dsh-folia 4.9.1 → 4.10.1

package/lib/client.js

@@ -780,6 +780,34 @@ window.__ModuleLoader__.load({
 				  "…": "…",
 				  // 开机动画：已开启但无选片时的提示（4.8.2）
 				  "已开启，但还没有选片 —— 下载一条后点「使用」": "Enabled, but no clip is selected yet — download one, then press Use",
+
+				  // ── 助手皮肤页签（4.10.0）────────────────────────────────────────────────
+				  "助手皮肤": "Assistant skins",
+				  "🎨 助手皮肤": "🎨 Assistant skins",
+				  "皮肤包安装到皮肤中心目录；装完到「设置 → 皮肤中心」里点选即可启用。皮肤中心与本插件读同一个目录，无需重启。": "Skin packs are installed into the skin centre's directory; pick one in Settings → Skin centre to enable it. It reads the same folder, so no restart is needed.",
+				  "本机已装（{n}）": "Installed ({n})",
+				  "站点皮肤（{n}）": "Skins on the site ({n})",
+				  "还没有安装任何皮肤 —— 从下面的站点清单里挑一个。": "No skins installed yet — pick one from the site list below.",
+				  "站点上还没有皮肤。": "No skins on the site yet.",
+				  "含动效钩子": "animated hooks",
+				  "已安装": "Installed",
+				  "已安装过：{name}": "Already installed: {name}",
+				  "已安装：{name} —— 到「设置 → 皮肤中心」点它即可启用": "Installed: {name} — pick it in Settings → Skin centre to enable",
+				  "卸载中…": "Uninstalling…",
+				  "动态": "Animated",
+				  "这个包里没有 skin.json，不是皮肤包": "No skin.json in this archive — not a skin pack",
+				  "包里有非法路径（已整包拒绝）": "The archive contains an unsafe path (rejected entirely)",
+				  "包太大了（上限 200 MB）": "Archive is too large (200 MB limit)",
+				  "下载地址不在白名单里": "The download host is not allow-listed",
+				  "站点被关闭了（DSH_FOLIA_SITE=off）": "The site is disabled (DSH_FOLIA_SITE=off)",
+				  "这个文件不是 zip": "This file is not a zip",
+
+				  // ── 助手皮肤：皮肤中心缺失时的引导（4.10.1）──────────────────────────
+				  "皮肤中心没装：它是**独立插件** @linxin666/dsh-client-ui-skin-center（不在 dsh-web-all 里，那个只是聚合包）。装它才能启用皮肤：": "The skin centre is not installed: it is its own plugin, @linxin666/dsh-client-ui-skin-center (dsh-web-all is only an aggregate). Install it to enable skins:",
+				  "已复制安装命令": "Install command copied",
+				  "复制失败，请手动选中上面的命令": "Copy failed — select the command above manually",
+				  "复制命令": "Copy command",
+				  "先装皮肤中心，否则皮肤装好也没法启用": "Install the skin centre first, or the skin cannot be enabled",
 				};
 
 				// ── 内联模块：src/i18n-copy-picker.js —— 英文词表域：壁纸选择器与快捷面板（picker-* · quick-panel · sidebar-right · theme-follow）（构建期注入；勿手改本段）──
@@ -18213,6 +18241,209 @@ window.__ModuleLoader__.load({
 
