dsh-boot-suite 2.13.21 → 2.15.15

package/lib/host-startup.js

@@ -91,6 +91,13 @@ const DEFAULTS = {
   voiceFx: 'robot',           // 声音效果：none | ai-mech | robot | radio | oldtv | dark（默认机器人，贴近旧版听感）
   voiceLead: 240,             // 提示音之后留一小段空白再开口
   welcomeDelay: 550,          // 05→06 过场和声钟之后等多久再进终幕欢迎语（0–3000ms；实测 550 最顺）
+  /* v2.15.0：iframe 启动模板（division-bigfish-codex）专属文案覆盖；空串 = 用模板自带的 config.js */
+  bigfishUsername: '',
+  bigfishTitle: '',
+  bigfishDesc: '',
+  bigfishForceEgg: false,     // 仅下一次启动：强制判定掉线彩蛋（便于测试）
+  bigfishVoiceFx: 'none',    // 全景大肥鱼模板内五句配音的效果：none|ai-mech|robot|radio|oldtv|dark
+  bigfishVoiceVolume: 50,       // 全景大肥鱼模板内五句配音的音量（0–100，默认 50%）
   identity: 'JOYCE MOORE',    // ← 设置页里可改的「身份名称」
   identityId: '0087',
   accessLevel: '3',
@@ -115,6 +122,26 @@ const DEFAULTS = {
   transitionMs: 600,
   transitionDir: 'left',      // 仅 scanline / slide 使用：left|right|up|down
   hiddenTemplates: [],        // v2.12.4：被用户「隐藏」的内置模板 id 列表（本地模板删除走文件）
+  testTemplates: [],          // v2.14.0：被归到「测试类模板」的模板 id 列表（正式下拉不再显示）
+  promotedTemplates: [],      // v2.14.0：被用户从测试类放回正式列表的模板 id 列表
+  /* v2.14.0 用户自备 BGM：只读本机文件、不上传、不内置。三段 = 第一幕 / 第二幕(含终幕) / 结尾淡出 */
+  bgmEnabled: false,
+  bgmLoop: true,                  // 整体循环；关掉后拍速/拍数/选段不再参与，整首只播一遍
+  bgmFile: '',                // 主音乐（存于 ~/.dsh/startup-music 的文件名）
+  bgmFile2: '',               // 第二段换曲；'' = 同主音乐
+  bgmVolume: 0.5,
+  bgmBpm: 100,                // 拍速（只用于算选段时长）
+  bgmBeats1: 16,              // 第一段拍数（选段时长 = 拍数 * 60 / BPM）
+  bgmBeats2: 32,              // 第二段拍数
+  bgm1Start: 0,               // 第一段在音频中的起点（秒）
+  bgm2Start: 0,               // 第二段起点（秒）
+  bgm1FadeIn: 1,              // 第一段淡入（秒）
+  bgm1FadeOut: 1,             // 第一段淡出（到第二段前，秒）
+  bgm2FadeIn: 1,              // 第二段淡入（秒）
+  bgm2FadeOut: 2,             // 第二段/结束淡出（秒）
+  bgmCrossfade: 1200,         // 两段交叉时长（毫秒）
+  bgm2Loop: false,            // 第二段是否循环
+  bgmDuck: true               // 配音时自动降低音乐（闪避）
 }
 
 const TEXT_KEYS = [
@@ -139,7 +166,7 @@ const ENUMS = {
   transitionOut: TRANSITION_TYPES,
   transitionDir: TRANSITION_DIRS
 }
-const BOOL_KEYS = ['enabled', 'requireInteraction', 'allowSkip', 'sound', 'bedNoise', 'voice', 'voiceCue']
+const BOOL_KEYS = ['enabled', 'requireInteraction', 'allowSkip', 'sound', 'bedNoise', 'voice', 'voiceCue', 'bgmEnabled', 'bgmLoop', 'bgm2Loop', 'bgmDuck']
 /** 数值字段的合法区间（越界即夹取）。 */
 const RANGES = {
   welcomeDelay: [0, 3000],
@@ -149,7 +176,19 @@ const RANGES = {
   voiceRate: [0.5, 2],
   voiceLead: [0, 1200],
   voicePitch: [0, 2],
-  voiceVolume: [0, 1]
+  voiceVolume: [0, 1],
+  bgmVolume: [0, 1],
+  bgmBpm: [40, 220],
+  bgmBeats1: [4, 128],
+  bgmBeats2: [4, 128],
+  bgm1Start: [0, 7200],
+  bgm2Start: [0, 7200],
+  bgm1FadeIn: [0, 10],
+  bgm1FadeOut: [0, 10],
+  bgm2FadeIn: [0, 10],
+  bgm2FadeOut: [0, 10],
+  bgmCrossfade: [0, 5000],
+  bigfishVoiceVolume: [0, 100]
 }
 
