diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index e24f9fd..c5035e2 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -5,12 +5,6 @@ on:
branches: ["**"]
pull_request:
workflow_dispatch:
- inputs:
- deploy_action:
- description: Production action (deploy requires explicit enabled Variable)
- type: choice
- options: [plan, bootstrap, deploy, rollback]
- default: plan
jobs:
verify:
# The NAS Docker runner must never execute code from external forks.
@@ -47,54 +41,5 @@ jobs:
python scripts/ci-compose-verify.py --cleanup
fi
- deploy:
- needs: verify
- if: success() && github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
- runs-on: ubuntu-latest
- concurrency:
- group: frame-flow-production
- cancel-in-progress: false
- env:
- CD_ACTION: ${{ github.event.inputs.deploy_action }}
- PROD_DEPLOY_ENABLED: ${{ vars.PROD_DEPLOY_ENABLED }}
- PROD_PROJECT: ${{ vars.PROD_PROJECT }}
- PROD_CONTAINER: ${{ vars.PROD_CONTAINER }}
- PROD_IMAGE_REPO: ${{ vars.PROD_IMAGE_REPO }}
- PROD_DATA_DIR: ${{ secrets.PROD_DATA_DIR }}
- PROD_CONFIG_DIR: ${{ secrets.PROD_CONFIG_DIR }}
- PROD_PHOTOS_DIR: ${{ secrets.PROD_PHOTOS_DIR }}
- SYNOLOGY_PHOTOS_URL: ${{ secrets.SYNOLOGY_PHOTOS_URL }}
- SYNOLOGY_PHOTOS_CERT_SHA256: ${{ secrets.SYNOLOGY_PHOTOS_CERT_SHA256 }}
- PROD_WEB_BIND: ${{ secrets.PROD_WEB_BIND }}
- PROD_WEB_PORT: ${{ vars.PROD_WEB_PORT }}
- FRAME_FLOW_STORAGE_NAME: ${{ vars.FRAME_FLOW_STORAGE_NAME }}
- PROD_STATE_VOLUME: ${{ vars.PROD_STATE_VOLUME }}
- PROD_MOCK: ${{ vars.PROD_MOCK }}
- PROD_WRITE_ENABLED: ${{ vars.PROD_WRITE_ENABLED }}
- DOCKER_PIP_INDEX_URL: ${{ vars.DOCKER_PIP_INDEX_URL }}
- DOCKER_PIP_FALLBACK_INDEX_URL: ${{ vars.DOCKER_PIP_FALLBACK_INDEX_URL }}
- CI_PIP_INDEX_URL: ${{ vars.CI_PIP_INDEX_URL }}
- CI_PIP_FALLBACK_INDEX_URL: ${{ vars.CI_PIP_FALLBACK_INDEX_URL }}
- DEBIAN_MIRROR: ${{ vars.DEBIAN_MIRROR }}
- DEBIAN_SECURITY_MIRROR: ${{ vars.DEBIAN_SECURITY_MIRROR }}
- steps:
- - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- - uses: https://github.com/actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
- with:
- python-version: '3.14'
- - name: Install deploy tooling
- run: python scripts/ci-install.py
- - name: Plan or deploy production (default is plan)
- env:
- PRODUCTION_ENV: ${{ secrets.PRODUCTION_ENV }}
- run: |
- . ./deploy/build-cn.env
- python scripts/production-deploy.py
- - name: Recover interrupted production deployment
- if: always()
- env:
- CD_ACTION: recover
- run: |
- if [ -n "${FRAME_FLOW_DEPLOY_OWNER:-}" ]; then
- python scripts/production-deploy.py
- fi
+# Production moved to Ubuntu Server. Release manually with scripts/server-release.py;
+# the shared NAS runner performs isolated verification only.
diff --git a/deploy/docker-compose.photos.yml b/deploy/docker-compose.photos.yml
index 3bbdf41..6735267 100644
--- a/deploy/docker-compose.photos.yml
+++ b/deploy/docker-compose.photos.yml
@@ -1,14 +1,6 @@
-# Opt-in read-only photo mount. Set NAS_PHOTOS_DIR to the actual NAS folder.
+# Retired: filesystem photo mounts are forbidden. Use Photos API sources.
+# This compatibility filename intentionally grants no additional host access.
services:
pigway-frame-flow:
environment:
- PHOTO_ROOT: /photos
- group_add:
- - "${NAS_PHOTOS_GID:-10333}"
- volumes:
- - type: bind
- source: ${NAS_PHOTOS_DIR:?Set NAS_PHOTOS_DIR to your existing photo directory}
- target: /photos
- read_only: true
- bind:
- create_host_path: false
+ SYNOLOGY_PHOTOS_CACHE_BYTES: ${SYNOLOGY_PHOTOS_CACHE_BYTES:-268435456}
diff --git a/docs/releases/v0.1.9.md b/docs/releases/v0.1.9.md
new file mode 100644
index 0000000..10852c9
--- /dev/null
+++ b/docs/releases/v0.1.9.md
@@ -0,0 +1,19 @@
+# v0.1.9
+
+照片来源通过 Synology Photos API 按账号权限读取，共享/个人空间、人物 any/all 筛选和有界 XL 预览缓存可用。生产拒绝文件系统照片来源及 /photos 挂载；本地上传、生成图片和 Server 本地图库继续保留。NAS 原图下载接口曾被拒绝，本版不宣称支持原图下载。
+
+自动化新增 1～10080 分钟的真实间隔，跨整点与跨天不按 Cron 字段重置，既有 Cron 任务保持原样。显示时长明确为到期恢复期限。统一来源快捷创建任务编辑器，改善登录及来源表单响应式布局、设备显示名与历史记录中英文；诊断详情保留原始标识。
+
+## 生产部署
+
+生产已迁至 Ubuntu Server，由 systemd 管理 Docker；业务、Docker 数据和恢复资料位于 T7，并有 UUID 与挂载依赖保护。NAS 旧 Frame 专属资源已清理且独立复核 PASS。CI 保留隔离验证，移除 NAS 自动生产部署任务，不再向 NAS 发布。
+
+正式发布使用 scripts/server-release.py：仅在既有 Ubuntu Server 环境运行，从已提交源码包构建，校验依赖锁、源码哈希、T7 UUID、容器安全约束和真实写入设置；备份 SQLite、配置及 Compose 后切换镜像，失败恢复旧 Compose，不自动回写旧数据库。它不执行上传、显示、删除或恢复图片等设备操作。成功后记录正式提交号、保存源码包及审计回执，删除本次暂存目录；白名单内的 Frame 旧迁移输入归档到本次 recovery，清除无恢复引用的临时镜像别名，共享 Console 资料不动。旧镜像及历史恢复资料保留供回滚，不执行全局 prune。
+
+脚本要求由 git archive 生成的源码放在 /srv/pigway/migration-inbox 的独立子目录；目录内同时提供 RELEASE_COMMIT、RELEASE_HASHES.json 和原始 source.tar.gz。哈希清单涵盖源码与源码包，不含自身。执行 sudo python3 <暂存目录>/scripts/server-release.py；成功后读取 /srv/pigway/apps/pigway-frame-flow/release-verification.json 并独立检查线上接口。
+
+## 验收范围
+
+完整后端测试、静态检查与桌面/平板/手机的中英文浏览器回归纳入发布检查。线上历史补丁已核验，真实写入保持开启；本轮正式发布不重复真实设备写入测试。隔离浏览器验证与真实设备写入证据分别记录于 docs/verification/2026-10-17-final-audit.md。
+
+局域网 HTTPS、独立加密备份及恢复演练仍是后续工作；T7 recovery 不属于独立备份。没有执行 USB 断连、服务器重启或压力测试。
diff --git a/docs/research/KOKONNA_LOCAL_CONTROL.md b/docs/research/KOKONNA_LOCAL_CONTROL.md
new file mode 100644
index 0000000..a746023
--- /dev/null
+++ b/docs/research/KOKONNA_LOCAL_CONTROL.md
@@ -0,0 +1,84 @@
+# KoKonna local-control investigation
+
+Reviewed 2026-10-06. No frame writes, network changes, or firmware changes.