 				// 仅供单测驱动（构建期内联时会剥掉 export，不影响产物）。
 
+				// ── 内联模块：src/panel-tabs-skins.js —— 「助手皮肤」页签：站点皮肤清单/安装/卸载 — 渲染由皮肤中心接管，我们只把 zip 解到 $DSH_HOME/skins（构建期注入；勿手改本段）──
+				/**
+				 * panel-tabs-skins.js — 「助手皮肤」页签：站点皮肤清单 / 安装 / 卸载 / 去皮肤中心启用。
+				 *
+				 * 与「桌宠」页签同构（fetch → busy → note → 卡片列表）。差别在**安装之后谁负责渲染**：
+				 * 桌宠由本插件自己画（pet-layer.js），皮肤则由皮肤中心接管 —— 我们只把 zip 解到
+				 * `$DSH_HOME/skins/<id>/`，皮肤中心下一次 catalog 扫描就会认领（它的缓存键里带父目录 mtime）。
+				 * 所以这个页签的职责边界是：**装/卸 + 告诉你下一步去哪启用**，不重复实现渲染。
+				 */
+
+				const SKIN_STYLE = {
+				  row: { display: "flex", alignItems: "center", gap: "10px", flexWrap: "wrap" },
+				  card: {
+				    display: "flex", flexDirection: "column", gap: "6px", padding: "10px",
+				    borderRadius: "10px", border: "1px solid rgba(255,255,255,0.14)",
+				    background: "rgba(255,255,255,0.04)", width: "188px",
+				  },
+				  thumb: {
+				    width: "100%", aspectRatio: "16 / 9", borderRadius: "6px",
+				    backgroundSize: "cover", backgroundPosition: "center",
+				    backgroundColor: "rgba(0,0,0,0.25)",
+				  },
+				  title: { fontSize: "13px", fontWeight: 600, whiteSpace: "nowrap", overflow: "hidden", textOverflow: "ellipsis" },
+				  meta: { fontSize: "11px", opacity: 0.72 },
+				  grid: { display: "flex", gap: "10px", flexWrap: "wrap", marginTop: "10px" },
+				  badge: {
+				    fontSize: "10px", padding: "1px 6px", borderRadius: "4px",
+				    background: "rgba(30,90,160,0.55)", alignSelf: "flex-start",
+				  },
+				};
+
+				function skinFmtBytes(n) {
+				  const v = Number(n) || 0;
+				  if (!v) return "";
+				  if (v < 1024 * 1024) return Math.round(v / 1024) + " KB";
+				  return (v / 1048576).toFixed(1) + " MB";
+				}
+
+				function SkinsTabPanel() {
+				  const [state, setState] = React.useState(null);
+				  const [busy, setBusy] = React.useState("");
+				  const [note, setNote] = React.useState(null);
+
+				  const load = React.useCallback(async (force) => {
+				    try {
+				      const resp = await apiJson("/skins/list" + (force ? "?refresh=1" : ""), { parse: "always" });
+				      const doc = (resp && resp.data) || null;
+				      if (resp && resp.ok && doc && doc.ok) {
+				        setState(doc);
+				        if (doc.siteError && doc.siteError !== "site-off") {
+				          setNote({ ok: false, text: weT("站点清单读不到：{msg}", { msg: String(doc.siteError) }) });
+				        }
+				      } else {
+				        setNote({ ok: false, text: weT("读取失败：{msg}", { msg: (doc && doc.error) || "unknown" }) });
+				      }
+				    } catch (e) {
+				      setNote({ ok: false, text: weT("请求失败：{msg}", { msg: (e && e.message) || weT("网络错误") }) });
+				    }
+				  }, []);
+
+				  React.useEffect(() => { load(false); }, [load]);
+
+				  const act = async (kind, payload, label) => {
+				    const structural = kind === "install" || kind === "remove";
+				    if (structural) setBusy(kind + ":" + ((payload && payload.id) || ""));
+				    setNote(null);
+				    try {
+				      const resp = await apiPostJson("/skins/" + kind, payload || {}, { parse: "always" });
+				      const r = (resp && resp.data) || null;
+				      if (resp && resp.ok && r && r.ok) {
+				        if (kind === "install") {
+				          setNote({
+				            ok: true,
+				            text: r.exists
+				              ? weT("已安装过：{name}", { name: label || "" })
+				              : weT("已安装：{name} —— 到「设置 → 皮肤中心」点它即可启用", { name: label || "" }),
+				          });
+				        }
+				        if (kind === "remove") setNote({ ok: true, text: weT("已卸载：{name}", { name: label || "" }) });
+				        await load(true);
+				      } else {
+				        const code = (r && r.error) || "failed";
+				        const map = {
+				          'no-skin-json': weT("这个包里没有 skin.json，不是皮肤包"),
+				          'unsafe-entry': weT("包里有非法路径（已整包拒绝）"),
+				          'too-large': weT("包太大了（上限 200 MB）"),
+				          'host-not-allowed': weT("下载地址不在白名单里"),
+				          'site-off': weT("站点被关闭了（DSH_FOLIA_SITE=off）"),
+				          'not-a-zip': weT("这个文件不是 zip"),
+				        };
+				        setNote({ ok: false, text: map[code] || weT("操作失败：{code}", { code }) });
+				      }
+				    } catch (e) {
+				      setNote({ ok: false, text: weT("请求失败：{msg}", { msg: (e && e.message) || weT("网络错误") }) });
+				    } finally {
+				      setBusy("");
+				    }
+				  };
+
+				  const children = [];
+				  children.push(React.createElement("div", { key: "head", style: SKIN_STYLE.row },
+				    React.createElement("div", { style: { fontSize: "13px", fontWeight: 600 } }, weT("🎨 助手皮肤")),
+				    React.createElement("button", {
+				      className: "we-picker__btn", type: "button",
+				      disabled: Boolean(busy),
+				      onClick: () => load(true),
+				    }, weT("刷新")),
+				  ));
+
+				  // 皮肤中心在不在，决定这段提示说什么：
+				  //   在   → "装完去皮肤中心点它"（本页签只负责落盘）
+				  //   不在 → 明说它是个**独立插件**（不在 dsh-web-all 里），给一条可复制的安装命令
+				  //   unknown（探测失败）→ 保守地按"在"讲，不吓唬用户
+				  const skinCenter = (state && state.skinCenter) || "unknown";
+				  if (skinCenter === "absent") {
+				    children.push(React.createElement("div", {
+				      key: "hint-absent",
+				      className: "we-picker__hint",
+				      style: { margin: "6px 0 4px", color: "#ffd08a", lineHeight: "1.6" },
+				    }, weT("皮肤中心没装：它是**独立插件** @linxin666/dsh-client-ui-skin-center（不在 dsh-web-all 里，那个只是聚合包）。装它才能启用皮肤：")));
+				    children.push(React.createElement("div", { key: "cmd", style: { display: "flex", gap: "8px", alignItems: "center", margin: "0 0 6px" } },
+				      React.createElement("code", {
+				        style: { fontSize: "11px", padding: "3px 8px", borderRadius: "6px", background: "rgba(255,255,255,0.08)" },
+				      }, "dsh plugin --profile web add @linxin666/dsh-client-ui-skin-center"),
+				      React.createElement("button", {
+				        className: "we-picker__btn", type: "button",
+				        onClick: () => { try { navigator.clipboard.writeText("dsh plugin --profile web add @linxin666/dsh-client-ui-skin-center"); setNote({ ok: true, text: weT("已复制安装命令") }); } catch { setNote({ ok: false, text: weT("复制失败，请手动选中上面的命令") }); } },
+				      }, weT("复制命令")),
+				    ));
+				  } else {
+				    children.push(React.createElement("div", {
+				      key: "hint",
+				      className: "we-picker__hint",
+				      style: { margin: "6px 0 4px", opacity: 0.8 },
+				    }, weT("皮肤包安装到皮肤中心目录；装完到「设置 → 皮肤中心」里点选即可启用。皮肤中心与本插件读同一个目录，无需重启。")));
+				  }
+
+				  // 提示行常驻占位（与开机动画/桌宠页签同一条纪律：不因 note 出现/消失让面板跳高度）
+				  children.push(React.createElement("div", {
+				    key: "note",
+				    className: "we-picker__hint",
+				    style: {
+				      color: note && !note.ok ? "#ff9a9a" : "#8ee6a8",
+				      margin: "2px 0 8px", minHeight: "18px", lineHeight: "18px",
+				      opacity: note ? 1 : 0, transition: "opacity 120ms linear",
+				    },
+				  }, note ? note.text : "\u00a0"));
+
+				  const installed = (state && state.installed) || [];
+				  if (state) {
+				    children.push(React.createElement("div", { key: "installed-head", className: "we-picker__hint" },
+				      weT("本机已装（{n}）", { n: installed.length })));
+				    children.push(React.createElement("div", { key: "installed", style: SKIN_STYLE.grid },
+				      installed.length === 0
+				        ? [React.createElement("span", { key: "none", className: "we-picker__hint" }, weT("还没有安装任何皮肤 —— 从下面的站点清单里挑一个。"))]
+				        : installed.map((s) => React.createElement("div", { key: s.id, style: SKIN_STYLE.card },
+				          React.createElement("div", { style: { ...SKIN_STYLE.title, color: s.accent || undefined } }, s.name || s.id),
+				          React.createElement("div", { style: SKIN_STYLE.meta },
+				            [s.version ? "v" + s.version : "", skinFmtBytes(s.bytes), s.hasHooks ? weT("含动效钩子") : ""]
+				              .filter(Boolean).join(" · ")),
+				          React.createElement("div", { style: { display: "flex", gap: "6px", alignItems: "center" } },
+				            React.createElement("button", {
+				              className: "we-picker__btn", type: "button",
+				              disabled: Boolean(busy),
+				              onClick: () => act("remove", { id: s.id }, s.name),
+				            }, busy === "remove:" + s.id ? weT("卸载中…") : weT("卸载")),
+				          ),
+				        )),
+				    ));
+				  }
+
+				  const site = (state && state.site) || [];
+				  children.push(React.createElement("div", { key: "site-head", className: "we-picker__hint", style: { marginTop: "10px" } },
+				    weT("站点皮肤（{n}）", { n: site.length })));
+				  children.push(React.createElement("div", { key: "site", style: SKIN_STYLE.grid },
+				    site.length === 0
+				      ? [React.createElement("span", { key: "none", className: "we-picker__hint" }, weT("站点上还没有皮肤。"))]
+				      : site.map((s) => {
+				        const busyThis = busy === "install:" + s.id;
+				        return React.createElement("div", { key: s.id, style: SKIN_STYLE.card },
+				          s.thumbUrl
+				            ? React.createElement("div", {
+				              style: { ...SKIN_STYLE.thumb, backgroundImage: "url(" + JSON.stringify(s.thumbUrl) + ")" },
+				            })
+				            : React.createElement("div", { style: SKIN_STYLE.thumb }),
+				          React.createElement("div", { style: SKIN_STYLE.title, title: s.title }, s.title),
+				          React.createElement("div", { style: SKIN_STYLE.meta },
+				            [skinFmtBytes(s.bytes), (s.tags || []).includes("动态") ? weT("动态") : ""].filter(Boolean).join(" · ")),
+				          s.installed
+				            ? React.createElement("div", { style: SKIN_STYLE.badge }, weT("已安装"))
+				            : React.createElement("button", {
+				              className: "we-picker__btn", type: "button",
+				              disabled: Boolean(busy),
+				              title: skinCenter === "absent" ? weT("先装皮肤中心，否则皮肤装好也没法启用") : undefined,
+				              onClick: () => act("install", { id: s.id, url: s.url }, s.title),
+				            }, busyThis ? weT("安装中…") : weT("安装")),
+				        );
+				      }),
+				  ));
+
+				  return React.createElement("div", { className: "we-picker", style: { display: "flex", flexDirection: "column" } }, children);
+				}
+
 				// ── 内联模块：src/features.js —— 客户端功能注册表：页签条 / 整区面板 / 常驻挂载层。装配点（quick-panel、client.js）只查表，不写功能名（构建期注入；勿手改本段）──
 				/**
 				 * features.js（客户端）— **功能注册表**：页签声明、面板工厂、挂载钩子。
@@ -18241,6 +18472,8 @@ window.__ModuleLoader__.load({
 				  { id: "playback", get label() { return weT("播放"); } },
 				  // 桌宠是"桌面上多出来的一只东西"，与壁纸/开机动画并列。
 				  { id: "pets", get label() { return weT("桌宠"); } },
+				  // 助手皮肤：装的是皮肤中心的皮肤包。我们只管装/卸，渲染与启用归皮肤中心。
+				  { id: "skins", get label() { return weT("助手皮肤"); } },
 				];
 