 function normalize(input) {
@@ -175,8 +214,15 @@ function normalize(input) {
       out[key] = value
     }
   }
+  const tplIdOk = (x) => typeof x === 'string' && /^[a-z0-9][a-z0-9-]{0,39}$/.test(x)
   out.hiddenTemplates = Array.isArray(src.hiddenTemplates)
-    ? [...new Set(src.hiddenTemplates.filter((x) => typeof x === 'string' && /^[a-z0-9][a-z0-9-]{0,39}$/.test(x)))].slice(0, 60)
+    ? [...new Set(src.hiddenTemplates.filter(tplIdOk))].slice(0, 60)
+    : []
+  out.testTemplates = Array.isArray(src.testTemplates)
+    ? [...new Set(src.testTemplates.filter(tplIdOk))].slice(0, 200)
+    : []
+  out.promotedTemplates = Array.isArray(src.promotedTemplates)
+    ? [...new Set(src.promotedTemplates.filter(tplIdOk))].slice(0, 200)
     : []
   if (!String(out.identity).trim()) out.identity = DEFAULTS.identity
   if (!String(out.identityId).trim()) {
@@ -577,6 +623,57 @@ function apply(ctx) {
   ]
   const TEMPLATE_ID_RE = /^[a-z0-9][a-z0-9-]{0,39}$/
 
+  /* v2.15.0：iframe 启动模板的静态文件路由。
+     /dsh-startup/template-file/<模板id>/<相对路径>：只放行白名单扩展名，禁止 .. 和绝对路径。
+     division-bigfish-codex/config.js 会追加设置页里的「连接用户名 / 标题 / 正文」覆盖。 */
+  const TEMPLATE_FILE_EXT_RE = /\.(html|js|css|json|wav|mp3|ogg|m4a|aac|png|jpe?g|webp|gif|svg|mp4|webm|woff2?|ttf|txt)$/i
+  const TEMPLATE_FILE_SEG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/
+  const TEMPLATE_FILE_TYPES = {
+    '.html': 'text/html; charset=utf-8', '.js': 'text/javascript; charset=utf-8',
+    '.css': 'text/css; charset=utf-8', '.json': 'application/json; charset=utf-8',
+    '.wav': 'audio/wav', '.mp3': 'audio/mpeg', '.ogg': 'audio/ogg', '.m4a': 'audio/mp4', '.aac': 'audio/aac',
+    '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.webp': 'image/webp', '.gif': 'image/gif',
+    '.svg': 'image/svg+xml', '.mp4': 'video/mp4', '.webm': 'video/webm',
+    '.woff2': 'font/woff2', '.woff': 'font/woff', '.ttf': 'font/ttf', '.txt': 'text/plain; charset=utf-8'
+  }
+  disposers.push(registerRoute({
+    kind: 'prefix',
+    path: ROUTE_BASE + '/template-file',
+    handler: (req, res) => {
+      const rest = decodeURIComponent(String(req.url || '').split('?')[0])
+        .slice((ROUTE_BASE + '/template-file/').length)
+      const parts = rest.split('/')
+      const id = String(parts[0] || '')
+      const rel = parts.slice(1).join('/')
+      if (!TEMPLATE_ID_RE.test(id) || !rel || rel.includes('..') || rel.includes(':')) { res.writeHead(404); res.end(); return }
+      if (!rel.split('/').every((seg) => TEMPLATE_FILE_SEG_RE.test(seg))) { res.writeHead(404); res.end(); return }
+      if (!TEMPLATE_FILE_EXT_RE.test(rel)) { res.writeHead(404); res.end(); return }
+      const roots = [path.join(USER_TPL_ROOT, id), path.join(PACKAGE_ROOT, 'templates', id)]
+      let target = null
+      for (const root of roots) {
+        const file = path.join(root, rel)
+        try { if (fs.statSync(file).isFile()) { target = file; break } } catch (err) { /* 下一处 */ }
+      }
+      if (!target) { res.writeHead(404); res.end(); return }
+      const ext = (rel.match(TEMPLATE_FILE_EXT_RE) || [''])[0].toLowerCase()
+      try {
+        let bytes = fs.readFileSync(target)
+        if (id === 'division-bigfish-codex' && rel === 'config.js') {
+          const cfg = readConfig()
+          const extra = []
+          if (cfg.bigfishUsername) extra.push('window.CONFIG.username=' + JSON.stringify(String(cfg.bigfishUsername)) + ';')
+          if (cfg.bigfishTitle) extra.push('window.CONFIG.title=' + JSON.stringify(String(cfg.bigfishTitle)) + ';')
+          if (cfg.bigfishDesc) extra.push('window.CONFIG.description=' + JSON.stringify(String(cfg.bigfishDesc)) + ';')
+          if (cfg.bigfishVoiceFx && cfg.bigfishVoiceFx !== 'none') extra.push('window.CONFIG.voiceFx=' + JSON.stringify(String(cfg.bigfishVoiceFx)) + ';')
+          const vv = Number(cfg.bigfishVoiceVolume); if (Number.isFinite(vv)) extra.push('window.CONFIG.voiceVolume=' + Math.max(0, Math.min(1, vv / 100)) + ';')
+          if (extra.length) bytes = Buffer.concat([bytes, Buffer.from('\n/* dsh-boot-suite overrides */\n' + extra.join('\n') + '\n', 'utf8')])
+        }
+        res.writeHead(200, { 'Content-Type': TEMPLATE_FILE_TYPES[ext] || 'application/octet-stream', 'Cache-Control': 'no-store' })
+        res.end(bytes)
+      } catch (err) { res.writeHead(500); res.end() }
+    }
+  }))
+
   function readTemplate(id) {
     if (!id || !TEMPLATE_ID_RE.test(String(id))) return null
     try { if ((readConfig().hiddenTemplates || []).includes(String(id))) return null } catch (err) { /* 配置读不到就不隐藏 */ }
@@ -1194,6 +1291,102 @@ function apply(ctx) {
     }
   }))
 