+
+## Sources and limits
+
+- Official FAQ: https://kokonna.art/pages/faq explicitly describes Bluetooth
+ upload and switching. This is a product-level claim, not verified B101 behavior.
+- Public OpenAPI: https://kokonna.art/pages/openapi documents cloud HTTPS calls.
+- Existing official Android nightly 1.6.5 APK from the prior download:
+ SHA256 `8f611bf74bbda70e7e7a5d087e4065dc6000849dcd2f12538d5ff5017c91e1c0`.
+ Static inspection of its packaged app-service.js; no vendor code is copied here.
+- Searches found community API clients, but no verified B101 firmware source or
+ documented bring-your-own-server configuration. Absence from search is not
+ proof that firmware source or another configuration path does not exist.
+
+## Observed client behavior
+
+The account client uses `https://robot.galaxyguide.cn/api/rpc`. Its Bluetooth
+upload flow calls `appFrame.uploadImage` with base64 and `synced: true`, receives
+an image ID, downloads the resulting image from the vendor server, and sends
+the bytes to the frame over BLE. Therefore this observed flow still exposes
+the original image to the vendor cloud.
+
+BLE service UUID: `4fafc201-1fb5-459e-8fcc-c5c9c331914b`.
+Characteristic UUID: `beb5483e-36e1-4688-b7f5-ea07361b26a7`.
+
+Observed JSON commands include `get_info`, `refresh_image`, and `set_image`.
+Image transfer uses start metadata (ID, rotation, type, size, chunk count),
+numbered binary chunks, sync acknowledgements/missing-chunk information, and
+an end command. The client chooses `y4` for firmware starting with B103 and
+`jpg` otherwise. That makes local JPEG transmission a plausible B101 research
+path, not a proven implementation: cloud-independent IDs, processing, firmware
+acceptance, pairing and completion semantics still require validation.
+
+The observed `set_config` payload contains `slideType`, `slideMinute`, and
+`nickname`; `set_wifi` contains SSID and password. No server-host setter was
+found in these paths or common host-setting symbol searches.
+
+## Host replacement assessment
+
+Changing Frame Flow's API base URL changes where Frame Flow sends requests,
+not where the frame connects. Replacing the frame's cloud server requires its
+device-side protocol and a supported address-setting mechanism or firmware
+change. DNS redirection alone may fail HTTPS certificate validation and still
+requires a compatible server implementation. TLS/pinning and actual device
+polling transport have not been established from this APK.
+
+Next read-only step: inspect BLE `get_info` and installed firmware compatibility.
+Any subsequent local image write needs a separate controlled test. No BLE driver
+is enabled by this investigation.
+
+## Wi-Fi-only follow-up
+
+The user excluded Bluetooth and additional gateways. The target is NAS-to-frame
+Wi-Fi control with the original hardware.
+
+GitHub's public repository search for `kokonna` returned three repositories:
+`patrickchen914/kokonna`, `nixihz/kokonna-skill`, and
+`zhengweiran66-eng/kokonna-product.html`. These provide a Home Assistant cloud
+integration, an OpenAPI CLI, and a product page, respectively; no verified B101
+device firmware or Wi-Fi local-server implementation was identified.
+
+Static APK checks found no hard-coded private IPv4 target, WebSocket URL,
+custom image-URL setter, or common server-host setter symbols in app-service.js.
+This does not exclude hidden firmware features or native-library code paths.
+`app.getFirmwares` is called with `robotId`. Upgrade submission passes a firmware
+name, locale and distributor ID through `app.setUpgradeFirmware`; the inspected
+UI does not supply a user-selected firmware download URL. Neither method was
+called during this investigation. Existing account RPC allowlists remain intact.
+
+Candidate paths, none yet verified:
+
+1. A device-local HTTP/TCP service: requires a confirmed frame LAN address and
+ bounded service inspection while the frame is awake.
+2. A firmware-supported custom server or image URL: requires configuration or
+ firmware evidence, not simply replacing the application's API host.
+3. A NAS implementation of the device's cloud protocol: requires the actual
+ polling/download protocol and address/TLS behavior. Passive observation at
+ the existing gateway may provide evidence; a normal NAS on a switched LAN
+ cannot assume it sees another device's outbound packets.
+
+No DNS redirection, router interception, certificate replacement, firmware
+upgrade, reset, or automatic display change was performed.
diff --git a/pigway_frame_flow/models.py b/pigway_frame_flow/models.py
index e2a8404..74ed9b3 100644
--- a/pigway_frame_flow/models.py
+++ b/pigway_frame_flow/models.py
@@ -265,7 +265,10 @@ class GalleryImage(BaseModel):
class Schedule(StrictModel):
- type: Literal["cron", "daily", "weekdays", "weekends", "date", "temporary"]
+ type: Literal[
+ "cron", "daily", "weekdays", "weekends", "date", "temporary", "interval"
+ ]
+ interval_minutes: int | None = Field(default=None, ge=1, le=10080)
cron: str | None = None
time: str | None = Field(default=None, pattern=r"^([01]\d|2[0-3]):[0-5]\d$")
at: datetime | None = None
diff --git a/pigway_frame_flow/providers/photo_sources.py b/pigway_frame_flow/providers/photo_sources.py
index b397a97..9b6f259 100644
--- a/pigway_frame_flow/providers/photo_sources.py
+++ b/pigway_frame_flow/providers/photo_sources.py
@@ -109,7 +109,18 @@ class PhotoSources:
raise FlowError(E.NOT_FOUND, "Photo source not found", 404)
return PhotoSourceInput.model_validate_json(row["payload"])
+ @staticmethod
+ def require_api_source(source):
+ # Block persisted legacy sources as well as new requests, before any disk read.