 				/**
@@ -18250,6 +18483,7 @@ window.__ModuleLoader__.load({
 				const WE_FEATURE_PANELS = {
 				  boot: BootTabPanel,
 				  pets: PetsTabPanel,
+				  skins: SkinsTabPanel,
 				};
 
 				/**

package/lib/features.js

@@ -126,12 +126,15 @@ export const FEATURES = [
     host: [
       'lib/routes/settings.js',
       'lib/routes/presets.js',
+      // 助手皮肤：站点皮肤包 → $DSH_HOME/skins（皮肤中心读同一目录，写盘即生效）。
+      'lib/routes/skins.js',
       'lib/settings-schema.js',
       'lib/components/fonts/routes/fontsets.js',
       'lib/components/fonts/routes/system-fonts.js',
     ],
     client: [
       'src/panel-tabs-appearance.js',
+      'src/panel-tabs-skins.js',
       'src/glass.js',
       'src/glass-panel.js',
       'src/glass-surfaces.js',
@@ -151,7 +154,7 @@ export const FEATURES = [
       'src/about-assets.js',
       'src/nav-icon.js',
     ],
-    tab: ['appearance'],
+    tab: ['appearance', 'skins'],
   },
   {
     id: 'playback',

package/lib/route-registry.js

@@ -19,6 +19,7 @@ import { registerInventoryRoutes, warmInventorySiteCache } from './routes/invent
 import { registerModulesRoutes, warmModulesCache } from './routes/modules.js';
 import { registerBootRoutes } from './routes/boot.js';
 import { registerSiteThumbRoutes } from './routes/site-thumb.js';
+import { registerSkinsRoutes } from './routes/skins.js';
 import { registerPetsRoutes } from './routes/pets.js';
 
 /**
@@ -71,6 +72,14 @@ export const FEATURE_ROUTE_FAMILIES = [
     register: registerPetsRoutes,
     deps: (c) => ({ disposers: c.disposers, base: c.base, log: c.log }),
   },
+  {
+    id: 'skins',
+    file: 'lib/routes/skins.js',
+    register: registerSkinsRoutes,
+    // 皮肤安装目标是 $DSH_HOME/skins（皮肤中心读同一个目录）：由路由自己按 DSH_HOME 解析，
+    // 不额外引入注入面 —— 少一处注入，就少一种"改了目录却没生效"的可能。
+    deps: (c) => ({ disposers: c.disposers, base: c.base, log: c.log }),
+  },
 ];
 