+  /* ── v2.14.0：用户自备背景音乐（BGM）────────────────────────────
+     文件只存本机 ~/.dsh/startup-music，不上传任何服务器；设置页只保存文件名。 */
+  const MUSIC_DIR = path.join(DSH_HOME, 'startup-music')
+  const MUSIC_INDEX = path.join(MUSIC_DIR, 'index.json')
+  const MUSIC_FILE_RE = /^music-[a-z0-9]{3,16}-[a-z0-9._-]{1,90}\.(mp3|wav|ogg|m4a|aac|flac)$/i
+  const MUSIC_EXT_RE = /\.(mp3|wav|ogg|m4a|aac|flac)$/i
+  const MUSIC_TYPES = { '.mp3': 'audio/mpeg', '.wav': 'audio/wav', '.ogg': 'audio/ogg', '.m4a': 'audio/mp4', '.aac': 'audio/aac', '.flac': 'audio/flac' }
+  function readMusicIndex() {
+    try {
+      const arr = JSON.parse(fs.readFileSync(MUSIC_INDEX, 'utf8'))
+      return Array.isArray(arr) ? arr.filter((x) => x && typeof x.file === 'string' && MUSIC_FILE_RE.test(x.file)) : []
+    } catch (e) { return [] }
+  }
+  function writeMusicIndex(arr) {
+    try {
+      fs.mkdirSync(MUSIC_DIR, { recursive: true })
+      fs.writeFileSync(MUSIC_INDEX, JSON.stringify(arr, null, 2) + '\n', 'utf8')
+    } catch (e) { /* 索引失败不影响文件本体 */ }
+  }
+  function sendAudioFile(res, file) {
+    const full = path.join(MUSIC_DIR, file)
+    const buf = fs.readFileSync(full)
+    const ext = (file.match(MUSIC_EXT_RE) || ['.mp3'])[0].toLowerCase()
+    res.writeHead(200, {
+      'Content-Type': MUSIC_TYPES[ext] || 'application/octet-stream',
+      'Content-Length': String(buf.length),
+      'Cache-Control': 'no-store'
+    })
+    res.end(buf)
+  }
+  disposers.push(registerRoute({
+    kind: 'exact',
+    path: ROUTE_BASE + '/music/list',
+    handler: async (req, res) => {
+      if ((req.method || 'GET').toUpperCase() !== 'GET') { sendJson(res, 405, { ok: false }); return }
+      try { sendJson(res, 200, { ok: true, files: readMusicIndex(), dir: MUSIC_DIR.replace(/\\/g, '/') }) }
+      catch (err) { sendJson(res, 500, { ok: false, error: String((err && err.message) || err) }) }
+    }
+  }))
+  disposers.push(registerRoute({
+    kind: 'exact',
+    path: ROUTE_BASE + '/music/file',
+    handler: async (req, res) => {
+      if ((req.method || 'GET').toUpperCase() !== 'GET') { sendJson(res, 405, { ok: false }); return }
+      let u = null
+      try { u = new URL(String(req.url || ''), 'http://localhost') } catch (eU) { sendJson(res, 400, { ok: false }); return }
+      const name = String(u.searchParams.get('name') || '')
+      if (!MUSIC_FILE_RE.test(name) || !fs.existsSync(path.join(MUSIC_DIR, name))) { sendJson(res, 404, { ok: false, error: 'music not found' }); return }
+      try { sendAudioFile(res, name) } catch (err) { sendJson(res, 500, { ok: false, error: String((err && err.message) || err) }) }
+    }
+  }))
+  disposers.push(registerRoute({
+    kind: 'exact',
+    path: ROUTE_BASE + '/music/upload',
+    handler: async (req, res) => {
+      if ((req.method || 'GET').toUpperCase() !== 'POST') { sendJson(res, 405, { ok: false }); return }
+      let u = null
+      try { u = new URL(String(req.url || ''), 'http://localhost') } catch (eU) { sendJson(res, 400, { ok: false }); return }
+      const rawName = String(u.searchParams.get('name') || '').replace(/[\\/]/g, '').trim().slice(0, 160)
+      const m = rawName.match(MUSIC_EXT_RE)
+      if (!m) { sendJson(res, 400, { ok: false, error: '只支持 mp3 / wav / ogg / m4a / aac / flac' }); return }
+      const bytes = await readRawBody(req, 100 * 1024 * 1024)
+      if (!bytes || !bytes.length) { sendJson(res, 413, { ok: false, error: '文件为空或超过 100MB' }); return }
+      const ext = m[0].toLowerCase()
+      const stamp = Date.now().toString(36)
+      const rand = Math.random().toString(36).slice(2, 8)
+      const file = 'music-' + stamp + '-' + rand + ext
+      try {
+        fs.mkdirSync(MUSIC_DIR, { recursive: true })
+        fs.writeFileSync(path.join(MUSIC_DIR, file), bytes)
+        const list = readMusicIndex()
+        list.unshift({ file, name: rawName.replace(MUSIC_EXT_RE, '').slice(0, 80) || file, size: bytes.length, added: Date.now() })
+        writeMusicIndex(list.slice(0, 60))
+        sendJson(res, 200, { ok: true, file, name: rawName.replace(MUSIC_EXT_RE, ''), size: bytes.length })
+      } catch (err) { sendJson(res, 500, { ok: false, error: String((err && err.message) || err) }) }
+    }
+  }))
+  disposers.push(registerRoute({
+    kind: 'exact',
+    path: ROUTE_BASE + '/music/delete',
+    handler: async (req, res) => {
+      if ((req.method || 'GET').toUpperCase() !== 'POST') { sendJson(res, 405, { ok: false }); return }
+      const text = await readBody(req, 8 * 1024)
+      let body = null
+      try { body = JSON.parse(text) } catch (e) { body = null }
+      const file = String((body && body.file) || '')
+      if (!MUSIC_FILE_RE.test(file)) { sendJson(res, 400, { ok: false, error: 'bad file' }); return }
+      try {
+        const full = path.join(MUSIC_DIR, file)
+        if (fs.existsSync(full)) fs.unlinkSync(full)
+        writeMusicIndex(readMusicIndex().filter((x) => x.file !== file))
+        sendJson(res, 200, { ok: true, file })
+      } catch (err) { sendJson(res, 500, { ok: false, error: String((err && err.message) || err) }) }
+    }
+  }))
+
   disposers.push(registerRoute({
     kind: 'exact',
     path: ROUTE_BASE + '/templates/delete',

