dsh-m 0.9.60 → 0.9.62

package/CHANGELOG.md

@@ -8,6 +8,21 @@ The full release history of dsh-m, maintained bilingually: **Chinese first, Engl
 
 ## 中文
 
+### 0.9.62 修复：灯箱控件浅色模式下不可见——影院遮罩自持 + 控件深色玻璃芯片 + 加载转圈/淡入
+
+- **根因（2026-10-09 用户浅/深双模式实拍）**：dsh-skins ADR-0007 浮层毛玻璃并集按 `[role="dialog"][aria-modal="true"]` 命中灯箱根（灯箱根带 dialog 语义），浅色模式下 86% 暖白 tint + blur14 把影院式黑遮罩改成了浅色毛玻璃；而 ‹›/✕ 沿用基础 `.dsvm-btn` 白色半透配方（`rgba(255,255,255,.14)` 底 + 白字白边），浅底上整体隐形。深色模式走皮肤 `rgb(18,18,26)` 分支尚可读，故「浅色看不清、深色还行」。无皮肤的原生形态（黑遮罩恒在）无症状——这正是它漏网到 0.9.61 的原因。
+- **双侧修复**：① dsh-m 侧（本版）：灯箱 `background` 加 `!important` 自持——「深色遮罩 + 浅色控件」是影院面的组件自有可读性不变量，不随颜色模式/皮肤翻转；marketplace 社区皮肤不可枚举，不变量必须组件自己兜底（`!important` 清单定长 4，回归门钉住，新增须显式登记）。② dsh-skins 侧：三皮肤 `[role="dialog"][aria-modal="true"]` 追加 `:not(.dsvm-lightbox)` 豁免（1.5.1，ADR-0007 amendment）——语义上「弹窗毛玻璃」本就不该染指图片影院。
+- **控件深色玻璃芯片**：‹›/✕ 从裸透明白改为与底部 pill 同族的深色芯片（slate-900 55% + 白描边 + blur8 + 投影）——深遮罩上靠描边/blur/投影出层次，浅遮罩上芯片本身就是对比面，任何颜色模式与皮肤下都可读；显式 `:hover` 提亮（特异性 0,3,0 压基础 `.dsvm-btn:hover` 0,2,0，免疫源顺序——评审 R1 同族教训）。
+- **加载指示与淡入（UX 补强）**：灯箱走链期间（weserv 慢速/8s 守卫换层/直连大图）此前是空黑黑洞，现转圈占位（`useImgChain` 暴露 `settled`；点转圈视为点遮罩可关——急躁关闭是合理逃生门）；图片 onLoad 后 160ms 淡入换场；`prefers-reduced-motion` 下停用淡入、转圈降速。
+- **验证**：1283 项测试全绿、typecheck 零错误；`client-lightbox.test.mjs` 新增 6 项结构锚（遮罩 `!important` 定长清单/芯片规则与显式 hover/转圈门控/淡入类名/settled 暴露/reduced-motion），0.9.60 批次既有锚（portal/复合选择器/拖拽带/焦点还原/序号 key）全数保持。
+
+### 0.9.61 修复：大陆浏览器拉不到插件截图/图标——图片加载链 weserv 优先双兜底
+
+- **根因（2026-10-09 实测）**：截图（raw.githubusercontent.com）与图标（github.com 头像）由用户浏览器直连拉取——服务器侧 200/0.2s，大陆浏览器路径时断时通，当日故障样本 dsh-wallpaper-engine 五图（22.5MB，含 10.4MB GIF）缩略图条与灯箱全空；0.9.60 已排除灯箱 v2 回归，图标「能显示」实为本地字母兜底。对标 dsh-market 1.66.14：缩略图无条件 weserv（其源码实测大陆 1.39s/23KB vs 原图 41KB）但灯箱直连零兜底——大陆点开大图同款黑洞。
+- **图片加载链（ADR-0014）**：三类消费方（缩略图 h=300 / 灯箱 w=1600 / 图标 h=96）共用 `useImgChain`——weserv 层（`fit=inside&we=1&output=webp&q=80` 服务端缩放转码）优先，失败或 8s 人工超时（仅此层；直连层零人工超时防误杀慢速合法下载）换原图直连，再败走终态：缩略图剔除（全败隐藏整条）、灯箱占位「⚠ 失败 + 重试 + 打开原图 ↗」、图标字母渐变兜底。赢家记忆按 raw/avatar 两桶记最近成功层，**链启动时快照次序**——同批多图竞态下兄弟图不因偏好翻转跳层（执行期实证：缩略图 1 经直连成功翻转偏好后 2/3 全灭的竞态）；链内前进序感知（偏好为 direct 时 direct 败仍按序试 weserv，固定阶梯会跳过兜底直判死）。四处 shots 基准同步换 visible（整条门控/截图条 map/灯箱门控/键盘导航+effect 依赖），列表保持全量 map + `${i}:${src}` 稳定 key，灯箱 index 钳制防越界。
+- **配套**：纯逻辑入 `src/client/img-chain.js`（URL 构造/桶分类/序感知 tier 机/赢家记忆，`WESERV_BASE` 单常量——未来设置项只改一处）；GLOSSARY 增「图片加载链（Image Chain）」一条；探针扩展 A16-A24（断直连/断 weserv/双断占位+重试/weserv 挂起 8s 守卫/赢家记忆/缩略图剔除/direct-first 换层 Probe 场景）+ `--live` 真网压缩实证；执行期探针 harness 三大确定性根基：**每场景全新 page（独立 context，消灭路由复挂竞态与跨场景解码复用）**、代次化 URL（凡需失败的 URL 全页生命周期唯一）、层序断言走 reqLog（page.on('request') 不依赖路由拦截）。
+- **验证**：1256 项测试全绿（基线 1236 + 新增 20）、typecheck 零错误；探针 31/31 三连跑稳定；`--live` 压缩实证 mascot-drawer.png 直连 2859KB vs weserv 151KB（≈18.9×）。评审吸收轮（完整多轮独立 subagent 评审）：R1-1【阻断】8s 守卫在成功加载后不清除——成功图 8s 后被强制换层重载（大陆场景缩略图误剔除/图标字母化/灯箱变占位），修以 settled 语义（onLoad 置真、链启动/翻页重置、timer 四条件守卫含空 url），并新增探针 A25（成功驻留 >8.5s 行为钉子，旧代码必红）与计时门控源锚；R1-2 A22 补负向断言（导航后零 weserv 形态请求）、A24 断言首请求形态（赢家记忆翻转获得证伪力）；R1-3 freshState 清 reqLog（场景封闭）；R1-5 url 变化改渲染期 derived-state 重置（消除中间帧幽灵请求）；R1-6 --live 双侧校验 r.ok + image/*（错误页不得假 PASS）；R2-3 advance 防御性 settled 重置。第二轮终局裁决：共识 approve。遗留后续项：中间帧消除的行为级探针（现由源锚防回归）。
+
 ### 0.9.60 修复：截图灯箱窗口态无导航/无法退出——createPortal 逃出面板包含块 + 控件常驻
 
 - **根因**：灯箱 `position:fixed` 是 `.dshm-panel`（`backdrop-filter` + `overflow:hidden`）的后代，面板盒成了它的包含块——图片按视口单位放大（旧 94vw/80vh），在 ≤680px 高的窗口态面板里必然溢出，in-flow 的 ‹›/圆点被裁出屏外，又没有 ✕；全屏态面板恰为视口才「碰巧」可见（即「只有全屏才有导航按钮，窗口态图片占满小屏且无法退出」）。
@@ -446,6 +461,21 @@ The full release history of dsh-m, maintained bilingually: **Chinese first, Engl
 