+ if source.kind == "local":
+ raise FlowError(
+ E.FORBIDDEN,
+ "Filesystem photo sources are disabled; use the Synology Photos API",
+ 403,
+ )
+
def save(self, source_id, source):
+ self.require_api_source(source)
if source.minimum_brightness > source.maximum_brightness:
raise FlowError(E.INVALID_REQUEST, "Brightness range is reversed")
if source.kind not in ("local", "synology-photos") and (
@@ -284,6 +295,7 @@ class PhotoSources:
def catalog(self, source_id, refresh=False, *, target_size=(1200, 1600)):
source = self.get(source_id)
+ self.require_api_source(source)
if not source.enabled:
raise FlowError(E.CONFLICT, "Photo source is disabled", 409)
session_identity = (
diff --git a/pigway_frame_flow/scheduler/engine.py b/pigway_frame_flow/scheduler/engine.py
index 39cec8a..ed5f17c 100644
--- a/pigway_frame_flow/scheduler/engine.py
+++ b/pigway_frame_flow/scheduler/engine.py
@@ -23,6 +23,10 @@ from pigway_frame_flow.storage.database import encode, now_iso
def next_run(schedule, after=None):
after = after or datetime.now(UTC)
+ if schedule.type == "interval":
+ if schedule.interval_minutes is None:
+ raise FlowError(E.INVALID_REQUEST, "Interval requires interval_minutes")
+ return (after + timedelta(minutes=schedule.interval_minutes)).isoformat()
if schedule.type in ("date", "temporary"):
if not schedule.at or schedule.at.tzinfo is None:
raise FlowError(E.INVALID_REQUEST, "One-time date must include timezone")
diff --git a/pigway_frame_flow/web/app.js b/pigway_frame_flow/web/app.js
index bb091de..3bd8d25 100644
--- a/pigway_frame_flow/web/app.js
+++ b/pigway_frame_flow/web/app.js
@@ -13,10 +13,10 @@ const t=k=>window.MESSAGES[state.lang][k]||k;
const esc=v=>String(v??'—').replace(/[&<>"']/g,c=>({'&':'&','<':'<','>':'>','"':'"',"'":'''}[c]));
const fmt=v=>v?new Date(v).toLocaleString(state.lang==='zh'?'zh-CN':'en-GB',{timeZone:'Asia/Shanghai'}):'—';
const padTime=(hour,minute)=>`${String(hour).padStart(2,'0')}:${String(minute).padStart(2,'0')}`;
-function normaliseSchedule(schedule){const copy={...schedule};if(copy.type!=='cron')return copy;const match=/^(\d{1,2})\s+(\d{1,2})\s+\*\s+\*\s+(\*|1-5|6,0|0,6)$/.exec(copy.cron||'');if(!match)return copy;const type=match[3]==='*'?'daily':match[3]==='1-5'?'weekdays':'weekends';return {type,time:padTime(match[2],match[1])};}
-function scheduleTypeLabel(type){if(type!=='cron')return t(type);return state.lang==='zh'?'高级规则（Cron）':'Advanced rule (Cron)';}
-function scheduleSummary(schedule){const value=normaliseSchedule(schedule);if(['daily','weekdays','weekends'].includes(value.type))return `${scheduleTypeLabel(value.type)} · ${value.time}（${state.lang==='zh'?'上海时间':'Shanghai time'}）`;if(value.type==='cron')return `${scheduleTypeLabel('cron')} · ${value.cron}`;return `${scheduleTypeLabel(value.type)} · ${fmt(value.at)}`;}
-function scheduleHint(type){if(type==='cron')return state.lang==='zh'?'仅在需要特殊规则时使用；例如“每天 08:00”请选择“每天”。':'Use only for special rules; choose Daily for a regular time.';if(['date','temporary'].includes(type))return state.lang==='zh'?'选择一次性执行的日期和时间。':'Choose the date and time for this one-time task.';return state.lang==='zh'?'选择执行时间（上海时区）。':'Choose a time in Shanghai time.';}
+function normaliseSchedule(schedule){const copy={...schedule};if(copy.type==='interval')return {type:copy.interval_minutes%60===0?'hours':'minutes',every:copy.interval_minutes%60===0?copy.interval_minutes/60:copy.interval_minutes};if(copy.type!=='cron')return copy;const match=/^(\d{1,2})\s+(\d{1,2})\s+\*\s+\*\s+(\*|1-5|6,0|0,6)$/.exec(copy.cron||'');if(!match)return copy;const type=match[3]==='*'?'daily':match[3]==='1-5'?'weekdays':'weekends';return {type,time:padTime(match[2],match[1])};}
+function scheduleTypeLabel(type){if(type==='hours')return state.lang==='zh'?'每隔若干小时':'Every N hours';if(type==='minutes')return state.lang==='zh'?'每隔若干分钟':'Every N minutes';if(type!=='cron')return t(type);return state.lang==='zh'?'高级规则（Cron）':'Advanced rule (Cron)';}
+function scheduleSummary(schedule){const value=normaliseSchedule(schedule);if(['hours','minutes'].includes(value.type))return state.lang==='zh'?`每 ${value.every} ${value.type==='hours'?'小时':'分钟'}`:`Every ${value.every} ${value.type}`;if(['daily','weekdays','weekends'].includes(value.type))return `${scheduleTypeLabel(value.type)} · ${value.time}（${state.lang==='zh'?'上海时间':'Shanghai time'}）`;if(value.type==='cron')return `${scheduleTypeLabel('cron')} · ${value.cron}`;return `${scheduleTypeLabel(value.type)} · ${fmt(value.at)}`;}
+function scheduleHint(type){if(['hours','minutes'].includes(type))return state.lang==='zh'?'从保存起等待一个间隔后首次执行，此后按间隔重复；不是图片显示时长。':'First runs one interval after saving, then repeats. This is separate from display duration.';if(type==='cron')return state.lang==='zh'?'仅在需要特殊规则时使用；例如“每天 08:00”请选择“每天”。':'Use only for special rules; choose Daily for a regular time.';if(['date','temporary'].includes(type))return state.lang==='zh'?'选择一次性执行的日期和时间。':'Choose the date and time for this one-time task.';return state.lang==='zh'?'选择执行时间（上海时区）。':'Choose a time in Shanghai time.';}
const buttons=(id,text,primary=false)=>``;
let toastTimer;
function toast(message){$('#toast').textContent=message;$('#toast').style.display='block';clearTimeout(toastTimer);toastTimer=setTimeout(()=>$('#toast').style.display='none',6000);}
@@ -34,7 +34,12 @@ function busy(fn){return async event=>{try{await fn(event);}catch(e){toast(e.mes
function applyTheme(){const dark=state.theme==='dark'||(state.theme==='system'&&matchMedia('(prefers-color-scheme:dark)').matches);document.documentElement.dataset.theme=dark?'dark':'light';}
function revealCurrentNavigation(){const active=$('#nav .active'),sidebar=$('.sidebar');if(active&&matchMedia('(max-width:720px)').matches)sidebar.scrollLeft=active.offsetLeft-(sidebar.clientWidth-active.offsetWidth)/2;}
window.addEventListener('resize',revealCurrentNavigation);
-function shell(){document.documentElement.lang=state.lang==='zh'?'zh-CN':'en';$('#lang').textContent=state.lang==='zh'?'EN':'中文';$('#theme').title=t('theme');$('#nav').innerHTML=Object.entries(icons).map(([id,icon])=>``).join('');document.querySelectorAll('[data-page]').forEach(b=>b.onclick=()=>navigate(b.dataset.page));$('#page-title').textContent=t(state.page);$('#device').innerHTML=(state.devices.length?state.devices:[{id:state.device,name:state.device}]).map(d=>``).join('');revealCurrentNavigation();}
+function deviceNameForId(id){return deviceDisplayName(state.devices.find(d=>d.id===id)||{id,name:id});}
+function operationActionLabel(action){const labels={'render':['生成预览','Generate preview'],'render-ai':['AI 生成图片','Generate AI image'],'official-widget':['更新官方订阅','Update official widget'],'delete':['删除图片','Delete image'],'display':['显示图片','Display image'],'restore':['恢复图片','Restore image'],'local-upload':['保存到图库','Save to gallery'],'reconcile':['核对状态','Reconcile']};return labels[action]?.[state.lang==='zh'?0:1]||t('operation');}
+function operationClientLabel(client){return client==='admin'?tr('管理员','Administrator'):client==='scheduler'?tr('自动调度','Scheduler'):client;}
+function operationErrorLabel(error){if(!error?.code)return '';const label=t(error.code);return label===error.code?t('error'):label;}
+function deviceDisplayName(device){const name=device.name||device.id;return device.id==='living-room'&&['living-room','Living room'].includes(name)?t('livingRoom'):name;}
+function shell(){document.documentElement.lang=state.lang==='zh'?'zh-CN':'en';$('#lang').textContent=state.lang==='zh'?'EN':'中文';$('#theme').title=t('theme');$('#nav').innerHTML=Object.entries(icons).map(([id,icon])=>``).join('');document.querySelectorAll('[data-page]').forEach(b=>b.onclick=()=>navigate(b.dataset.page));$('#page-title').textContent=t(state.page);$('#device').innerHTML=(state.devices.length?state.devices:[{id:state.device,name:state.device}]).map(d=>``).join('');revealCurrentNavigation();}
// A destination appears only when its connection and read/write adapter are available.