package/lib/host-wallpaper.js

@@ -695,19 +695,40 @@ export default {
       }
     }
 
+    /* v2.14.0：壁纸路由也接入信任栅栏（与 host-startup 同款；DSH connection 服务可拒绝未授权请求） */
+    function resolveWebServer(c) {
+      return (typeof c.get === 'function' ? c.get('webServer') : undefined) || c.webServer
+    }
+    function rejected(req, res) {
+      try {
+        const conn = (typeof ctx.get === 'function' ? ctx.get('connection') : undefined) || ctx.connection
+        if (!conn || typeof conn.requestRejection !== 'function') return false
+        const code = conn.requestRejection(req)
+        if (!code) return false
+        res.statusCode = code
+        res.end()
+        return true
+      } catch { return false }
+    }
+    function registerRoute(route) {
+      const ws = resolveWebServer(ctx)
+      const handler = route.handler
+      ws.register(Object.assign({}, route, { handler: (req, res) => (rejected(req, res) ? undefined : handler(req, res)) }))
+    }
+
     /* v2.13.17：开机就把丢图目录建好；老用户/新装用户都不会再看到「?」 */
     try { mkdirSync(wallpaperImageDir(), { recursive: true }) } catch { /* 忽略 */ }
-    ctx.effect(() => ctx.webServer.register({ kind: 'exact', path: '/chat-wallpaper/config', handler: configHandler }))
-    ctx.effect(() => ctx.webServer.register({ kind: 'exact', path: '/chat-wallpaper/image', handler: imageHandler }))
-    ctx.effect(() => ctx.webServer.register({ kind: 'exact', path: '/chat-wallpaper/images', handler: imagesHandler }))
-    ctx.effect(() => ctx.webServer.register({ kind: 'exact', path: '/chat-wallpaper/set', handler: setHandler }))
-    ctx.effect(() => ctx.webServer.register({ kind: 'exact', path: '/chat-wallpaper/open-dir', handler: openDirHandler }))
-    ctx.effect(() => ctx.webServer.register({ kind: 'exact', path: '/chat-wallpaper/videos', handler: videosHandler }))
-    ctx.effect(() => ctx.webServer.register({ kind: 'exact', path: '/chat-wallpaper/video', handler: videoHandler }))
-    ctx.effect(() => ctx.webServer.register({ kind: 'exact', path: '/chat-wallpaper/video-preview', handler: videoPreviewHandler }))
-    ctx.effect(() => ctx.webServer.register({ kind: 'exact', path: '/chat-wallpaper/videos/delete', handler: videosDeleteHandler }))
-    ctx.effect(() => ctx.webServer.register({ kind: 'exact', path: '/chat-wallpaper/videos/roots', handler: videoRootsHandler }))
-    ctx.effect(() => ctx.webServer.register({ kind: 'exact', path: '/chat-wallpaper/status', handler: statusHandler }))
+    ctx.effect(() => registerRoute({ kind: 'exact', path: '/chat-wallpaper/config', handler: configHandler }))
+    ctx.effect(() => registerRoute({ kind: 'exact', path: '/chat-wallpaper/image', handler: imageHandler }))
+    ctx.effect(() => registerRoute({ kind: 'exact', path: '/chat-wallpaper/images', handler: imagesHandler }))
+    ctx.effect(() => registerRoute({ kind: 'exact', path: '/chat-wallpaper/set', handler: setHandler }))
+    ctx.effect(() => registerRoute({ kind: 'exact', path: '/chat-wallpaper/open-dir', handler: openDirHandler }))
+    ctx.effect(() => registerRoute({ kind: 'exact', path: '/chat-wallpaper/videos', handler: videosHandler }))
+    ctx.effect(() => registerRoute({ kind: 'exact', path: '/chat-wallpaper/video', handler: videoHandler }))
+    ctx.effect(() => registerRoute({ kind: 'exact', path: '/chat-wallpaper/video-preview', handler: videoPreviewHandler }))
+    ctx.effect(() => registerRoute({ kind: 'exact', path: '/chat-wallpaper/videos/delete', handler: videosDeleteHandler }))
+    ctx.effect(() => registerRoute({ kind: 'exact', path: '/chat-wallpaper/videos/roots', handler: videoRootsHandler }))
+    ctx.effect(() => registerRoute({ kind: 'exact', path: '/chat-wallpaper/status', handler: statusHandler }))
 
