dsh-client-ui-skin-tianlight 2.0.3 → 2.0.4

package/README.md

@@ -6,6 +6,10 @@
 >
 > npm 包名 `dsh-client-ui-skin-tianlight`（v2.0.2 起；旧链接安装包名 `@dsh-external/dsh-client-ui-skin-tianlight`）· 布线行 `ui-skin-tianlight` · body 属性 `data-dsh-tianlight`
 
+## v2.0.4 · 安全修复版（建议升级）
+
+修复了 v2.0.3 验收中发现的问题，其中最重要的一条：Wallpaper Engine 网页壁纸的页面以前会以 DSH 源的身份运行，现在一律沙箱化。2.0.2 和 2.0.3 都受影响，请升级：先完全退出 DSH，再运行 `npx dsh-client-ui-skin-tianlight@latest`。另外 `npx` 不再顺带下载整套 DSH 依赖，安装快很多。详见 [RELEASE-NOTES-v2.0.4.md](RELEASE-NOTES-v2.0.4.md)。
+
 ## v2.0.3 · 一条命令安装
 
 ```bash

package/bin/cli.mjs

@@ -28,6 +28,7 @@ import {
   pruneBackups,
   readJson,
   removeInstalledFiles,
+  isUncPath,
   resolveDshHome,
   scanPatches,
   writeJsonAtomic,
@@ -59,6 +60,7 @@ const M = {
     home: (p) => `DSH 数据目录：${p}`,
     noHome: (p) => `找不到 DSH 数据目录 ${p}\n  请先安装并启动一次 DeepSeek Harness；数据目录不在默认位置时用 --dsh-home <目录> 指定。`,
     noProfiles: '这个 DSH 数据目录里还没有 profile。请先启动一次 DSH 再运行本命令。',
+    unc: '不支持网络路径（\\\\服务器\\共享）作为 DSH 数据目录，请使用本机磁盘上的目录。',
     profileMissing: (p, list) => `没有名为 "${p}" 的 profile。现有：${list.join('、') || '（无）'}`,
     profileAmbiguous: (list) => `有多个 profile：${list.join('、')}\n  请用 --profile <名称> 指定要装到哪一个。`,
     profile: (p) => `目标 profile：${p}`,
@@ -120,6 +122,7 @@ const M = {
     home: (p) => `DSH home: ${p}`,
     noHome: (p) => `DSH home not found: ${p}\n  Install and start DeepSeek Harness once first, or pass --dsh-home <dir>.`,
     noProfiles: 'This DSH home has no profile yet. Start DSH once, then run this command again.',
+    unc: 'Network paths (\\\\server\\share) are not supported as the DSH home; use a local directory.',
     profileMissing: (p, list) => `No profile named "${p}". Existing: ${list.join(', ') || '(none)'}`,
     profileAmbiguous: (list) => `Several profiles exist: ${list.join(', ')}\n  Pick one with --profile <name>.`,
     profile: (p) => `Target profile: ${p}`,
@@ -186,7 +189,10 @@ const die = (line, code = 1) => {
 
 // ---- shared steps -----------------------------------------------------------
 function locate() {
+  const requestedHome = value('--dsh-home') ?? process.env.DSH_HOME ?? ''
+  if (isUncPath(requestedHome)) die(M.unc)
   const dshHome = resolveDshHome({ dshHome: value('--dsh-home') })
+  if (isUncPath(dshHome)) die(M.unc)
   say(M.home(dshHome))
   if (existsSync(dshHome) === false) die(M.noHome(dshHome))
   const profiles = listProfiles(dshHome)

package/bin/installer.mjs

@@ -59,6 +59,11 @@ export function writeJsonAtomic(file, value) {
 
 // ---- locating DSH -----------------------------------------------------------
 
+/** `\\server\share` / `//server/share` (and `\\?\UNC\...`): network locations are refused. */
+export function isUncPath(value) {
+  return typeof value === 'string' && /^(?:\\\\|\/\/)/.test(value.trim())
+}
+
 export function resolveDshHome({ dshHome = null, env = process.env, home = homedir() } = {}) {
   if (typeof dshHome === 'string' && dshHome.trim() !== '') return resolve(dshHome.trim())
   if (typeof env.DSH_HOME === 'string' && env.DSH_HOME.trim() !== '') return resolve(env.DSH_HOME.trim())
@@ -401,37 +406,57 @@ export function pruneBackups(profileDir, keep = KEEP_BACKUPS) {
  * backup folder (a link is just unlinked), then swap the staged copy in. If the swap
  * fails the previous copy is put back.
