dsh-plugin-vrmpet3d 0.1.3 → 0.1.4

package/desktop/game-visibility.cjs

@@ -1,6 +1,4 @@
 // A focused game temporarily hides only a pet window that was visible beforehand.
-const http = require('node:http');
-const https = require('node:https');
 // A transparent window can paint and report pixel hits after showInactive while
 // Chromium still uses the pre-hide input surface. A real bounds transition (the
 // same transition wheel zoom causes) rebuilds that surface without changing the pet.
@@ -27,24 +25,41 @@ function createVisibilityController(win, hooks = {}) {
 function watchGameVisibility(win, pageURL, interval = 500, hooks = {}) {
   const apply = createVisibilityController(win, hooks);
   const url = new URL('/vrmpet3d/desktop', pageURL);
-  const transport = url.protocol === 'https:' ? https : http;
+  // The page and this poll must use the SAME Chromium session (cookies/proxy/TLS).
+  // Node's http.get never inherited the window's authentication cookies.
+  const session = win.webContents.session;
   let request = null, stopped = false;
-  function poll() {
+  async function poll() {
     if (stopped || request || win.isDestroyed()) return;
-    request = transport.get(url, { timeout: 1500 }, response => {
-      let body = '', failed = response.statusCode !== 200;
-      response.on('data', chunk => { body += chunk; if (body.length > 16384) { failed = true; response.destroy(); } });
-      response.on('end', () => {
-        if (stopped) return;
-        try { apply(!failed && JSON.parse(body).gameFocused === true); } catch (_) { apply(false); }
+    const controller = new AbortController();
+    request = controller;
+    const deadline = setTimeout(() => controller.abort(), 1500);
+    deadline.unref?.();
+    try {
+      const response = await session.fetch(url.href, {
+        credentials: 'include', redirect: 'error', cache: 'no-store', signal: controller.signal,
       });
-      response.on('error', () => { if (!stopped) apply(false); });
-    });
-    request.on('timeout', () => request.destroy());
-    request.on('error', () => { if (!stopped) apply(false); });
-    request.on('close', () => { request = null; });
+      if (!response.ok || response.redirected || !/^application\/json\b/i.test(response.headers.get('content-type') || '')) {
+        await response.body?.cancel();
+        throw new Error('game status is not authenticated JSON');
+      }
+      const reader = response.body.getReader();
+      let size = 0;
+      const chunks = [];
+      try {
+        for (;;) {
+          const { value, done } = await reader.read();
+          if (done) break;
+          size += value.byteLength;
+          if (size > 16384) { await reader.cancel(); throw new Error('game status exceeds limit'); }
+          chunks.push(Buffer.from(value));
+        }
+      } finally { reader.releaseLock(); }
+      if (!stopped) apply(JSON.parse(Buffer.concat(chunks).toString('utf8')).gameFocused === true);
+    } catch (_) { if (!stopped) apply(false); }
+    finally { clearTimeout(deadline); if (request === controller) request = null; }
   }
   const timer = setInterval(poll, interval); timer.unref(); poll();
-  return function stop() { stopped = true; clearInterval(timer); if (request) request.destroy(); apply(false); };
+  return function stop() { stopped = true; clearInterval(timer); if (request) request.abort(); apply(false); };
 }
 module.exports = { createVisibilityController, watchGameVisibility, refreshInputRegion };

package/lib/client.core.js

@@ -5013,7 +5013,7 @@ var MOTION_STATES = STATUS_STATES.concat(INTERACTION_STATES, ['dancing']);
     function load() {
       if (!supported || stopped) return Promise.resolve(null);
       var request = ++issued;
-      return doFetch(url, { credentials: 'omit' })
+      return doFetch(url, { credentials: 'same-origin' })
         .then(function (response) {
           if (response.status === 404 || response.status === 405) {
             supported = false;
@@ -5177,7 +5177,7 @@ var MOTION_STATES = STATUS_STATES.concat(INTERACTION_STATES, ['dancing']);
     function load() {
       if (!supported || stopped) return Promise.resolve(null);
       var request = ++issued;
-      return doFetch(url, { credentials: 'omit' })
+      return doFetch(url, { credentials: 'same-origin' })
         .then(function (response) {
           if (response.status === 404 || response.status === 405) {
             supported = false;
@@ -5221,7 +5221,7 @@ var MOTION_STATES = STATUS_STATES.concat(INTERACTION_STATES, ['dancing']);
   /**
    * The reporting half of `watchHostState`: the app's pet tells the host what it resolved.
    *
-   * Deduplicated on the last value SENT, so the sixty-per-second frame loop can call this on every change
+   * Deduplicated on the latest in-flight value or acknowledged value, so the frame loop can call this on every change
    * without a POST per frame — and a state that flaps back to what the host already has costs nothing.
    *
    * The 碎碎念 LINE travels with the state, and the dedupe key is both together: the pet can say something
@@ -5253,6 +5253,8 @@ var MOTION_STATES = STATUS_STATES.concat(INTERACTION_STATES, ['dancing']);
     var sentUnread = null;
     /** The last diagnostic sent (see `report`), so the heartbeat re-states what the state it repeats was based on. */
     var sentWhy = null;
+    var reportSequence = 0;
+    var pendingReport = null;
     var beatTimer = null;
     /**
      * What the heartbeat re-states: the last STATE and LINE, never the touch.
@@ -5473,22 +5475,27 @@ var MOTION_STATES = STATUS_STATES.concat(INTERACTION_STATES, ['dancing']);
         return JSON.stringify(value ? [value.waitingSessionIds || [], value.completedSessionIds || [],
           value.statusSessionId || null, value.completedSessionId || null] : [[], [], null, null]);
       };
-      if (force !== true && next === sent && nextLine === sentLine && nextTouchKey === sentTouchKey
-        && nextClockKey === sentClockKey && nextUnread === sentUnread && navigationKey(nextWhy) === navigationKey(sentWhy)) {
+      // Dedupe against the newest in-flight request, or the last ACKNOWLEDGED report.
+      // A rejected request must remain retryable; an older response cannot commit over a newer report.
+      if (!doFetch || !next) return Promise.resolve(null);
+      var key = JSON.stringify([next, nextLine, nextTouchKey, nextClockKey, nextUnread, navigationKey(nextWhy)]);
+      if (force !== true && ((pendingReport && pendingReport.key === key)
+        || (!pendingReport && next === sent && nextLine === sentLine && nextTouchKey === sentTouchKey
+          && nextClockKey === sentClockKey && nextUnread === sentUnread && navigationKey(nextWhy) === navigationKey(sentWhy)))) {
         return Promise.resolve(null);
       }
-      sent = next;
-      sentLine = nextLine;
-      sentTouch = nextTouch;
-      sentClock = nextClock;
-      sentUnread = nextUnread;
-      sentWhy = nextWhy;
-      // No state, no report: the host refuses an unknown name, and a line with no state behind it would only
-      // clear the state it is meant to accompany.
-      if (!doFetch || !next) return Promise.resolve(null);
-      // Recorded for the heartbeat AFTER the send is judged worth making, so a beat always repeats something the
-      // host has actually been told.
-      lastBeat = { state: next, line: nextLine, why: nextWhy };
+      var request = ++reportSequence;
+      pendingReport = { key: key, request: request };
+      // Heartbeats retry the latest desired STATE, never a one-shot touch event.
+      lastBeat = { state: next, line: nextLine, why: nextWhy, clock: nextClock, unread: nextUnread };
+      function failed() {
+        if (request === reportSequence) {
+          pendingReport = null;
+          sent = null;
+          sentLine = sentTouch = sentClock = sentUnread = sentWhy = null;
+        }
+        return null;
+      }
       try {
         var body = { state: next };
         if (nextLine) body.line = nextLine;
@@ -5496,16 +5503,57 @@ var MOTION_STATES = STATUS_STATES.concat(INTERACTION_STATES, ['dancing']);
         if (nextClock) body.clock = nextClock;
         if (nextUnread !== null) body.unread = nextUnread;
         if (nextWhy) body.why = nextWhy;
-        return doFetch(url, {
-          method: 'POST',
-          credentials: 'omit',
-          headers: { 'content-type': 'application/json' },
-          body: JSON.stringify(body),
-        }).then(function () { return next; }, function () { return null; });
+        return postReport(body).then(function (accepted) {
+          if (!accepted) return failed();
+          if (request === reportSequence) {
+            pendingReport = null;
+            sent = next;
+            sentLine = nextLine;
+            sentTouch = nextTouch;
+            sentClock = nextClock;
+            sentUnread = nextUnread;
+            sentWhy = nextWhy;
+          }
+          return next;
+        }).catch(failed);
       } catch (_error) {
-        return Promise.resolve(null);
+        return Promise.resolve(failed());
       }
     }
+    function readAcknowledgement(response) {
+      if (!response || !response.ok || response.redirected) return Promise.resolve(false);
+      return response.json().then(function (payload) {
+        return !!payload && typeof payload.seq === 'number' && Number.isFinite(payload.seq)
+          && payload.seq >= 0 && payload.superseded !== true;
+      });
+    }
+    function postReport(body) {
+      var controller = typeof AbortController === 'function' ? new AbortController() : null;
+      var deadline = null;
+      // A stalled fetch/body must not permanently suppress all subsequent heartbeats.
+      var timeoutMs = Number(settings.requestTimeoutMs) > 0 ? Number(settings.requestTimeoutMs) : 8000;
+      return new Promise(function (resolve, reject) {
+        deadline = setTimeout(function () {
+          if (controller) controller.abort();
+          resolve(false);
+        }, timeoutMs);
+        if (deadline && typeof deadline.unref === 'function') deadline.unref();
+        try {
+          var options = {
+            method: 'POST', credentials: 'same-origin', redirect: 'error',
+            headers: { 'content-type': 'application/json' }, body: JSON.stringify(body),
+          };
+          if (controller) options.signal = controller.signal;
+          Promise.resolve(doFetch(url, options)).then(readAcknowledgement).then(resolve, reject);
+        } catch (error) { reject(error); }
+      }).then(function (accepted) {
+        clearTimeout(deadline);
+        return accepted;
+      }, function (error) {
+        clearTimeout(deadline);
+        throw error;
+      });
+    }
     /**
      * Re-state the last report, unchanged, so that SILENCE can be told from DEATH.
      *
@@ -5522,7 +5570,8 @@ var MOTION_STATES = STATUS_STATES.concat(INTERACTION_STATES, ['dancing']);
        * all" on every beat — so the floating window lost the turn's 用时 a few seconds into every long turn. `force`
        * is the parameter that exists for this.
        */
-      return report(lastBeat.state, lastBeat.line, null, sentClock, true, sentUnread, lastBeat.why);
+      if (pendingReport) return Promise.resolve(null);
+      return report(lastBeat.state, lastBeat.line, null, lastBeat.clock, true, lastBeat.unread, lastBeat.why);
     }
 