// Future cloud-drive destinations must implement their adapter before registration here.
const galleryDestinationAdapters=new Set(['kokonna','local-assets']);
@@ -67,13 +72,13 @@ async function blobImage(img,path){
}
function hydrateImages(){const observer=new IntersectionObserver(entries=>entries.forEach(entry=>{if(entry.isIntersecting){observer.unobserve(entry.target);blobImage(entry.target,entry.target.dataset.src);}}),{rootMargin:'100px'});document.querySelectorAll('img[data-src]').forEach(img=>{imageLoading(img);observer.observe(img);});}
function notice(){return state.settings?.mock?`
${t('mock')}
`:'';}
-async function navigate(page=state.page){const previousPage=state.page;state.page=icons[page]?page:'dashboard';location.hash=state.page;shell();state.epoch++;const epoch=state.epoch;
+async function navigate(page=state.page){document.body.classList.toggle('login-mode',!state.token);const previousPage=state.page;state.page=icons[page]?page:'dashboard';location.hash=state.page;shell();state.epoch++;const epoch=state.epoch;
if(!state.token){login();return;}
if(previousPage!==state.page)$('#main').replaceChildren();
const previousBlobs=state.blobs;state.blobs=[];
try{await views[state.page](epoch);for(const url of previousBlobs)URL.revokeObjectURL(url);if(epoch!==state.epoch)return;const enhance={dashboard:enhanceDashboard,templates:enhanceTemplates,settings:enhanceSettings,upload:enhanceUpload,history:enhanceHistory,automation:enhanceAutomation}[state.page];if(enhance)await enhance();guardDeviceButtons();}catch(e){if(epoch!==state.epoch)return;if(!state.token){shell();login();toast(e.message);return;}$('#main').innerHTML=`
`;$('#theme-select').onchange=()=>{state.theme=$('#theme-select').value;localStorage.setItem('ff-theme',state.theme);applyTheme();};$('#language-select').onchange=()=>{state.lang=$('#language-select').value;localStorage.setItem('ff-language',state.lang);navigate();};bind('logout',async()=>{await api('/api/v1/auth/logout',{method:'POST'});forgetLogin();shell();login();});accountSettings();}
};
function jobPayload(j,changes={}){return {name:j.name,enabled:j.enabled,device_id:j.device_id,schedule:j.schedule,source:j.source,display_duration:j.display_duration,restore_previous:j.restore_previous,priority:j.priority,cleanup_unstarred:j.cleanup_unstarred||false,...changes};}
-async function jobEditor(job){const j=job||{name:'',enabled:true,device_id:state.device,schedule:{type:'daily',time:'07:00'},source:{type:'template',template:'daily-dashboard',data:{}},display_duration:5400,restore_previous:true,priority:50};showModal(`
`;
bind('new-job',()=>jobEditor());
document.querySelectorAll('[data-job-edit]').forEach(button=>button.onclick=()=>jobEditor(jobs[button.dataset.jobEdit]));
document.querySelectorAll('[data-job-toggle]').forEach(button=>button.onclick=busy(async()=>{const job=jobs[button.dataset.jobToggle];await api('/api/v1/jobs/'+job.id,{method:'PUT',body:jobPayload(job,{enabled:!job.enabled})});await navigate();}));
diff --git a/pigway_frame_flow/web/extensions.js b/pigway_frame_flow/web/extensions.js
index 3776e24..9167fb5 100644
--- a/pigway_frame_flow/web/extensions.js
+++ b/pigway_frame_flow/web/extensions.js
@@ -49,7 +49,7 @@ async function officialWidgetControls(info,data){
const send=cover_id=>confirmDialog(tr('此操作会改变官方订阅和画框内容，是否继续？','This changes the official subscription and frame content. Continue?'),async()=>{const args=cover_id?Object.fromEntries([...document.querySelectorAll('[data-widget-arg]')].filter(x=>x.value).map(x=>[x.dataset.widgetArg,x.value])):{};const r=await api('/api/v1/devices/'+state.device+'/widgets/selection',{method:'POST',body:{cover_id,args},headers:{'Idempotency-Key':'widget-'+clientUUID()}});await waitOperation(r.operation_id);await navigate('templates');});if(!disabled){$('#official-widget-use').onclick=busy(()=>send(Number($('#official-widget-choice').value)));$('#official-widget-cancel').onclick=busy(()=>send(null));}
}
function addPhotoQualityFields(source){
- const box=document.createElement('section');box.innerHTML=`
${tr('照片筛选','Photo filtering')}
${tr('按小图清晰度、亮度和相似度筛选，不改动或删除 NAS 原照片；无法保证识别闭眼。建议先用低阈值。本地目录来源仍需挂载 /photos；Synology Photos API 来源通过网络读取，无需文件挂载。','Filters thumbnail sharpness, brightness and similarity without modifying or deleting originals. Closed-eye detection is not guaranteed. Start with low thresholds. Local-folder sources still require /photos; Synology Photos API sources read over the network without file mounts.')}
${tr('对 API 获取的预览图按清晰度、亮度和相似度筛选，不修改或删除 NAS 原照片；无法保证识别闭眼。建议先使用较低阈值。','Filters API previews by sharpness, brightness and similarity without modifying or deleting NAS originals. Closed-eye detection is not guaranteed. Start with low thresholds.')}
`);$('#source-job-form').onsubmit=busy(async e=>{e.preventDefault();await api('/api/v1/jobs',{method:'POST',body:{name:$('#source-job-name').value,device_id:state.device,enabled:$('#source-job-enabled').checked,cleanup_unstarred:false,schedule:{type:'cron',cron:$('#source-job-cron').value},source:{type:'photo_source',source_id:id,fit:'contain',profile:'color'}}});$('#modal').close();await navigate('automation');});
+async function sourceJobForm(id){
+ await jobEditor({name:t('randomPhoto'),device_id:state.device,enabled:false,schedule:{type:'interval',interval_minutes:120},source:{type:'photo_source',source_id:id,fit:'contain',profile:'color'},display_duration:0,restore_previous:false,priority:50});
}
diff --git a/pigway_frame_flow/web/i18n.js b/pigway_frame_flow/web/i18n.js
index 3484e47..1204642 100644
--- a/pigway_frame_flow/web/i18n.js
+++ b/pigway_frame_flow/web/i18n.js
@@ -17,16 +17,16 @@ Object.assign(window.MESSAGES.zh,{poetryNotice:'Frame Flow 每日诗词：内置
Object.assign(MESSAGES.zh,{officialContentTitle:'KoKonna 官方小组件与订阅',officialContentDescription:'官方产品资料列出的内容类型；下列功能与 Frame Flow 自建模板分开管理。',officialCalendarWeather:'日历与当地天气',officialWordAlmanacTravel:'每日一词、传统黄历、全球旅行推荐',officialNews:'每日新闻',officialCreative:'AI 语音 / 文字 / 涂鸦 / 照片转艺术；照片轮播',officialSubscriptionUnavailable:'公开 OpenAPI 尚未列出订阅目录、当前订阅、开通或取消订阅接口。官方订阅请继续在官方小程序中管理；Frame Flow 不会读取或修改这些设置。你使用的每日诗词属于官方小程序内容，当前无法通过公开 API 确认完整类型列表。',officialProductDocs:'官方内容介绍 ↗',officialAPIDocs:'官方 OpenAPI ↗'});