  */
+export const STAGING_PREFIX = `.${PKG_NAME}.tl-staging-`
+
+/** v2.0.4 (L1): staging copies left behind by an interrupted/failed earlier run. */
+export function cleanStaleStaging(modulesDir) {
+  const removed = []
+  if (existsSync(modulesDir) === false) return removed
+  for (const name of readdirSync(modulesDir)) {
+    if (name.startsWith(STAGING_PREFIX) === false) continue
+    safeRemoveTree(join(modulesDir, name))
+    removed.push(name)
+  }
+  return removed
+}
+
 export function installFiles({ srcRoot = SELF_ROOT, profileDir, backupDir, entries = packageEntries(srcRoot) }) {
   const modules = join(profileDir, 'node_modules')
   mkdirSync(modules, { recursive: true })
+  cleanStaleStaging(modules)
   const target = join(modules, PKG_NAME)
-  const staging = join(modules, `.${PKG_NAME}.tl-staging-${process.pid}`)
-  rmSync(staging, { recursive: true, force: true })
-  mkdirSync(staging, { recursive: true })
-  for (const entry of entries) cpSync(join(srcRoot, entry), join(staging, entry), { recursive: true })
-  const stagedManifestPath = join(staging, 'package.json')
-  const stagedManifest = readJson(stagedManifestPath)
-  if (stagedManifest.private !== undefined) {
-    delete stagedManifest.private
-    writeFileSync(stagedManifestPath, JSON.stringify(stagedManifest, null, 2) + '\n', 'utf8')
-  }
-
-  const before = inspectInstalled(profileDir)
+  const staging = join(modules, `${STAGING_PREFIX}${process.pid}`)
   let parked = null
-  if (before.kind === 'link') {
-    removeLink(target)
-  } else if (before.kind === 'dir') {
-    parked = join(backupDir, 'previous-package')
-    renameSync(target, parked)
-  }
+  let swapped = false
   try {
-    renameSync(staging, target)
-  } catch (error) {
-    if (parked !== null && existsSync(target) === false) renameSync(parked, target)
-    rmSync(staging, { recursive: true, force: true })
-    throw error
+    mkdirSync(staging, { recursive: true })
+    for (const entry of entries) cpSync(join(srcRoot, entry), join(staging, entry), { recursive: true })
+    const stagedManifestPath = join(staging, 'package.json')
+    const stagedManifest = readJson(stagedManifestPath)
+    if (stagedManifest.private !== undefined) {
+      delete stagedManifest.private
+      writeFileSync(stagedManifestPath, JSON.stringify(stagedManifest, null, 2) + '\n', 'utf8')
+    }
+    const before = inspectInstalled(profileDir)
+    if (before.kind === 'link') {
+      removeLink(target)
+    } else if (before.kind === 'dir') {
+      parked = join(backupDir, 'previous-package')
+      renameSync(target, parked)
+    }
+    try {
+      renameSync(staging, target)
+      swapped = true
+    } catch (error) {
+      if (parked !== null && existsSync(target) === false) renameSync(parked, target)
+      throw error
+    }
+    return { previous: before, parked }
+  } finally {
+    // v2.0.4 (L1): whatever failed — copy, parking (EPERM on a locked file), swap —
+    // never leave the ~37 MB staging copy behind.
+    if (swapped === false) safeRemoveTree(staging)
   }
-  return { previous: before, parked }
 }
 
 export function removeInstalledFiles({ profileDir, backupDir }) {

package/build-info.json

@@ -1,8 +1,8 @@
 {
   "schema": 1,
   "product": "dsh-client-ui-skin-tianlight",
-  "version": "2.0.3",
-  "commit": "e257c5800dbf9dafeba84093f8c57a292ce0eb9c",
-  "builtAt": "2026-11-12T23:55:42+08:00",
+  "version": "2.0.4",
+  "commit": "37c4db1b350a47b6794262bbe246a259710177db",
+  "builtAt": "2026-11-13T17:10:57+08:00",
   "source": "pack"
 }

package/docs/THIRD-PARTY.md

@@ -0,0 +1,161 @@
+# 第三方组件与许可
+
+天光皮肤本体是 MIT（见根目录 `LICENSE`）。本文件列出随仓库分发（或作为实现依据）的第三方组件、
+版本、许可与归属；发布包（`node tools/pack.mjs`）会带上 `lib/we-wallpaper/`、`vendor/we-wallpaper/`、
+`vendor/webwallgl/` 及各自的许可文件。
+