 ## English
 
+### Fixed in 0.9.62 — lightbox controls invisible in light color schemes: self-owned cinema backdrop + dark glass control chips + loading spinner/fade
+
+- **Root cause (user photos, both color schemes, 2026-10-09)**: the dsh-skins ADR-0007 overlay-frost union targets `[role="dialog"][aria-modal="true"]` - which matches the lightbox root (it carries dialog semantics). In light schemes the 86% warm-white tint + blur14 turned the cinema-black backdrop into light frosted glass, while ‹›/✕ reuse the base `.dsvm-btn` translucent-white recipe (`rgba(255,255,255,.14)` fill, white glyph/border) - invisible on a light surface. Dark schemes hit the skin's `rgb(18,18,26)` branch and stayed readable, hence "light mode unreadable, dark mode okay". Vanilla installs (backdrop always near-black) never showed it - which is how it slipped past 0.9.61.
+- **Two-sided fix**: ① dsh-m side (this release): the lightbox `background` is now `!important`-owned - "dark backdrop + light controls" is the component's own readability invariant for a cinema surface and must not flip with color schemes or skins; marketplace community skins are un-enumerable, so the component must defend itself (the `!important` inventory is pinned at a fixed length of 4 by the regression gate; additions must register explicitly). ② dsh-skins side: all three skins exempt `.dsvm-lightbox` via `:not(...)` (1.5.1, ADR-0007 amendment) - semantically a "dialog frost" never should have tinted an image theater.
+- **Dark glass control chips**: ‹›/✕ move from bare translucent white to a chip in the same family as the bottom pill (slate-900 55% + white border + blur8 + shadow) - on dark backdrops the border/blur/shadow provide edge definition, on light backdrops the chip itself is the contrast surface; readable under any scheme or skin. Explicit `:hover` brightening (specificity 0,3,0 beats base `.dsvm-btn:hover` 0,2,0 regardless of source order - the R1 family lesson).
+- **Loading indicator & fade (UX)**: while the image chain runs (slow weserv / 8s guard tier-swap / large direct original) the lightbox used to be a silent black void; it now shows a spinner (`useImgChain` exposes `settled`; clicking the spinner counts as a backdrop click - an impatient close is a legitimate escape hatch). The image fades in over 160ms on onLoad; under `prefers-reduced-motion` the fade is disabled and the spinner slows down.
+- **Verification**: 1283 tests green, typecheck clean; `client-lightbox.test.mjs` gains 6 structural anchors (backdrop `!important` fixed-length inventory / chip rules with explicit hover / spinner gating / fade class / settled exposure / reduced-motion); all 0.9.60-era anchors (portal / compound selectors / titlebar offset / focus restore / index keys) retained.
+
+### Fixed in 0.9.61 — screenshots/icons unreachable from mainland browsers: weserv-first dual-fallback image chain
+
+- **Root cause (measured 2026-10-09)**: screenshots (raw.githubusercontent.com) and icons (github.com avatars) load browser-direct - fine from the server (200/0.2s), intermittently dead from mainland browsers. That day's failure sample dsh-wallpaper-engine (5 images, 22.5MB incl. a 10.4MB GIF) rendered an empty strip and a black lightbox; 0.9.60 ruled out a lightbox-v2 regression, and "working" icons were the local letter fallback. Benchmark dsh-market 1.66.14: thumbnails unconditionally via weserv (their in-source mainland measurement: 1.39s/23KB vs 41KB original) but the lightbox loads direct with zero fallback - the same mainland black hole.
+- **Image chain (ADR-0014)**: three consumers (thumbnail h=300 / lightbox w=1600 / icon h=96) share `useImgChain` - weserv tier first (`fit=inside&we=1&output=webp&q=80` server-side resize/recode), on failure or an 8s guard (that tier only; the direct tier gets no artificial timeout so slow-but-legal downloads are never killed) fall back to the original URL, then to per-consumer finals: thumbnails dropped (whole strip hidden when all fail), lightbox placeholder "failed + retry + open original", icon letter fallback. Winner memory per service bucket (raw/avatar) remembers the last successful tier, and **each chain snapshots the order at start** - sibling images racing in the same batch never skip a tier because a preference flipped mid-flight (found in execution: thumbnail 1 succeeding via direct flipped the preference and killed thumbnails 2/3); advancement is order-aware (with direct preferred, a direct failure still tries weserv - a fixed ladder would skip the fallback entirely). All four shots references switch to visible (strip gating / strip map / lightbox gating / keyboard nav + effect deps), the strip keeps a full-list map with stable `${i}:${src}` keys, and the lightbox index is clamped against shrinkage.
+- **Supporting**: pure logic in `src/client/img-chain.js` (URL builder / bucket classifier / order-aware tier machine / winner memory; `WESERV_BASE` single constant - a future setting changes one line); one GLOSSARY term (Image Chain); probe extended A16-A24 (direct-blocked / weserv-blocked / dual-block placeholder+retry / weserv-hang 8s guard / winner memory / strip removal / direct-first Probe scenario) plus `--live` real-network compression; three probe-harness determinism pillars learned during execution: **a fresh page (fresh context) per scenario** (kills route-remount races and cross-scenario decoded-image reuse), generation URLs (`?g=N` - any URL that must fail is unique for the page lifetime), and tier-order assertions via reqLog (`page.on('request')` survives route interception quirks).
+- **Verification**: 1256 tests green (1236 baseline + 20 new), typecheck clean; probe 31/31 stable across three runs; `--live` compression: mascot-drawer.png direct 2859KB vs weserv 151KB (~18.9x). Review absorption round (full multi-round independent subagent review): R1-1 [blocker] the 8s guard survived a successful load - a displayed image was force-advanced 8s later (mainland: thumbnails wrongly dropped, icons degraded, lightbox mutating into the placeholder); fixed with settled semantics (set by onLoad, reset on chain start/navigation, four-condition timer guard incl. empty url), pinned by new probe A25 (dwell >8.5s; the old code cannot pass it) plus timer-gating source anchors. R1-2 A22 gains the negative assertion (zero weserv-form requests after navigation) and A24 asserts the first request's form (winner-memory flip now falsifiable). R1-3 freshState clears reqLog (scenario closure). R1-5 url change resets via render-phase derived state (the one-frame ghost request is gone). R1-6 --live validates r.ok + image/* on both fetches. R2-3 defensive settled reset in advance. Round-2 verdict: consensus approve. Deferred: a behavioral probe for the middle-frame elimination (currently pinned by source anchors).
+
 ### Fixed in 0.9.60 — screenshot lightbox unusable when windowed: portal out of the panel containing block + always-visible controls
 
 - **Root cause**: the lightbox was a `position:fixed` descendant of `.dshm-panel` (`backdrop-filter` + `overflow:hidden`), so the panel box became its containing block. The image sized in viewport units (old 94vw/80vh) inevitably overflows the ≤680px-tall windowed panel and the in-flow ‹›/dots row gets clipped off-screen, with no close button at all; fullscreen only worked because the panel then equals the viewport (the reported "nav buttons appear only in fullscreen; windowed fills the small screen and cannot exit").

