fix: avoid rotating Synology display dimensions twice

This reverts commit db0b408680.

.env.example

@@ -17,15 +17,10 @@ IMAGE_URL_ALLOWED_HOSTS=
 BUILD_COMMIT=development
 BUILD_TIME=unknown
 
-# Optional read-only NAS photo mount; use deploy/docker-compose.photos.yml.
+# Filesystem/NFS photo sources are retired. Use Synology Photos API or WebDAV.
-# NAS_PHOTOS_DIR=/volume2/photo
-# PHOTO_ROOT=/photos
 # Optional WebDAV credential reference; prefer a secret file under /config.
 # FRAME_FLOW_SOURCE_CLOUD_FILE=/config/webdav-cloud.secret
 
-# Optional existing group with photo read permission; does not change NAS ACLs.
-# NAS_PHOTOS_GID=101
-
 # Optional Synology Photos shared-space people filter. Configure a pinned NAS endpoint.
 # Login in the photo-source editor; only the session is saved in /config (mode 0600).
 SYNOLOGY_PHOTOS_URL=

.github/workflows/community.yml

@@ -0,0 +1,26 @@
+name: Community checks
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  verify:
+    # GitHub-hosted disposable runner only; never run forks on the NAS runner.
+    if: github.server_url == 'https://github.com'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: '3.14'
+      - run: python -m pip install -e '.[test]'
+      - run: python -m ruff check pigway_frame_flow tests scripts
+      - run: python -m ruff format --check pigway_frame_flow tests scripts
+      - run: python -m mypy pigway_frame_flow
+      - run: python -m pytest -q
+      - run: python scripts/ci-audit.py

.github/workflows/verify.yml

@@ -8,7 +8,7 @@ on:
 jobs:
   verify:
     # The NAS Docker runner must never execute code from external forks.
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    if: github.server_url != 'https://github.com' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ubuntu-latest
     env:
       DOCKER_PIP_INDEX_URL: ${{ vars.DOCKER_PIP_INDEX_URL }}

.gitignore

@@ -24,3 +24,6 @@ build-cache/wheels/*
 # Private browser captures and platform metadata
 docs/screenshots/
 .DS_Store
+
+# Private deployment receipts belong outside public source control.
+docs/verification/

CONTRIBUTING.md

@@ -0,0 +1,19 @@
+# Contributing
+
+Use Python 3.14.x and follow the development commands in README.md. Run Ruff
+lint/format checks, mypy and pytest before submitting a pull request. Keep changes
+focused and include a regression test for behavior fixes where practical.
+
+Use mock mode with device writes disabled. Do not commit `.env`, credentials,
+private configuration, databases, photos, or production receipts. Tests must not
+contact real frames or mutate production services.
+
+GitHub mirrors run community checks on disposable GitHub-hosted runners, including
+fork PRs. Gitea uses the existing trusted NAS runner and rejects fork PRs; maintainers
+review contributions before moving them to a trusted branch. Docker build/smoke
+verification remains in Gitea CI. Production releases are maintainer-controlled;
+contributors do not need access to production infrastructure.
+
+For security issues, follow SECURITY.md instead of posting exploit details publicly.
+Contributions are provided under the project's MIT license; preserve third-party
+licenses and provenance when introducing external code or assets.

Dockerfile

@@ -37,6 +37,7 @@ RUN --mount=type=cache,id=frameflow-pip-py314-${TARGETARCH},target=/root/.cache/
     else python /build-tools/install.py --locked; fi
 COPY pigway_frame_flow ./pigway_frame_flow
 COPY vendor ./vendor
+COPY LICENSE NOTICE.md ./
 # Publish only the cleaned filesystem, without retaining build-stage layers.
 RUN rm -rf /usr/local/lib/python*/site-packages/pip \
       /usr/local/lib/python*/site-packages/pip-*.dist-info \

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Pigway
+Copyright (c) 2026 PIGWay
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

NOTICE.md

@@ -1,6 +1,6 @@
 # Notices
 
-Pigway Frame Flow is an independent project. KoKonna is a supported device
+PIGWay Frame Flow is an independent project. KoKonna is a supported device
 integration and is not affiliated with this project unless otherwise stated.
 KoKonna names and marks belong to their respective owners.
 