+## 1. dsh-we-wallpaper 宿主半（MIT）
+
+v0.6.0 的 Wallpaper Engine 库集成把上游 **dsh-we-wallpaper** 的宿主半（MIT）**以源码形式内嵌**，
+使皮肤能在**不填写任何目录**的前提下浏览本机 Wallpaper Engine 库。
+
+| 项 | 值 |
+|---|---|
+| 上游 | <https://github.com/pbadgpmeb22791-sketch/dsh-we-wallpaper> |
+| 版本 / 提交 | `v0.4.0` @ `61ccaa2`（把 v0.4.0 提升到仓库根的 restructure commit） |
+| 归属 | Copyright (c) 2026 **dsh-we-wallpaper contributors** |
+| 内嵌文件 | `lib/we-wallpaper/host.mjs`（单 ESM，仅 Node 内置模块；上游 `lib/index.js`，由上游 TS 源码构建） |
+| 许可全文 | [`lib/we-wallpaper/LICENSE`](../lib/we-wallpaper/LICENSE) |
+| 修改说明 | [`lib/we-wallpaper/README.md`](../lib/we-wallpaper/README.md)（grep `TIANLIGHT` 可定位全部改动） |
+
+保留：无框架扫描器、无依赖 `.pkg`/TEX 解码器、HTTP 路由族。
+未内嵌：上游 cordis/settings 插件接线与上游客户端半（由本皮肤自己的客户端渲染列表并播放壁纸）。
+
+对本仓库的修改（摘要，详细见上表 README）：去掉插件接线改为纯函数导出；同源校验放宽到 DSH Desktop
+webview 与 `127.0.0.1/localhost`（跨站仍 403）；运行状态/缓存从 `~/.dsh` 移到插件 gitignored `state/`
+（`TIANLIGHT_WE_HOME` 可覆盖）；wcap 路径指向 `vendor/we-wallpaper/wcap/`；本地 project 的 `.pkg` 也支持解出；
+场景动态缓存 503 语义明确；扫描器结果映射为本皮肤的 `_wallpapers`/`_engines` 形状。
+
+```text
+MIT License
+
+Copyright (c) 2026 dsh-we-wallpaper contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+## 2. wcap（Unlicense / 公有领域）
+
+可选的「场景动态缓存」（Windows-only）使用上游 dsh-we-wallpaper 随附的窗口捕获工具 `wcap`：
+
+| 文件 | 来源 | 许可 |
+|---|---|---|
+| `vendor/we-wallpaper/wcap/wcap-x64.exe` | 上游 `tools/wcap/wcap-x64.exe` | Unlicense（public domain） |
+| `vendor/we-wallpaper/wcap/scene-capture-desktop.ps1` | 上游 `tools/wcap/` | Unlicense |
+| `vendor/we-wallpaper/wcap/send-window-capture-hotkey.ps1` | 上游 `tools/wcap/` | Unlicense |
+| 许可全文 | 上游 `tools/wcap/LICENSE`，逐字内嵌 | [`vendor/we-wallpaper/wcap/LICENSE`](../vendor/we-wallpaper/wcap/LICENSE) |
+
+```text
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or distribute
+this software, either in source code form or as a compiled binary, for any
+purpose, commercial or non-commercial, and by any means.
+
+In jurisdictions that recognize copyright laws, the author or authors of
+this software dedicate any and all copyright interest in the software to the
+public domain. We make this dedication for the benefit of the public at large
+and to the detriment of our heirs and successors. We intend this dedication
+to be an overt act of relinquishment in perpetuity of all present and future
+rights to this software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <https://unlicense.org>.
+```
+
+> `wcap` 只在用户显式请求「生成动态」时被 `POST /api/we-wallpaper/scene-video/generate/<id>` 调用；
+> 仓库测试套件用 `TIANLIGHT_WE_DISABLE_SCENE_VIDEO=1` 跳过它（不会在维护者桌面弹窗）。
+
+## 3. RePKG（MIT，DXT 解码的实现依据）
+
+`lib/we-wallpaper/host.mjs` 的 `pkg-tex` 解包/解码器在格式实现上参考并移植了 **RePKG** 的 DXT 解码
+（LibSquish 派生的 C# 实现）；上游 dsh-we-wallpaper 同样以此为实现依据。
+
+| 项 | 值 |
+|---|---|
+| 项目 | <https://github.com/notscuffed/repkg> |
+| 归属 | Copyright (c) **Xalcon @ mmowned.com**（见上游文件头） |
+| 许可 | MIT |
+| 使用方式 | 格式/算法参考与 DXT 解码移植；未整份复制其 C# 实现 |
+
+RePKG 的 MIT 许可全文（v2.0.4 起逐字附在这里，随 npm 包分发）：
+
+```
+MIT License
+
+Copyright (c) Xalcon @ mmowned.com
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+## 4. WebWallGL（MIT）
+
+Wallpaper Engine 场景通道使用仓库内 `vendor/webwallgl/` 的 WebWallGL 3.0（可选依赖，不内联进
+`lib/client.js`）：
+
+| 项 | 值 |
+|---|---|
+| 位置 | `vendor/webwallgl/webwallgl.global.min.js`（+ `README.upstream.md`） |
+| 归属 | Copyright (c) 2026 **oneincase** `<462534624@qq.com>` |
+| 许可 | MIT；全文见 [`vendor/webwallgl/LICENSE`](../vendor/webwallgl/LICENSE) |
+
+## 4.1 二进制与压缩代码（v2.0.4 起公布校验值）
+
+下面两个文件不是从本仓库源码构建的，包内无法审计其源码，只能按来源与校验值核对。`wcap-x64.exe` 未做代码签名，且只在用户显式点击「生成动态」时才会运行。
+
+| 文件 | SHA-256 | 来源 |
+|---|---|---|
+| `vendor/we-wallpaper/wcap/wcap-x64.exe` | `4bd124febf537f0f569bd5cb7486ddbb9e664b509f39e421e6949767829b6be6` | 上游 dsh-we-wallpaper `tools/wcap/wcap-x64.exe`，原样复制 |