package/docs/DESIGN.md

@@ -71,12 +71,12 @@
 
 - **双层模型**：主清单（§2.1–2.4 全部语义不变）之上叠加只读的**社区清单**——awesome-dsh-plugin 维护的全量社区目录（4,377+ 条，日增约 62）。**合并市场 = 主清单 ∪ 社区清单去重（主清单恒优先）**，GUI / agent 工具 / CLI 三端同源同语义。本节修订 §9.1 Q25「不做运行时多源合并」，架构决策见 [ADR-0003](./adr/0003-community-catalog-merge.md)。
 - **数据锚定 npm 包（Q39）**：`dsh-plugin-catalog`（CC0-1.0，版本 `YYYY.MDD.RUN`）为唯一数据锚。获取链：`registry.npmjs.org` dist-tags 探测最新版本（几 KB）→ **版本未变不重拉正文（版本号即 revalidate 验证器）**→ jsDelivr 按精确版本直取 `plugins.json`（版本 pin 后内容不可变，CDN 缓存无害）→ npmmirror files API → unpkg 按精确版本直取（末位兜底；均为纯 JSON 文件线路，不引入 tar 解包依赖）。npm 精确版本不可变 = 完整性锚；**不做包内快照兜底**（对日增 62 条的目录，过期数据不得冒充最新——陈旧必须显式标注），失败如实报错（发生了什么 / 为什么 / 现在怎么办）。
-- **目录适配层**：原生条目 → 收录条目。`description.zh`（缺省回退 `en`；>500 字符截断并计数）→ description；`npm` 非空 → `source: npm`（`url` 为 github.com 形态时同时派生 `github` owner/repo，子包取 repo 根，0.9.51 起），否则 `source: github`（owner/repo 取自 url）；`url` → homepage；tags 置空；**分类保留原生值不转译**（开放集，Q40）；`stars/downloads/capabilities/screenshots` 等不进收录条目本体，仅在市场层作为旁路数据透传展示。id 合成：原生 `name` 是裸名（实测 4,377 条中 190 个重名），合成小写 `owner--name` 形态并满足 v1 id 规则（非法字符折叠为 `-`，超 64 字符截断加哈希尾缀），适配层内冲突追加序号。
+- **目录适配层**：原生条目 → 收录条目。`description.zh`（缺省回退 `en`；>500 字符截断并计数）→ description；`npm` 非空 → `source: npm`（`url` 为 github.com 形态时同时派生 `github` owner/repo，子包取 repo 根，0.9.51 起），否则 `source: github`（owner/repo 取自 url）；`url` → homepage；tags 置空；**分类保留原生值不转译**（开放集，Q40）；Community Catalog 的 `stars/downloads/capabilities/screenshots` 等不进收录条目本体，仅在 CommunityEntry/市场层作为旁路数据透传；Primary 截图另按 §2.6 从作者仓库读取，不进入 MarketItem。id 合成：原生 `name` 是裸名（实测 4,377 条中 190 个重名），合成小写 `owner--name` 形态并满足 v1 id 规则（非法字符折叠为 `-`，超 64 字符截断加哈希尾缀），适配层内冲突追加序号。
 - **校验语义（Q43）**：社区清单独立校验——容器层严格（顶层键白名单、`plugins` 数组、32 MiB / 30,000 条上限，超限**整份拒收**）+ 条目层宽松（单条不合格**跳过 + 计数**，汇入 warnings，不整份拒绝）。主清单严格校验（§2.2）不变。**无 npm 的 monorepo 子包条目跳过并计数**（repo 根不是正确安装目标）；有 npm 的子包条目按 npm 安装、正常收录；tarball-only 条目按 github 源收录（dsh-m 不安装 tarball）。
 - **分类（Q40）**：精选分类（5 个，主清单 schema 不变）∪ 社区分类（开放集）。已知 20 个社区分类带中文标签进筛选栏「社区」组；`ui`/`tools`/`market` 三 id 与精选同名、共享过滤桶；上游新增的未知分类原样渲染进「社区·新分类」临时组，发版收录标签。
 - **降级语义（Q42）**：主清单 unavailable + 社区可用 → 显示社区条目 + 顶部错误横幅 + 安装不禁用；社区 unavailable → 主清单照常 + 静默 notice；探测失败时回落 `<ns>/awesome/` **运行时缓存**并显式标注 stale（绝不冒充 ready）——运行时缓存语义与主清单自定义源一致，被禁止的只是**包内快照**；社区**绝不**回退主清单伪装。（**0.9.15 修订**：SWR 常态化后市场页不再显示「缓存快照」临时横幅——stale 标注移至设置页社区卡，「绝不冒充 ready / 过期可被观察到」的诚实约束不变。）
 - **开关与缓存**：`communityCatalog`（默认 true，volatile live 生效）+ `communityCatalogPin`（可选锁 npm 版本）；CLI 用 `DSHM_COMMUNITY_CATALOG=0` 退出。社区缓存放 `<namespace>/awesome/` 子目录（不参与 `pruneCaches` 的顶层 `*.json` 清理），正文按版本文件缓存，`fetchedAt`/版本号/线路进设置页展示；TTL 复用 `cacheTtlMin`（只约束 dist-tags 探测频率）。
-- **市场行为（Q45/Q46）**：默认排序主清单置顶（组内维持原顺序）+ 社区按 30 天下载量降序（无数据按名称）；搜索同时匹配中英文描述；「只看主清单」chip 常驻筛选栏首位。**探测边界**：市场浏览页对社区 npm 条目做 latest 探测（registry 无配额限制）；社区 github 条目**不做**浏览页 REST 探测（GitHub 匿名 60 次/小时在 50 条/页 × 2 调用下不可控），更新检查收敛到详情/安装时的按需解析——配额耗尽时已有可读提示（versions.ts `githubRateLimitMessage`）。**已装页豁免**：探测对象受已装数量天然约束，继续探测；计量在**真实 GitHub HTTP 请求层**（一次 `githubLatestTag` ≈ 1–3 个请求：release 路径 1–2 个、fallback 路径 releases→tags→commits 最多 3 个）：单请求 ≤25 次、宿主进程滚动 1 小时 ≤50 次（**仅作用于被动探测**——用户主动 install/upgrade/诊断不经此预算）、同仓库 in-flight single-flight、超限标 `latestError` 不阻塞列表——否则用户装的社区 github 插件永远没有更新徽标。独立 CLI 进程不共享宿主内预算，文档如实标注 best-effort（并发场景不承诺 60/h 绝不耗尽）。能力披露（capabilities/红线）只在详情折叠区展示（缺省 = 未扫描 ≠ 未检出），卡片不打标（Q44，防警告疲劳）；截图仅详情层加载（GitHub 图床白名单由上游保证）。
+- **市场行为（Q45/Q46）**：默认排序主清单置顶（组内维持原顺序）+ 社区按 30 天下载量降序（无数据按名称）；搜索同时匹配中英文描述；「只看主清单」chip 常驻筛选栏首位。**探测边界**：市场浏览页对社区 npm 条目做 latest 探测（registry 无配额限制）；社区 github 条目**不做**浏览页 REST 探测（GitHub 匿名 60 次/小时在 50 条/页 × 2 调用下不可控），更新检查收敛到详情/安装时的按需解析——配额耗尽时已有可读提示（versions.ts `githubRateLimitMessage`）。**已装页豁免**：探测对象受已装数量天然约束，继续探测；计量在**真实 GitHub HTTP 请求层**（一次 `githubLatestTag` ≈ 1–3 个请求：release 路径 1–2 个、fallback 路径 releases→tags→commits 最多 3 个）：单请求 ≤25 次、宿主进程滚动 1 小时 ≤50 次（**仅作用于被动探测**——用户主动 install/upgrade/诊断不经此预算）、同仓库 in-flight single-flight、超限标 `latestError` 不阻塞列表——否则用户装的社区 github 插件永远没有更新徽标。独立 CLI 进程不共享宿主内预算，文档如实标注 best-effort（并发场景不承诺 60/h 绝不耗尽）。能力披露（capabilities/红线）只在详情折叠区展示（缺省 = 未扫描 ≠ 未检出），卡片不打标（Q44，防警告疲劳）；社区截图仅详情层加载且其 GitHub 图床白名单由上游保证；Primary 作者清单按 §2.6 由 Host 与客户端消费端各自校验。
 