Object.assign(MESSAGES.en,{officialContentTitle:'KoKonna official widgets and subscriptions',officialContentDescription:'Content types listed in official product materials; managed separately from Frame Flow templates.',officialCalendarWeather:'Calendar and local weather',officialWordAlmanacTravel:'Word of the day, traditional almanac and global travel recommendations',officialNews:'Daily news',officialCreative:'AI voice / text / sketch / photo-to-art; photo rotation',officialSubscriptionUnavailable:'Public OpenAPI does not list subscription discovery, current subscription, subscribe or unsubscribe endpoints. Manage official subscriptions in the official mini-program. Frame Flow cannot read or modify these settings. Your daily-poetry subscription is mini-program content; its complete catalog cannot currently be verified through public API.',officialProductDocs:'Official content overview ↗',officialAPIDocs:'Official OpenAPI ↗'});
-Object.assign(MESSAGES.zh,{photoSources:'照片数据源',sourceHint:'从只读 NAS 目录或 WebDAV 选图；预览不会改变画框。',addSource:'添加数据源',browse:'浏览照片',randomPreview:'随机选图预览',sourceJob:'定时随机照片',noSources:'暂无照片，请添加数据源或检查目录。',sourceKind:'数据源类型',nasDirectory:'NAS 本地目录',sourceLocation:'目录 / WebDAV URL',sourceLocationHint:'本地填写挂载照片根目录下的相对路径，如 . 或 family。WebDAV 填写 HTTPS 目录 URL，并先在设置中允许该域名。',sourceCredential:'WebDAV 凭据环境变量名',sourceCredentialHint:'仅填写变量名，禁止填写密码。管理员通过环境变量或 Secret 配置 JSON username/password。',sourceRecursive:'包含子目录（本地目录）',sourceImages:'可用照片',sourceBrowseHint:'按需读取目录，点击文件名才生成预览；不会下载全部原图。',previousPage:'上一页',nextPage:'下一页',sourcePreviewHint:'这是已选中照片的预览，显示时使用同一张照片。',randomPhoto:'随机照片',sourceJobHint:'每次执行重新随机选图。默认暂停；启用后会按时改变画框显示。'});
-Object.assign(MESSAGES.en,{photoSources:'Photo sources',sourceHint:'Choose photos from a read-only NAS folder or WebDAV. Preview does not change the frame.',addSource:'Add source',browse:'Browse photos',randomPreview:'Preview random photo',sourceJob:'Schedule random photos',noSources:'No photos yet. Add a source or check the folder.',sourceKind:'Source type',nasDirectory:'NAS local folder',sourceLocation:'Folder / WebDAV URL',sourceLocationHint:'Local: relative folder under the mounted photo root, e.g. . or family. WebDAV: HTTPS directory URL; allow its hostname in Settings first.',sourceCredential:'WebDAV credential environment name',sourceCredentialHint:'Enter a variable name, never a password. Admin configures JSON username/password via environment or Secret.',sourceRecursive:'Include subfolders (local)',sourceImages:'Available photos',sourceBrowseHint:'Catalog loaded on demand. Click a filename to preview; originals are not downloaded in bulk.',previousPage:'Previous page',nextPage:'Next page',sourcePreviewHint:'Display uses this exact previewed photo.',randomPhoto:'Random photo',sourceJobHint:'Choose a fresh random photo each run. Paused by default; enabling changes the frame on schedule.'});
+Object.assign(MESSAGES.zh,{photoSources:'照片数据源',sourceHint:'通过 Synology Photos API 管理照片来源、人物和筛选规则。浏览与预览不会改变画框。',addSource:'添加数据源',browse:'浏览照片',randomPreview:'随机选图预览',sourceJob:'定时随机照片',noSources:'暂无照片，请添加数据源或检查目录。',sourceKind:'数据源类型',sourceLocation:'目录 / WebDAV URL',sourceLocationHint:'Synology Photos：所选空间内的目录路径，. 表示整个空间。按需获取 XL 预览图，不下载原图。其他云盘使用对应目录地址或 ID。',sourceCredential:'WebDAV 凭据环境变量名',sourceCredentialHint:'仅填写变量名，禁止填写密码。管理员通过环境变量或 Secret 配置 JSON username/password。',sourceRecursive:'包含子目录',sourceImages:'可用照片',sourceBrowseHint:'按需读取目录，点击文件名才生成预览；不会下载全部原图。',previousPage:'上一页',nextPage:'下一页',sourcePreviewHint:'这是已选中照片的预览，显示时使用同一张照片。',randomPhoto:'随机照片',sourceJobHint:'每次执行重新随机选图。默认暂停；启用后会按时改变画框显示。'});
+Object.assign(MESSAGES.en,{photoSources:'Photo sources',sourceHint:'Manage photo sources, people and filters through the Synology Photos API. Browsing and previewing do not change the frame.',addSource:'Add source',browse:'Browse photos',randomPreview:'Preview random photo',sourceJob:'Schedule random photos',noSources:'No photos yet. Add a source or check the folder.',sourceKind:'Source type',sourceLocation:'Folder / WebDAV URL',sourceLocationHint:'Synology Photos: folder path within the selected space; . means the whole space. Downloads XL previews on demand, not originals. Other drives use their folder URL or ID.',sourceCredential:'WebDAV credential environment name',sourceCredentialHint:'Enter a variable name, never a password. Admin configures JSON username/password via environment or Secret.',sourceRecursive:'Include subfolders',sourceImages:'Available photos',sourceBrowseHint:'Catalog loaded on demand. Click a filename to preview; originals are not downloaded in bulk.',previousPage:'Previous page',nextPage:'Next page',sourcePreviewHint:'Display uses this exact previewed photo.',randomPhoto:'Random photo',sourceJobHint:'Choose a fresh random photo each run. Paused by default; enabling changes the frame on schedule.'});
Object.assign(MESSAGES.zh,{organizedPhotos:'仅日期开头文件夹中的照片',folderCaption:'照片下方显示文件夹文字',folderCaptionHint:'第一行：去掉日期和地点后的主题；第二行：日期；第三行：@ 后的地点（没有地点则省略）。子目录沿用上级日期文件夹。'});
Object.assign(MESSAGES.en,{organizedPhotos:'Only photos in date-prefixed folders',folderCaption:'Show folder caption below the photo',folderCaptionHint:'Line 1: title without date/place. Line 2: date. Line 3: place after @, omitted when absent. Subfolders inherit their nearest dated folder.'});
-Object.assign(MESSAGES.zh,{synologyPreviews:'超大图片使用 Synology Photos 的现有预览图'});Object.assign(MESSAGES.en,{synologyPreviews:'Use existing Synology Photos previews for oversized images'});
+Object.assign(MESSAGES.zh,{});Object.assign(MESSAGES.en,{});
-Object.assign(MESSAGES.zh,{peopleFilter:'按 Synology Photos 人物筛选',peopleHint:'只从当前目录中选择符合人物条件的照片。所选空间的人物相册需要当前 Photos 账号有权访问。',choosePeople:'连接 / 选择人物',personMatch:'人物匹配方式',personAny:'包含任意所选人物',personAll:'同时包含所有所选人物',photosConfigure:'管理员需配置 SYNOLOGY_PHOTOS_URL 和 SYNOLOGY_PHOTOS_CERT_SHA256，并将共享 photo 目录挂载为照片根目录。',photosSessionHint:'仅保存受保护的登录会话，不保存 NAS 密码。会话失效后需要重新连接。',photosConnect:'连接 Synology Photos',photosDisconnect:'断开连接',peopleSearch:'搜索人物名称或 ID',peopleUnnamed:'显示未命名人物分组',peopleSelected:'已选择：'});