 /**

package/lib/routes/skins.js

@@ -0,0 +1,394 @@
+/**
+ * routes/skins.js — **助手皮肤**页签的宿主半边：列站点皮肤、安装到皮肤中心目录、卸载。
+ *
+ * 为什么是这个形态（而不是另造一套渲染）：皮肤中心扫的是 `$DSH_HOME/skins/<id>/`
+ * （`skin.json` + `skin.css` + 可选 `hooks.mjs` + `assets/`）。我们只要**把站点上的 zip 解到那个目录**，
+ * 皮肤中心下一次 catalog 扫描就会认领它 —— 它的缓存键里带父目录 `mtimeMs`，新增目录必然穿透缓存。
+ * 所以这里不"通知"皮肤中心，也不需要它配合：写盘即生效。
+ *
+ * 数据契约（站点一条 = 一个 zip；解出来必须是 v2 皮肤目录）：
+ *   <皮肤根>/<id>/skin.json  必填（id/name 从里面取，**不信任 URL 里的名字**）
+ *   <皮肤根>/<id>/skin.css   必填（contributes.stylesheet 指向它）
+ *   hooks.mjs 可选；带它时皮肤中心会要求 `dsh-market.provenance.json` 字节对得上才执行 ——
+ *   我们的 zip 是原样打的，所以 provenance 一起解出来，语义与市场安装一致。
+ *
+ * 纪律：
+ *   · 只写 `$DSH_HOME/skins`，删也只删它下面（realpath 前缀校验，防符号链接逃逸）；
+ *   · 下载白名单 = 站点 host（挡 SSRF）；只认 zip 魔数；单包上限 200 MB；
+ *   · 解包拒路径穿越（整包拒绝，不是跳过）；可执行后缀一律不落盘；
+ *   · 失败清干净：绝不留下没有 skin.json 的残缺目录（否则皮肤中心会把它算进"坏皮肤"）。
+ */
+import { createHash } from 'node:crypto';
+import { inflateRawSync } from 'node:zlib';
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+/** 注入契约（ADR-0013 D12）。 */
+export { unzipSkinZip, safeSkinId };
+export const DEPS = ['disposers', 'base', 'log'];
+
+/** 站点分类 slug：助手皮肤。 */
+const SKIN_CATEGORY = 'assistant-skin';
+const MAX_ZIP_BYTES = 200 * 1024 * 1024;
+const FETCH_TIMEOUT_MS = 60000;
+const SKIN_ID_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/;
+/** 可执行/脚本后缀：皮肤包不需要，一律不写（防"皮肤包里塞个 exe"）。 */
+const SKIP_EXEC_RE = /\.(exe|dll|bat|cmd|com|scr|ps1|sh|msi|vbs|wsf|hta|lnk|jar)$/i;
+
+function dshHome() {
+  return process.env.DSH_HOME || join(process.env.APPDATA || homedir(), 'dsh-desktop', 'harness');
+}
+/** 皮肤根：与皮肤中心同一个目录（它读 `$DSH_HOME/skins`）。 */
+function skinsRoot() { return join(dshHome(), 'skins'); }
+
+function siteBase() {
+  const raw = process.env.DSH_FOLIA_SITE;
+  if (typeof raw === 'string' && raw.trim().toLowerCase() === 'off') return null;
+  const base = (typeof raw === 'string' && raw.trim()) ? raw.trim() : 'https://folia-5ve.pages.dev';
+  return base.replace(/\/+$/, '');
+}
+
+/**
+ * 皮肤中心是否在线。
+ *
+ * 为什么由宿主探而不是前端探：两个插件跑在同一个 webServer 上，用请求自带的 Host 就能问到自己 —— 
+ * 前端也能问，但宿主这一侧拿到的结果与"装没装"一一对应，而且不受浏览器缓存/跨源策略影响。
+ * 判据用**它自己的 catalog 路由**：该路由不需要鉴权（实测 200），404 就是没装。
+ */
+const skinCenterProbe = { at: 0, state: 'unknown' };
+async function probeSkinCenter(hostHeader, force) {
+  const now = Date.now();
+  if (!force && skinCenterProbe.at && now - skinCenterProbe.at < 30000) return skinCenterProbe.state;
+  let state = 'unknown';
+  if (hostHeader) {
+    try {
+      const r = await fetch('http://' + hostHeader + '/api/skin-center/v2/catalog', { signal: AbortSignal.timeout(4000) });
+      state = r.status === 404 ? 'absent' : (r.ok ? 'present' : 'present');
+      // 401/403 也说明插件在（只是该路由被别的版本加了鉴权）；只有 404 才代表没装。
+    } catch { state = 'unknown'; }
+  }
+  skinCenterProbe.at = now;
+  skinCenterProbe.state = state;
+  return state;
+}
+
+/** 站点列表缓存（30 秒）：面板打开与"刷新"共用，避免每次都打站点。 */
+const siteCache = { at: 0, items: [], error: null };
+const SITE_TTL_MS = 30000;
+
+async function fetchSiteSkins(force) {
+  const now = Date.now();
+  if (!force && siteCache.at && now - siteCache.at < SITE_TTL_MS) return siteCache;
+  const base = siteBase();
+  if (!base) { siteCache.at = now; siteCache.items = []; siteCache.error = 'site-off'; return siteCache; }
+  try {
+    const url = base + '/api/public/wallpapers?category=' + encodeURIComponent(SKIN_CATEGORY) + '&limit=100';
+    const res = await fetch(url, { headers: { accept: 'application/json' }, signal: AbortSignal.timeout(20000) });
+    if (!res.ok) throw new Error('http-' + res.status);
+    const body = await res.json();
+    const items = (body && body.data && body.data.items) || [];
+    siteCache.items = items.map((it) => ({
+      id: String(it.slug || ''),
+      title: String(it.title || it.slug || ''),
+      bytes: Number(it.bytes) || 0,
+      mime: String(it.mime || ''),
+      url: String(it.url || ''),
+      thumbUrl: it.thumbUrl ? String(it.thumbUrl) : '',
+      tags: (() => { try { return JSON.parse(it.tags || '[]'); } catch { return []; } })(),
+    }));
+    siteCache.error = null;
+  } catch (e) {
+    siteCache.error = (e && e.message) || 'fetch-failed';
+    siteCache.items = siteCache.items || [];
+  }
+  siteCache.at = now;
+  return siteCache;
+}
+
+/** 本机已装皮肤（只读 `$DSH_HOME/skins`）。 */
+function listInstalled() {
+  const root = skinsRoot();
+  let names = [];
+  try { names = readdirSync(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name); } catch { return []; }
+  const out = [];
+  for (const dirId of names) {
+    const dir = join(root, dirId);
+    let manifest;
+    try { manifest = JSON.parse(readFileSync(join(dir, 'skin.json'), 'utf8')); } catch { continue; }
+    let bytes = 0;
+    try { bytes = dirBytes(dir); } catch { /* 忽略 */ }
+    out.push({
+      dirId,
+      id: String(manifest.id || dirId),
+      name: String(manifest.name || manifest.nameEn || manifest.id || dirId),
+      nameEn: manifest.nameEn ? String(manifest.nameEn) : '',
+      version: String(manifest.version || ''),
+      author: String(manifest.author || ''),
+      accent: manifest.accent ? String(manifest.accent) : '',
+      hasHooks: existsSync(join(dir, 'hooks.mjs')),
+      hasProvenance: existsSync(join(dir, 'dsh-market.provenance.json')),
+      bytes,
+    });
+  }
+  out.sort((a, b) => a.name.localeCompare(b.name, 'zh-Hans-CN'));
+  return out;
+}
+
+function dirBytes(dir) {
+  let total = 0;
+  for (const name of readdirSync(dir)) {
+    const abs = join(dir, name);
+    const st = statSync(abs);
+    total += st.isDirectory() ? dirBytes(abs) : st.size;
+  }
+  return total;
+}
+
+/* ── zip 读取（只读，够用即可；判据见 test/skins-http.mjs）────────────────── */
+/**
+ * 解一个 zip 缓冲成条目数组。
+ *