     function startHeartbeat(intervalMs) {
@@ -5552,12 +5601,8 @@ var MOTION_STATES = STATUS_STATES.concat(INTERACTION_STATES, ['dancing']);
       if (!doFetch) return Promise.resolve(null);
       var message = error && (error.stack || error.message) ? String(error.stack || error.message) : String(error);
       try {
-        return doFetch(url, {
-          method: 'POST',
-          credentials: 'omit',
-          headers: { 'content-type': 'application/json' },
-          body: JSON.stringify({ state: sent || '', error: message.slice(0, 500) }),
-        }).then(function () { return message; }, function () { return null; });
+        return postReport({ state: sent || '', error: message.slice(0, 500) })
+          .then(function (accepted) { return accepted ? message : null; }).catch(function () { return null; });
       } catch (_error) {
         return Promise.resolve(null);
       }
@@ -5618,7 +5663,7 @@ var MOTION_STATES = STATUS_STATES.concat(INTERACTION_STATES, ['dancing']);
     function load() {
       if (!supported || stopped) return Promise.resolve(null);
       var request = ++issued;
-      return doFetch(url, { credentials: 'omit' })
+      return doFetch(url, { credentials: 'same-origin' })
         .then(function (response) {
           if (response.status === 404 || response.status === 405) {
             // No store on this host: stop asking, and let the caller keep its own storage.
@@ -5644,7 +5689,7 @@ var MOTION_STATES = STATUS_STATES.concat(INTERACTION_STATES, ['dancing']);
       var request = ++issued;
       return doFetch(url, {
         method: 'POST',
-        credentials: 'omit',
+        credentials: 'same-origin',
         headers: { 'content-type': 'application/json' },
         body: JSON.stringify(body || {}),
       })