 ### 2.6 双清单分区市场与交互升级（0.7.0 grilling 定稿 2026-09-29）
 
@@ -92,6 +92,7 @@
   - 搜索：相关性加权管线——NFKC 归一化 + 中西文边界插空格 + 字段权重（name/npm > owner > 描述 > 分类）+ 命中类型加分 + 按条目缓存归一化结果；输入 250ms debounce + IME composition 全程处理 + draft/已提交 query 分离。**0.9.25 起搜索跨区全局**（两分区搜索框同语义）：摘要行报两分区精确命中数（`sourceCounts`），结果页内按精选段置顶分组，分类 chips 搜索态隐藏、「筛选」按钮随摘要行保留（页大小组）。**0.9.26 补充**：GUI 跨区搜索通道精选命中稳定前置（`curatedFirst`，分区内相关序不变；tools/CLI 不传，三端同序不变）——摘要行全局计数与首页所见一致，弱命中精选不被 downloads tie-break 埋进后页。
   - 描述 5 行钳制（真实溢出才显示展开钮）；**数据层双语**——描述按 UI 语言取 zh/en（数据现成），UI 完整双语字典列 backlog。
 - **详情 = Modal 且为卡片超集**（「detail 显示少于摘要就是倒退」）：byline / 分类 / 收录日期 / 下载量窗口三要素（计数 + 窗口 + 核对时间）/ 描述全文 / 截图灯箱（←→/Esc、**禁自动轮播**）/ 能力披露 + 红线（**默认收起**）/ 安装命令折叠行（0.9.14 起按上下文显隐：desktop 上下文与已安装条目整行隐藏——命令两来源恒为 `--profile web` 语义，desktop 装机走弹窗内安装按钮）/ deprecated 替代链接；精选条目超集另加 verified 与 tags。**安装确认走 Modal**。安装信息就地显示（0.9.15）：进行中进度行与终态结果行挂 Modal 内、底层同源进度行让位——展示派生自全局操作记录，§2.6「状态不挂卡片」所有权模型不变。卡片瘦身：能力披露、截图、安装命令全部迁出卡片（Q44 精神「只在详情层、默认收起」不变，载体升级）。
+- **详情截图来源（2026-10-09，[ADR-0015](./adr/0015-primary-screenshot-manifest.md)）**：Community live 条目沿用 `CommunityEntry.screenshots`（来自版本化 `dsh-plugin-catalog`）；Primary DetailModal 调 GUI Host method `primary-screenshots({ id })`，Host 按 active Primary Registry 精确查 id 与 `github`，仅当 `github` 存在时懒读仓库根 `screenshots.json`（HEAD）。清单为顶层最多 8 个仓库相对路径；缺 github、缺文件、无效内容或网络失败均返回空列表，不回退 Community Catalog、README 或 npm repository。清单只在 Modal state/Host 内存缓存（成功结果 10 分钟、空/失败结果负缓存 1 分钟），不进入 `MarketItem`、市场 localStorage 快照、收藏快照、Agent 工具或 CLI；最终图片仍经现有 `safeScreenshots` 与 [ADR-0014](./adr/0014-image-chain-weserv-first.md) 的 `useImgChain`。`source='primary'` 是 market 分区参数，与 `primary-screenshots` Host method 分离；现有 Community Zone 可独立加载社区数据。
 - **全局操作记录**：每个变更操作一条 record（`queued / running / input=冲突待决 / done / warned / failed`），**状态不挂卡片**——翻页、搜索、切 tab 不丢；**localStorage 持久化队列**，宿主重载恢复时逐条校验「此刻仍成立才执行，否则报告」；覆盖安装、升级、卸载、开关。已装侧跟随一致化：「全部更新 (N)」批量入口 + tab 更新红点 + 卡片视觉与发现侧同体系；组管理、个人备注列 backlog。
 - **收藏**：浏览器 localStorage 本地收藏（不进 profile、不进服务端）；收藏区 stale 条目（目录中已下架）单独提示 + 一键清理。
 - **agent/CLI 契约（允许破坏性变更）**：`dshm_search` 参数改为 `query / category / source('primary'|'community'|'all'，默认 all，与 GUI 分区对齐) / limit(默认 10，clamp 1–80) / offset(真翻页)`；`primary_only` 删除。输出补 `community` 标记与 `downloads/stars`；社区分类直出中文标签（不再回退英文 slug）；工具描述整体重写（真实规模 + 翻页语义，删「registry is curated & small」）。CLI 对齐 `--source / --offset / --limit`，默认 10 条。

package/lib/client.js

@@ -478,6 +478,66 @@ var init_lightbox = __esm({
   }
 });
 