+ * @param {Buffer} buf
+ * @param {{ maxEntries?: number, maxEntryBytes?: number, maxTotalBytes?: number }} [limits]
+ * @returns {{ name: string, data: Buffer, isDir: boolean }[]}
+ * @throws {Error} code: `not-a-zip` / `bad-zip` / `unsafe-entry` / `too-large`
+ */
+function unzipSkinZip(buf, limits = {}) {
+  const maxEntries = limits.maxEntries || 4000;
+  const maxEntry = limits.maxEntryBytes || 256 * 1024 * 1024;
+  const maxTotal = limits.maxTotalBytes || 512 * 1024 * 1024;
+  if (!Buffer.isBuffer(buf) || buf.length < 22) throw Object.assign(new Error('not a zip'), { code: 'not-a-zip' });
+  const magic = buf.readUInt32LE(0);
+  if (magic !== 0x04034b50 && magic !== 0x06054b50) throw Object.assign(new Error('not a zip'), { code: 'not-a-zip' });
+  let eocd = -1;
+  for (let i = buf.length - 22; i >= Math.max(0, buf.length - 22 - 65535); i -= 1) {
+    if (buf.readUInt32LE(i) === 0x06054b50) { eocd = i; break; }
+  }
+  if (eocd < 0) throw Object.assign(new Error('no EOCD'), { code: 'bad-zip' });
+  const count = buf.readUInt16LE(eocd + 10);
+  const cdSize = buf.readUInt32LE(eocd + 12);
+  const cdOffset = buf.readUInt32LE(eocd + 16);
+  if (count > maxEntries) throw Object.assign(new Error('too many entries'), { code: 'too-large' });
+  if (cdOffset + cdSize > buf.length) throw Object.assign(new Error('CD out of range'), { code: 'bad-zip' });
+  const out = [];
+  let p = cdOffset;
+  let total = 0;
+  for (let i = 0; i < count; i += 1) {
+    if (p + 46 > buf.length || buf.readUInt32LE(p) !== 0x02014b50) throw Object.assign(new Error('bad CD'), { code: 'bad-zip' });
+    const method = buf.readUInt16LE(p + 10);
+    const compSize = buf.readUInt32LE(p + 20);
+    const uncompSize = buf.readUInt32LE(p + 24);
+    const nameLen = buf.readUInt16LE(p + 28);
+    const extraLen = buf.readUInt16LE(p + 30);
+    const commentLen = buf.readUInt16LE(p + 32);
+    const localOffset = buf.readUInt32LE(p + 42);
+    const name = buf.toString('utf8', p + 46, p + 46 + nameLen);
+    p += 46 + nameLen + extraLen + commentLen;
+    const norm = String(name || '').replace(/\\/g, '/');
+    if (!norm || norm.includes('\0') || norm.startsWith('/') || /^[a-zA-Z]:/.test(norm) || norm.split('/').some((s) => s === '..')) {
+      throw Object.assign(new Error('unsafe entry: ' + name), { code: 'unsafe-entry' });
+    }
+    if (norm.endsWith('/')) { out.push({ name: norm, data: Buffer.alloc(0), isDir: true }); continue; }
+    if (uncompSize > maxEntry) throw Object.assign(new Error('entry too large'), { code: 'too-large' });
+    total += uncompSize;
+    if (total > maxTotal) throw Object.assign(new Error('archive too large'), { code: 'too-large' });
+    if (localOffset + 30 > buf.length || buf.readUInt32LE(localOffset) !== 0x04034b50) throw Object.assign(new Error('bad local header'), { code: 'bad-zip' });
+    const lNameLen = buf.readUInt16LE(localOffset + 26);
+    const lExtraLen = buf.readUInt16LE(localOffset + 28);
+    const dataStart = localOffset + 30 + lNameLen + lExtraLen;
+    const dataEnd = dataStart + compSize;
+    if (dataEnd > buf.length) throw Object.assign(new Error('truncated'), { code: 'bad-zip' });
+    const raw = buf.subarray(dataStart, dataEnd);
+    let data;
+    if (method === 0) data = Buffer.from(raw);
+    else if (method === 8) {
+      try { data = inflateRawSync(raw); } catch (e) { throw Object.assign(new Error('inflate failed'), { code: 'bad-zip' }); }
+    } else throw Object.assign(new Error('unsupported method ' + method), { code: 'bad-zip' });
+    out.push({ name: norm, data, isDir: false });
+  }
+  return out;
+}
+
+/** 比对本机/站点 id 用的归一键：去掉可选的 `skin-` 前缀（站点 slug 为避撞名会加）。 */
+function normSkinId(raw) {
+  const s = String(raw || '').trim().toLowerCase();
+  return s.startsWith('skin-') ? s.slice(5) : s;
+}
+
+/** 皮肤 id 只允许安全字符（要当目录名用）。 */
+function safeSkinId(raw) {
+  const s = String(raw || '').trim();
+  return SKIN_ID_RE.test(s) ? s : '';
+}
+
+/** 校验"删/写这个目录"确实在皮肤根下面（realpath 前缀，挡符号链接逃逸）。 */
+function resolveInside(root, id) {
+  const dir = join(root, id);
+  const realRoot = existsSync(root) ? realpathSync(root) : root;
+  const realDir = existsSync(dir) ? realpathSync(dir) : dir;
+  const withSep = realRoot.endsWith('\\') || realRoot.endsWith('/') ? realRoot : realRoot + (process.platform === 'win32' ? '\\' : '/');
+  return realDir === realRoot || realDir.startsWith(withSep) ? dir : '';
+}
+
+function sendJson(res, code, payload) {
+  res.statusCode = code;
+  res.setHeader('content-type', 'application/json; charset=utf-8');
+  res.end(JSON.stringify(payload));
+}
+
+function readJsonBody(req, limit = 64 * 1024) {
+  return new Promise((resolve) => {
+    let acc = '';
+    let done = false;
+    req.on('data', (d) => {
+      if (done) return;
+      acc += d;
+      if (acc.length > limit) { done = true; resolve(null); }
+    });
+    req.on('end', () => { if (!done) { done = true; try { resolve(JSON.parse(acc || '{}')); } catch { resolve(null); } } });
+    req.on('error', () => { if (!done) { done = true; resolve(null); } });
+  });
+}
+
+export function registerSkinsRoutes(webServer, c) {
+  const { disposers, base, log } = c;
+
+  /* ① 列表：站点可装的 + 本机已装的（同一份响应，面板一次拿全） */
+  disposers.push(webServer.register({
+    kind: 'exact',
+    path: `${base}/skins/list`,
+    handler: async (req, res) => {
+      const force = /[?&]refresh=1/.test(req.url || '');
+      const site = await fetchSiteSkins(force);
+      const installed = listInstalled();
+      const skinCenter = await probeSkinCenter(req.headers && req.headers.host, force);
+      // ⚠️ 站点 slug 与本机皮肤 id **不总是同一个字符串**：站点上 slug 是全站唯一的，
+      // 撞名时上传工具会加 `skin-` 前缀（实测 blue-throated-bee-eater 同时是桌宠 id）。
+      // 所以比对要归一：两边都去掉可选的 `skin-` 前缀再比，否则会显示成"未安装"。