+| `vendor/webwallgl/webwallgl.global.min.js` | `2f86ab955f3377e2fa2cfd5ffa72f5813fe8f6e4a272295fed36f4c1e626b1e5` | WebWallGL 3.0 发布的压缩构建，原样复制（见 `vendor/webwallgl/README.upstream.md`） |
+
+`tools/test.mjs` 会断言这两个校验值，文件被替换时测试会变红。
+
+## 5. 默认演示素材
+
+仓库完整版附带的 `assets/bg-4k.mp4` / `assets/cat.png` 是演示素材，
+**不在 MIT 代码许可范围内**：桌宠形象与视频版权归各自权利方，替换或再分发前请确认你有使用权；
+发布包默认**包含**这两个文件（`node tools/pack.mjs` 的随包演示素材白名单，Release 附件同源；
+需要纯代码包时用 `node tools/pack.mjs --code-only`，此时只带代码、清单、`lib/`、`vendor/`、
+`presets/` 与 `assets/README.md`）。
+
+---
+
+*本文件随 v0.6.0 新增；若后续再内嵌第三方代码，请在同一 PR 里补行并附许可全文。*

package/lib/index.js

@@ -73,7 +73,7 @@ const HOST_API = '2'
  * manifest is stamped with it. The handshake no longer compares it, so a
  * browser-half-only update can run against an unchanged host process.
  */
-const BUILD = '2.0.3'
+const BUILD = '2.0.4'
 
 function readRoots() {
   try {

package/lib/media-types.js

@@ -5,7 +5,7 @@
 // list is exactly how "the upload accepted a format the player cannot decode"
 // bugs happen. One table, imported by every route.
 
-import { statSync } from 'node:fs'
+import { realpathSync, statSync } from 'node:fs'
 import { dirname, resolve, sep } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -198,7 +198,17 @@ export function isSafeSvgBuffer(buffer) {
 		if (SVG_NAMED_ENTITIES.has(entity[1]) === false) return { ok: false, reason: 'named entity' }
 		entity = entityPattern.exec(text)
 	}
-	const tagPattern = /<\s*\/?\s*([A-Za-z_][\w.-]*:)?([A-Za-z_][\w.-]*)([^>]*?)>/g
+	// v2.0.4 (M1): a raw `>` inside a quoted attribute value (`alt=">"`) used to end
+	// the tag early so the attributes after it were never inspected. Two layers now:
+	// a document-wide raw scan that does not depend on where a tag ends, and a tag
+	// scanner whose attribute part consumes whole quoted strings.
+	if (/[\s/"']on[a-z]+\s*=/i.test(text)) return { ok: false, reason: 'inline event handler' }
+	for (const denied of SVG_DENY_ELEMENTS) {
+		if (new RegExp('<\\s*(?:[A-Za-z_][\\w.-]*:)?' + denied + '(?![\\w.:-])', 'i').test(text)) {
+			return { ok: false, reason: 'dangerous element: ' + denied }
+		}
+	}
+	const tagPattern = /<\s*\/?\s*([A-Za-z_][\w.-]*:)?([A-Za-z_][\w.-]*)((?:[^>"']|"[^"]*"|'[^']*')*?)>/g
 	let firstLocalName = ''
 	let match = tagPattern.exec(text)
 	while (match !== null) {
@@ -250,16 +260,43 @@ export function isSafeSvgBuffer(buffer) {
 }
 
 /**
- * Resolves `name` inside `root` and proves the result stays inside it. Symlinks and
- * `..` are both defeated by comparing the RESOLVED path against the resolved root
- * with a trailing separator, which is the only containment test that cannot be
- * fooled by a crafted filename.
+ * v2.0.4 (M2): true when the REAL path of `target` (symlinks and Windows junctions
+ * resolved) is `root` itself or inside the real path of `root`. Lexical checks
+ * (`resolve()` + startsWith) cannot see links; this one can. A path that cannot be
+ * resolved (missing, permission) is reported as outside — callers fail closed.
+ */
+export function realPathInside(root, target) {
+  try {
+    const realRoot = realpathSync.native(root)
+    const realTarget = realpathSync.native(target)
+    const fold = (value) => (process.platform === 'win32' ? value.toLowerCase() : value)
+    const prefix = realRoot.endsWith(sep) ? realRoot : realRoot + sep
+    return fold(realTarget) === fold(realRoot) || fold(realTarget).startsWith(fold(prefix))
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Resolves `name` inside `root` and proves the result stays inside it: `..` and
+ * separators are refused by SAFE_NAME plus a lexical prefix test, and an existing
+ * entry must also resolve (through any symlink/junction) to a real path inside the
+ * real root (v2.0.4; before that the comment claimed this but the code did not).