     const cfg = readConfig()
     const img = resolveImage(cfg)

package/lib/splash.js

@@ -90,6 +90,23 @@
     voiceSource: 'asset',       // asset=优先用真声素材 / tts=全部 TTS 合成
     voiceLead: 240,
     welcomeDelay: 550,             // 终幕欢迎语相对 05→06 和声钟的延迟（ms）
+    /* v2.14.0 用户自备 BGM（与 lib/host-startup.js DEFAULTS 对齐） */
+    bgmEnabled: false,
+    bgmFile: '',
+    bgmFile2: '',
+    bgmVolume: 0.5,
+    bgmBpm: 100,
+    bgmBeats1: 16,
+    bgmBeats2: 32,
+    bgm1Start: 0,
+    bgm2Start: 0,
+    bgm1FadeIn: 1,
+    bgm1FadeOut: 1,
+    bgm2FadeIn: 1,
+    bgm2FadeOut: 2,
+    bgmCrossfade: 1200,
+    bgm2Loop: false,
+    bgmDuck: true,
     identity: 'JOYCE MOORE',    // ← 设置页可改的"身份名称"
     identityId: '0087',
     accessLevel: '3',
@@ -273,6 +290,10 @@
     if (file && /^[a-z0-9][a-z0-9._-]{0,40}\.(mp3|wav|ogg|m4a|aac)$/i.test(file) && TEMPLATE && TEMPLATE.id) {
       return '/dsh-startup/template-asset/' + encodeURIComponent(TEMPLATE.id) + '/' + file
     }
+    /* v2.14.0：全局 line-N 已并入音色包，别再回落已删除的 lib/assets/line-N.mp3（会 404） */
+    var pack = (typeof C !== 'undefined' && C && C.voicePack) || 'f'
+    if (pack === 'builtin') pack = 'f'
+    if (/^line-[1-9]\d?$/.test(name)) return '/dsh-startup/voice/' + pack + '/' + name + '.mp3'
     return '/dsh-startup/asset/' + name + '.mp3'
   }
   var MAX_STEPS = 24
@@ -1483,6 +1504,17 @@
       preload: function () { loadAsset('sfx-tick'); loadAsset('sfx-ticks-run') },
       ensureAsset: ensureAsset,
       playAssetAndWait: playAssetAndWait,
+      ctx: ac,
+      decodeBuffer: function (ab) {
+        var c = ac()
+        return new Promise(function (resolve, reject) {
+          if (!c) { reject(new Error('no audio context')); return }
+          try {
+            var p = c.decodeAudioData(ab, resolve, reject)
+            if (p && typeof p.then === 'function') p.then(resolve, reject)
+          } catch (e) { reject(e) }
+        })
+      },
       /* 文字渐显 / 阶段推进 / 按钮确认 —— 优先用真素材 */
       tick: function () { if (!playAsset('sfx-tick', 0.45)) tone(1760, 0.035, 'square', 0.022) },
       confirm: function () { if (!playAsset('sfx-tick', 0.85)) { tone(660, 0.09, 'triangle', 0.07); tone(990, 0.17, 'triangle', 0.055, 0.085) } },
@@ -1655,7 +1687,9 @@
         return audio.ensureAsset(useAsset).then(function (ok) {
           if (!ok || finished) return 0
           if (C.voiceCue !== false) audio.cue()
+          if (isGlobalLine) bgm.duck(true)
           return audio.playAssetAndWait(useAsset, 0.85, isGlobalLine ? fx : 'none').then(function (ms) {
+            if (isGlobalLine) bgm.duck(false)
             if (ms > 0) setMeter(true)
             return ms
           })
@@ -1798,11 +1832,243 @@
   }
 