+// src/client/img-chain.js
+var img_chain_exports = {};
+__export(img_chain_exports, {
+  WESERV_BASE: () => WESERV_BASE,
+  WESERV_TIMEOUT_MS: () => WESERV_TIMEOUT_MS,
+  needsTimeout: () => needsTimeout,
+  nextTier: () => nextTier,
+  preferredTier: () => preferredTier,
+  rememberSuccess: () => rememberSuccess,
+  resetTierPreferences: () => resetTierPreferences,
+  serviceBucketOf: () => serviceBucketOf,
+  tierOrder: () => tierOrder,
+  weservUrl: () => weservUrl
+});
+function weservUrl(src, { w, h: h2 } = {}) {
+  const bare = String(src).replace(/^https?:\/\//, "");
+  const size = Number.isFinite(w) && w > 0 ? `w=${Math.floor(w)}` : Number.isFinite(h2) && h2 > 0 ? `h=${Math.floor(h2)}` : "";
+  const sizePart = size ? `&${size}` : "";
+  return `${WESERV_BASE}url=${encodeURIComponent(bare)}${sizePart}&fit=inside&we=1&output=webp&q=80`;
+}
+function serviceBucketOf(url) {
+  try {
+    return new URL(String(url)).hostname === "github.com" ? "avatar" : "raw";
+  } catch {
+    return "raw";
+  }
+}
+function tierOrder(preferred) {
+  return preferred === "direct" ? ["direct", "weserv"] : ["weserv", "direct"];
+}
+function nextTier(current, preferred = "weserv") {
+  const order = tierOrder(preferred);
+  const idx = order.indexOf(current);
+  if (idx === -1 || idx === order.length - 1) return "failed";
+  return order[idx + 1];
+}
+function needsTimeout(tier) {
+  return tier === "weserv";
+}
+function preferredTier(bucket) {
+  return preferredByBucket[bucket === "avatar" ? "avatar" : "raw"];
+}
+function rememberSuccess(bucket, tier) {
+  if (tier !== "weserv" && tier !== "direct") return;
+  preferredByBucket[bucket === "avatar" ? "avatar" : "raw"] = tier;
+}
+function resetTierPreferences() {
+  preferredByBucket.raw = "weserv";
+  preferredByBucket.avatar = "weserv";
+}
+var WESERV_BASE, WESERV_TIMEOUT_MS, preferredByBucket;
+var init_img_chain = __esm({
+  "src/client/img-chain.js"() {
+    "use strict";
+    WESERV_BASE = "https://images.weserv.nl/?";
+    WESERV_TIMEOUT_MS = 8e3;
+    preferredByBucket = { raw: "weserv", avatar: "weserv" };
+  }
+});
+
 // src/client/markdown.js
 var markdown_exports = {};
 __export(markdown_exports, {
@@ -1592,6 +1652,7 @@ var { DEFAULT_PAGE_SIZE: DEFAULT_PAGE_SIZE2, MARKET_PAGE_SIZES: MARKET_PAGE_SIZE
 var { readMarketSnapshot: readMarketSnapshot2, writeMarketSnapshot: writeMarketSnapshot2, isDefaultFirstPageQuery: isDefaultFirstPageQuery2 } = (init_market_snapshot(), __toCommonJS(market_snapshot_exports));
 var { backdropCloseHandlers: backdropCloseHandlers2 } = (init_backdrop(), __toCommonJS(backdrop_exports));
 var { lbStep: lbStep2 } = (init_lightbox(), __toCommonJS(lightbox_exports));
+var { WESERV_TIMEOUT_MS: WESERV_TIMEOUT_MS2, weservUrl: weservUrl2, serviceBucketOf: serviceBucketOf2, tierOrder: tierOrder2, nextTier: nextTier2, needsTimeout: needsTimeout2, preferredTier: preferredTier2, rememberSuccess: rememberSuccess2 } = (init_img_chain(), __toCommonJS(img_chain_exports));
 var { createMarkdown: createMarkdown2 } = (init_markdown(), __toCommonJS(markdown_exports));
 var { ExtLink, MdImg, renderMarkdown } = createMarkdown2(h);
 var { installedViewModel: installedViewModel2, registrySourceKey: registrySourceKey2 } = (init_installed_view(), __toCommonJS(installed_view_exports));
@@ -1772,6 +1833,9 @@ var ZH = {
   "lb.prev": "\u4E0A\u4E00\u5F20\uFF08\u2190\uFF09",
   "lb.next": "\u4E0B\u4E00\u5F20\uFF08\u2192\uFF09",
   "lb.hint": "\u70B9\u56FE\u6216\u7A7A\u767D\u5904\u5173\u95ED \xB7 \u2190\u2192 \u5207\u6362",
+  "lb.fail": "\u56FE\u7247\u52A0\u8F7D\u5931\u8D25",
+  "lb.retry": "\u91CD\u8BD5",
+  "lb.open": "\u6253\u5F00\u539F\u56FE",
   "filter.title": "\u7B5B\u9009",
   "filter.sortfield": "\u6392\u5E8F\u5B57\u6BB5",
   "filter.sortdir": "\u6392\u5217\u65B9\u5411",
@@ -2050,6 +2114,9 @@ var EN = {
   "lb.prev": "Previous (\u2190)",
   "lb.next": "Next (\u2192)",
   "lb.hint": "Click image or backdrop to close \xB7 \u2190\u2192 to switch",
+  "lb.fail": "Failed to load image",
+  "lb.retry": "Retry",
+  "lb.open": "Open original",
   "filter.title": "Filter",
   "filter.sortfield": "Sort by",
   "filter.sortdir": "Direction",
@@ -2290,21 +2357,48 @@ var CSS = `
    \u8BC4\u5BA1 R1\uFF1A\u2715/\u2039\u203A \u7528 .dsvm-btn.dsvm-lb* \u590D\u5408\u9009\u62E9\u5668\u2014\u2014\u57FA\u7840 .dsvm-btn \u89C4\u5219\u6E90\u987A\u5E8F\u9760\u540E
    \uFF08padding:5px 14px/font-size:13px/radius:8px\uFF09\uFF0C\u540C\u7279\u5F02\u6027\u4E0B\u4F1A\u53CD\u6740\u5355\u7C7B\u89C4\u5219\uFF08\u5B9E\u6D4B\u5B57\u5F62 13px\u226026px\uFF09\u3002
    \u8BC4\u5BA1 R2\uFF1Atop \u8BA9\u51FA Windows Desktop \u62D6\u62FD\u5E26 var(--dsh-windows-titlebar-height)\uFF080.9.4 \u5148\u4F8B\uFF0C
-   \u58F3\u9876 -webkit-app-region:drag \u541E\u70B9\u51FB\u3001\u65E0\u89C6 z-index\uFF09\uFF1BWeb \u65E0\u6B64\u53D8\u91CF\u56DE\u843D 0px \u884C\u4E3A\u4E0D\u53D8\u3002 */
-.dsvm-lightbox{position:fixed;top:var(--dsh-windows-titlebar-height,0px);left:0;right:0;bottom:0;z-index:2147483200;background:rgba(0,0,0,.88);display:flex;align-items:center;justify-content:center}
+   \u58F3\u9876 -webkit-app-region:drag \u541E\u70B9\u51FB\u3001\u65E0\u89C6 z-index\uFF09\uFF1BWeb \u65E0\u6B64\u53D8\u91CF\u56DE\u843D 0px \u884C\u4E3A\u4E0D\u53D8\u3002
+   0.9.62 \u5F71\u9662\u906E\u7F69\u81EA\u6301\uFF1A\u706F\u7BB1\u662F\u56FE\u7247\u5F71\u9662\u9762\uFF0C\u300C\u6DF1\u8272\u906E\u7F69 + \u6D45\u8272\u63A7\u4EF6\u300D\u662F\u7EC4\u4EF6\u81EA\u6709\u53EF\u8BFB\u6027
+   \u4E0D\u53D8\u91CF\uFF0C\u4E0D\u968F\u989C\u8272\u6A21\u5F0F/\u76AE\u80A4\u7FFB\u8F6C\u3002\u5B9E\u8BC1\u78B0\u649E\uFF1Adsh-skins ADR-0007 \u6D6E\u5C42\u6BDB\u73BB\u7483\u5E76\u96C6\u6309
+   [role=dialog][aria-modal=true] \u547D\u4E2D\u672C\u6839\uFF08\u6D45\u8272\u6A21\u5F0F 86% \u6696\u767D tint+blur14\uFF09\uFF0C\u767D\u8272\u63A7\u4EF6
+   \u5728\u6D45\u5E95\u4E0A\u4E0D\u53EF\u89C1\uFF08\u7528\u6237\u53CC\u6A21\u5F0F\u5B9E\u62CD\uFF09\u3002\u53CC\u4FA7\u4FEE\u590D\u2014\u2014\u76AE\u80A4\u4FA7 :not(.dsvm-lightbox) \u8C41\u514D
+   \uFF08dsh-skins 1.5.1 \u8D77\uFF09\uFF1B\u672C\u4FA7 background !important \u81EA\u6301\uFF1Amarketplace \u793E\u533A\u76AE\u80A4\u4E0D\u53EF
+   \u679A\u4E3E\uFF0C\u5F71\u9662\u4E0D\u53D8\u91CF\u5FC5\u987B\u7531\u7EC4\u4EF6\u81EA\u5DF1\u515C\u5E95\u3002!important \u6E05\u5355\u5B9A\u957F\uFF08\u6CE8\u91CA\u63D0\u53CA\xD72 + \u672C\u89C4\u5219
+   + sidebar footer \u517C\u5BB9\u89C4\u5219\uFF09\uFF0C\u65B0\u589E\u987B\u6539 client-lightbox \u65AD\u8A00\u663E\u5F0F\u767B\u8BB0\uFF0C\u6CE8\u91CA\u5373\u5B88\u536B\u3002 */
+.dsvm-lightbox{position:fixed;top:var(--dsh-windows-titlebar-height,0px);left:0;right:0;bottom:0;z-index:2147483200;background:rgba(0,0,0,.88)!important;display:flex;align-items:center;justify-content:center}
 .dsvm-lightbox img{max-width:min(92vw,1500px);max-height:74vh;border-radius:8px;cursor:zoom-out;box-shadow:0 10px 44px rgba(0,0,0,.55);display:block}
 .dsvm-btn:focus-visible{outline:2px solid rgba(255,255,255,.75);outline-offset:2px}
 .dsvm-btn.dsvm-lbclose{position:absolute;top:12px;right:12px;width:38px;height:38px;padding:0;border-radius:10px;display:flex;align-items:center;justify-content:center}
 .dsvm-btn.dsvm-lbarrow{position:absolute;top:50%;transform:translateY(-50%);width:46px;height:60px;padding:0;font-size:26px;line-height:1;border-radius:10px}