  */
 export function safeJoin(root, name) {
   if (typeof name !== 'string' || SAFE_NAME.test(name) === false) return null
   const joined = resolve(root, name)
   const prefix = root.endsWith(sep) ? root : root + sep
-  return joined.startsWith(prefix) ? joined : null
+  if (joined.startsWith(prefix) === false) return null
+  let exists = false
+  try {
+    statSync(joined)
+    exists = true
+  } catch {
+    exists = false
+  }
+  if (exists && realPathInside(root, joined) === false) return null
+  return joined
 }
 
 /** Card metadata: size is cheap (one stat) and lets the library show real weight. */

package/lib/pet-chat.js

@@ -31,6 +31,15 @@ export const PET_CHAT_MAX_CHARS = 4000
 export const PET_CHAT_MAX_TOKENS = 600
 /** Whole-call deadline; the browser adapter also races at 20 s. */
 export const PET_CHAT_TIMEOUT_MS = 20000
+/**
+ * v2.0.4 (M3): host-side call budget. The browser keeps its own (stricter, user
+ * configurable) quota, but any same-origin script could call this route directly,
+ * so the host enforces a ceiling of its own. Set just above the most the UI can ever
+ * spend (user daily limit max 120 + 12 autonomous thoughts) so normal use never hits
+ * it. Every accepted call counts, including failures and timeouts.
+ */
+export const PET_CHAT_HOST_PER_MINUTE = 8
+export const PET_CHAT_HOST_PER_DAY = 140
 
 /**
  * Fixed system prompt. It must not be assembled from Host or page data: the page
@@ -203,7 +212,33 @@ export function createPetChat(options = {}) {
 			? Math.floor(options.maxBodyBytes)
 			: PET_CHAT_MAX_BODY_BYTES
 	const maxChars = Number.isFinite(options.maxChars) && options.maxChars > 0 ? Math.floor(options.maxChars) : PET_CHAT_MAX_CHARS
+	const perMinute =
+		Number.isFinite(options.perMinute) && options.perMinute > 0 ? Math.floor(options.perMinute) : PET_CHAT_HOST_PER_MINUTE
+	const perDay = Number.isFinite(options.perDay) && options.perDay > 0 ? Math.floor(options.perDay) : PET_CHAT_HOST_PER_DAY
+	const now = typeof options.now === 'function' ? options.now : () => Date.now()
 	let busy = false
+	/** Accepted-call timestamps of the last minute + the per-local-day counter. */
+	let recent = []
+	let dayKey = ''
+	let dayCount = 0
+	const localDayKey = (ms) => {
+		const d = new Date(ms)
+		return `${d.getFullYear()}-${d.getMonth() + 1}-${d.getDate()}`
+	}
+	/** Reserve one call from the host budget; false when the minute or day is spent. */
+	const takeBudget = () => {
+		const t = now()
+		recent = recent.filter((stamp) => t - stamp < 60000)
+		const key = localDayKey(t)
+		if (key !== dayKey) {
+			dayKey = key
+			dayCount = 0
+		}
+		if (recent.length >= perMinute || dayCount >= perDay) return false
+		recent.push(t)
+		dayCount += 1
+		return true
+	}
 
 	/**
 	 * Handle one request. Never throws, never rejects; the response body is always
@@ -287,6 +322,11 @@ export function createPetChat(options = {}) {
 					respond(429, { ok: false, code: PET_CHAT_CODES.BUSY })
 					return
 				}
+				if (takeBudget() === false) {
+					req?.resume?.()
+					respond(429, { ok: false, code: PET_CHAT_CODES.RATE_LIMIT })
+					return
+				}
 				busy = true
 				acquired = true
 				controller = new AbortController()

package/lib/scene-project.js

@@ -12,7 +12,7 @@
 
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs'
 import { join, resolve, sep } from 'node:path'
-import { ROUTE, SAFE_NAME, fileSize } from './media-types.js'
+import { ROUTE, SAFE_NAME, fileSize, realPathInside } from './media-types.js'
 
 /** Extensions a scene renderer may legitimately request. No HTML/JS/EXE. */
 export const SCENE_FILE_EXT = new Set([
@@ -81,6 +81,8 @@ export function sceneFilePath(projectDir, segments) {
     current = resolve(current, segment)
     if (current.startsWith(prefix) === false) return null
   }
+  // v2.0.4 (M2): a junction/symlink inside the project must not lead outside it.
+  if (existsSync(current) && realPathInside(base, current) === false) return null
   const ext = current.slice(current.lastIndexOf('.')).toLowerCase()
   if (SCENE_FILE_EXT.has(ext) === false) return null
   return current

package/lib/we-wallpaper/host.mjs

@@ -30,6 +30,7 @@ import { fileURLToPath } from "node:url";
 import { basename, dirname, extname, isAbsolute, join, resolve, sep } from "node:path";
 import { deflateSync } from "node:zlib";
 import { parseRange } from "../http-media.js";
+import { realPathInside } from "../media-types.js";
 //#region src/pkg-tex.ts
 /**
 * Wallpaper Engine scene.pkg → background image extractor.