   var runStarted = false
+  /* ── v2.14.0 用户自备 BGM ───────────────────────────────────────
+     只播放用户本机导入的音乐（宿主 /dsh-startup/music/file 提供）。
+     三段：第一幕(loop) → 第二幕(可换曲) → 结束淡出；两段之间交叉叠化。
+     任何异常都静默失败，绝不阻塞开机动画。 */
+  var bgm = (function () {
+    var ACTIVE = false
+    var SECOND = false
+    var cur = null          /* { src, gain, name, which } */
+    var baseVol = 0
+    var buffered = {}
+    var ducked = false
+
+    function num(v, d) { var n = Number(v); return isFinite(n) ? n : d }
+    function clamp(v, lo, hi) { return Math.min(hi, Math.max(lo, v)) }
+    function ctxNow() { var c = audio.ctx(); return c ? c.currentTime : 0 }
+
+    function segOf(which) {
+      var bpm = clamp(num(C.bgmBpm, 100), 40, 220)
+      var beats = which === 1 ? clamp(Math.round(num(C.bgmBeats1, 16)), 4, 128) : clamp(Math.round(num(C.bgmBeats2, 32)), 4, 128)
+      return {
+        start: Math.max(0, num(which === 1 ? C.bgm1Start : C.bgm2Start, 0)),
+        dur: beats * 60 / bpm,
+        fadeIn: clamp(num(which === 1 ? C.bgm1FadeIn : C.bgm2FadeIn, 1), 0, 10),
+        fadeOut: clamp(num(which === 1 ? C.bgm1FadeOut : C.bgm2FadeOut, 1), 0, 10),
+        loop: which === 2 ? (C.bgmLoop !== false && C.bgm2Loop === true) : (C.bgmLoop !== false)
+      }
+    }
+
+    function load(name) {
+      if (!name) return Promise.resolve(null)
+      if (buffered[name]) return Promise.resolve(buffered[name])
+      return fetch('/dsh-startup/music/file?name=' + encodeURIComponent(name), { cache: 'no-store' })
+        .then(function (r) { if (!r.ok) throw new Error('bgm http ' + r.status); return r.arrayBuffer() })
+        .then(function (ab) { return audio.decodeBuffer(ab) })
+        .then(function (buf) { if (buf) buffered[name] = buf; return buf })
+        .catch(function () { return null })
+    }
+
+    function kill(fadeSec) {
+      var old = cur
+      cur = null
+      if (!old) return
+      try {
+        var c = audio.ctx()
+        var t = c ? c.currentTime : 0
+        var g = old.gain.gain
+        try {
+          var v = g.value
+          g.cancelScheduledValues(t)
+          g.setValueAtTime(v, t)
+          g.linearRampToValueAtTime(0, t + Math.max(0.05, fadeSec))
+        } catch (e) {}
+        var src = old.src
+        var waitMs = Math.round(Math.max(0.05, fadeSec) * 1000) + 80
+        setTimeout(function () { try { src.stop(); src.disconnect() } catch (e2) {} }, waitMs)
+        setTimeout(function () { try { old.gain.disconnect() } catch (e3) {} }, waitMs + 50)
+      } catch (e) {}
+    }
+
+    function startSeg(which, name) {
+      return load(name).then(function (buf) {
+        if (!ACTIVE || !buf) return
+        var c = audio.ctx()
+        if (!c) return
+        var seg = segOf(which)
+        var loop = seg.loop
+        var dur = loop ? Math.min(buf.duration, Math.max(0.05, seg.dur)) : Math.max(0.05, buf.duration - seg.start)
+        var src = c.createBufferSource()
+        src.buffer = buf
+        src.loop = loop
+        var loopEnd = Math.min(buf.duration, seg.start + dur)
+        if (seg.start >= buf.duration - 0.05) seg.start = 0
+        src.loopStart = Math.max(0, Math.min(seg.start, buf.duration - 0.05))
+        src.loopEnd = Math.max(src.loopStart + 0.05, loopEnd)
+        var gain = c.createGain()
+        gain.gain.value = 0
+        src.connect(gain)
+        gain.connect(c.destination)
+        var t = c.currentTime
+        var level = baseVol
+        if (ducked && C.bgmDuck !== false) level = baseVol * 0.35
+        var fi = Math.max(0.02, seg.fadeIn)
+        try {
+          gain.gain.setValueAtTime(0, t)
+          gain.gain.linearRampToValueAtTime(level, t + fi)
+        } catch (e) {}
+        try { src.start(t, seg.start) } catch (e) { try { src.start() } catch (e2) { return } }
+        cur = { src: src, gain: gain, name: name, which: which }
+      })
+    }
+
+    function begin() {
+      if (C.bgmEnabled !== true) { diagRun('bgm off'); return }