 .dsvm-lbarrow.prev{left:12px}
 .dsvm-lbarrow.next{right:12px}
+/* 0.9.62 \u63A7\u4EF6\u6DF1\u8272\u73BB\u7483\u82AF\u7247\uFF1A\u2039\u203A/\u2715 \u539F\u968F\u57FA\u7840 .dsvm-btn \u88F8\u900F\u660E\u767D\uFF08rgba(255,255,255,.14) \u5E95
+   + \u767D\u5B57\u767D\u8FB9\uFF09\uFF0C\u906E\u7F69\u4E00\u65E6\u88AB\u4EFB\u4F55\u6765\u6E90\u6539\u6D45\u5373\u6574\u4F53\u9690\u5F62\uFF08\u672C\u6B21\u4E8B\u6545\u7684\u53E6\u4E00\u534A\uFF09\u3002\u6539\u7528\u4E0E\u5E95\u90E8
+   pill \u540C\u65CF\u7684\u6DF1\u8272\u82AF\u7247\uFF08slate-900 55% + \u767D\u63CF\u8FB9 + blur + \u6295\u5F71\uFF09\u2014\u2014\u6DF1\u906E\u7F69\u4E0A\u9760\u63CF\u8FB9/blur/\u6295\u5F71
+   \u51FA\u5C42\u6B21\uFF0C\u6D45\u906E\u7F69\u4E0A\u82AF\u7247\u672C\u8EAB\u5C31\u662F\u5BF9\u6BD4\u9762\uFF0C\u4EFB\u4F55\u989C\u8272\u6A21\u5F0F\u4E0E\u76AE\u80A4\u4E0B\u90FD\u53EF\u8BFB\uFF1Bhover \u63D0\u4EAE\u3002
+   \u663E\u5F0F :hover\uFF08\u7279\u5F02\u6027 0,3,0\uFF09\u538B\u8FC7\u57FA\u7840 .dsvm-btn:hover\uFF080,2,0\uFF09\u2014\u2014\u5373\u4FBF\u672C\u5757\u6392\u5728\u57FA\u7840\u89C4\u5219
+   \u4E4B\u524D\u4E5F\u4E0D\u88AB\u6E90\u987A\u5E8F\u53CD\u6740\uFF08\u8BC4\u5BA1 R1 \u540C\u65CF\u6559\u8BAD\uFF09\u3002 */
+.dsvm-btn.dsvm-lbclose,.dsvm-btn.dsvm-lbarrow{background:rgba(15,23,42,.55);border-color:rgba(255,255,255,.28);box-shadow:0 4px 16px rgba(0,0,0,.35);backdrop-filter:blur(8px);-webkit-backdrop-filter:blur(8px)}
+.dsvm-btn.dsvm-lbclose:hover,.dsvm-btn.dsvm-lbarrow:hover{background:rgba(15,23,42,.8);border-color:rgba(255,255,255,.5)}
 .dsvm-lbbar{position:absolute;left:50%;bottom:14px;transform:translateX(-50%);display:flex;align-items:center;gap:12px;max-width:94vw;background:rgba(15,23,42,.62);border:1px solid rgba(255,255,255,.16);border-radius:999px;padding:7px 16px;backdrop-filter:blur(6px);-webkit-backdrop-filter:blur(6px)}
 .dsvm-lbcount{color:rgba(255,255,255,.82);font-size:12px;font-variant-numeric:tabular-nums;white-space:nowrap}
 .dsvm-lbhint{color:rgba(255,255,255,.55);font-size:11px;white-space:nowrap}
 .dsvm-lbdots{display:flex;gap:2px}
 .dsvm-lbdot{box-sizing:content-box;width:8px;height:8px;padding:5px;border-radius:50%;background:rgba(255,255,255,.32);background-clip:content-box;cursor:pointer}
 .dsvm-lbdot.on{background:#fff;background-clip:content-box}
+/* 0.9.62 \u52A0\u8F7D\u6307\u793A\u4E0E\u6DE1\u5165\uFF1A\u706F\u7BB1\u8D70\u94FE\u671F\u95F4\uFF08weserv \u6162\u901F/8s \u5B88\u536B\u6362\u5C42/\u76F4\u8FDE\u5927\u56FE\uFF09\u6B64\u524D\u662F
+   \u7A7A\u9ED1\u9ED1\u6D1E\uFF0C\u73B0\u8F6C\u5708\u5360\u4F4D\uFF1B\u56FE\u7247 onLoad\uFF08useImgChain settled\uFF09\u540E 160ms \u6DE1\u5165\u6362\u573A\u3002
+   prefers-reduced-motion \u4E0B\u8F6C\u573A\u505C\u7528\uFF08\u8F6C\u5708\u964D\u901F\u4FDD\u7559\u6D3B\u52A8\u6307\u793A\uFF09\u3002 */
+@keyframes dsvm-lbspin{to{transform:rotate(360deg)}}
+.dsvm-lbspin{position:absolute;left:50%;top:50%;width:34px;height:34px;margin:-17px 0 0 -17px;border-radius:50%;border:3px solid rgba(255,255,255,.25);border-top-color:rgba(255,255,255,.92);animation:dsvm-lbspin .8s linear infinite}
+.dsvm-lightbox .dsvm-lbimg{opacity:0;transition:opacity .16s ease-out}
+.dsvm-lightbox .dsvm-lbimg.dsvm-lbimg-on{opacity:1}
+@media (prefers-reduced-motion:reduce){.dsvm-lbspin{animation-duration:1.6s}.dsvm-lightbox .dsvm-lbimg{transition:none}}
 @media (max-width:640px){.dsvm-lbhint{display:none}.dsvm-btn.dsvm-lbarrow{width:40px;height:54px}}
+/* 0.9.61 \u53CC\u8D25\u7EC8\u6001\u5360\u4F4D\uFF1A\u5C45\u4E2D\u5217\u2014\u2014\u26A0 \u6587\u6848 + \u91CD\u8BD5\uFF08\u590D\u7528 dsvm-btn\uFF09+ \u6253\u5F00\u539F\u56FE\uFF08ExtLink \u65B0\u6807\u7B7E\uFF09 */
+.dsvm-lbfail{display:flex;flex-direction:column;align-items:center;gap:12px;padding:24px 32px;background:rgba(15,23,42,.55);border:1px solid rgba(255,255,255,.14);border-radius:12px}
+.dsvm-lbfailmsg{color:rgba(255,255,255,.85);font-size:14px}
+.dsvm-lbfail a{color:rgba(255,255,255,.75);font-size:13px;text-decoration:underline}
 .dsvm-card-clickable, .dshm-card{cursor:pointer}
 .dshm-card:hover{border-color:var(--dsw-alias-interactive-bg-selected,#4f46e5)}
 .dsvm-btn{border:1px solid rgba(255,255,255,.35);background:rgba(255,255,255,.14);color:#fff;border-radius:8px;padding:5px 14px;font:inherit;font-size:13px;cursor:pointer}
@@ -2563,18 +2657,20 @@ function useMarketData(zone = "community") {
   return { query, data, loading, error, reload, updateQuery };
 }
 function Icon({ entry }) {
-  const [broken, setBroken] = useState(false);
   const letter = String(entry.name || entry.id || "?").charAt(0).toUpperCase();
   const url = entry.icon || (entry.github ? `https://github.com/${entry.github.split("/")[0]}.png?size=64` : null);
-  if (!url || broken) {
+  const chain = useImgChain(url || "", { h: 96 });
+  if (!url || chain.failed) {
     return h("div", { className: "dshm-icon", "aria-hidden": "true" }, letter);
   }
   return h("img", {
     className: "dshm-icon",
-    src: url,
+    src: chain.src,
     alt: "",
-    onError: () => setBroken(true),
-    referrerPolicy: "no-referrer"
+    onError: chain.onError,
+    onLoad: chain.onLoad,
+    referrerPolicy: "no-referrer",
+    decoding: "async"
   });
 }
 function Spin() {
@@ -2962,7 +3058,7 @@ function compactCount(n) {
   }
   return String(n);
 }
-function Shot({ src, onClick }) {
+function Shot({ src, onClick, onBroken }) {
   const [show, setShow] = useState(false);
   const ref = useRef(null);
   useEffect(() => {
@@ -2983,6 +3079,10 @@ function Shot({ src, onClick }) {
     io.observe(el);
     return () => io.disconnect();
   }, []);
+  const chain = useImgChain(src, { h: 300, active: show });
+  useEffect(() => {
+    if (chain.failed && onBroken) onBroken(src);
+  }, [chain.failed, onBroken, src]);
   return h(
     "div",
     {
@@ -2999,9 +3099,52 @@ function Shot({ src, onClick }) {
         }
       }
     },
-    show ? h("img", { className: "dsvm-shot", src, alt: "", loading: "lazy", referrerPolicy: "no-referrer", fetchPriority: "low" }) : null
+    show ? chain.failed ? null : h("img", { className: "dsvm-shot", src: chain.src, alt: "", loading: "lazy", referrerPolicy: "no-referrer", fetchPriority: "low", decoding: "async", onError: chain.onError, onLoad: chain.onLoad }) : null
   );
 }
+function useImgChain(url, opts) {
+  const { w, h: h2, active = true } = opts || {};
+  const bucket = useMemo(() => serviceBucketOf2(url), [url]);
+  const startPrefRef = useRef(null);
+  if (startPrefRef.current === null) startPrefRef.current = preferredTier2(serviceBucketOf2(url));
+  const [tier, setTier] = useState(() => tierOrder2(startPrefRef.current)[0]);
+  const [settled, setSettled] = useState(false);
+  const startChain = useCallback(() => {
+    startPrefRef.current = preferredTier2(serviceBucketOf2(url));
+    setSettled(false);
+    setTier(tierOrder2(startPrefRef.current)[0]);
+  }, [url]);
+  const [prevUrl, setPrevUrl] = useState(url);
+  if (prevUrl !== url) {
+    setPrevUrl(url);
+    startPrefRef.current = preferredTier2(serviceBucketOf2(url));
+    setSettled(false);
+    setTier(tierOrder2(startPrefRef.current)[0]);
+  }
+  const failed = tier === "failed";
+  const src = failed ? "" : tier === "weserv" ? weservUrl2(url, { w, h: h2 }) : url;
+  const advance = () => {
+    setSettled(false);
+    setTier((t) => nextTier2(t, startPrefRef.current));