README.md

@@ -1,8 +1,10 @@
-# Pigway Frame Flow
+# PIGWay Frame Flow
+
+Development currently supports Python 3.14.x. See [contributing](CONTRIBUTING.md) and [security reporting](SECURITY.md).
 
 [简体中文](README.zh-CN.md) | English
 
-Pigway Frame Flow is a lightweight, self-hosted platform for programmable smart-frame automation. It runs independently on a NAS or server, with its own Web UI, image library, rendering, scheduler and REST API. KoKonna is a supported device integration; external applications do not need its credentials or SDK.
+PIGWay Frame Flow is a lightweight, self-hosted platform for programmable smart-frame automation. It runs independently on a NAS or server, with its own Web UI, image library, rendering, scheduler and REST API. KoKonna is a supported device integration; external applications do not need its credentials or SDK.
 
 ### Installation
 
@@ -47,7 +49,7 @@ Synology Photos API sources work without `/photos` or NFS mounts, with shared/cu
 - Seven templates: Daily Dashboard, Weather, Calendar, Quote, Photo + Text, Daily Poetry and System Alert.
 - Layout Studio for collages/posters with 1–12 images; optional OpenAI-compatible layout planning and source-driven automatic collages.
 - Device-bound schedules, ordered/random playlists, temporary priority overrides, restore and persistent operation history.
-- Read-only NAS folders, Synology Photos person filtering, WebDAV and optional cloud-drive connectors. Each source has its own folder and filter settings. People filtering uses one shared Synology Photos sign-in; WebDAV and cloud-drive credentials belong to their respective sources.
+- Synology Photos person filtering, WebDAV and optional cloud-drive connectors. Each source has its own folder and filter settings. People filtering uses one shared Synology Photos sign-in; WebDAV and cloud-drive credentials belong to their respective sources.
 - Optional weather, calendar, monitoring, AI, MQTT and webhook integrations. Provider configuration is required; an unconnected provider is not a working connection.
 
 Templates **render images**, including text-only templates. Choose a template, edit its data, generate a preview, then display it. Preview generation and saving template settings do not update the frame. Photo + Text and Daily Dashboard can include a selected local photo; other templates do not automatically choose one. Scheduled template jobs render afresh on each run. See [photo sources](docs/PHOTO_SOURCES.md), [automatic collages](docs/AUTOMATIC_COLLAGE.md) and [integration setup/limits](docs/EXTENSIONS.md).

README.zh-CN.md

@@ -1,4 +1,6 @@
-# Pigway Frame Flow
+# PIGWay Frame Flow
+
+开发环境目前支持 Python 3.14.x。参见[贡献指南](CONTRIBUTING.md)和[安全问题报告](SECURITY.md)。
 
 简体中文 | [English](README.md)
 
@@ -47,7 +49,7 @@ Synology Photos 可使用独立的 API 来源，无需 `/photos` 或 NFS 挂载
 - 七种模板：家庭早报、天气、日历、一句话、照片与文字、每日诗词、系统告警。
 - 拼图工作室支持 1–12 张图片的拼图与海报；可选 OpenAI 兼容接口排版，以及从数据源自动选图拼接。
 - 绑定设备的定时任务、顺序/随机播放列表、带优先级的临时覆盖、恢复与持久化操作历史。
-- 只读 NAS 文件夹、Synology Photos 人物筛选、WebDAV 和可选网盘连接器；每个数据源独立配置、独立授权。
+- Synology Photos 人物筛选、WebDAV 和可选网盘连接器；每个数据源独立配置、独立授权。
 - 可选天气、日历、监控、AI、MQTT 与 Webhook 集成。需要配置对应 Provider；尚未授权的数据源不会被当作已连接。
 