+      if (!C.bgmFile) { diagRun('bgm no file'); return }
+      ACTIVE = true
+      SECOND = false
+      ducked = false
+      baseVol = clamp(num(C.bgmVolume, 0.5), 0, 1)
+      try { audio.ctx() } catch (e) {}
+      diagRun('bgm start file=' + C.bgmFile)
+      startSeg(1, String(C.bgmFile))
+      /* 预载第二段，换曲时无空档 */
+      var name2 = String(C.bgmFile2 || C.bgmFile)
+      if (name2) load(name2)
+    }
+
+    return {
+      start: function () { if (ACTIVE) return; begin() },
+      /* v2.15.10：iframe 模板掉线彩蛋——弹出时截断，重连后重播 */
+      restart: function () { if (ACTIVE) return; begin() },
+      cut: function () { if (!ACTIVE) return; ACTIVE = false; diagRun('bgm cut'); kill(0.12) },
+      toSecond: function () {
+        if (!ACTIVE || SECOND) return
+        SECOND = true
+        var name = String(C.bgmFile2 || C.bgmFile || '')
+        if (!name) return
+        var cross = clamp(num(C.bgmCrossfade, 1200), 0, 5000) / 1000
+        diagRun('bgm to second file=' + name)
+        startSeg(2, name)
+        kill(cross > 0 ? cross : 0.12)
+      },
+      stop: function () {
+        if (!ACTIVE) return
+        ACTIVE = false
+        diagRun('bgm stop')
+        var out = clamp(num(C.bgm2FadeOut, 2), 0, 10)
+        kill(out > 0 ? out : 0.15)
+      },
+      duck: function (on) {
+        if (!ACTIVE || !cur || C.bgmDuck === false) return
+        ducked = !!on
+        var c = audio.ctx()
+        if (!c) return
+        var t = c.currentTime
+        var target = on ? baseVol * 0.35 : baseVol
+        try {
+          cur.gain.gain.cancelScheduledValues(t)
+          cur.gain.gain.setTargetAtTime(target, t, on ? 0.12 : 0.25)
+        } catch (e) {}
+      }
+    }
+  })()
+
+  /* v2.15.0：iframe 启动模板（如 division-bigfish-codex）。
+     整屏 iframe 自己演、自己判定彩蛋；宿主只负责挂载/收尾。
+     - 完成：iframe postMessage {type:'dsh-startup-done'} 或 window 'dsh-startup-done' 事件
+     - 跳过：postMessage skip / Esc / 设置页「立即预览」的跳过 API
+     - 同源时顺手把作者编辑器侧栏藏掉，只留动画舞台。 */
+  var iframeCleanup = null
+
+  function runIframeTemplate(tpl) {
+    diagRun('iframe template ' + tpl.id)
+    var entry = String(tpl.entry || 'index.html').replace(/^\/+/, '')
+    var wrap = document.createElement('div')
+    wrap.setAttribute('data-dsh-iframe-template', tpl.id)
+    wrap.style.cssText = 'position:fixed;inset:0;z-index:2147483647;background:#000;overflow:hidden'
+    var frame = document.createElement('iframe')
+    frame.setAttribute('allow', 'autoplay; fullscreen')
+    frame.setAttribute('allowfullscreen', 'true')
+    frame.style.cssText = 'position:absolute;inset:0;width:100%;height:100%;border:0;background:#000;display:block'
+    frame.style.visibility = 'hidden'
+    frame.src = '/dsh-startup/template-file/' + encodeURIComponent(tpl.id) + '/' + entry + (C.bigfishForceEgg ? '?egg=1' : '')
+    wrap.appendChild(frame)
+    document.body.appendChild(wrap)
+
+    var settle = null
+    var done = new Promise(function (resolve) { settle = resolve })
+    function finishOnce() { if (settle) { var fn2 = settle; settle = null; fn2() } }
+    function onMessage(e) {
+      var d = e && e.data
+      if (d && typeof d === 'object' && (d.type === 'dsh-startup-done' || d.type === 'dsh-startup-skip')) finishOnce()
+      /* v2.15.8：模板内配音开始时闪避 BGM */
+      if (d && typeof d === 'object' && d.type === 'dsh-startup-voice') bgm.duck(d.on === true)
+    if (d && typeof d === 'object' && d.type === 'dsh-startup-bgm') { if (d.on === false) bgm.cut(); else bgm.restart() }
+    }
+    function onKey(e) {
+      if (e.key === 'Escape') { finishOnce(); return }
+      /* v2.15.3：焦点被 DSH 输入框抢走后，父页面把空格转发进 iframe 切 tips */
+      if (e.key === ' ' || e.key === 'Spacebar' || e.code === 'Space') {
+        e.preventDefault()
+        try { frame.contentWindow.postMessage({ type: 'dsh-tip-next' }, '*') } catch (eTip) { /* noop */ }
+      }
+    }
+    window.addEventListener('message', onMessage)
+    window.addEventListener('dsh-startup-done', finishOnce)