+  };
+  const onError = advance;
+  const onLoad = useCallback(() => {
+    setSettled(true);
+    rememberSuccess2(bucket, tier);
+  }, [bucket, tier]);
+  const retry = startChain;
+  useEffect(() => {
+    if (!url || !active || settled || !needsTimeout2(tier)) return;
+    const timer = setTimeout(advance, WESERV_TIMEOUT_MS2);
+    return () => clearTimeout(timer);
+  }, [url, active, settled, tier]);
+  return { src, failed, retry, onError, onLoad, settled };
+}
+function UseImgChainProbe(props) {
+  const chain = useImgChain(props.url, { w: props.w, h: props.h });
+  if (chain.failed) return h("div", { className: "dsvm-probe-failed" }, "chain:failed");
+  return h("img", { src: chain.src, alt: "", referrerPolicy: "no-referrer", decoding: "async", onError: chain.onError, onLoad: chain.onLoad });
+}
 function Lightbox({ shots, index, onNav, onClose }) {
   const single = shots.length <= 1;
   const closeRef = useRef(null);
@@ -3016,10 +3159,21 @@ function Lightbox({ shots, index, onNav, onClose }) {
   useEffect(() => {
     if (closeRef.current) closeRef.current.focus();
   }, []);
+  const chain = useImgChain(shots[index], { w: 1600 });
   const node = h(
     "div",
     { className: "dsvm-lightbox", role: "dialog", "aria-modal": "true", "aria-label": lookup("lb.title"), ...backdropCloseHandlers2(onClose) },
-    h("img", { src: shots[index], alt: "", onClick: onClose, referrerPolicy: "no-referrer" }),
+    chain.failed ? h(
+      "div",
+      { className: "dsvm-lbfail", onClick: (e) => e.stopPropagation() },
+      h("div", { className: "dsvm-lbfailmsg" }, `\u26A0 ${lookup("lb.fail")}`),
+      h("button", { className: "dsvm-btn", onClick: chain.retry }, lookup("lb.retry")),
+      h(ExtLink, { href: shots[index] }, lookup("lb.open"))
+    ) : [
+      // 0.9.62 走链期间转圈占位（settled 即卸载；点它视为点遮罩可关——急躁关闭是合理逃生门）
+      !chain.settled && chain.src ? h("div", { className: "dsvm-lbspin", "aria-hidden": "true" }) : null,
+      h("img", { className: `dsvm-lbimg${chain.settled ? " dsvm-lbimg-on" : ""}`, src: chain.src, alt: "", onClick: onClose, referrerPolicy: "no-referrer", decoding: "async", onError: chain.onError, onLoad: chain.onLoad })
+    ],
     h("button", { ref: closeRef, className: "dsvm-btn dsvm-lbclose", "aria-label": lookup("common.close"), title: lookup("common.close"), onClick: onClose }, h(XIcon)),
     single ? null : h("button", { className: "dsvm-btn dsvm-lbarrow prev", "aria-label": lookup("lb.prev"), title: lookup("lb.prev"), onClick: () => onNav(lbStep2(index, -1, shots.length)) }, "\u2039"),
     single ? null : h("button", { className: "dsvm-btn dsvm-lbarrow next", "aria-label": lookup("lb.next"), title: lookup("lb.next"), onClick: () => onNav(lbStep2(index, 1, shots.length)) }, "\u203A"),
@@ -3046,7 +3200,39 @@ function useModalDepth(active) {
 }
 function DetailModal({ it, labels, busy, onClose, onInstall, onUpgrade, upgradeBusy, upgradeRec, profileKind, installRec, installNote }) {
   useModalDepth(true);
-  const shots = it.community === true ? safeScreenshots(it) : [];
+  const communityScreenshotSource = it.community === true || typeof it.owner === "string";
+  const [primaryShotState, setPrimaryShotState] = useState({ id: null, screenshots: [] });
+  useEffect(() => {
+    let live = true;
+    const controller = new AbortController();
+    setPrimaryShotState({ id: it.id, screenshots: [] });
+    if (communityScreenshotSource || typeof it.id !== "string" || it.id.trim() === "") {
+      return () => {
+        live = false;
+        controller.abort();
+      };
+    }
+    api("primary-screenshots", { id: it.id }, controller.signal).then((data) => {
+      if (!live) return;
+      setPrimaryShotState({ id: it.id, screenshots: safeScreenshots({ screenshots: data && data.screenshots }) });
+    }).catch(() => {
+      if (live) setPrimaryShotState({ id: it.id, screenshots: [] });
+    });
+    return () => {
+      live = false;
+      controller.abort();
+    };
+  }, [it.id, it.github, it.community, it.owner]);
+  const primaryShots = primaryShotState.id === it.id ? primaryShotState.screenshots : [];
+  const shots = communityScreenshotSource ? safeScreenshots(it) : primaryShots;
+  const [brokenShots, setBrokenShots] = useState([]);
+  const [brokenShotsKey, setBrokenShotsKey] = useState(it.id);
+  if (brokenShotsKey !== it.id) {
+    setBrokenShotsKey(it.id);
+    setBrokenShots([]);
+  }
+  const breakShot = useCallback((src) => setBrokenShots((prev) => prev.includes(src) ? prev : prev.concat(src)), []);
+  const visible = shots.filter((src) => !brokenShots.includes(src));
   const [lb, setLb] = useState(null);
   const [copied, setCopied] = useState(false);
   const [rmOpen, setRmOpen] = useState(false);
@@ -3060,14 +3246,14 @@ function DetailModal({ it, labels, busy, onClose, onInstall, onUpgrade, upgradeB
         if (lb !== null) setLb(null);
         else onClose();
       }
-      if (lb !== null && shots.length > 1) {
-        if (e.key === "ArrowLeft") setLb((i) => lbStep2(i, -1, shots.length));
-        if (e.key === "ArrowRight") setLb((i) => lbStep2(i, 1, shots.length));
+      if (lb !== null && visible.length > 1) {
+        if (e.key === "ArrowLeft") setLb((i) => lbStep2(i, -1, visible.length));
+        if (e.key === "ArrowRight") setLb((i) => lbStep2(i, 1, visible.length));
       }
     };
     document.addEventListener("keydown", onKey);
     return () => document.removeEventListener("keydown", onKey);
-  }, [lb, shots.length, onClose]);
+  }, [lb, visible.length, onClose]);
   const catLabel = labels && labels[it.category] || (["essentials", "cui-picks", "self-dev", "tencent-lighthouse", "watchlist"].includes(it.category) ? lookup("cat." + it.category) : it.category);
   const installCmd = typeof it.install === "string" && it.install !== "" ? it.install : it.source === "npm" ? `dsh plugin --profile web add ${it.npm}` : `dsh plugin --profile web add github:${it.github}`;
   const copyCmd = async () => {
@@ -3136,10 +3322,10 @@ function DetailModal({ it, labels, busy, onClose, onInstall, onUpgrade, upgradeB
         h("summary", null, lookup("readme.show")),
         rmOpen ? h(ReadmeBlock, { pkg: it.npm, repo: it.github }) : h("div", { className: "dshm-hint" }, lookup("readme.loading"))
       ) : null,
-      shots.length ? h(
+      visible.length ? h(
         "div",
         { className: "dsvm-shotrow" },
-        ...shots.map((src, i) => h(Shot, { key: `${i}:${src}`, src, onClick: () => setLb(i) }))
+        ...shots.map((src, i) => h(Shot, { key: `${i}:${src}`, src, onClick: () => setLb(visible.indexOf(src)), onBroken: breakShot }))
       ) : null,
       it.community === true ? h(
         "details",
@@ -3182,7 +3368,8 @@ function DetailModal({ it, labels, busy, onClose, onInstall, onUpgrade, upgradeB
         ) : h("button", { className: "dshm-btn primary", disabled: busy, onClick: () => onInstall(it) }, busy ? h(Spin) : lookup("action.install"))
       )
     ),
-    lb !== null && shots.length ? h(Lightbox, { shots, index: lb, onNav: setLb, onClose: () => setLb(null) }) : null
+    // 0.9.61（评审 F）：visible 活引用 + index 钳制（后台剔除收缩防越界）
+    lb !== null && visible.length ? h(Lightbox, { shots: visible, index: Math.min(lb, visible.length - 1), onNav: setLb, onClose: () => setLb(null) }) : null
   );
 }
 var ZONE_TABS = [