 模板会**生成图片**，纯文字模板也是如此。使用顺序是：选择模板 → 编辑内容 → 生成预览 → 显示到画框。生成预览和保存模板设置都不会更新画框。“照片与文字”和“家庭早报”可以包含指定的本地照片，其他模板不会自动选图；定时模板任务每次运行会重新渲染。参见[照片数据源](docs/PHOTO_SOURCES.md)、[自动拼图](docs/AUTOMATIC_COLLAGE.md)和[集成配置及限制](docs/EXTENSIONS.md)。
@@ -69,6 +71,8 @@ Web UI / Scheduler / REST API → DisplayService → FrameDeviceDriver → KoKon
 
 Ticktar 集成为可选项，Frame Flow 不依赖 Ticktar 启动，也不访问其数据库。参见[外部集成契约](docs/integrations/TICKTAR.md)。
 
+Console 监控接入提供独立只读 ZIP 插件，支持服务就绪、画框在线/电量及任务最近结果，见 [Console 插件安装说明](https://tea.pigway.com/way/pigway-console-adapter-frame-flow/src/branch/main/README.zh-CN.md)。
+
 ### 存储与安全
 
 Docker 持久化 `/data/frameflow.db`、`/data` 下的图片/生成文件/缓存，以及 `/config` 下的私有配置和会话文件。容器以 UID/GID 10333 运行，根文件系统只读，使用独立桥接网络、`unless-stopped` 重启策略和有大小限制的标准输出日志；不需要 privileged、host network 或 Docker socket。

SECURITY.md

@@ -0,0 +1,15 @@
+# Security policy
+
+Security fixes target the latest release. Older releases have no guaranteed
+backport support. Upgrade before verifying whether an issue is still present.
+
+Do not publish credentials, private photos, production logs, or working exploit
+payloads in public issues. Contact the repository owner privately through the
+hosting platform when available. If no private contact channel is available,
+open an issue asking for a confidential reporting channel without technical
+vulnerability details. There is currently no dedicated security mailbox or
+promised response SLA.
+
+A useful private report includes the affected version, deployment mode, required
+permissions, impact, and minimal steps using mock data. Do not test on another
+person's deployment or write to real frames without explicit authorization.

deploy/Dockerfile.runtime-update

@@ -8,6 +8,7 @@ COPY requirements.lock /app/requirements.expected.lock
 RUN python -c "from pathlib import Path; assert Path('/app/requirements.lock').read_bytes() == Path('/app/requirements.expected.lock').read_bytes(), 'Dependency lock changed; use the full Dockerfile'"
 COPY pigway_frame_flow /app/pigway_frame_flow
 COPY vendor /app/vendor
+COPY LICENSE NOTICE.md /app/
 # Publish only the cleaned filesystem, without retaining build-stage layers.
 RUN rm -rf /usr/local/lib/python*/site-packages/pip \
       /usr/local/lib/python*/site-packages/pip-*.dist-info \
@@ -29,4 +30,4 @@ CMD ["python", "-m", "uvicorn", "pigway_frame_flow.main:app", "--host", "0.0.0.0
 ARG BUILD_COMMIT
 ARG BUILD_TIME
 ENV BUILD_COMMIT=$BUILD_COMMIT BUILD_TIME=$BUILD_TIME
-LABEL org.opencontainers.image.title="Pigway Frame Flow" org.opencontainers.image.version="0.1.15" org.opencontainers.image.revision=$BUILD_COMMIT
+LABEL org.opencontainers.image.title="PIGWay Frame Flow" org.opencontainers.image.version="0.1.19" org.opencontainers.image.revision=$BUILD_COMMIT