@@ -2184,6 +2185,9 @@ function resolveWebTarget(base, segments) {
 	const resolvedBase = resolve(base);
 	const target = resolve(join(resolvedBase, ...segments.length > 0 ? segments : ["index.html"]));
 	if (target !== resolvedBase && !target.startsWith(resolvedBase + sep)) return null;
+	// v2.0.4 (M2): lexical containment alone lets a junction/symlink inside the
+	// project point anywhere on disk; the REAL path must stay inside the real root.
+	if (existsSync(target) && !realPathInside(resolvedBase, target)) return null;
 	return target;
 }
 /**
@@ -2235,6 +2239,33 @@ function pipeFileSafe(res, path, options) {
 * @param abs - absolute file path.
 * @param cacheControl - cache directive (default no-cache).
 */
+/**
+ * v2.0.4 (H1): every HTML document this host serves is a wallpaper page from the
+ * user's Wallpaper Engine library. Served from the DSH origin without a policy it
+ * would run with the DSH origin's storage and APIs whenever it is opened directly or
+ * embedded by any site (the read-only /web route deliberately accepts cross-site and
+ * `Origin: null` requests so the skin's sandboxed frame can load its sub-resources).
+ * `sandbox allow-scripts` makes the document an opaque origin no matter who loads it
+ * — exactly what the skin's own `<iframe sandbox="allow-scripts">` already does, so
+ * the wallpaper behaves the same in the skin — and frame-ancestors keeps other sites
+ * from embedding it at all.
+ */
+export const WE_HTML_CSP =
+	"default-src 'none'; script-src * blob: data: 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval'; " +
+	"worker-src * blob: data:; style-src * blob: data: 'unsafe-inline'; img-src * data: blob:; media-src * data: blob:; " +
+	"font-src * data: blob:; connect-src * data: blob:; frame-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'; " +
+	"frame-ancestors 'self' dsh-app: dsh:; sandbox allow-scripts";
+/** Response headers that make a served HTML/XHTML/XML document inert to the DSH origin. */
+export function weDocumentHeaders(type) {
+	const lower = String(type ?? "").toLowerCase();
+	if (lower.startsWith("text/html") || lower.startsWith("application/xhtml") || lower.startsWith("application/xml") || lower.startsWith("text/xml")) {
+		return {
+			"content-security-policy": WE_HTML_CSP,
+			"referrer-policy": "no-referrer"
+		};
+	}
+	return {};
+}
 function serveFile(req, res, abs, cacheControl = "no-cache") {
 	const stat = statSync(abs, { throwIfNoEntry: false });
 	if (stat === void 0 || !stat.isFile()) {
@@ -2258,6 +2289,7 @@ function serveFile(req, res, abs, cacheControl = "no-cache") {
 	if (type === "image/svg+xml") {
 		headers["content-security-policy"] = "sandbox; default-src 'none'; style-src 'unsafe-inline'; img-src data:; font-src data:";
 	}
+	Object.assign(headers, weDocumentHeaders(type));
 	if (req.method === "HEAD") {
 		res.writeHead(200, {
 			...headers,

package/lib/web-project.js

@@ -17,7 +17,7 @@
 
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs'
 import { basename, join, resolve, sep } from 'node:path'
-import { ROUTE, SAFE_NAME } from './media-types.js'
+import { ROUTE, SAFE_NAME, realPathInside } from './media-types.js'
 import { servePath, sendText } from './http-media.js'
 
 /** Extensions a web wallpaper page may load. No archives, no executables. */
@@ -102,7 +102,9 @@ export function webProjectFilePath(projectDir, segments) {
   if (list.length === 0) {
     const entry = projectEntryName(readProjectJson(base))
     if (SAFE_NAME.test(entry) === false) return null
-    return join(base, entry)
+    const entryPath = join(base, entry)
+    if (existsSync(entryPath) && realPathInside(base, entryPath) === false) return null
+    return entryPath
   }
   if (list.length > MAX_SEGMENTS) return null
   let current = base
@@ -117,6 +119,8 @@ export function webProjectFilePath(projectDir, segments) {
     current = resolve(current, segment)
     if (current.startsWith(prefix) === false) return null
   }
+  // v2.0.4 (M2): a junction/symlink inside the project must not lead outside it.