package/lib/client.js

@@ -1672,7 +1672,7 @@
       if ((!globalThis.dshDesktop && !/Electron\//i.test(globalThis.navigator.userAgent)) || !self.canUseIndependentPet()) {
         globalThis.open(gameUrl, '_blank', 'noopener'); return;
       }
-      fetch('/vrmpet3d/desktop', { method: 'POST', credentials: 'omit',
+      fetch('/vrmpet3d/desktop', { method: 'POST', credentials: 'same-origin',
         headers: { 'content-type': 'application/json' },
         body: JSON.stringify({ action: 'game', modelId: self.currentModelId() })
       }).then(function (response) {
@@ -1705,7 +1705,7 @@
       fetch('/vrmpet3d/desktop', {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
-        credentials: 'omit',
+        credentials: 'same-origin',
         // The model goes with the request: the model window must configure the model that is ON SCREEN, and this
         // surface is the only one that knows it at that moment. Without it the host can only fall back to the
         // launcher's model (or nothing), which is how the settings window ended up describing the built-in
@@ -1741,12 +1741,12 @@
     var send = function (body) {
       return fetch('/vrmpet3d/setup-state', {
         method: 'POST',
-        credentials: 'omit',
+        credentials: 'same-origin',
         headers: { 'content-type': 'application/json' },
         body: JSON.stringify(body),
       });
     };
-    return fetch('/vrmpet3d/setup-state', { credentials: 'omit' })
+    return fetch('/vrmpet3d/setup-state', { credentials: 'same-origin' })
       .then(function (response) { return response.ok ? response.json() : null; })
       .then(function (state) {
         if (!state || state.completed === true || state.prompted === true) return null;
@@ -1754,7 +1754,7 @@
           .then(function () {
             return fetch('/vrmpet3d/desktop', {
               method: 'POST',
-              credentials: 'omit',
+              credentials: 'same-origin',
               headers: { 'content-type': 'application/json' },
               body: JSON.stringify({ action: 'setup' }),
             });
@@ -2273,7 +2273,7 @@
     this.syncDesktop(null, strings.desktopStarting);
     return fetch('/vrmpet3d/desktop', {
       method: 'POST',
-      credentials: 'omit',
+      credentials: 'same-origin',
       headers: { 'content-type': 'application/json' },
       body: JSON.stringify({
         action: enabled ? 'enable' : 'disable',
@@ -2296,7 +2296,7 @@
   /** Ask the host what the window is doing, and show it. */
   VrmPet3DWidget.prototype.refreshDesktopStatus = function () {
     var self = this;
-    return fetch('/vrmpet3d/desktop', { credentials: 'omit' })
+    return fetch('/vrmpet3d/desktop', { credentials: 'same-origin' })
       .then(function (response) { return response.ok ? response.json() : null; })
       .then(function (status) { self.syncDesktop(status, null); return status; })
       .catch(function () {
@@ -3004,7 +3004,7 @@
    */
   VrmPet3DWidget.prototype.refreshCatalog = function () {
     var self = this;
-    return fetch('/vrmpet3d/catalog', { credentials: 'omit' })
+    return fetch('/vrmpet3d/catalog', { credentials: 'same-origin' })
       .then(function (response) {
         if (!response.ok) throw new Error(word(self.language, 'catalogRoute', { status: response.status }));
         return response.json();
@@ -3222,7 +3222,7 @@
    */
   VrmPet3DWidget.prototype.refreshMotions = function () {
     var self = this;
-    return fetch('/vrmpet3d/motions', { credentials: 'omit' })
+    return fetch('/vrmpet3d/motions', { credentials: 'same-origin' })
       .then(function (response) {
         if (!response.ok) throw new Error('motion catalog route returned HTTP ' + response.status);
         return response.json();
@@ -3689,7 +3689,7 @@
   /** Fetch one motion's bytes from the host's byte route. */
   VrmPet3DWidget.prototype.fetchMotionBytes = function (motionId) {
     var url = '/vrmpet3d/motion?m=' + encodeURIComponent(motionId);
-    return fetch(url, { credentials: 'omit' }).then(function (response) {
+    return fetch(url, { credentials: 'same-origin' }).then(function (response) {
       if (!response.ok) throw new Error(word(this.language, 'motionRoute', { status: response.status }));
       return response.arrayBuffer();
     });
@@ -4298,7 +4298,7 @@
       return fetch('/vrmpet3d/say', {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
-        credentials: 'omit',
+        credentials: 'same-origin',
         /**
          * The request carries five things, and each is a different answer to "what is this line about".
          *

package/lib/client.scene.js

@@ -2060,11 +2060,12 @@
      * repeated GET of the same URL without touching the disk — which would make 重载模型 look like it did nothing. The
      * one-shot buster from `bustModelCache` rides the query string, and is consumed here so an ordinary load stays clean.
      */
-    if (this.modelBust) {
+    var reload = Boolean(this.modelBust);
+    if (reload) {
       url += (url.indexOf('?') === -1 ? '?' : '&') + 'v=' + this.modelBust;
       this.modelBust = null;
     }
-    var promise = fetch(url, { credentials: 'omit' })
+    var promise = fetch(url, { credentials: 'same-origin', cache: reload ? 'reload' : 'default' })
       .then(function (response) {
         if (!response.ok) throw new Error('asset route returned HTTP ' + response.status);
         return response.arrayBuffer();

package/lib/config-page.js

@@ -1081,7 +1081,7 @@
      * it is the same predicate as `loadModelInfo`'s, not "is the picker here".
      */
     if (!needsModelVocabulary()) return Promise.resolve(null);
-    return fetch('/vrmpet3d/catalog', { credentials: 'omit' })
+    return fetch('/vrmpet3d/catalog', { credentials: 'same-origin' })
       .then(function (response) { return response.ok ? response.json() : null; })
       .then(function (body) {
         catalog = body && Array.isArray(body.models) ? body.models : [];
@@ -1183,7 +1183,7 @@
   }
 
   function loadImported() {
-    return fetch('/vrmpet3d/models', { credentials: 'omit' })
+    return fetch('/vrmpet3d/models', { credentials: 'same-origin' })
       .then(function (response) { return response.ok ? response.json() : null; })
       .then(function (body) {
         imported.models = body && Array.isArray(body.importedModels) ? body.importedModels : [];
@@ -1209,7 +1209,7 @@
   function writeImported(body) {
     return fetch('/vrmpet3d/models', {
       method: 'POST',
-      credentials: 'omit',
+      credentials: 'same-origin',
       headers: { 'content-type': 'application/json' },
       body: JSON.stringify(body),
     }).then(function (response) {
@@ -1341,7 +1341,7 @@
   }
 
   function loadImportedMotions() {
-    return fetch('/vrmpet3d/motions', { credentials: 'omit' })
+    return fetch('/vrmpet3d/motions', { credentials: 'same-origin' })
       .then(function (response) { return response.ok ? response.json() : null; })
       .then(function (body) {
         importedMotions.imports = body && Array.isArray(body.importedMotions) ? body.importedMotions : [];
@@ -1363,7 +1363,7 @@
   function writeImportedMotion(body) {
     return fetch('/vrmpet3d/motions', {
       method: 'POST',
-      credentials: 'omit',
+      credentials: 'same-origin',
       headers: { 'content-type': 'application/json' },
       body: JSON.stringify(body),
     }).then(function (response) {
@@ -1503,7 +1503,7 @@
     var settle = function () {
       if (modelInfoInFlight && modelInfoInFlight.id === id) modelInfoInFlight = null;
     };
-    var promise = fetch('/vrmpet3d/model-info?m=' + encodeURIComponent(id), { credentials: 'omit' })
+    var promise = fetch('/vrmpet3d/model-info?m=' + encodeURIComponent(id), { credentials: 'same-origin' })
       .then(function (response) {
         if (response.status === 404) return null;
         return response.ok ? response.json() : null;
@@ -2787,7 +2787,7 @@
   }
 