deploy/compose.ubuntu-photos-api.yml

@@ -9,8 +9,8 @@ services:
     init: true
     user: "10333:10333"
     ports:
-      - "${FRAME_FLOW_BIND:-192.0.2.10}:81:18787"
+      - "${FRAME_FLOW_BIND:-127.0.0.1}:81:18787"
-    env_file: ${FRAME_FLOW_ENV_FILE:-/srv/pigway/apps/pigway-frame-flow/.env}
+    env_file: ${FRAME_FLOW_ENV_FILE:?Set the private environment file path}
     environment:
       TZ: Asia/Shanghai
       DATA_DIR: /data
@@ -23,12 +23,12 @@ services:
       TMPDIR: /data/tmp
     volumes:
       - type: bind
-        source: /srv/pigway/apps/pigway-frame-flow/data
+        source: ${FRAME_FLOW_APP_DIR:?Set the existing application directory}/data
         target: /data
         bind:
           create_host_path: false
       - type: bind
-        source: /srv/pigway/apps/pigway-frame-flow/config
+        source: ${FRAME_FLOW_APP_DIR:?Set the existing application directory}/config
         target: /config
         bind:
           create_host_path: false

docs/PUBLICATION.md

@@ -4,7 +4,9 @@ Runtime keys, passwords, sessions, private photos, databases and local `.env` fi
 must remain outside Git. Examples use documentation-only addresses and identities.
 Personal deployment reports and screenshots are excluded from public history.
 
-The NAS Docker runner accepts trusted repository events only. External fork PRs
+The Gitea NAS Docker runner accepts trusted repository events only. GitHub mirrors
+use the separate community workflow on GitHub-hosted disposable runners, with
+read-only repository permissions and no deployment configuration. External fork PRs
 are not executed on this runner; maintainers must review them before copying changes
 to a trusted branch. All lint, type, test, audit and isolated Docker checks remain.
 
@@ -18,3 +20,17 @@ Publishing requires scanning all refs, removing private historic files, pruning
 unreachable remote Git objects and archiving/removing historical Actions logs.
 A private original mirror is retained outside the repository. Existing clones must
 reclone after the privacy history rewrite; do not merge the original history back.
+
+## Private deployment inputs
+
+Do not publish host addresses, workstation paths, disk UUIDs, photo-library counts,
+or deployment receipts. Keep receipts and recovery bundles outside the repository
+in an owner-only directory. A privacy history rewrite changes existing commit IDs;
+existing clones must be replaced instead of merging old history back.
+
+`server-release.py` reads `FRAME_FLOW_ROOT` (default `/srv/frameflow`), requires
+`FRAME_FLOW_MOUNT_UUID` and `FRAME_FLOW_ORIGIN`, and retains the mount-identity
+check before release actions. Supply verified values privately to the sudo process;
+existing installations must set their existing root explicitly. Do not use the
+generic default to migrate a deployment. The script still requires the existing
+mount guard and does not change host mounts, services, or storage automatically.

docs/REAL_DEVICE_TEST.md

@@ -9,7 +9,7 @@
    duplicates, name/date/dimensions anomalies. No download-all action.
 3. Stop on discrepancy. Missing model fields must be reported as unavailable.
 4. Once explicitly authorized, locally render **one** 1200×1600 test image containing
-   PIGWAY FRAME FLOW TEST and Shanghai timestamp, no private content.
+   PIGWay Frame Flow TEST and Shanghai timestamp, no private content.
 5. Record an operation ID and previous image; one upload only, no write retries.
 6. Poll device read-only no more often than 60 seconds, respecting the 20/min budget.
    Confirm imageId and synced. If sent but response lost, mark UNKNOWN, block writes,