-Object.assign(MESSAGES.en,{peopleFilter:'Filter by Synology Photos people',peopleHint:'Choose matching people photos only within this folder. The Photos account needs access to People albums in the selected space.',choosePeople:'Connect / choose people',personMatch:'Person matching',personAny:'Any selected person',personAll:'All selected people together',photosConfigure:'Admin must configure SYNOLOGY_PHOTOS_URL and SYNOLOGY_PHOTOS_CERT_SHA256, and mount the shared photo folder as the photo root.',photosSessionHint:'Only a protected login session is stored, never your NAS password. Reconnect when the session expires.',photosConnect:'Connect Synology Photos',photosDisconnect:'Disconnect',peopleSearch:'Search person name or ID',peopleUnnamed:'Show unnamed person groups',peopleSelected:'Selected: '});
+Object.assign(MESSAGES.zh,{peopleFilter:'按 Synology Photos 人物筛选',peopleHint:'只从当前目录中选择符合人物条件的照片。所选空间的人物相册需要当前 Photos 账号有权访问。',choosePeople:'连接 / 选择人物',personMatch:'人物匹配方式',personAny:'包含任意所选人物',personAll:'同时包含所有所选人物',photosConfigure:'管理员需配置 SYNOLOGY_PHOTOS_URL 和 SYNOLOGY_PHOTOS_CERT_SHA256。照片和人物均通过 API 读取。',photosSessionHint:'仅保存受保护的登录会话，不保存 NAS 密码。会话失效后需要重新连接。',photosConnect:'连接 Synology Photos',photosDisconnect:'断开连接',peopleSearch:'搜索人物名称或 ID',peopleUnnamed:'显示未命名人物分组',peopleSelected:'已选择：'});
+Object.assign(MESSAGES.en,{peopleFilter:'Filter by Synology Photos people',peopleHint:'Choose matching people photos only within this folder. The Photos account needs access to People albums in the selected space.',choosePeople:'Connect / choose people',personMatch:'Person matching',personAny:'Any selected person',personAll:'All selected people together',photosConfigure:'Configure SYNOLOGY_PHOTOS_URL and SYNOLOGY_PHOTOS_CERT_SHA256. Photos and people are read through the API.',photosSessionHint:'Only a protected login session is stored, never your NAS password. Reconnect when the session expires.',photosConnect:'Connect Synology Photos',photosDisconnect:'Disconnect',peopleSearch:'Search person name or ID',peopleUnnamed:'Show unnamed person groups',peopleSelected:'Selected: '});
Object.assign(MESSAGES.zh,{'photo-sources':'照片数据源'});
Object.assign(MESSAGES.en,{'photo-sources':'Photo sources'});
@@ -117,22 +117,22 @@ Object.assign(window.MESSAGES.en,{
Object.assign(window.MESSAGES.zh,{studio:'拼版与海报',connections:'连接中心'});
Object.assign(window.MESSAGES.en,{studio:'Layout Studio',connections:'Connections'});
-Object.assign(MESSAGES.zh,{photosConnectionHelp:'NAS 照片登录与文件夹设置分开管理。人物筛选和 Photos 预览需要保持连接。',photosConnected:'已连接',photosDisconnected:'未连接',photosReconnect:'重新登录',photosReconnectHelp:'尚未登录或会话已失效。依赖 Synology Photos 的自动化会失败，请先登录 NAS 账号。无需填写配置变量。',photosConnectedHelp:'连接已保存。相关自动化将在下次计划时间使用照片，不会立即切换画框。',photosSetupHelp:'服务尚未配置 Photos 地址和证书。请管理员完成部署设置后再登录；这里不需要填写网盘变量。',photosLoginHelp:'使用登录群晖 NAS / Synology Photos 的账号密码，不是 Frame Flow 账号，也不是 KoKonna Key。',nasUsername:'NAS 用户名',nasPassword:'NAS 密码'});
-Object.assign(MESSAGES.en,{photosConnectionHelp:'Manage NAS sign-in separately from photo folders. People filtering and Photos previews require a connection.',photosConnected:'Connected',photosDisconnected:'Not connected',photosReconnect:'Sign in again',photosReconnectHelp:'Not signed in or the session expired. Automation using Synology Photos will fail until you sign in. No configuration variable is required here.',photosConnectedHelp:'Connection saved. Automation will use photos at its next scheduled time; the frame is not changed now.',photosSetupHelp:'The Photos address and certificate are not configured. Ask the administrator to finish deployment setup. Drive variables are not needed here.',photosLoginHelp:'Use your Synology NAS / Photos account, not your Frame Flow account or KoKonna key.',nasUsername:'NAS username',nasPassword:'NAS password'});
-Object.assign(MESSAGES.zh,{sourceHint:'管理 NAS 照片目录、WebDAV 和网盘来源。浏览与生成预览不会改变画框。'});
-Object.assign(MESSAGES.en,{sourceHint:'Manage NAS folders, WebDAV and cloud drives. Browsing and generating previews do not change the frame.'});
+Object.assign(MESSAGES.zh,{photosConnectionHelp:'此账号通过 Synology Photos API 授权读取照片和人物。连接成功后，请添加照片来源并设置空间和人物；更换账号会影响所有 Photos 来源。',photosConnected:'已连接',photosDisconnected:'未连接',photosReconnect:'重新登录',photosReconnectHelp:'尚未登录或会话已失效。依赖 Synology Photos 的自动化会失败，请先登录 NAS 账号。无需填写配置变量。',photosConnectedHelp:'连接已保存。相关自动化将在下次计划时间使用照片，不会立即切换画框。',photosSetupHelp:'服务尚未配置 Photos 地址和证书。请管理员完成部署设置后再登录；这里不需要填写网盘变量。',photosLoginHelp:'使用登录群晖 NAS / Synology Photos 的账号密码，不是 Frame Flow 账号，也不是 KoKonna Key。',nasUsername:'NAS 用户名',nasPassword:'NAS 密码'});
+Object.assign(MESSAGES.en,{photosConnectionHelp:'This account authorizes photo and people access through the Synology Photos API. After connecting, add a photo source and choose its space and people. Changing accounts affects all Photos sources.',photosConnected:'Connected',photosDisconnected:'Not connected',photosReconnect:'Sign in again',photosReconnectHelp:'Not signed in or the session expired. Automation using Synology Photos will fail until you sign in. No configuration variable is required here.',photosConnectedHelp:'Connection saved. Automation will use photos at its next scheduled time; the frame is not changed now.',photosSetupHelp:'The Photos address and certificate are not configured. Ask the administrator to finish deployment setup. Drive variables are not needed here.',photosLoginHelp:'Use your Synology NAS / Photos account, not your Frame Flow account or KoKonna key.',nasUsername:'NAS username',nasPassword:'NAS password'});
+Object.assign(MESSAGES.zh,{sourceHint:'通过 Synology Photos API 管理照片来源、人物和筛选规则。浏览与预览不会改变画框。'});
+Object.assign(MESSAGES.en,{sourceHint:'Manage photo sources, people and filters through the Synology Photos API. Browsing and previewing do not change the frame.'});
Object.assign(MESSAGES.zh,{choosePeople:'选择人物'});
Object.assign(MESSAGES.en,{choosePeople:'Choose people'});
-Object.assign(MESSAGES.zh,{photosSharedConnection:'共享连接',photosConnectionHelp:'当前仅支持一台 NAS、一个 Photos 登录账号。下方文件夹分别保存设置；此登录不是任何一张数据源卡片的专属连接。人物筛选使用此共享连接，普通目录读取和本地缩略图不依赖此账号。',photosLoginHelp:'使用群晖 NAS / Photos 账号，不是 Frame Flow 账号或 KoKonna Key。更换账号会影响所有启用人物筛选的数据源；个人空间的人物可能不同，更换后请逐个重新核对人物选择。',sourceIndependentHelp:'这里只保存当前数据源的目录、人物与筛选规则，不会修改其他数据源，也不会更换顶部共享 NAS 账号。任务通过数据源 ID 引用这些设置。',sourceIdLabel:'数据源 ID',sourceSharedPhotos:'关联：顶部 Synology Photos 共享连接（人物筛选）',sourceLocalOnly:'关联：NAS 挂载目录；读取文件无需顶部 Photos 登录',sourceOwnCredentials:'关联：此数据源自己的网盘/WebDAV 凭据；不使用顶部 NAS 登录'});