   function loadMotions() {
-    return fetch('/vrmpet3d/motions', { credentials: 'omit' })
+    return fetch('/vrmpet3d/motions', { credentials: 'same-origin' })
       .then(function (response) {
         if (!response.ok) return null;
         return response.json();
@@ -2992,7 +2992,7 @@
     try {
       fetch('/vrmpet3d/preview', {
         method: 'POST',
-        credentials: 'omit',
+        credentials: 'same-origin',
         headers: { 'content-type': 'application/json' },
         body: JSON.stringify(preview || {}),
       }).catch(function () { return null; });
@@ -4186,7 +4186,7 @@
      */
     var loadLlm = function (wanted) {
       askedLlmProvider = wanted || '';
-      return fetch('/vrmpet3d/llm' + (wanted ? '?provider=' + encodeURIComponent(wanted) : ''), { credentials: 'omit' })
+      return fetch('/vrmpet3d/llm' + (wanted ? '?provider=' + encodeURIComponent(wanted) : ''), { credentials: 'same-origin' })
         .then(function (response) { return response.ok ? response.json() : null; })
         .then(function (body) {
           if (!body) return;
@@ -4391,7 +4391,7 @@
         fetch('/vrmpet3d/say', {
           method: 'POST',
           headers: { 'content-type': 'application/json' },
-          credentials: 'omit',
+          credentials: 'same-origin',
           // The HOST answers in this language, so the test line reads like the pet the user is configuring.
           body: JSON.stringify({ state: state, language: language }),
         }).then(function (response) { return response.json(); })
@@ -4631,7 +4631,7 @@
    * about "is anything drawing this model".
    */
   function refreshStatus() {
-    return fetch('/vrmpet3d/desktop', { credentials: 'omit' })
+    return fetch('/vrmpet3d/desktop', { credentials: 'same-origin' })
       .then(function (response) { return response.ok ? response.json() : null; })
       .then(function (status) {
         if (!status) {
@@ -5444,7 +5444,7 @@
       };
       fetch('/vrmpet3d/desktop', {
         method: 'POST',
-        credentials: 'omit',
+        credentials: 'same-origin',
         headers: { 'content-type': 'application/json' },
         body: JSON.stringify({ action: 'setup' }),
       }).then(function (response) {

package/lib/core.js

@@ -5005,7 +5005,7 @@ var MOTION_STATES = STATUS_STATES.concat(INTERACTION_STATES, ['dancing']);
     function load() {
       if (!supported || stopped) return Promise.resolve(null);
       var request = ++issued;
-      return doFetch(url, { credentials: 'omit' })
+      return doFetch(url, { credentials: 'same-origin' })
         .then(function (response) {
           if (response.status === 404 || response.status === 405) {
             supported = false;
@@ -5169,7 +5169,7 @@ var MOTION_STATES = STATUS_STATES.concat(INTERACTION_STATES, ['dancing']);
     function load() {
       if (!supported || stopped) return Promise.resolve(null);
       var request = ++issued;
-      return doFetch(url, { credentials: 'omit' })
+      return doFetch(url, { credentials: 'same-origin' })
         .then(function (response) {
           if (response.status === 404 || response.status === 405) {
             supported = false;
@@ -5213,7 +5213,7 @@ var MOTION_STATES = STATUS_STATES.concat(INTERACTION_STATES, ['dancing']);
   /**
    * The reporting half of `watchHostState`: the app's pet tells the host what it resolved.
    *
-   * Deduplicated on the last value SENT, so the sixty-per-second frame loop can call this on every change
+   * Deduplicated on the latest in-flight value or acknowledged value, so the frame loop can call this on every change
    * without a POST per frame — and a state that flaps back to what the host already has costs nothing.
    *
    * The 碎碎念 LINE travels with the state, and the dedupe key is both together: the pet can say something
@@ -5245,6 +5245,8 @@ var MOTION_STATES = STATUS_STATES.concat(INTERACTION_STATES, ['dancing']);
     var sentUnread = null;
     /** The last diagnostic sent (see `report`), so the heartbeat re-states what the state it repeats was based on. */
     var sentWhy = null;
+    var reportSequence = 0;
+    var pendingReport = null;
     var beatTimer = null;
     /**
      * What the heartbeat re-states: the last STATE and LINE, never the touch.
@@ -5465,22 +5467,27 @@ var MOTION_STATES = STATUS_STATES.concat(INTERACTION_STATES, ['dancing']);
         return JSON.stringify(value ? [value.waitingSessionIds || [], value.completedSessionIds || [],
           value.statusSessionId || null, value.completedSessionId || null] : [[], [], null, null]);
       };
-      if (force !== true && next === sent && nextLine === sentLine && nextTouchKey === sentTouchKey
-        && nextClockKey === sentClockKey && nextUnread === sentUnread && navigationKey(nextWhy) === navigationKey(sentWhy)) {
+      // Dedupe against the newest in-flight request, or the last ACKNOWLEDGED report.
+      // A rejected request must remain retryable; an older response cannot commit over a newer report.
+      if (!doFetch || !next) return Promise.resolve(null);
+      var key = JSON.stringify([next, nextLine, nextTouchKey, nextClockKey, nextUnread, navigationKey(nextWhy)]);
+      if (force !== true && ((pendingReport && pendingReport.key === key)
+        || (!pendingReport && next === sent && nextLine === sentLine && nextTouchKey === sentTouchKey
+          && nextClockKey === sentClockKey && nextUnread === sentUnread && navigationKey(nextWhy) === navigationKey(sentWhy)))) {
         return Promise.resolve(null);
       }
-      sent = next;
-      sentLine = nextLine;
-      sentTouch = nextTouch;
-      sentClock = nextClock;
-      sentUnread = nextUnread;
-      sentWhy = nextWhy;
-      // No state, no report: the host refuses an unknown name, and a line with no state behind it would only
-      // clear the state it is meant to accompany.
-      if (!doFetch || !next) return Promise.resolve(null);
-      // Recorded for the heartbeat AFTER the send is judged worth making, so a beat always repeats something the
-      // host has actually been told.
-      lastBeat = { state: next, line: nextLine, why: nextWhy };
+      var request = ++reportSequence;
+      pendingReport = { key: key, request: request };
+      // Heartbeats retry the latest desired STATE, never a one-shot touch event.
+      lastBeat = { state: next, line: nextLine, why: nextWhy, clock: nextClock, unread: nextUnread };
+      function failed() {
+        if (request === reportSequence) {
+          pendingReport = null;
+          sent = null;
+          sentLine = sentTouch = sentClock = sentUnread = sentWhy = null;
+        }
+        return null;
+      }
       try {
         var body = { state: next };
         if (nextLine) body.line = nextLine;
@@ -5488,16 +5495,57 @@ var MOTION_STATES = STATUS_STATES.concat(INTERACTION_STATES, ['dancing']);
         if (nextClock) body.clock = nextClock;
         if (nextUnread !== null) body.unread = nextUnread;
         if (nextWhy) body.why = nextWhy;
-        return doFetch(url, {
-          method: 'POST',
-          credentials: 'omit',
-          headers: { 'content-type': 'application/json' },
-          body: JSON.stringify(body),
-        }).then(function () { return next; }, function () { return null; });
+        return postReport(body).then(function (accepted) {
+          if (!accepted) return failed();
+          if (request === reportSequence) {
+            pendingReport = null;
+            sent = next;
+            sentLine = nextLine;
+            sentTouch = nextTouch;
+            sentClock = nextClock;
+            sentUnread = nextUnread;
+            sentWhy = nextWhy;
+          }
+          return next;
+        }).catch(failed);
       } catch (_error) {
-        return Promise.resolve(null);
+        return Promise.resolve(failed());
       }
     }
+    function readAcknowledgement(response) {
+      if (!response || !response.ok || response.redirected) return Promise.resolve(false);
+      return response.json().then(function (payload) {
+        return !!payload && typeof payload.seq === 'number' && Number.isFinite(payload.seq)
+          && payload.seq >= 0 && payload.superseded !== true;
+      });
+    }
+    function postReport(body) {
+      var controller = typeof AbortController === 'function' ? new AbortController() : null;
+      var deadline = null;
+      // A stalled fetch/body must not permanently suppress all subsequent heartbeats.
+      var timeoutMs = Number(settings.requestTimeoutMs) > 0 ? Number(settings.requestTimeoutMs) : 8000;
+      return new Promise(function (resolve, reject) {
+        deadline = setTimeout(function () {
+          if (controller) controller.abort();
+          resolve(false);
+        }, timeoutMs);
+        if (deadline && typeof deadline.unref === 'function') deadline.unref();
+        try {
+          var options = {
+            method: 'POST', credentials: 'same-origin', redirect: 'error',
+            headers: { 'content-type': 'application/json' }, body: JSON.stringify(body),
+          };
+          if (controller) options.signal = controller.signal;
+          Promise.resolve(doFetch(url, options)).then(readAcknowledgement).then(resolve, reject);
+        } catch (error) { reject(error); }
+      }).then(function (accepted) {
+        clearTimeout(deadline);
+        return accepted;
+      }, function (error) {
+        clearTimeout(deadline);
+        throw error;
+      });
+    }
     /**
      * Re-state the last report, unchanged, so that SILENCE can be told from DEATH.
      *
@@ -5514,7 +5562,8 @@ var MOTION_STATES = STATUS_STATES.concat(INTERACTION_STATES, ['dancing']);
        * all" on every beat — so the floating window lost the turn's 用时 a few seconds into every long turn. `force`
        * is the parameter that exists for this.
        */
-      return report(lastBeat.state, lastBeat.line, null, sentClock, true, sentUnread, lastBeat.why);
+      if (pendingReport) return Promise.resolve(null);
+      return report(lastBeat.state, lastBeat.line, null, lastBeat.clock, true, lastBeat.unread, lastBeat.why);
     }
 