+  if (existsSync(current) && realPathInside(base, current) === false) return null
   const ext = current.slice(current.lastIndexOf('.')).toLowerCase()
   if (WEB_FILE_EXT.has(ext) === false) return null
   return current

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-client-ui-skin-tianlight",
   "description": "Tianlight skin for the dsh web GUI: Makoto Shinkai daylight skies, a looping video wallpaper, a wallpaper library with upload/rotation, optional WebWallGL scene support, and a draggable Mint chibi-cat desktop companion",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "type": "module",
   "main": "lib/index.js",
   "bin": {
@@ -43,6 +43,14 @@
     "@deepseek-ai/dsh-api-remotes": ">=0.2.0-rc.1 <0.2.1-0 || >=0.2.1-0 <0.2.2-0 || >=0.2.2-0 <0.3.0-0",
     "@deepseek-ai/dsh-api-session-controller": ">=0.2.0-rc.1 <0.2.1-0 || >=0.2.1-0 <0.2.2-0 || >=0.2.2-0 <0.3.0-0"
   },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/dsh-api-remotes": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-api-session-controller": {
+      "optional": true
+    }
+  },
   "scripts": {
     "build": "node tools/build.mjs",
     "build:check": "node tools/build.mjs --check",
@@ -68,6 +76,7 @@
     "assets",
     "presets",
     "cordis.patch.yml",
+    "docs/THIRD-PARTY.md",
     "skin.json",
     "build-info.json",
     "LICENSE",

package/skin.json

@@ -2,7 +2,7 @@
   "id": "tianlight",
   "name": "天光",
   "nameEn": "TIANLIGHT",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "author": "local",
   "tagline": "新海诚式天光 ・ 动态壁纸与可上传壁纸库 ・ 可选 WebWallGL 场景 ・ 薄荷小猫桌宠 ・ 职责通道（role pack → 桌宠气泡/选择） ・ 生活节奏与主动开口预算 ・ 可替换图片/≤32MiB 视频形象 ・ 液态玻璃三档 ・ AI 桌宠（严格权限） ・ 接入 DSH Agent（受控） ・ 桌宠即入口 ・ 兼容 DSH 0.2.0–0.2.2",
   "description": "以新海诚天光为基调的沉浸式皮肤：全屏循环视频壁纸置于内容之下，半透明天光玻璃面板；壁纸库支持上传、隐藏、轮播、画面滤镜与标签检索；可选的 WebWallGL 通道实时渲染 Wallpaper Engine 场景；可拖拽的薄荷 Q 版小猫桌宠会靠近回应、陪你互动。v0.5.0 加入了宿主配置同步与 schema 迁移、模块开关、渲染预算、特效与氛围层、时段/专注联动、系统音频与 Now Playing、网页壁纸、动态分辨率与预裁剪缓存、可选转码、导入导出包与配方分享链接、排版增强、可读性护栏、键盘无障碍与 zh/en 双语；v0.6.0 接入 Wallpaper Engine 壁纸库；v0.7.0 新增职责通道：外部角色包可在桌宠旁显示带按钮的职责气泡（审批/完成/喝水等），并把用户选择（等会儿/静音/休息时再说）回传给职责引擎。本版只改浏览器半，无需重启 DSH（Ctrl+F5 即可）。同一份构建适配 DSH 0.2.0 / 0.2.1 / 0.2.2（选择器桥按运行时钩子分层降级）。　v1.0.0 正式版：桌宠升级为有生活节奏的角色智能体——虚拟时钟/每日作息/主动开口预算/跨会话记忆，职责提醒可被静默与预算闸门延迟并在窗口期自动回放；形象可替换为本地图片或 ≤32 MiB 视频；新增可选液态玻璃（真实/柔和/磨砂，低电量自动降级）；新增「角色 / 生活」设置页与专注计时；无宿主路由改动，Ctrl+F5 即可。　v1.1.0：角色中枢（侧栏入口 + 全屏面板，一屏管生活/形象/玻璃/记忆）、AI 桌宠（本地大脑 + 可选 LLM 适配器，严格能力白名单与硬上限、审计与暂停开关）、形象支持本地上传图片/视频（≤32MiB）。　