-Object.assign(MESSAGES.en,{photosSharedConnection:'Shared connection',photosConnectionHelp:'Currently one NAS and one Photos account are supported. Each folder stores its own settings; this sign-in is not owned by any source card. People filtering uses this shared session. Ordinary folder reads and local thumbnails do not use this account.',photosLoginHelp:'Use a Synology NAS / Photos account, not a Frame Flow account or KoKonna key. Changing accounts affects all people-filtered sources. Personal-space people may differ; recheck each source after switching accounts.',sourceIndependentHelp:'These folder, people and filter settings apply only to this source. Other sources and the shared NAS account are unchanged. Jobs refer to these settings by source ID.',sourceIdLabel:'Source ID',sourceSharedPhotos:'Connection: shared Synology Photos session above (people filtering)',sourceLocalOnly:'Connection: mounted NAS folder; file reads do not require Photos sign-in',sourceOwnCredentials:'Connection: this source’s drive/WebDAV credentials; independent of NAS sign-in'});
+Object.assign(MESSAGES.zh,{photosSharedConnection:'共享连接',photosConnectionHelp:'此账号通过 Synology Photos API 授权读取照片和人物。连接成功后，请添加照片来源并设置空间和人物；更换账号会影响所有 Photos 来源。',photosLoginHelp:'使用群晖 NAS / Photos 账号，不是 Frame Flow 账号或 KoKonna Key。更换账号会影响所有启用人物筛选的数据源；个人空间的人物可能不同，更换后请逐个重新核对人物选择。',sourceIndependentHelp:'这里只保存当前数据源的目录、人物与筛选规则，不会修改其他数据源，也不会更换顶部共享 NAS 账号。任务通过数据源 ID 引用这些设置。',sourceIdLabel:'数据源 ID',sourceSharedPhotos:'关联：Synology Photos API 共享账号',sourceOwnCredentials:'关联：此数据源自己的网盘/WebDAV 凭据；不使用顶部 NAS 登录'});
+Object.assign(MESSAGES.en,{photosSharedConnection:'Shared connection',photosConnectionHelp:'This account authorizes photo and people access through the Synology Photos API. After connecting, add a photo source and choose its space and people. Changing accounts affects all Photos sources.',photosLoginHelp:'Use a Synology NAS / Photos account, not a Frame Flow account or KoKonna key. Changing accounts affects all people-filtered sources. Personal-space people may differ; recheck each source after switching accounts.',sourceIndependentHelp:'These folder, people and filter settings apply only to this source. Other sources and the shared NAS account are unchanged. Jobs refer to these settings by source ID.',sourceIdLabel:'Source ID',sourceSharedPhotos:'Connection: shared Synology Photos API account',sourceOwnCredentials:'Connection: this source’s drive/WebDAV credentials; independent of NAS sign-in'});
Object.assign(MESSAGES.zh,{photosDisconnect:'断开共享连接',photosSharedDisconnectWarning:'这将断开所有人物筛选数据源共用的 Photos 登录，相关任务会无法读取人物照片。文件夹设置和网盘连接不变。确定断开吗？'});
Object.assign(MESSAGES.en,{photosDisconnect:'Disconnect shared session',photosSharedDisconnectWarning:'This disconnects the Photos session used by all people-filtered sources. Their tasks will fail to read people photos. Folder settings and drive connections remain unchanged. Disconnect?'});
-Object.assign(MESSAGES.zh,{weather:'天气',connected:'已连接',disconnected:'未连接',sortOrder:'排序方式',playbackMode:'播放顺序',apiKeyConfigured:'API 密钥已配置',templateSourceUnavailable:'这张图片没有可编辑的模板来源。可编辑模板仅适用于保留了模板配置的生成图片。',localDeleteConfirm:'确认删除本地图库中的这张图片？不会删除 NAS 原始照片或云端副本，也不会切换画框。此操作不可撤销。',cloudDeleteConfirm:'确认删除这张图片的云端副本？不会删除 NAS 原始照片或本地图库副本。此操作不可撤销。',gallerySelectionHelp:'全选和反选只作用于当前页可见图片；批量操作处理当前页全部已勾选图片，包括搜索后隐藏的勾选项。',starHelp:'星标保存在服务端，用于防止自动清理本地图及其最近一次成功上传的云端副本。星标本身不会上传或切换画框；手动删除仍有效。',sourceLocationHint:'NAS 目录：填写挂载照片根目录下的相对路径，如 . 或 family。WebDAV：填写 HTTPS 目录地址，并在设置中允许其域名。Google Drive / 阿里云盘：目录 ID；百度网盘：目录路径。',sourceCredential:'WebDAV / 网盘凭据环境变量名',sourceCredentialHint:'填写变量名，不要填写密码。管理员可通过环境变量配置凭据；原生网盘也可使用下方 OAuth 凭据。'});
-Object.assign(MESSAGES.en,{weather:'Weather',connected:'Connected',disconnected:'Not connected',sortOrder:'Sort order',playbackMode:'Playback order',apiKeyConfigured:'API key configured',templateSourceUnavailable:'No editable template source is available for this image. Template editing requires a generated image with saved template settings.',localDeleteConfirm:'Delete this local gallery image? NAS originals and cloud copies remain intact, and the frame display is unchanged. This cannot be undone.',cloudDeleteConfirm:'Delete this cloud image? NAS originals and local gallery copies remain intact. This cannot be undone.',gallerySelectionHelp:'Select all and invert affect visible images on this page. Batch actions include every checked image on this page, including items hidden by search.',starHelp:'Stars are saved on the server and protect the local image and its latest successfully uploaded cloud copy from automatic cleanup. Starring does not upload or change the frame; manual deletion still applies.',sourceLocationHint:'NAS: a relative folder under the mounted photo root, such as . or family. WebDAV: an HTTPS folder URL whose hostname is allowed in Settings. Google Drive / AliPan: folder ID. Baidu: folder path.',sourceCredential:'WebDAV / drive credential environment variable',sourceCredentialHint:'Enter a variable name, never a password. An administrator can configure credentials through environment variables; native drives can also use the OAuth credentials below.'});
+Object.assign(MESSAGES.zh,{weather:'天气',connected:'已连接',disconnected:'未连接',sortOrder:'排序方式',playbackMode:'播放顺序',apiKeyConfigured:'API 密钥已配置',templateSourceUnavailable:'这张图片没有可编辑的模板来源。可编辑模板仅适用于保留了模板配置的生成图片。',localDeleteConfirm:'确认删除本地图库中的这张图片？不会删除 NAS 原始照片或云端副本，也不会切换画框。此操作不可撤销。',cloudDeleteConfirm:'确认删除这张图片的云端副本？不会删除 NAS 原始照片或本地图库副本。此操作不可撤销。',gallerySelectionHelp:'全选和反选只作用于当前页可见图片；批量操作处理当前页全部已勾选图片，包括搜索后隐藏的勾选项。',starHelp:'星标保存在服务端，用于防止自动清理本地图及其最近一次成功上传的云端副本。星标本身不会上传或切换画框；手动删除仍有效。',sourceLocationHint:'Synology Photos：所选空间内的目录路径，. 表示整个空间。按需获取 XL 预览图，不下载原图。其他云盘使用对应目录地址或 ID。',sourceCredential:'WebDAV / 网盘凭据环境变量名',sourceCredentialHint:'填写变量名，不要填写密码。管理员可通过环境变量配置凭据；原生网盘也可使用下方 OAuth 凭据。'});