     function startHeartbeat(intervalMs) {
@@ -5544,12 +5593,8 @@ var MOTION_STATES = STATUS_STATES.concat(INTERACTION_STATES, ['dancing']);
       if (!doFetch) return Promise.resolve(null);
       var message = error && (error.stack || error.message) ? String(error.stack || error.message) : String(error);
       try {
-        return doFetch(url, {
-          method: 'POST',
-          credentials: 'omit',
-          headers: { 'content-type': 'application/json' },
-          body: JSON.stringify({ state: sent || '', error: message.slice(0, 500) }),
-        }).then(function () { return message; }, function () { return null; });
+        return postReport({ state: sent || '', error: message.slice(0, 500) })
+          .then(function (accepted) { return accepted ? message : null; }).catch(function () { return null; });
       } catch (_error) {
         return Promise.resolve(null);
       }
@@ -5610,7 +5655,7 @@ var MOTION_STATES = STATUS_STATES.concat(INTERACTION_STATES, ['dancing']);
     function load() {
       if (!supported || stopped) return Promise.resolve(null);
       var request = ++issued;
-      return doFetch(url, { credentials: 'omit' })
+      return doFetch(url, { credentials: 'same-origin' })
         .then(function (response) {
           if (response.status === 404 || response.status === 405) {
             // No store on this host: stop asking, and let the caller keep its own storage.
@@ -5636,7 +5681,7 @@ var MOTION_STATES = STATUS_STATES.concat(INTERACTION_STATES, ['dancing']);
       var request = ++issued;
       return doFetch(url, {
         method: 'POST',
-        credentials: 'omit',
+        credentials: 'same-origin',
         headers: { 'content-type': 'application/json' },
         body: JSON.stringify(body || {}),
       })

package/lib/desktop-page.js

@@ -1374,7 +1374,7 @@
       fetch('/vrmpet3d/say', {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
-        credentials: 'omit',
+        credentials: 'same-origin',
         body: JSON.stringify({
           state: hostState || null,
           event: stateEventName(),
@@ -1694,7 +1694,7 @@
      */
     function refreshCatalog() {
       if (typeof fetch !== 'function') return Promise.resolve([]);
-      return fetch('/vrmpet3d/catalog', { credentials: 'omit' })
+      return fetch('/vrmpet3d/catalog', { credentials: 'same-origin' })
         .then(function (response) {
           if (!response.ok) throw new Error('catalog route returned HTTP ' + response.status);
           return response.json();
@@ -1870,7 +1870,7 @@
      */
     function openSettingsWindow(page) {
       if (page === 'game') {
-        fetch('/vrmpet3d/desktop', { method: 'POST', credentials: 'omit',
+        fetch('/vrmpet3d/desktop', { method: 'POST', credentials: 'same-origin',
           headers: { 'content-type': 'application/json' },
           body: JSON.stringify({ action: 'game', modelId: resolvedModelId(preferences.modelId || loadedModel) })
         }).then(function (response) { if (!response.ok) throw new Error('小游戏窗口打开失败'); })
@@ -1890,7 +1890,7 @@
         fetch('/vrmpet3d/desktop', {
           method: 'POST',
           headers: { 'content-type': 'application/json' },
-          credentials: 'omit',
+          credentials: 'same-origin',
           // Same reason as the app's pet: name the model that is on screen, so the window opens on it.
           body: JSON.stringify({ action: which, modelId: resolvedModelId(preferences.modelId || loadedModel) }),
         }).then(function (response) { if (!response.ok) fallback(); })
@@ -2672,7 +2672,7 @@
             try {
               fetch('/vrmpet3d/preview', {
                 method: 'POST',
-                credentials: 'omit',
+                credentials: 'same-origin',
                 headers: { 'content-type': 'application/json' },
                 body: '{}',
               }).catch(function () { return null; });
@@ -2799,7 +2799,7 @@
     }
 
     function fetchMotionBytes(id) {
-      return fetch('/vrmpet3d/motion?m=' + encodeURIComponent(id), { credentials: 'omit' })
+      return fetch('/vrmpet3d/motion?m=' + encodeURIComponent(id), { credentials: 'same-origin' })
         .then(function (response) {
           if (!response.ok) throw new Error('the motion route answered HTTP ' + response.status);
           return response.arrayBuffer();
@@ -2918,7 +2918,7 @@
      */
     function refreshMotions() {
       if (!motionRouteAvailable || typeof fetch !== 'function') return Promise.resolve(null);
-      return fetch('/vrmpet3d/motions', { credentials: 'omit' })
+      return fetch('/vrmpet3d/motions', { credentials: 'same-origin' })
         .then(function (response) {
           if (response.status === 404 || response.status === 405) {
             motionRouteAvailable = false;
@@ -3646,7 +3646,7 @@
       scene.setPreview(null);
       scene.setState('resting');
       fetch('/vrmpet3d/preview', {
-        method: 'POST', credentials: 'omit',
+        method: 'POST', credentials: 'same-origin',
         headers: { 'content-type': 'application/json' }, body: '{}',
       }).catch(function () { return null; });
     }

package/lib/index.js

@@ -17,7 +17,9 @@
 // boundary hub still provides a baseline; with no `webServer` service the pet
 // still runs from its built-in placeholder avatar and reports why.
 