docs/SYNOLOGY_PHOTOS_API.md

@@ -10,7 +10,7 @@
 - 支持目录相对路径、递归开关、日期文件夹 / 标题、方向及现有质量筛选。`.` 表示所选空间根目录；路径以 Photos 返回的目录名为准，不是 Ubuntu 绝对路径。
 - 图片使用经过实测的 `Thumbnail.get` v2、`size=xl`。原始文件名不代表下载的是原图。对 NAS 当前原图下载接口的探测被拒绝，原图下载**未宣称支持**。
 - 照片枚举 `Browse.Item.list` v7，人物 `Browse.Person.list` v3；每批 500 条，最多 100000 条，超过明确失败，界面目录上限仍由 `catalog_limit` 控制。不支持 NAS 未暴露或账号无权访问的相册。
-- 旧 `local` 来源保留挂载读取方式，不自动变成 API 来源。新建 / 编辑来源时可明确选择 API 类型。
+- 文件系统 `local` 来源已停用；旧配置需显式转换为 Photos API 来源。
 
 ## 安全与缓存
 
@@ -22,14 +22,11 @@
 
 ## Ubuntu 候选配置
 
-正式代码在 `/home/developer/Documents/Projects/pigway-frame-flow` 的 `codex/synology-photos-api` 分支开发，不能以迁移临时解包目录作为开发仓库。
+在正式 Git 仓库开发；不要把迁移临时解包目录作为开发仓库。
 
-候选文件：`deploy/compose.ubuntu-photos-api.yml`。外部 `192.0.2.10:81`，内部 `18787`，UID/GID `10333:10333`，数据和配置固定为：
+候选文件：`deploy/compose.ubuntu-photos-api.yml`。内部端口 `18787`，UID/GID `10333:10333`。通过私有环境变量设置 `FRAME_FLOW_APP_DIR`（已有应用目录）、`FRAME_FLOW_ENV_FILE`（已有私有配置文件）和可选 `FRAME_FLOW_BIND`（默认回环地址），不在仓库保存真实主机地址或部署目录。
 
-- `/srv/pigway/apps/pigway-frame-flow/data:/data`
+无 `/photos` 绑定。`create_host_path: false` 防止在 T7 未挂载时悄悄创建目录；但仍需在启动前检查 `findmnt -T "$FRAME_FLOW_APP_DIR"` 的实际源设备。
-- `/srv/pigway/apps/pigway-frame-flow/config:/config`
-
-无 `/photos` 绑定。`create_host_path: false` 防止在 T7 未挂载时悄悄创建目录；但仍需在启动前检查 `findmnt -T /srv/pigway` 的实际源设备。
 
 `.env` 需从已确认的配置安全迁移，保留 Photos URL、证书 pin 与已有 Frame Flow / 相框鉴权；不要把密钥写入仓库。模板默认 `KOKONNA_WRITE_ENABLED=false`。创建 `data/tmp`，属主保持 10333:10333，`TMPDIR=/data/tmp`。Docker data-root 和 containerd root 也必须在 T7，不能仅检查 bind mount。
 
@@ -60,6 +57,6 @@ FRAME_FLOW_IMAGE='<已验证的镜像标签>' docker compose -f deploy/compose.u
 
 ## NFS 授权判断
 
-API 来源的共享 / 个人空间取图已经可以完全不依赖 NFS，因此这条新取图链路不需要为 `192.0.2.10` 保留 DSM `photo` NFS 授权。但目前旧来源和待迁移配置没有全部切换验收，不能据此宣称迁移完成或旧本地来源已可脱离挂载。确认没有其他已批准用途后，可以单独授权删除该特定 NFS 规则；本次没有删除。
+API 来源的共享 / 个人空间取图已经可以完全不依赖 NFS，因此这条新取图链路不需要为旧客户端保留 DSM `photo` NFS 授权。但目前旧来源和待迁移配置没有全部切换验收，不能据此宣称迁移完成或旧本地来源已可脱离挂载。确认没有其他已批准用途后，可以单独授权删除该特定 NFS 规则；本次没有删除。
 