package/lib/core/host-api.js

@@ -13,6 +13,7 @@ import { runDoctor } from './doctor.js';
 import { listInstalledWithMeta, listMarket, installFromRegistry, selfUpgrade, uninstallPlugin, upgradePlugin, InstallGuardError, } from './market.js';
 import { runProfileTransaction, TransactionError } from './profile-transaction.js';
 import { readInstalledPluginReadme } from './installed.js';
+import { loadPrimaryScreenshots } from './primary-screenshots.js';
 import { isNewerVersion, npmLatest, npmPackumentReadme } from './versions.js';
 import { getCommunitySummary } from './community.js';
 import { RegistryConfigError } from './registry-controller.js';
@@ -218,6 +219,7 @@ export function createApiDispatcher(ctx) {
         npmLatest: ctx.deps?.npmLatest ?? npmLatest,
         readInstalledPluginReadme: ctx.deps?.readInstalledPluginReadme ?? readInstalledPluginReadme,
         npmPackumentReadme: ctx.deps?.npmPackumentReadme ?? npmPackumentReadme,
+        loadPrimaryScreenshots: ctx.deps?.loadPrimaryScreenshots ?? loadPrimaryScreenshots,
         getCommunitySummary: ctx.deps?.getCommunitySummary ?? getCommunitySummary,
         runTransaction: ctx.deps?.runTransaction ?? runProfileTransaction,
         scheduleRestart: ctx.deps?.scheduleRestart ?? scheduleRestart,
@@ -324,6 +326,28 @@ export function createApiDispatcher(ctx) {
                     payload = { plugins: snap.loaded.registry.plugins, registryState: snap.loaded, community };
                     break;
                 }
+                case 'primary-screenshots': {
+                    const id = strArg(body, 'id');
+                    if (!id)
+                        throw new ApiProtocolError(400, '缺少 id');
+                    await ctx.controller.ensureReady({ signal });
+                    const snap = await ctx.controller.snapshot({ signal });
+                    // 只信 active Primary Registry 的精确 id → github 映射；请求体中的 github/url 一律忽略。
+                    // 本 method 不调用 listMarket/getCommunitySummary，也不加载 Community Catalog。
+                    const entry = snap.loaded.registry.plugins.find((candidate) => candidate.id === id);
+                    if (!entry || typeof entry.github !== 'string' || entry.github.trim() === '') {
+                        payload = { screenshots: [] };
+                        break;
+                    }
+                    try {
+                        payload = { screenshots: await d.loadPrimaryScreenshots(entry.github) };
+                    }
+                    catch {
+                        // 截图是可选详情元数据；manifest 不可用不应阻塞详情或安装决策。
+                        payload = { screenshots: [] };
+                    }
+                    break;
+                }
                 case 'market': {
                     await ctx.controller.ensureReady();
                     // GUI policy：忽略客户端 withLatest，固定 true；limit clamp 1..96、缺省 32

package/lib/core/primary-screenshots.js

@@ -0,0 +1,142 @@
+import { fetchTextLimited } from './httpx.js';
+const MANIFEST_HOST = 'raw.githubusercontent.com';
+const MANIFEST_FILE = 'screenshots.json';
+const MAX_MANIFEST_BYTES = 64 * 1024;
+const MAX_SCREENSHOTS = 8;
+const SUCCESS_TTL_MS = 10 * 60_000;
+const EMPTY_TTL_MS = 60_000;
+const OWNER_MAX = 39;
+const REPO_MAX = 100;
+const GITHUB_REPO_RE = /^[A-Za-z0-9][A-Za-z0-9-]*\/[A-Za-z0-9._-]+$/;
+const CONTROL_RE = /[\u0000-\u001f\u007f]/;
+function manifestUrl(github) {
+    const value = typeof github === 'string' ? github.trim() : '';
+    if (!GITHUB_REPO_RE.test(value))
+        return null;
+    const slash = value.indexOf('/');
+    const owner = value.slice(0, slash);
+    const repo = value.slice(slash + 1);
+    if (owner.length > OWNER_MAX || repo.length > REPO_MAX || repo === '.' || repo === '..')
+        return null;
+    return `https://${MANIFEST_HOST}/${owner}/${repo}/HEAD/${MANIFEST_FILE}`;
+}
+function screenshotUrl(manifest, rawPath) {
+    if (typeof rawPath !== 'string')
+        return null;
+    const path = rawPath.trim();
+    if (!path || CONTROL_RE.test(path))
+        return null;
+    if (path.startsWith('/') || path.startsWith('\\') || path.includes('\\'))
+        return null;
+    if (/^[a-z][a-z\d+.-]*:/i.test(path) || path.startsWith('//'))
+        return null;
+    if (/[?#]/.test(path))
+        return null;
+    const segments = path.split('/');
+    if (segments.some((part) => part === '' || part === '.' || part === '..'))
+        return null;
+    const base = new URL('.', manifest);
+    return new URL(segments.map((part) => encodeURIComponent(part)).join('/'), base).toString();
+}
+function parseManifest(text, manifestUrl) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return [];
+    }
+    if (!Array.isArray(parsed) || parsed.length === 0 || parsed.length > MAX_SCREENSHOTS)
+        return [];
+    const result = [];
+    for (const path of parsed) {
+        const url = screenshotUrl(manifestUrl, path);
+        if (!url)
+            return [];
+        result.push(url);
+    }
+    return result;
+}
+function assertManifestHost(raw, isRedirectHop) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new Error(isRedirectHop ? 'screenshot manifest redirect URL is invalid' : 'invalid screenshot manifest request URL');
+    }
+    if (url.protocol !== 'https:' || url.hostname !== MANIFEST_HOST || url.username || url.password || url.port) {
+        throw new Error(isRedirectHop
+            ? 'screenshot manifest redirects must remain on raw.githubusercontent.com'
+            : 'screenshot manifest request URL must be https://raw.githubusercontent.com');
+    }
+}
+/**
+ * Read an author-owned root screenshots.json without consulting Community Catalog.
+ * All network access is bounded, and a rejected/empty manifest degrades to no gallery.
+ */
+export function createPrimaryScreenshotReader(options = {}) {
+    const fetchText = options.fetchText ?? fetchTextLimited;
+    const now = options.now ?? Date.now;
+    const cache = new Map();
+    const flights = new Map();
+    return async (github) => {
+        const url = manifestUrl(github);
+        if (!url)
+            return [];
+        const key = url.toLowerCase();
+        const timestamp = now();
+        for (const [cachedKey, value] of cache) {
+            if (value.expiresAt <= timestamp)
+                cache.delete(cachedKey);
+        }
+        const cached = cache.get(key);
+        if (cached && cached.expiresAt > timestamp)
+            return [...cached.screenshots];
+        const pending = flights.get(key);
+        if (pending)
+            return [...(await pending)];
+        const flight = (async () => {
+            let screenshots = [];
+            let hop = 0;
+            try {
+                const text = await fetchText(url, {
+                    timeoutMs: 5_000,
+                    maxBytes: MAX_MANIFEST_BYTES,
+                    headers: { accept: 'application/json' },
+                    onRequest: (hopUrl) => {
+                        // 逐跳 host guard；错误文案区分初始跳与重定向跳，避免调试误导（评审建议落盘）。
+                        const isRedirectHop = hop > 0;
+                        hop += 1;
+                        assertManifestHost(hopUrl, isRedirectHop);
+                    },
+                });
+                screenshots = parseManifest(text, url);
+            }
+            catch {
+                // Images are optional metadata: a missing/unavailable manifest must not block detail/install.
+                screenshots = [];
+            }
+            cache.set(key, {
+                screenshots,
+                expiresAt: now() + (screenshots.length > 0 ? SUCCESS_TTL_MS : EMPTY_TTL_MS),
+            });
+            return screenshots;
+        })();
+        flights.set(key, flight);
+        try {
+            return [...(await flight)];
+        }
+        finally {
+            if (flights.get(key) === flight)
+                flights.delete(key);
+        }
+    };
+}
+/** Production reader: one process-memory cache shared by GUI Host calls. */
+export const loadPrimaryScreenshots = createPrimaryScreenshotReader();
+/** Exported parser contract for focused regression tests; production calls the reader above. */
+export const PRIMARY_SCREENSHOT_LIMIT = MAX_SCREENSHOTS;
+export const PRIMARY_SCREENSHOT_MANIFEST_MAX_BYTES = MAX_MANIFEST_BYTES;
+export const PRIMARY_SCREENSHOT_SUCCESS_TTL_MS = SUCCESS_TTL_MS;
+export const PRIMARY_SCREENSHOT_EMPTY_TTL_MS = EMPTY_TTL_MS;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-m",
-  "version": "0.9.60",
+  "version": "0.9.62",
   "description": "可自定义收录清单的 DSH 插件市场：收录、安装、卸载、升级一站完成，附 agent 工具与 dshm CLI。",
   "license": "MIT",
   "type": "module",