-import { copyFileSync, createReadStream, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { copyFileSync, createReadStream, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { createHash } from 'node:crypto';
 import { homedir } from 'node:os';
 import { basename, dirname, extname, isAbsolute, join, normalize, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -55,6 +57,21 @@ import { COMPRESSED_SUFFIX, decompressBrotli, isCompressedMotionName } from './b
 /** The shared pure logic, published by the import above. */
 const core = globalThis.__VRMPET3D_CORE__;
 
+/** Resolve from the running CLI, not the plugin's dependencies or the Node executable.
+ * package.json is exported by the chat package; lib/client.js is intentionally not.
+ * Resolve the entry's symlink first so globally installed CLI shims work too.
+ */
+export function installRootFromDshEntry(entry = process.argv[1]) {
+  if (!entry) return null;
+  try {
+    const fromDsh = createRequire(realpathSync(entry));
+    const chatPackage = fromDsh.resolve('@deepseek-ai/dsh-client-ui-chat/package.json');
+    return dirname(dirname(dirname(dirname(chatPackage))));
+  } catch {
+    return null;
+  }
+}
+
 export const name = 'vrmpet3d';
 
 /**
@@ -1811,7 +1828,43 @@ function sendJson(req, res, payload) {
  * copies of this drifted before — one capped at 64 KB and one not — and the route without the
  * cap is the one that reads an arbitrary upload into memory.
  */
+function allowWriteRequest(req, res) {
+  const headers = req.headers || {};
+  const site = headers['sec-fetch-site'];
+  if (site === 'cross-site') {
+    sendStatus(res, 403, 'cross-site writes are not allowed');
+    return false;
+  }
+  // This forbidden browser header describes the PUBLIC request, even when a proxy
+  // rewrites Host internally. A foreign web page cannot forge same-origin metadata.
+  if (site === 'same-origin' && headers.origin !== 'null') return true;
+  // Compare authority using the browser's scheme: TLS may terminate at a reverse proxy.
+  // Do not trust arbitrary X-Forwarded-* headers to authorize a different public host.
+  const source = headers.origin || headers.referer;
+  if (source) {
+    try {
+      const origin = new URL(source);
+      const target = new URL(`${origin.protocol}//${headers.host}`);
+      if (!/^https?:$/.test(origin.protocol) || origin.host !== target.host || target.username || target.password) throw new Error('origin');
+    } catch {
+      sendStatus(res, 403, 'a same-origin request is required');
+      return false;
+    }
+  } else if (site && site !== 'same-origin' && site !== 'none') {
+    sendStatus(res, 403, 'a same-origin request is required');
+    return false;
+  }
+  // Native/local clients have no browser Origin. Browser JSON writes below still require
+  // a non-safelisted content type, so text/plain cannot bypass the CORS preflight.
+  return true;
+}
+
 function readJsonBody(req, res, limit, onBody) {
+  if (!allowWriteRequest(req, res)) return;
+  if (!/^application\/json\s*(?:;|$)/i.test(String(req.headers?.['content-type'] || ''))) {
+    sendStatus(res, 415, 'application/json is required');
+    return;
+  }
   const chunks = [];
   let size = 0;
   let refused = false;
@@ -1855,6 +1908,12 @@ const MODEL_UPLOAD_LIMIT = 256 * 1024 * 1024;
  * and no callback at all once the response has been sent.
  */
 function readRawBody(req, res, limit, onBody) {
+  if (!allowWriteRequest(req, res)) return;
+  const mediaType = String(req.headers?.['content-type'] || '').split(';')[0].trim().toLowerCase();
+  if (!mediaType || ['text/plain', 'application/x-www-form-urlencoded', 'multipart/form-data'].includes(mediaType)) {
+    sendStatus(res, 415, 'a binary content type is required');
+    return;
+  }
   const chunks = [];
   let size = 0;
   let refused = false;
@@ -1891,18 +1950,32 @@ function methodAllowed(req, res) {
   return false;
 }
 
-/**
- * Stream one allowlisted file. Shared by the asset route and the motion route.
- *
- * Shared rather than copied: the size cap, the MIME table and the read-error
- * handling are the parts a second implementation would get subtly wrong, and a
- * motion has to be served exactly like a model.
- *
- * `root` is the directory the entry was scanned from. The id map is the
- * allowlist, but containment is re-checked here, so an entry that was somehow
- * built with a path outside its own root is refused rather than streamed.
- */
-function sendFile(req, res, target, root) {
+/** Private browser validators for a model or its sibling texture. */
+function modelCacheHeaders(target, stats, reload) {
+  // Include file identity as well as size/times: model IDs are positional and can
+  // later address a different file. Hash the identity so no server path is exposed.
+  const fingerprint = [realpathSync(target), stats.dev, stats.ino, stats.size, stats.mtimeMs, stats.ctimeMs].join('|');
+  return {
+    etag: `W/"${createHash('sha256').update(fingerprint).digest('hex')}"`,
+    // Store only in the user's browser. Revalidation still passes through proxy auth.
+    'cache-control': reload ? 'no-store' : 'private, no-cache',
+    'access-control-allow-origin': '*',
+    'x-content-type-options': 'nosniff',
+  };
+}
+
+function modelNotModified(req, res, headers, reload) {
+  if (reload) return false;
+  const requested = String(req.headers['if-none-match'] || '').split(',').map(value => value.trim());
+  const tag = headers.etag.replace(/^W\//, '');
+  if (!requested.some(value => value === '*' || value.replace(/^W\//, '') === tag)) return false;
+  res.writeHead(304, headers);
+  res.end();
+  return true;
+}
+
+/** Stream an allowlisted model/texture or motion; only model callers enable caching. */
+function sendFile(req, res, target, root, modelCache = null) {
   if (!isInside(root, target)) {
     sendStatus(res, 404, 'file not found');
     return;
@@ -1924,6 +1997,12 @@ function sendFile(req, res, target, root) {
     return;
   }
 
+  let cacheHeaders = {};
+  if (modelCache) {
+    try { cacheHeaders = modelCacheHeaders(target, stats, modelCache.reload); }
+    catch { sendStatus(res, 404, 'file not found'); return; }
+    if (modelNotModified(req, res, cacheHeaders, modelCache.reload)) return;
+  }
   const extension = extname(target).toLowerCase();
   const headers = {
     'content-type': MIME_TYPES[extension] ?? 'application/octet-stream',
@@ -1931,10 +2010,11 @@ function sendFile(req, res, target, root) {
     // The page is a different origin from this route in some shells, and the
     // bytes are the user's own local files, so a permissive read is correct.
     'access-control-allow-origin': '*',
-    // `no-store`: a user replacing a model file on disk must see the new one on
-    // reload, and these bytes are cheap to re-read locally.
+    // Motion callers retain no-store; model/texture callers override this with
+    // private storage and ETag validation so edited files still replace old bytes.
     'cache-control': 'no-store',
     'x-content-type-options': 'nosniff',
+    ...cacheHeaders,
   };
 