+Object.assign(MESSAGES.en,{weather:'Weather',connected:'Connected',disconnected:'Not connected',sortOrder:'Sort order',playbackMode:'Playback order',apiKeyConfigured:'API key configured',templateSourceUnavailable:'No editable template source is available for this image. Template editing requires a generated image with saved template settings.',localDeleteConfirm:'Delete this local gallery image? NAS originals and cloud copies remain intact, and the frame display is unchanged. This cannot be undone.',cloudDeleteConfirm:'Delete this cloud image? NAS originals and local gallery copies remain intact. This cannot be undone.',gallerySelectionHelp:'Select all and invert affect visible images on this page. Batch actions include every checked image on this page, including items hidden by search.',starHelp:'Stars are saved on the server and protect the local image and its latest successfully uploaded cloud copy from automatic cleanup. Starring does not upload or change the frame; manual deletion still applies.',sourceLocationHint:'Synology Photos: folder path within the selected space; . means the whole space. Downloads XL previews on demand, not originals. Other drives use their folder URL or ID.',sourceCredential:'WebDAV / drive credential environment variable',sourceCredentialHint:'Enter a variable name, never a password. An administrator can configure credentials through environment variables; native drives can also use the OAuth credentials below.'});
Object.assign(MESSAGES.zh,{currentImageId:'当前图片 ID',modelSource:'型号信息来源',modelVerified:'设备 API 返回',modelConfigured:'设备配置文件',switchInterval:'切换间隔',sync:'云端同步状态',synced:'云端已确认',syncing:'等待云端确认'});
Object.assign(MESSAGES.en,{currentImageId:'Current image ID',modelSource:'Model information source',modelVerified:'Device API',modelConfigured:'Device configuration',switchInterval:'Switch interval',sync:'Cloud sync status',synced:'Cloud confirmed',syncing:'Awaiting cloud confirmation'});
@@ -140,7 +140,9 @@ Object.assign(MESSAGES.en,{currentImageId:'Current image ID',modelSource:'Model
Object.assign(MESSAGES.zh,{noSources:'尚未配置照片数据源，请先添加。',noSourcePhotos:'当前目录或筛选条件下没有可用照片。',sourceLocation:'目录路径 / 地址 / ID',temporaryOptionsHint:'勾选到期恢复时，显示时长和优先级用于临时显示；未勾选时持续显示，直到其他操作切换图片。'});
Object.assign(MESSAGES.en,{noSources:'No photo sources configured. Add a source first.',noSourcePhotos:'No photos match this folder and its filters.',sourceLocation:'Folder path / URL / ID',temporaryOptionsHint:'With restore enabled, duration and priority apply to the temporary display. Otherwise, the image stays until another action changes it.'});
-Object.assign(MESSAGES.zh,{synologyAPISource:'Synology Photos API（无需挂载）',sourcePhotosAPI:'关联：共享 Photos 登录；按需下载 XL 预览图，无需 /photos 挂载',sourceLocationHint:'本地目录：挂载根目录下的相对路径。Photos API：所选空间的目录路径，. 表示整个空间；按需取 XL 预览图，不下载原图。WebDAV：HTTPS 目录地址。Google Drive / 阿里云盘：目录 ID；百度网盘：目录路径。',photosConnectionHelp:'当前共享一个 NAS Photos 登录。Photos API 来源通过此会话获取照片和人物，不需要挂载；本地目录来源仍从 /photos 读取。更换账号影响所有 Photos API 来源和人物筛选。',sourceRecursive:'包含子目录（本地 / Photos API）'});
-Object.assign(MESSAGES.en,{synologyAPISource:'Synology Photos API (no mount)',sourcePhotosAPI:'Connection: shared Photos session; downloads XL previews on demand, without /photos',sourceLocationHint:'Local: relative folder under the mounted root. Photos API: folder path in the selected space; . means the whole space. Downloads XL previews, not originals. WebDAV: HTTPS folder URL. Google Drive / AliPan: folder ID. Baidu: folder path.',photosConnectionHelp:'One NAS Photos session is shared. Photos API sources use it for photos and people without a mount; local-folder sources still read /photos. Changing accounts affects all Photos API sources and people filtering.',sourceRecursive:'Include subfolders (local / Photos API)'});
-Object.assign(MESSAGES.zh,{photosReconnectHelp:'尚未连接或会话已失效。Photos API 来源及依赖人物筛选的任务需要重新登录后才能读取照片。',photosSharedDisconnectWarning:'这将断开所有 Photos API 来源和人物筛选共用的登录，相关任务将无法读取照片。目录配置和独立网盘连接不会删除。确定断开吗？',photosConfigure:'管理员需配置 SYNOLOGY_PHOTOS_URL 和 SYNOLOGY_PHOTOS_CERT_SHA256。Photos API 来源无需 /photos 挂载；本地目录来源仍需挂载。'});
-Object.assign(MESSAGES.en,{photosReconnectHelp:'Not connected or session expired. Photos API sources and people-filtered tasks need a new sign-in before reading photos.',photosSharedDisconnectWarning:'Disconnect the shared session used by all Photos API sources and people filters? Their tasks cannot read photos until reconnected. Folder settings and separate drive connections are retained.',photosConfigure:'Configure SYNOLOGY_PHOTOS_URL and SYNOLOGY_PHOTOS_CERT_SHA256. Photos API sources need no /photos mount; local-folder sources still require it.'});
+Object.assign(MESSAGES.zh,{synologyAPISource:'Synology Photos API',sourcePhotosAPI:'通过共享 Photos 账号读取 XL 预览图与人物，遵循账号访问权限。',sourceLocationHint:'Synology Photos：所选空间内的目录路径，. 表示整个空间。按需获取 XL 预览图，不下载原图。其他云盘使用对应目录地址或 ID。',photosConnectionHelp:'此账号通过 Synology Photos API 授权读取照片和人物。连接成功后，请添加照片来源并设置空间和人物；更换账号会影响所有 Photos 来源。',sourceRecursive:'包含子目录'});
+Object.assign(MESSAGES.en,{synologyAPISource:'Synology Photos API',sourcePhotosAPI:'Reads XL previews and people through the shared Photos account, respecting its access permissions.',sourceLocationHint:'Synology Photos: folder path within the selected space; . means the whole space. Downloads XL previews on demand, not originals. Other drives use their folder URL or ID.',photosConnectionHelp:'This account authorizes photo and people access through the Synology Photos API. After connecting, add a photo source and choose its space and people. Changing accounts affects all Photos sources.',sourceRecursive:'Include subfolders'});
+Object.assign(MESSAGES.zh,{photosReconnectHelp:'尚未连接或会话已失效。Photos API 来源及依赖人物筛选的任务需要重新登录后才能读取照片。',photosSharedDisconnectWarning:'这将断开所有 Photos API 来源和人物筛选共用的登录，相关任务将无法读取照片。目录配置和独立网盘连接不会删除。确定断开吗？',photosConfigure:'管理员需配置 SYNOLOGY_PHOTOS_URL 和 SYNOLOGY_PHOTOS_CERT_SHA256。照片和人物均通过 API 读取。'});
+Object.assign(MESSAGES.en,{photosReconnectHelp:'Not connected or session expired. Photos API sources and people-filtered tasks need a new sign-in before reading photos.',photosSharedDisconnectWarning:'Disconnect the shared session used by all Photos API sources and people filters? Their tasks cannot read photos until reconnected. Folder settings and separate drive connections are retained.',photosConfigure:'Configure SYNOLOGY_PHOTOS_URL and SYNOLOGY_PHOTOS_CERT_SHA256. Photos and people are read through the API.'});
+
+Object.assign(window.MESSAGES.zh,{signIn:'登录',livingRoom:'客厅'});Object.assign(window.MESSAGES.en,{signIn:'Sign in',livingRoom:'Living room'});
diff --git a/pigway_frame_flow/web/index.html b/pigway_frame_flow/web/index.html
index 9d6ed9b..b23b8d2 100644
--- a/pigway_frame_flow/web/index.html
+++ b/pigway_frame_flow/web/index.html
@@ -1,3 +1,3 @@
Pigway Frame Flow
-