+    document.addEventListener('keydown', onKey, true)
+    frame.addEventListener('load', function () {
+      try {
+        var doc = frame.contentDocument
+        if (!doc || !doc.head) return
+        var st = doc.createElement('style')
+        st.textContent = 'html,body{overflow:hidden!important;background:#000!important}main{display:block!important}aside{display:none!important}#stage{width:100vw!important;height:100vh!important;display:grid!important;place-items:center!important}svg#scene{width:100vw!important;height:100vh!important;max-height:none!important}'
+        doc.head.appendChild(st)
+      } catch (err) { /* 跨域就跳过（同源正常情况下不会） */ }
+      /* v2.15.2：把焦点交给 iframe，模板内才能收到空格切 tips；
+         同时把 Esc 处理器注入 iframe（焦点进去后父页面的 keydown 收不到）。 */
+      try {
+        var ew = frame.contentWindow
+        if (ew) {
+          try { ew.focus() } catch (eFocus) { /* noop */ }
+          doc.addEventListener('keydown', function (eKey) {
+            if (eKey.key === 'Escape') {
+              try { ew.parent.postMessage({ type: 'dsh-startup-skip' }, '*') } catch (e9) { /* noop */ }
+            }
+          })
+        }
+      } catch (err2) { /* noop */ }
+      try { frame.style.visibility = 'visible' } catch (err) { /* noop */ }
+    })
+    setTimeout(function () { try { frame.style.visibility = 'visible' } catch (err) { /* noop */ } }, 2000)
+    var safety = setTimeout(finishOnce, (Number(tpl.duration) > 0 ? Number(tpl.duration) * 1000 : 45000) + 90000)
+    iframeCleanup = function () {
+      clearTimeout(safety)
+      window.removeEventListener('message', onMessage)
+      window.removeEventListener('dsh-startup-done', finishOnce)
+      document.removeEventListener('keydown', onKey, true)
+      try { if (wrap.parentNode) wrap.parentNode.removeChild(wrap) } catch (err) { /* noop */ }
+      finishOnce()
+    }
+    return done.then(function () {
+      /* v2.15.11：模板不再自己做白闪；结尾由插件退场转场接管。
+         这里不提前卸 iframe / 停 BGM，交给被转场盖住的 finish() 统一清理。 */
+      return transOut(transType('Out'), finish)
+    })
+  }
+
   function run() {
     if (runStarted) { diagRun('run skipped (duplicate entry)'); return Promise.resolve() }
     runStarted = true
+    if (TEMPLATE && TEMPLATE.engine === 'iframe' && TEMPLATE.id) {
+      /* v2.15.8：iframe 模板也支持用户自备 BGM（父页面播，模板自己演） */
+      try { bgm.start() } catch (eBgmIframe) { /* 静默失败，绝不阻塞启动 */ }
+      return runIframeTemplate(TEMPLATE)
+    }
     diagRun('run enter timeline=' + (TIMELINE ? 'v2' : 'v1') + ' tpl=' + ((TEMPLATE && TEMPLATE.id) || '?') + ' tpl2=' + ((TEMPLATE2 && TEMPLATE2.id) || 'none'))
     audio.bedStart()   /* 本地补丁：开机即"开通道"，底噪一路铺到揭幕 */
+    bgm.start()
     /* v2 时间线模板：不演档案开场，直接跑图层时序 */
     if (TIMELINE) {
       /* v2.12.0：第一幕入场转场（非默认类型才挂覆盖层，且非阻塞 —— 第一幕照跑） */
@@ -2880,6 +3146,8 @@
     if (!TEMPLATE2 || !Array.isArray(TEMPLATE2.layers) || !TEMPLATE2.layers.length) {
       return Promise.resolve()
     }
+    /* v2.15.9：没有第二幕就不切第二段音乐（原来提前调用，导致「不播放第二幕」也会换曲） */
+    bgm.toSecond()
     /* v2.12.0：衔接/退场选择在切换点现场读（设置页「立即预览」会换掉 window.__DSH_STARTUP__） */
     var joinType = transType('Join')
     var joinOverlay = transActive(joinType)
@@ -3578,6 +3846,8 @@
   }
 
   function finish() {
+    bgm.stop()
+    if (iframeCleanup) { try { var cleanIframe = iframeCleanup; iframeCleanup = null; cleanIframe() } catch (eIframe) { /* noop */ } }
     if (finished) return
     diagRun('finish videos=' + videoCount())
     finished = true

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-boot-suite",
-  "version": "2.13.21",
-  "description": "DeepSeek Harness 启动动画与聊天背景插件：两幕开机动画、自定义动画导入、三段转场、6 套干音音色（英文 1 + 日文 5）+ 5 种声音效果、聊天背景图片/循环视频、更新前自动回滚；聊天背景新增黑白原版素材模式。 第二幕提供 2K/4K 两档可选（4K 由社区 1catmint1 的 8K 超分版下采样，BSD-3-Clause）。",
+  "version": "2.15.15",
+  "description": "两幕启动动画（默认档案暖白 + 鲸鱼娘扫描睁眼，2K/4K 可切），支持导入视频/图片、三段转场、11→6 套配音音色与 5 种声音效果、聊天背景/循环视频、内置 iframe 启动模板（全景大肥鱼-含彩蛋版）与更新前自动回滚。",
   "keywords": [
     "dsh",
     "dsh-plugin",