   try {
@@ -2026,7 +2106,7 @@ export function createModelInfoHandler(store) {
  * through the server-held id map, so a crafted id cannot name a file outside it.
  */
 /**
- * Unpacked model bytes, keyed by path + size + mtime — see the compressed branch in `createAssetHandler`.
+ * Unpacked model bytes, keyed by file identity and metadata — see `modelCacheHeaders`.
  *
  * Bounded like the thumbnail cache, and for the same reason: a model is megabytes, so an unbounded map of them is a leak with
  * a friendly name. Two or three entries cover switching between the models someone actually uses.
@@ -2059,6 +2139,8 @@ export function createAssetHandler(store) {
         return;
       }
     }
+    const reload = url.searchParams.has('v');
+    if (!isInside(entry.root, target)) { sendStatus(res, 404, 'file not found'); return; }
     /**
      * A COMPRESSED model is unpacked HERE, the way a compressed clip is on the motion route: the renderer is always handed a
      * plain VRM/GLB, so nothing downstream — the scene, the loaders, the bytes' own header check — has to know about brotli.
@@ -2075,8 +2157,15 @@ export function createAssetHandler(store) {
         sendStatus(res, 404, `cannot read the model: ${error.message}`);
         return;
       }
-      const key = `${target}|${stats.size}|${stats.mtimeMs}`;
-      let plain = modelBytesCache.get(key);
+      if (!stats.isFile()) { sendStatus(res, 404, 'not a file'); return; }
+      if (stats.size > MAX_ASSET_BYTES) { sendStatus(res, 413, 'file exceeds the asset byte limit'); return; }
+      let headers;
+      try { headers = modelCacheHeaders(target, stats, reload); }
+      catch { sendStatus(res, 404, 'file not found'); return; }
+      // Revalidation needs neither a disk read nor Brotli decompression.
+      if (modelNotModified(req, res, headers, reload)) return;
+      const key = headers.etag;
+      let plain = reload ? null : modelBytesCache.get(key);
       if (!plain) {
         try {
           plain = decompressBrotli(readFileSync(target));
@@ -2087,11 +2176,12 @@ export function createAssetHandler(store) {
         modelBytesCache.set(key, plain);
         while (modelBytesCache.size > MODEL_BYTES_CACHE_LIMIT) modelBytesCache.delete(modelBytesCache.keys().next().value);
       }
-      res.writeHead(200, { 'content-type': 'model/gltf-binary', 'content-length': String(plain.byteLength) });
-      res.end(Buffer.from(plain));
+      res.writeHead(200, { ...headers, 'content-type': 'model/gltf-binary', 'content-length': String(plain.byteLength) });
+      if (req.method === 'HEAD') { res.end(); return; }
+      res.end(plain);
       return;
     }
-    sendFile(req, res, target, entry.root);
+    sendFile(req, res, target, entry.root, { reload });
   };
 }
 
@@ -2301,7 +2391,7 @@ export function apply(ctx, config = {}) {
   const whale = resolveWhaleMark({
     asar: envVar('DSH_ASAR') || undefined,
     resourcesPath: process.resourcesPath,
-    installRoot: findInstallRoot(dirname(process.execPath)),
+    installRoot: findInstallRoot(dirname(process.execPath)) || installRootFromDshEntry(),
     localFile: envVar('WHALE_FILE') || join(PLUGIN_ROOT, 'assets', 'whale-tail.apng'),
     stateFile: join(importRootDir(), 'whale-tail.apng'),
     log: (message) => ctx.logger?.warn?.(message),
@@ -3688,6 +3778,8 @@ export function apply(ctx, config = {}) {
    * the note where it is read below.
    */
   const sayHandler = (req, res) => {
+    // GET is retained for older clients, but it can invoke a paid AI provider too.
+    if (!allowWriteRequest(req, res)) return;
     const run = (event, state, language, part, structure, chain, clipPrompt) => {
       const box = speechBoxFor(event, state);
       if (!box) {
@@ -3833,14 +3925,21 @@ export function apply(ctx, config = {}) {
   };
 
   /**
-   * Where a window's page lives, derived from the request so no port is guessed.
-   *
-   * The route is a parameter because there are two windows now, and both URLs come from the same host
-   * header — the one the caller actually reached the plugin on.
+   * Native windows run on THIS host. Reach the actual listener directly so they do not
+   * depend on the remote browser's proxy login cookies or its externally terminated TLS.
+   * Forwarded headers are deliberately not used as a native navigation target.
    */
   const pageUrlFor = (req, route) => {
-    const host = req?.headers?.host;
-    return host ? `http://${host}${route || ROUTES.window}` : null;
+    const address = req?.socket?.localAddress;
+    const port = req?.socket?.localPort;
+    if (address && Number.isInteger(port) && port > 0 && port <= 65535) {
+      const ip = address.startsWith('::ffff:') && /^\d+\.\d+\.\d+\.\d+$/.test(address.slice(7)) ? address.slice(7) : address;
+      const host = ip.includes(':') ? `[${ip}]` : ip;
+      try { return new URL(route || ROUTES.window, `${req.socket.encrypted ? 'https' : 'http'}://${host}:${port}`).href; }
+      catch { return null; }
+    }
+    // A native window cannot infer a trusted listener from a public Host header.
+    return null;
   };
 
   const desktopPageHandler = (req, res) => {
@@ -4101,7 +4200,7 @@ export function apply(ctx, config = {}) {
       }
       if (action === 'game') {
         const gameUrl = pageUrlFor(req, ROUTES.game);
-        if (!gameUrl) { sendStatus(res, 400, 'no host header'); return; }
+        if (!gameUrl) { sendStatus(res, 400, 'local listener address is unavailable'); return; }
         const url = new URL(gameUrl);
         if (typeof body.modelId === 'string') url.searchParams.set('model', body.modelId.slice(0, 256));
         const opened = desktopWindow.openConfig({ url: url.href });
@@ -4157,7 +4256,7 @@ export function apply(ctx, config = {}) {
       if (action === 'setup') {
         const setupUrl = pageUrlFor(req, ROUTES.setup);
         if (!setupUrl) {
-          sendStatus(res, 400, 'no host header to build the page URL from');
+          sendStatus(res, 400, 'local listener address is unavailable');
           return;
         }
         const opened = desktopWindow.openConfig({ url: setupUrl });
@@ -4178,7 +4277,7 @@ export function apply(ctx, config = {}) {
          */
         const pickerUrl = pageUrlFor(req, ROUTES.picker);
         if (!pickerUrl) {
-          sendStatus(res, 400, 'no host header to build the page URL from');
+          sendStatus(res, 400, 'local listener address is unavailable');
           return;
         }
         const opened = desktopWindow.openConfig({ url: pickerUrl });
@@ -4207,11 +4306,12 @@ export function apply(ctx, config = {}) {
         // A model parameter window is ABOUT a model, so it carries one; the 通用设置 window has no model in its URL.
         if (page === 'model' && wanted) query.push('model=' + encodeURIComponent(wanted));
         const route = page === 'global' ? ROUTES.global : ROUTES.config;
-        const settingsUrl = pageUrlFor(req, route) + (query.length ? '?' + query.join('&') : '');
-        if (!settingsUrl) {
-          sendStatus(res, 400, 'no host header to build the page URL from');
+        const settingsBase = pageUrlFor(req, route);
+        if (!settingsBase) {
+          sendStatus(res, 400, 'local listener address is unavailable');
           return;
         }
+        const settingsUrl = settingsBase + (query.length ? '?' + query.join('&') : '');
         const opened = desktopWindow.openConfig({ url: settingsUrl });
         if (!opened.ok) {
           sendStatus(res, 500, opened.error || 'the settings window could not be opened');
@@ -4227,7 +4327,7 @@ export function apply(ctx, config = {}) {
       if (action === 'restart') desktopWindow.stop();
       const url = pageUrlFor(req);
       if (!url) {
-        sendStatus(res, 400, 'no host header to build the page URL from');
+        sendStatus(res, 400, 'local listener address is unavailable');
         return;
       }
       /**