v1.2.0：桌宠右键直达角色中枢；新增受控 DSH Agent 接入（agentChat 权限默认关闭、显式授权、无自动触发、每日≤10 次/≤500 字/60s，可连接现有会话或新建桌宠会话）。　v1.3.0：角色入口收进桌宠——去掉设置页「角色 / 生活」与侧栏「角色」按钮，右键桌宠（或桌宠菜单「角色中枢」）打开全部功能；生活节奏设置已并入角色中枢。　v1.4.0：权限模型调整——「驱动 DSH」仍强烈永久禁止；直接联网/读写文件/执行命令/代审批/代发消息/安装插件改为用户可显式授予的高风险权限（默认关闭、可撤销、全程审计；皮肤不内置实现，需你注册能力适配器才会被调用）。　v1.5.0：恢复默认桌宠形象、液态玻璃默认开启并加预览（实时可见）、角色中枢新增天气卡（启用/城市/定位/刷新，显示当前天气）、一键功能自检、应用内反馈面板（复制/预填 GitHub Issue/下载 JSON）+ GitHub issue 模板。　v1.6.0：安全上限整体上调（主动开口 12/50、本地 chat 20/分 1200/天、输入 1000 字、LLM 日 60/上限 120、分钟 6、输出 1200 字、20s 超时、Agent 日 30/上限 100、输入 1000 字/120s）；液态玻璃在 depth!=off 时统一应用到全部界面（侧栏/设置/壁纸库/中枢/对话框/菜单/列表框/输入区/气泡/胶囊/提示等），无壁纸场景时自动补一层玻璃兜底，关闭档零变化、低电量自动降级。　v1.6.1：液态玻璃升级 v2（OriginOS 风更厚磨砂、多层 specular 高光、1px 亮暗边、外柔光、细噪点与柔和回弹）；修复侧栏「新会话」按钮深色块并玻璃化；DSH 主界面右上新增常驻天气胶囊（点击打开角色中枢天气卡）。　v1.6.2：移除壁纸左上角固定的「晨光/太阳」装饰（旧版每张壁纸重建场景都会绘制一个 top-left dawn burst，看起来像常驻小太阳）；场景层只保留 veil 天空光渐变，切换壁纸不再出现任何固定角标（仅视觉变化）。　v1.6.3：显示名精简为「天光」（skin id / 包名 / data 属性 / 设置键均不变，旧用户无迁移成本）；完成 DSH 0.2.0-rc.2 / 0.2.1-rc.5 / 0.2.2-rc.1 三线兼容性实证（compat-matrix 三行全 COMPATIBLE、hook-scan 全桥接钩子在位、upgrade-check 升级假设全部成立）。　v1.6.4（公开 v1.0.3 正式版）：桌宠新增「AI 对话」菜单（输入条 + 气泡回复，识别当前替换的图片/视频形象，视频上方空间不足自动翻转）；每个自定义形象可编辑一套动作名与回复（按 mediaId 生效，未改动跟随默认）；角色中枢形象文件名常显列表（文件名/类型/大小，点击切换）；完成全代码审查修复（默认文案冻结、WE 宿主 stream error、低电量异步泄漏、bridge 节点清理、转码超时兜底、宿主同源栅栏收紧、聊天视口翻转）。　v1.6.5（公开 v1.0.4 正式版）：修复桌宠「AI 对话」关不掉的问题——新增面板「×」关闭按钮、点空白关闭、全局 Esc 关闭、[hidden] 真正隐藏，并支持桌宠靠近屏幕底部时点桌宠直接退出（菜单被裁到视口外也能退出）。仅浏览器半，无宿主路由改动，Ctrl+F5 即可。　v1.6.6（公开 v1.0.5 正式版）：修复 AI 对话面板在桌宠默认靠右位置时「×」关闭按钮被视口裁掉的问题（面板水平夹取进视口，拖拽/窗口缩放后重算），并把顶部翻转阈值改为按面板实际高度计算（新增按钮行后不再裁到顶部），略增大关闭按钮点击区域。仅浏览器半；版本常量变更，Ctrl+F5 + 重启 DSH 一次可消除宿主半 stale 提示。　v1.6.7（公开 v1.0.6 正式版）：壁纸面板默认视图新增一等「URL 地址」「ShaderToy 代码」快捷来源（点击直达编辑器，并修复 URL/Shader 应用假成功与卡死）；桌宠「AI 对话」收到回复即自动收起输入面板、只留气泡回复；新增「☰」对话历史（与 AI 对话相邻）：可查看历史、开启新对话、编辑已发消息、删除对话，数据存本机 localStorage。仅浏览器半；版本常量变更，Ctrl+F5 + 重启 DSH 一次可消除宿主半 stale 提示。　v1.6.8（公开 v1.0.7 正式版）：桌宠新增「自主思考」智能体——按间隔做内心独白、可自主开口（受既有主动开口预算约束），聊天回复融入最近对话/时段/记忆/当前想法更像人；角色中枢新增「自主思考」卡片（开关/间隔/自主开口/现在想一下/最近想法/清空）。不新增权限与网络通道，不驱动 DSH Agent；仅浏览器半，Ctrl+F5 即可；版本常量变更，重启 DSH 一次可消除宿主半 stale 提示。　v2.0.0：桌宠 AI 对话接入 DSH 自带 LLM（宿主路由 _pet-chat；默认跟随 DSH 默认模型，仍须在角色中枢两步授权 llm；不建会话、不调工具、60/日、6/分、1200 字、20s 超时；失败按稳定错误码提示）；版本号统一为 2.0.0（仓库 / DSH 安装 / GitHub 发布同名同号）；并入 v1.6.8 之后的体检修复批次（设置同步合并与冲突保护、宿主/桥接安全收口、统一浮层层序、壁纸切换与性能、可读性/低电量、导出导入一致性）；默认演示素材精简为 bg-4k.mp4（H.264 4K）与 cat.png，bg-main.mp4 改为可选自备首选槽。本版改了宿主半：升级后必须重启 DSH 一次 + Ctrl+F5，之后纯浏览器半更新仍只需 Ctrl+F5。",