-实际版本、镜像标识、通过 / 失败 / 未执行项见本任务验证记录。
+实际部署回执和照片库统计应私下保管，不提交公共仓库。

docs/UI_LAYOUT_AUDIT.md

@@ -1,62 +0,0 @@
-# UI 一致性与图片加载检查
-
-页面使用既有真实元数据创建控件和图片区域，不使用页面骨架或虚构图片卡片。
-搜索、排序、卡片操作与写入保护在图片请求前初始化；已知图库数据可先显示，
-后台刷新元数据。首页图片独立加载，不阻塞后续页面内容。
-
-图片共用局部加载函数：旋转指示器仅居中显示于所属图片容器，网络请求与解码完成后
-立即显示图片，失败后显示中英文提示。没有固定等待或动画最短展示时长。
-图库仅请求可见区域及附近图片。浏览器禁缓存不会清除服务端缩略图缓存，
-快速图片可能在第一帧绘制前完成，动画不一定肉眼可见。
-
-手动拼版先创建全部真实区域与坐标/拖动交互，再并行请求图片。
-每张图片独立完成或失败，持久的区域容器保持加载前后几何位置与坐标索引稳定。
-过期布局事件不修改新的规划。
-
-移动端导航单行横向滚动，当前入口自动进入可见区域；低高度横屏侧栏可滚动。
-页头在窄屏分行，并为底部安全区域留白。可见控件保留 44 像素触控高度，
-当前导航使用 aria-current，扩展表单标签关联相应控件。
-表格与手机导航允许容器内滚动，不应导致整页水平溢出。
-
-## 自动检查
-
-使用隔离 Mock 服务、临时数据与测试账号，禁止对生产执行可写的 Mock 脚本。
-Photos 授权使用拦截测试响应；不需要真实 NAS 凭据。
-
-```sh
-FRAME_FLOW_URL=http://127.0.0.1:6005 \
-FRAME_FLOW_ENV_FILE=/path/to/mock.env \
-FRAME_FLOW_TEST_USERNAME=test-ui \
-FRAME_FLOW_TEST_PASSWORD=test-only-password \
-node scripts/ui-layout-audit.cjs
-```
-
-需要已安装的 Playwright；可通过 NODE_PATH 指定运行时。
-FRAME_FLOW_VIEWPORTS 接受包含 width/height 的 JSON 数组；
-FRAME_FLOW_SCREENSHOT_DIR 可选，用于保存仅含测试数据的截图。
-
-| 脚本 | 检查范围 | 本次结果 |
-| --- | --- | --- |
-| ui-layout-audit.cjs | 11 页面、本地/云端图库、6 类弹窗、展开手动拼版；溢出、控件间距、触控高度、弹窗边界 | 16 组尺寸/语言/主题组合，305 项通过 |
-| ui-image-loading.cjs | 三种宽度、明暗主题；局部居中、成功解码、错误提示与无障碍状态 | 45 项通过 |
-| ui-progressive-loading.cjs | 阻塞初始化/元数据/图片/任务筛选；首次无缓存时控件先就绪、输入保留、慢请求切换、列表失败、无骨架 | 18 项通过 |
-| ui-studio-image-loading.cjs | 桌面/手机、明暗主题；并行请求、独立完成/失败、坐标与拖动、稳定区域 | 31 项通过 |
-
-上述检查无页面脚本异常。生产静态文件与构建文件哈希比对、health/ready 检查通过；
-生产浏览器交互验证使用拦截的账号、规划及素材响应，对真实服务仅 GET，
-不代表真实账号密码登录、AI 生成、iOS/Android 实机或软键盘测试。
-
-连接中心内容较长，后续可按用户任务分组；模板与排版导航图标仍有重复。
-
-
-## 首次未缓存图库的初始化
-
-目的地标签、搜索、排序、刷新和上传控件必须先于列表接口完成。
-仅已有列表的缓存分支先渲染还不够；无缓存时也应创建真实控件与空的列表容器。
-元数据返回前不推测图片数量，不显示真实空图库提示，不生成骨架卡片。
-列表失败保留页面控件；慢云端请求期间切换 NAS，迟到响应不得覆盖新页面。
-列表返回后保留之前输入的搜索词和排序。任务筛选在同一导航内复用请求，仍不阻塞图库。
-
-启动使用 Settings API 中不调用厂商接口的 device_catalog；完整设备状态作为后台更新，
-迟到响应在退出账号后不应用。ui-gallery-bootstrap.cjs 同时阻塞设备状态与图片列表，
-验证真实控件仍先显示，列表返回后保留查询和排序，2 项通过。