package/lib/mini-game-page.js

@@ -39,7 +39,7 @@
   var focusClient = globalThis.crypto && crypto.randomUUID ? crypto.randomUUID() : Date.now().toString(36) + Math.random().toString(36).slice(2);
   function reportGameFocus(active, keepalive) {
     if (testMode || stopped && active) return;
-    return fetch('/vrmpet3d/desktop', { method: 'POST', credentials: 'omit', keepalive: keepalive === true,
+    return fetch('/vrmpet3d/desktop', { method: 'POST', credentials: 'same-origin', keepalive: keepalive === true,
       headers: { 'content-type': 'application/json' }, body: JSON.stringify({ action: 'game-focus', clientId: focusClient, active: active }) }).catch(function () {});
   }
   function fitLifeIcons() {
@@ -242,7 +242,7 @@
       return opened;
     }
     fetch('/vrmpet3d/desktop', { method: 'POST', headers: { 'content-type': 'application/json' },
-      credentials: 'omit', body: JSON.stringify({ action: 'game-session', sessionId: target.id }) })
+      credentials: 'same-origin', body: JSON.stringify({ action: 'game-session', sessionId: target.id }) })
       .then(function (r) { if (!r.ok) throw new Error('会话切换失败'); return r.json(); })
       .then(function (body) { if (!body.ok) throw new Error('该会话已不再等待处理'); bridge.focusHost(); })
       .catch(function (error) { $('connection').textContent = error.message + '，请重试。'; });
@@ -250,7 +250,7 @@
   function poll() {
     statusRequest = new AbortController();
     var timeout = setTimeout(function () { statusRequest.abort(); }, 5000);
-    fetch('/vrmpet3d/state', { credentials: 'omit', cache: 'no-store', signal: statusRequest.signal }).then(function (r) {
+    fetch('/vrmpet3d/state', { credentials: 'same-origin', cache: 'no-store', signal: statusRequest.signal }).then(function (r) {
       if (!r.ok) throw new Error('status unavailable'); return r.json();
     }).then(function (state) {
       if (stopped) return;
@@ -557,9 +557,9 @@
   if (restored) pause(true); frameId = requestAnimationFrame(frame);
   // Snapshot the selected model; the game never writes model preferences or moves the pet's scene.
   Promise.all([
-    fetch('/vrmpet3d/settings', { credentials: 'omit' }).then(function (r) { if (!r.ok) throw new Error('无法读取模型设置'); return r.json(); }),
-    fetch('/vrmpet3d/catalog', { credentials: 'omit' }).then(function (r) { if (!r.ok) throw new Error('无法读取模型列表'); return r.json(); }),
-    fetch('/vrmpet3d/motions', { credentials: 'omit' }).then(function (r) { if (!r.ok) throw new Error('无法读取分发的弹簧骨默认参数'); return r.json(); }),
+    fetch('/vrmpet3d/settings', { credentials: 'same-origin' }).then(function (r) { if (!r.ok) throw new Error('无法读取模型设置'); return r.json(); }),
+    fetch('/vrmpet3d/catalog', { credentials: 'same-origin' }).then(function (r) { if (!r.ok) throw new Error('无法读取模型列表'); return r.json(); }),
+    fetch('/vrmpet3d/motions', { credentials: 'same-origin' }).then(function (r) { if (!r.ok) throw new Error('无法读取分发的弹簧骨默认参数'); return r.json(); }),
   ]).then(function (values) {
     if (stopped) return;
     var prefs = values[0].preferences || {}, models = values[1].models || [];

package/lib/model-picker.js

@@ -427,7 +427,7 @@
       if (!doFetch) return Promise.reject(new Error(text.noFetchUpload));
       return doFetch(path, {
         method: 'POST',
-        credentials: 'omit',
+        credentials: 'same-origin',
         headers: { 'content-type': 'application/json' },
         body: JSON.stringify(body),
       }).then(function (response) {
@@ -617,7 +617,7 @@
         onStatus(text.listFailed, 'warn');
         return Promise.resolve(null);
       }
-      return doFetch(catalogUrl, { credentials: 'omit' })
+      return doFetch(catalogUrl, { credentials: 'same-origin' })
         .then(function (response) { return response.ok ? response.json() : null; })
         .then(function (payload) {
           if (!apply(payload)) onStatus(text.listFailed, 'warn');
@@ -692,10 +692,10 @@
       setBusy(true, text.importingFile(name));
       return doFetch(uploadUrl + '?file=' + encodeURIComponent(name), {
         method: 'POST',
-        credentials: 'omit',
+        credentials: 'same-origin',
         // The extension decided what this is; the CONTENT TYPE is what tells the host to read a raw body
         // rather than JSON, so it is stated even when the browser has no type for the file.
-        headers: { 'content-type': file.type && file.type !== 'application/json' ? file.type : 'application/octet-stream' },
+        headers: { 'content-type': 'application/octet-stream' },
         body: file,
       }).then(function (response) {
         if (!response.ok) {

package/lib/scene.js

@@ -2052,11 +2052,12 @@
      * repeated GET of the same URL without touching the disk — which would make 重载模型 look like it did nothing. The
      * one-shot buster from `bustModelCache` rides the query string, and is consumed here so an ordinary load stays clean.
      */
-    if (this.modelBust) {
+    var reload = Boolean(this.modelBust);
+    if (reload) {
       url += (url.indexOf('?') === -1 ? '?' : '&') + 'v=' + this.modelBust;
       this.modelBust = null;
     }
-    var promise = fetch(url, { credentials: 'omit' })
+    var promise = fetch(url, { credentials: 'same-origin', cache: reload ? 'reload' : 'default' })
       .then(function (response) {
         if (!response.ok) throw new Error('asset route returned HTTP ' + response.status);
         return response.arrayBuffer();

package/lib/setup-page.js

@@ -301,7 +301,7 @@
   function post(path, body) {
     return fetch(path, {
       method: 'POST',
-      credentials: 'omit',
+      credentials: 'same-origin',
       headers: { 'content-type': 'application/json' },
       body: JSON.stringify(body),
     }).then(function (response) {
@@ -315,7 +315,7 @@
   }
 
   function getJson(path) {
-    return fetch(path, { credentials: 'omit' })
+    return fetch(path, { credentials: 'same-origin' })
       .then(function (response) { return response.ok ? response.json() : null; })
       .catch(function () { return null; });
   }
@@ -517,7 +517,7 @@
   function renderRuntimeNote() {
     var line = el('setup-runtime-path');
     if (!line || typeof fetch !== 'function') return;
-    fetch('/vrmpet3d/desktop', { credentials: 'omit' })
+    fetch('/vrmpet3d/desktop', { credentials: 'same-origin' })
       .then(function (response) { return response.ok ? response.json() : null; })
       .then(function (status) {
         var dir = status && typeof status.runtimeDir === 'string' ? status.runtimeDir : '';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-vrmpet3d",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "DeepSeek Harness 的 VRM 3D 桌宠：任务状态联动、独立悬浮窗、模型动作与 AI 碎碎念。",
   "type": "module",
   "license": "MIT",