at a time. Each file keeps its own mirror fallback,
-					* retry rounds (the node half's business, ./preset), validation and slot name
-					* in a failure.
+					* The RULES are not fetched at all: they are compiled into the bundle
+					* (./profile), so this is a set of picture transfers and nothing else. That
+					* is why there is no manifest round, no shape gate and no "not a profile"
+					* failure left — nothing remote can decide what this installs.
+					*
+					* Each slot is one request, up to `PRESET_CONCURRENCY` at a time, and each
+					* file keeps its own host fallback, retry rounds (the node half's business,
+					* ./preset), validation and slot name in a failure.
 					*
 					* STRICT: the first wallpaper that cannot be had stops the queue. What had
 					* already arrived is kept for the next press (`presetHeld` below) — the
 					* difference between retrying one file and retrying the lot. Nothing is
-					* touched here, so "the author renamed a file" arrives as an error naming the
-					* file rather than as a profile quietly missing a picture.
+					* touched here, so a wrong URL arrives as an error naming the slot rather
+					* than as a profile quietly missing a picture.
 					*/
 					fetchRecommended: async (onProgress) => {
-						const head = await fetchPresetConfig();
-						if (!head.ok) return {
-							ok: false,
-							error: head.error
-						};
-						const slots = head.slots;
-						const key = presetKey(head.version, head.config);
+						const slots = PROFILE_SLOTS;
+						const key = RECOMMENDED_REVISION;
 						const images = presetResume(presetHeld, key);
 						let bytes = 0;
 						for (const url of Object.values(images)) bytes += url.length;
@@ -9131,18 +9502,46 @@ window.__ModuleLoader__.load({
 						presetHeld = null;
 						return {
 							ok: true,
-							preset: {
-								version: head.version,
-								exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
-								config: head.config,
-								images
-							}
+							preset: recommendedThemeFile(images)
 						};
 					},
 					/** Replace EVERYTHING with a downloaded profile: empty the store, then write it. */
-					applyRecommended: async (preset) => {
-						if (!canWriteConfig()) return false;
-						return await applyThemeFile({ applyActive }, preset, true);
+					applyRecommended: async (_preset) => {
+						if (!canWriteConfig()) return {
+							ok: false,
+							wiped: false
+						};
+						const res = await adoptRecommended();
+						if (!res.ok) {
+							if (res.wiped === true) {
+								const after = await loadPersisted();
+								if (after !== null) {
+									adoptConfig(after.config);
+									clearImages();
+									applyActive();
+								}
+							}
+							return {
+								ok: false,
+								error: res.error,
+								slot: res.slot,
+								wiped: res.wiped === true
+							};
+						}
+						const persisted = await loadPersisted();
+						if (persisted === null) return {
+							ok: false,
+							error: "the profile was installed but could not be read back",
+							wiped: true
+						};
+						adoptConfig(persisted.config);
+						clearImages();
+						for (const slot of cfg.rules.flatMap(ruleSlots)) await loadSlot(slot);
+						applyActive();
+						return {
+							ok: true,
+							wiped: false
+						};
 					},
 					readStoreUsage: () => readStoreUsage(cfg.rules.flatMap(ruleSlots)),
 					pruneOrphanImages: async () => {
@@ -9166,7 +9565,10 @@ window.__ModuleLoader__.load({
 			ctx.effect(() => () => {
 				disposeThemeResets();
 			}, "dsh-background-by-model: theme resets watch");
-			const onPageHide = () => flushSave();
+			const onPageHide = () => {
+				flushSave();
+				drainDeferredDeletes();
+			};
 			window.addEventListener("pagehide", onPageHide);
 			ctx.effect(() => () => window.removeEventListener("pagehide", onPageHide), "dsh-background-by-model: pagehide flush");
 		}