docs/audits/2026-10-05-project-audit.md

@@ -1,83 +0,0 @@
-# Frame Flow 项目审计 — 2026-10-05
-
-审计基线：794a7e1485cc9046be3e77f6557c75740305ac47。
-范围：本地源码、配置、Mock 测试与依赖审计；不包含本次 NAS 状态验证、真实账号登录或真实设备写入。未修改业务代码。
-
-## 发现
-
-### P1：队列扫描上限导致后续高优先级告警饥饿
-
-`display/service.py:222` 只取按创建时间排序的前 50 个 QUEUED 操作，再跳过
-被 override 阻挡的低优先级请求。如果这 50 项全被阻挡，第 51 项更高优先级
-告警每一轮都无法被扫描到；其他设备请求与本地渲染也可能受影响。
-
-Mock 复现：激活 priority=50 的一小时 override，排入 50 个 priority=10
-请求，再排 priority=90 请求，调用 process_one 后后者仍为 QUEUED。
-建议先筛选可执行请求，或分页扫描直到找到可执行操作；增加跨设备与优先级回归测试。
-
-### P2：会话失效未更新连接状态，并误清第一方登录
-
-`integrations/kokonna_official/rpc.py:44-51` 在官方返回“请重新登陆”时抛出
-UNAUTHORIZED，但没有使官方 session 失效。`connection.py:104-113` 只依据
-本地 token 非空，继续显示 authorized=true。`web/app.js:17` 将任意 API 401
-都当作 Frame Flow 登录失效并执行 forgetLogin，包括外部官方会话过期。
-
-Mock 复现：RPC 返回 HTTP 500 / error -1 / 请重新登陆后，authorized 仍 true。
-建议区分第一方认证与外部账号过期，持久化失效状态，保留 Frame Flow 登录，
-在官方区域提供重新连接提示。
-
-### P2：损坏的可选官方会话文件阻止整个服务启动
-
-`connection.py:44-51` 在构造函数中直接解析 JSON 并索引字段，没有异常隔离。
-DeviceRegistry 在应用启动时构建该对象。损坏 JSON、缺字段或文件不可读会
-使可选功能故障升级为全服务启动失败，影响 API Key、UI 和 Scheduler。
-
-Mock 复现：官方 secret 文件内容为 `{broken`，create_app 抛 JSONDecodeError。
-建议隔离并禁用该连接，记录不含文件内容的诊断；其他核心功能继续启动。
-
-### P2：持久化失败导致断开状态与重启状态不同
-
-`connection.py:122-127,146-157` 先修改内存，再保存。磁盘满、权限错误等
-导致保存失败时没有回滚。尤其 disconnect 已清内存，而磁盘仍保留旧 token，
-重启后又恢复旧连接；虽然原请求返回错误，随后状态查询却会显示未连接。
-
-Mock 复现：让 _save 抛 OSError；当前 authorized=false，重新构造连接后 true。
-建议先原子持久化候选状态，再提交内存状态；失败时保持一致并提供明确错误。
-
-### P2：Request ID 脱敏遗漏官方会话
-
-`api/app.py:148-150` 仅检查 API Key、Frame Flow Token、registry.keys，
-没有检查用于官方会话的 settings.additional_secrets。符合 Request ID 长度和
-字符限制的会话值若被客户端误用为 X-Request-ID，可被响应头和错误模型原样回显。
-本问题不表示未授权者能凭空取到 token，而是违反已有 secret 不回显约束。
-
-Mock 复现：完成模拟官方连接后，将 synthetic session `mock-session` 作为
-X-Request-ID 发给 /health，响应原样返回该值。建议统一使用完整 secret 集合。
-
-## 验证
-
-- pytest：154 passed，0 failed，0 warning。
-- Ruff：通过（应用和 tests）。
-- mypy：36 个源码文件通过。
-- pip-audit（requirements.lock）：No known vulnerabilities found。
-- 五项专项 Mock 复现均确认上述行为，不调用真实 KoKonna。
-- 没有因发现问题而启用官方写方法；严格 RPC allowlist 仍阻止未启用方法。
-
-## 边界与下一步
-
-测试全绿不代表无缺陷：现有套件没有覆盖以上失败场景。
-本轮没有修复或部署；建议先修复队列饥饿，再统一外部账号状态与第一方认证，
-然后补齐会话文件容错、持久化事务一致性和 Request ID 脱敏测试。
-依赖审计仅表示本次查询未发现已知漏洞，不是全部依赖安全的证明。
-
-## 修复与复验
-
-上述五项已修复：队列使用 keyset 分页查找可执行操作；官方账号失效使用
-独立 `OFFICIAL_AUTH_REQUIRED` 错误码并清除会话，前端保留第一方登录且提供
-重新连接入口；可选 secret 解析失败不再阻止核心启动；持久化候选状态成功后
-才提交内存变更；Request ID 检查涵盖官方会话凭据。
-
-复验：164 passed、0 warning（新增 10 项回归测试）；Ruff 通过；mypy 36 文件
-通过；113 项布局检查通过；官方过期/第一方登录隔离浏览器检查通过。
-已知本地凭据对照历史扫描通过（278 个 blob）；该扫描不等同于发现所有未知
-secret 的通用审计。本轮不部署 NAS，不执行真实设备写接口。