+      const installedKeys = new Set();
+      for (const s of installed) {
+        installedKeys.add(normSkinId(s.id));
+        installedKeys.add(normSkinId(s.dirId));
+      }
+      sendJson(res, 200, {
+        ok: true,
+        skinCenter,
+        siteBase: siteBase(),
+        siteError: site.error,
+        installed,
+        site: site.items.map((it) => ({ ...it, installed: installedKeys.has(normSkinId(it.id)) })),
+      });
+    },
+  }));
+
+  /* ② 安装：下载 zip → 解到 $DSH_HOME/skins/<id> */
+  disposers.push(webServer.register({
+    kind: 'exact',
+    path: `${base}/skins/install`,
+    handler: async (req, res) => {
+      if ((req.method || 'GET').toUpperCase() !== 'POST') { sendJson(res, 405, { ok: false, error: 'method-not-allowed' }); return; }
+      const body = await readJsonBody(req);
+      if (!body) { sendJson(res, 400, { ok: false, error: 'bad-body' }); return; }
+      const base0 = siteBase();
+      if (!base0) { sendJson(res, 400, { ok: false, error: 'site-off' }); return; }
+      let url;
+      try { url = new URL(String(body.url || ''), base0); } catch { sendJson(res, 400, { ok: false, error: 'bad-url' }); return; }
+      const allowHost = new URL(base0).host.toLowerCase();
+      if (url.host.toLowerCase() !== allowHost) { sendJson(res, 400, { ok: false, error: 'host-not-allowed' }); return; }
+
+      const root = skinsRoot();
+      // 幂等：站点 id 与本机目录同名时直接返回（用户"再点一次"应该是立刻生效，而不是重下一遍）
+      const hinted = safeSkinId(body.id);
+      if (hinted && existsSync(join(root, hinted, 'skin.json'))) {
+        sendJson(res, 200, { ok: true, exists: true, id: hinted, dir: join(root, hinted) });
+        return;
+      }
+
+      let buf;
+      try {
+        const r = await fetch(url.toString(), { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+        if (!r.ok) { sendJson(res, 502, { ok: false, error: 'http-' + r.status }); return; }
+        const len = Number(r.headers.get('content-length') || 0);
+        if (len && len > MAX_ZIP_BYTES) { sendJson(res, 413, { ok: false, error: 'too-large' }); return; }
+        buf = Buffer.from(await r.arrayBuffer());
+        if (buf.length > MAX_ZIP_BYTES) { sendJson(res, 413, { ok: false, error: 'too-large' }); return; }
+      } catch (e) {
+        sendJson(res, 502, { ok: false, error: e && e.name === 'TimeoutError' ? 'timeout' : 'network' });
+        return;
+      }
+
+      let entries;
+      try { entries = unzipSkinZip(buf); } catch (e) {
+        sendJson(res, 422, { ok: false, error: (e && e.code) || 'bad-zip' });
+        return;
+      }
+      const manifestEntry = entries.find((e) => !e.isDir && /^skin\.json$/i.test(e.name));
+      if (!manifestEntry) { sendJson(res, 422, { ok: false, error: 'no-skin-json' }); return; }
+      let manifest;
+      try { manifest = JSON.parse(manifestEntry.data.toString('utf8')); } catch { sendJson(res, 422, { ok: false, error: 'bad-skin-json' }); return; }
+      // 目录名以 skin.json 的 id 为准（不信任 URL/调用方给的名字）。
+      const skinId = safeSkinId(manifest && manifest.id) || hinted;
+      if (!skinId) { sendJson(res, 422, { ok: false, error: 'bad-skin-id' }); return; }
+      const dir = resolveInside(root, skinId);
+      if (!dir) { sendJson(res, 400, { ok: false, error: 'unsafe-id' }); return; }
+      if (existsSync(join(dir, 'skin.json'))) {
+        sendJson(res, 200, { ok: true, exists: true, id: skinId, dir });
+        return;
+      }
+
+      try {
+        rmSync(dir, { recursive: true, force: true });
+        mkdirSync(dir, { recursive: true });
+        let written = 0;
+        let skipped = 0;
+        for (const e of entries) {
+          if (e.isDir) continue;
+          if (SKIP_EXEC_RE.test(e.name)) { skipped += 1; continue; }
+          const target = join(dir, e.name);
+          const parent = join(target, '..');
+          mkdirSync(parent, { recursive: true });
+          writeFileSync(target, e.data);
+          written += 1;
+        }
+        const check = JSON.parse(readFileSync(join(dir, 'skin.json'), 'utf8'));
+        if (!check || !check.id) throw new Error('manifest lost after write');
+        sendJson(res, 200, {
+          ok: true,
+          id: skinId,
+          name: String(check.name || check.nameEn || skinId),
+          dir,
+          written,
+          skipped,
+          bytes: buf.length,
+          installedDir: root,
+        });
+      } catch (e) {
+        try { rmSync(dir, { recursive: true, force: true }); } catch { /* ignore */ }
+        try { log && log('skins install failed: ' + (e && e.message)); } catch { /* ignore */ }
+        sendJson(res, 500, { ok: false, error: 'extract-failed', detail: String(e && e.message).slice(0, 200) });
+      }
+    },
+  }));
+
+  /* ③ 卸载：只删皮肤根下的那个目录 */
+  disposers.push(webServer.register({
+    kind: 'exact',
+    path: `${base}/skins/remove`,
+    handler: async (req, res) => {
+      if ((req.method || 'GET').toUpperCase() !== 'POST') { sendJson(res, 405, { ok: false, error: 'method-not-allowed' }); return; }
+      const body = await readJsonBody(req);
+      const id = safeSkinId(body && body.id);
+      if (!id) { sendJson(res, 400, { ok: false, error: 'bad-id' }); return; }
+      const root = skinsRoot();
+      const dir = resolveInside(root, id);
+      if (!dir) { sendJson(res, 400, { ok: false, error: 'unsafe-id' }); return; }
+      if (!existsSync(dir)) { sendJson(res, 404, { ok: false, error: 'not-installed' }); return; }
+      try { rmSync(dir, { recursive: true, force: true }); } catch (e) {
+        sendJson(res, 500, { ok: false, error: 'remove-failed', detail: String(e && e.message).slice(0, 160) });
+        return;
+      }
+      sendJson(res, 200, { ok: true, id });
+    },
+  }));
+}

package/package.json

@@ -1,234 +1,234 @@
-{
-    "name":  "dsh-folia",
-    "version":  "4.9.1",
-    "description":  "Folia 壁纸引擎：把本机 Wallpaper Engine 壁纸搬进 DSH 界面（场景实时渲染 / 视频 / 网页），内置液态玻璃与 Folia 吉祥物，并可从自建站点拉取壁纸。单包形态（组件已合并）。",
-    "type":  "module",
-    "engines":  {
-                    "node":  "\u003e=22.12.0",
-                    "dsh":  "^0.2.0-rc.1"
-                },
-    "main":  "lib/index.js",
-    "types":  "lib/types/index.d.ts",
-    "icon":  "./icon.png",
-    "repository":  {
-                       "type":  "git",
-                       "url":  "git+https://github.com/lehua-art/dsh-folia.git"
-                   },
-    "keywords":  [
-                     "dsh",
-                     "dsh-plugin",
-                     "deepseek-harness",
-                     "wallpaper",
-                     "folia",
-                     "theme",
-                     "background"
-                 ],
-    "publishConfig":  {
-                          "access":  "public"
-                      },
-    "exports":  {
-                    ".":  {
-                              "types":  "./lib/types/index.d.ts",
-                              "default":  "./lib/index.js"
-                          },
-                    "./client":  {
-                                     "types":  "./lib/types/client.d.ts",
-                                     "default":  "./lib/client.js"
-                                 },
-                    "./subpackage-boot.js":  "./lib/subpackage-boot.js",
-                    "./cordis.patch.yml":  "./cordis.patch.yml",
-                    "./package.json":  "./package.json"
-                },
-    "files":  [
-                  "icon.png",
-                  "lib/index.js",
-                  "lib/host-boot.js",
-                  "lib/log.js",
-                  "lib/notice.js",
-                  "lib/kernel/",
-                  "lib/kernel/data-dir.js",
-                  "lib/kernel/config.js",
-                  "lib/kernel/host-kernel.js",
-                  "lib/kernel/host-session.js",
-                  "lib/boot/",
-                  "lib/routes/",
-                  "lib/occlusion/",
-                  "lib/fontsets/",
-                  "lib/glass-presets/",
-                  "lib/about/",
-                  "lib/component-visibility.js",
-                  "lib/client.js",
-                  "lib/http-body.js",
-                  "lib/json-response.js",
-                  "lib/pkg-read.js",
-                  "lib/scene-manifest.js",
-                  "lib/settings-schema.js",
-                  "lib/subpackage-boot.js",
-                  "lib/media/",
-                  "lib/media/transcode.js",
-                  "lib/media/mp4-probe.js",
-                  "lib/media/scene-probe.js",
-                  "lib/media/video-preview.js",
-                  "lib/media/frame-store.js",
-                  "lib/media/media-dirs.js",
-                  "lib/media-origin.js",
-                  "lib/inventory.js",
-                  "lib/serve.js",
-                  "lib/faststart.js",
-                  "lib/cache-dir.js",
-                  "lib/upload-store.js",
-                  "lib/diag-trace.js",
-                  "lib/http-lifecycle.js",
-                  "lib/mp4-vfs.js",
-                  "lib/startup-sweep.js",
-                  "lib/fs-paths.js",
-                  "lib/upload-dir.js",
-                  "lib/wallpaper-scan.js",
-                  "lib/steam-discovery.js",
-                  "lib/webwallgl/",
-                  "lib/we-assets.js",
-                  "lib/shim-seed.js",
-                  "lib/we-props.js",
-                  "lib/we-focus-guard.js",
-                  "lib/types/index.d.ts",
-                  "lib/types/client.d.ts",
-                  "cordis.patch.yml",
-                  "assets/readme/hero-light.png",
-                  "assets/readme/hero-dark.png",
-                  "assets/readme/key-lang-zh-light.png",
-                  "assets/readme/key-lang-zh-dark.png",
-                  "assets/readme/key-lang-en-light.png",
-                  "assets/readme/key-lang-en-dark.png",
-                  "assets/readme/key-lang-start-light.png",
-                  "assets/readme/key-lang-start-dark.png",
-                  "assets/readme/key-get-light.png",
-                  "assets/readme/key-get-dark.png",
-                  "assets/readme/key-setup-light.png",
-                  "assets/readme/key-setup-dark.png",
-                  "assets/readme/key-docs-light.png",
-                  "assets/readme/key-docs-dark.png",
-                  "assets/readme/key-release-light.png",
-                  "assets/readme/key-release-dark.png",
-                  "assets/readme/stat-version-light.png",
-                  "assets/readme/stat-version-dark.png",
-                  "assets/readme/stat-formats-light.png",
-                  "assets/readme/stat-formats-dark.png",
-                  "assets/readme/stat-mascots-light.png",
-                  "assets/readme/stat-mascots-dark.png",
-                  "assets/readme/stat-modules-light.png",
-                  "assets/readme/stat-modules-dark.png",
-                  "assets/readme/section-intro-light.png",
-                  "assets/readme/section-intro-dark.png",
-                  "assets/readme/section-preview-light.png",
-                  "assets/readme/section-preview-dark.png",
-                  "assets/readme/section-start-light.png",
-                  "assets/readme/section-start-dark.png",
-                  "assets/readme/section-index-light.png",
-                  "assets/readme/section-index-dark.png",
-                  "assets/readme/section-features-light.png",
-                  "assets/readme/section-features-dark.png",
-                  "assets/readme/section-formats-light.png",
-                  "assets/readme/section-formats-dark.png",
-                  "assets/readme/section-install-light.png",
-                  "assets/readme/section-install-dark.png",
-                  "assets/readme/section-usage-light.png",
-                  "assets/readme/section-usage-dark.png",
-                  "assets/readme/section-pet-light.png",
-                  "assets/readme/section-pet-dark.png",
-                  "assets/readme/section-config-light.png",
-                  "assets/readme/section-config-dark.png",
-                  "assets/readme/section-compat-light.png",
-                  "assets/readme/section-compat-dark.png",
-                  "assets/readme/section-develop-light.png",
-                  "assets/readme/section-develop-dark.png",
-                  "assets/readme/section-community-light.png",
-                  "assets/readme/section-community-dark.png",
-                  "assets/readme/section-credits-light.png",
-                  "assets/readme/section-credits-dark.png",
-                  "assets/readme/section-support-light.png",
-                  "assets/readme/section-support-dark.png",
-                  "assets/readme/section-stars-light.png",
-                  "assets/readme/section-stars-dark.png",
-                  "assets/readme/SOURCES.md",
-                  "assets/readme/OFL-Jersey20.txt",
-                  "assets/readme/mascot-eating-rice-1280x1784.jpg",
-                  "README.md",
-                  "README.en.md",
-                  "README.beginner.md",
-                  "lib/components/",
-                  "lib/features.js",
-                  "lib/route-registry.js",
-                  "lib/settings/"
-              ],
-    "dsh":  {
-                "bundle":  {
-                               "patch":  "./cordis.patch.yml"
-                           },
-                "client":  {
-                               "inject":  [
-                                              "@deepseek-ai/dsh-client-runtime"
-                                          ],
-                               "platform":  "web",
-                               "immediately":  true
-                           }
-            },
-    "license":  "MIT",
-    "scripts":  {
-                    "build":  "node scripts/build-client.mjs",
-                    "install:source":  "node scripts/install-source.mjs",
-                    "install:release":  "node scripts/install-release.mjs",
-                    "pack:release":  "node scripts/pack-release.mjs",
-                    "verify:deployment":  "node test/verify-deployment.mjs",
-                    "verify:pet-link":  "node test/verify-pet-link.mjs",
-                    "verify:pet-link:integration":  "node test/verify-pet-hotplug-integration.mjs",
-                    "verify:pet-link:browser":  "node test/verify-pet-tuner-browser.mjs",
-                    "verify":  "node test/run-guards.mjs verify",
-                    "verify:docs":  "node test/run-guards.mjs docs",
-                    "verify:bridge":  "node test/verify-bridge-ci.mjs --provision",
-                    "verify:bridge:strict":  "node test/verify-media-bridge.mjs --provision",
-                    "verify:e2e":  "node test/e2e-web-media-origin.mjs",
-                    "lint":  "eslint .",
-                    "typecheck":  "tsc --noEmit -p tsconfig.json",
-                    "verify:static":  "node test/verify-static.mjs",
-                    "smoke":  "node test/run-guards.mjs smoke",
-                    "verify:all":  "node test/run-guards.mjs all",
-                    "prepack":  "node scripts/prepare.mjs",
-                    "test:boot":  "node test/boot-http.mjs",
-                    "test:pets":  "node test/pets-http.mjs",
-                    "test:pets-layer":  "node test/pets-layer.mjs",
-                    "test:features":  "node test/verify-features.mjs",
-                    "audit":  "node test/run-audit.mjs",
-                    "gate":  "node scripts/build-client.mjs \u0026\u0026 node test/run-guards.mjs smoke \u0026\u0026 node test/verify-features.mjs \u0026\u0026 node test/verify-route-registry.mjs \u0026\u0026 node test/verify-settings-ownership.mjs \u0026\u0026 node test/boot-http.mjs \u0026\u0026 node test/pets-http.mjs \u0026\u0026 node test/pets-layer.mjs"
-                },
-    "peerDependencies":  {
-                             "@deepseek-ai/cordis":  "^4.0.4",
-                             "@deepseek-ai/dsh-client-runtime":  "\u003e=0.1.5-rc.1",
-                             "@deepseek-ai/dsh-client-ui-slots":  "\u003e=0.1.5-rc.1",
-                             "@deepseek-ai/dsh-host-webserver":  "\u003e=0.1.5-rc.1",
-                             "react":  "^18.2.0"
-                         },
-    "peerDependenciesMeta":  {
-                                 "@deepseek-ai/dsh-client-runtime":  {
-                                                                         "optional":  true
-                                                                     },
-                                 "@deepseek-ai/dsh-client-ui-slots":  {
-                                                                          "optional":  true
-                                                                      },
-                                 "@deepseek-ai/dsh-host-webserver":  {
-                                                                         "optional":  true
-                                                                     }
-                             },
-    "dependencies":  {
-                         "webwallgl":  "^3.0.0",
-                         "x11":  "^4.3.1"
-                     },
-    "overrides":  {
-                      "js-yaml":  "4.3.2"
-                  },
-    "devDependencies":  {
-                            "@eslint/js":  "^10.0.1",
-                            "@types/node":  "^26.6.5",
-                            "eslint":  "^10.12.0",
-                            "typescript":  "^7.0.2"
-                        }
+{
+  "name": "dsh-folia",
+  "version": "4.10.1",
+  "description": "Folia 壁纸引擎：把本机 Wallpaper Engine 壁纸搬进 DSH 界面（场景实时渲染 / 视频 / 网页），内置液态玻璃与 Folia 吉祥物，并可从自建站点拉取壁纸。单包形态（组件已合并）。",
+  "type": "module",
+  "engines": {
+    "node": ">=22.12.0",
+    "dsh": "^0.2.0-rc.1"
+  },
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "icon": "./icon.png",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/lehua-art/dsh-folia.git"
+  },
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek-harness",
+    "wallpaper",
+    "folia",
+    "theme",
+    "background"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./client": {
+      "types": "./lib/types/client.d.ts",
+      "default": "./lib/client.js"
+    },
+    "./subpackage-boot.js": "./lib/subpackage-boot.js",
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "icon.png",
+    "lib/index.js",
+    "lib/host-boot.js",
+    "lib/log.js",
+    "lib/notice.js",
+    "lib/kernel/",
+    "lib/kernel/data-dir.js",
+    "lib/kernel/config.js",
+    "lib/kernel/host-kernel.js",
+    "lib/kernel/host-session.js",
+    "lib/boot/",
+    "lib/routes/",
+    "lib/occlusion/",
+    "lib/fontsets/",
+    "lib/glass-presets/",
+    "lib/about/",
+    "lib/component-visibility.js",
+    "lib/client.js",
+    "lib/http-body.js",
+    "lib/json-response.js",
+    "lib/pkg-read.js",
+    "lib/scene-manifest.js",
+    "lib/settings-schema.js",
+    "lib/subpackage-boot.js",
+    "lib/media/",
+    "lib/media/transcode.js",
+    "lib/media/mp4-probe.js",
+    "lib/media/scene-probe.js",
+    "lib/media/video-preview.js",
+    "lib/media/frame-store.js",
+    "lib/media/media-dirs.js",
+    "lib/media-origin.js",
+    "lib/inventory.js",
+    "lib/serve.js",
+    "lib/faststart.js",
+    "lib/cache-dir.js",
+    "lib/upload-store.js",
+    "lib/diag-trace.js",
+    "lib/http-lifecycle.js",
+    "lib/mp4-vfs.js",
+    "lib/startup-sweep.js",
+    "lib/fs-paths.js",
+    "lib/upload-dir.js",
+    "lib/wallpaper-scan.js",
+    "lib/steam-discovery.js",
+    "lib/webwallgl/",
+    "lib/we-assets.js",
+    "lib/shim-seed.js",
+    "lib/we-props.js",
+    "lib/we-focus-guard.js",
+    "lib/types/index.d.ts",
+    "lib/types/client.d.ts",
+    "cordis.patch.yml",
+    "assets/readme/hero-light.png",
+    "assets/readme/hero-dark.png",
+    "assets/readme/key-lang-zh-light.png",
+    "assets/readme/key-lang-zh-dark.png",
+    "assets/readme/key-lang-en-light.png",
+    "assets/readme/key-lang-en-dark.png",
+    "assets/readme/key-lang-start-light.png",
+    "assets/readme/key-lang-start-dark.png",
+    "assets/readme/key-get-light.png",
+    "assets/readme/key-get-dark.png",
+    "assets/readme/key-setup-light.png",
+    "assets/readme/key-setup-dark.png",
+    "assets/readme/key-docs-light.png",
+    "assets/readme/key-docs-dark.png",
+    "assets/readme/key-release-light.png",
+    "assets/readme/key-release-dark.png",
+    "assets/readme/stat-version-light.png",
+    "assets/readme/stat-version-dark.png",
+    "assets/readme/stat-formats-light.png",
+    "assets/readme/stat-formats-dark.png",
+    "assets/readme/stat-mascots-light.png",
+    "assets/readme/stat-mascots-dark.png",
+    "assets/readme/stat-modules-light.png",
+    "assets/readme/stat-modules-dark.png",
+    "assets/readme/section-intro-light.png",
+    "assets/readme/section-intro-dark.png",
+    "assets/readme/section-preview-light.png",
+    "assets/readme/section-preview-dark.png",
+    "assets/readme/section-start-light.png",
+    "assets/readme/section-start-dark.png",
+    "assets/readme/section-index-light.png",
+    "assets/readme/section-index-dark.png",
+    "assets/readme/section-features-light.png",
+    "assets/readme/section-features-dark.png",
+    "assets/readme/section-formats-light.png",
+    "assets/readme/section-formats-dark.png",
+    "assets/readme/section-install-light.png",
+    "assets/readme/section-install-dark.png",
+    "assets/readme/section-usage-light.png",
+    "assets/readme/section-usage-dark.png",
+    "assets/readme/section-pet-light.png",
+    "assets/readme/section-pet-dark.png",
+    "assets/readme/section-config-light.png",
+    "assets/readme/section-config-dark.png",
+    "assets/readme/section-compat-light.png",
+    "assets/readme/section-compat-dark.png",
+    "assets/readme/section-develop-light.png",
+    "assets/readme/section-develop-dark.png",
+    "assets/readme/section-community-light.png",
+    "assets/readme/section-community-dark.png",
+    "assets/readme/section-credits-light.png",
+    "assets/readme/section-credits-dark.png",
+    "assets/readme/section-support-light.png",
+    "assets/readme/section-support-dark.png",
+    "assets/readme/section-stars-light.png",
+    "assets/readme/section-stars-dark.png",
+    "assets/readme/SOURCES.md",
+    "assets/readme/OFL-Jersey20.txt",
+    "assets/readme/mascot-eating-rice-1280x1784.jpg",
+    "README.md",
+    "README.en.md",
+    "README.beginner.md",
+    "lib/components/",
+    "lib/features.js",
+    "lib/route-registry.js",
+    "lib/settings/",
+    "lib/routes/skins.js"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-runtime"
+      ],
+      "platform": "web",
+      "immediately": true
+    }
+  },
+  "license": "MIT",
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.4",
+    "@deepseek-ai/dsh-client-runtime": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-host-webserver": ">=0.1.5-rc.1",
+    "react": "^18.2.0"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/dsh-client-runtime": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-slots": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-host-webserver": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "webwallgl": "^3.0.0",
+    "x11": "^4.3.1"
+  },
+  "overrides": {
+    "js-yaml": "4.3.2"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^26.6.5",
+    "eslint": "^10.12.0",
+    "typescript": "^7.0.2"
+  },
+  "scripts": {
+    "build": "node scripts/build-client.mjs",
+    "install:source": "node scripts/install-source.mjs",
+    "install:release": "node scripts/install-release.mjs",
+    "pack:release": "node scripts/pack-release.mjs",
+    "verify:deployment": "node test/verify-deployment.mjs",
+    "verify:pet-link": "node test/verify-pet-link.mjs",
+    "verify:pet-link:integration": "node test/verify-pet-hotplug-integration.mjs",
+    "verify:pet-link:browser": "node test/verify-pet-tuner-browser.mjs",
+    "verify": "node test/run-guards.mjs verify",
+    "verify:docs": "node test/run-guards.mjs docs",
+    "verify:bridge": "node test/verify-bridge-ci.mjs --provision",
+    "verify:bridge:strict": "node test/verify-media-bridge.mjs --provision",
+    "verify:e2e": "node test/e2e-web-media-origin.mjs",
+    "lint": "eslint .",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "verify:static": "node test/verify-static.mjs",
+    "smoke": "node test/run-guards.mjs smoke",
+    "verify:all": "node test/run-guards.mjs all",
+    "test:boot": "node test/boot-http.mjs",
+    "test:pets": "node test/pets-http.mjs",
+    "test:pets-layer": "node test/pets-layer.mjs",
+    "test:features": "node test/verify-features.mjs",
+    "audit": "node test/run-audit.mjs",
+    "gate": "node scripts/build-client.mjs && node test/run-guards.mjs smoke && node test/verify-features.mjs && node test/verify-route-registry.mjs && node test/verify-settings-ownership.mjs && node test/boot-http.mjs && node test/pets-http.mjs && node test/pets-layer.mjs"
+  }
 }