docs/audits/2026-10-16-ui-copy.md

@@ -1,27 +0,0 @@
-# 界面表达审计（2026-10-16）
-
-范围：11 个主页面、主要弹窗、中英文文案、README 和照片数据源说明；对照当前 API、清理与来源记录逻辑。不是厂商接口能力或线上服务状态的全面审计。
-
-| 位置 | 原问题 | 修正 |
-| --- | --- | --- |
-| 图库 | 排序使用“适配方式” | 独立“排序方式”标签 |
-| 轮播 / 播放列表 | 播放顺序使用图片适配标签；间隔重复单位 | 使用“播放顺序”“切换间隔” |
-| 总览 | 天气缺译，显示原始 weather | 补齐中英文 |
-| 总览 | 图片 ID 标成图片；型号来源标成型号 | 独立标注 ID 与信息来源 |
-| 同步状态 | “已同步”容易被视为实物刷新确认 | 标明云端确认 |
-| 图片来源 | 无记录却断言非本系统生成 | 只描述未找到可用记录 |
-| 模板编辑 | 非模板图片复用不准确的来源错误 | 明确无可编辑的模板来源 |
-| 删除 | 本地当前图也提示画框切图 | 按本地、云端、当前云端副本区分确认文案 |
-| 星标 / 多选 | 自动清理保护及隐藏勾选项范围不明确 | 加入服务端保留、手动删除、当前页选择范围说明 |
-| 上传 | 固定尺寸提示可能与输出不一致 | 提示以生成预览为准 |
-| 显示选项 | 不勾选恢复时仍显示时长，容易误解 | 说明时长与优先级的临时显示用途 |
-| 数据源 | 未配置与无匹配照片共用空态 | 拆分两种空态 |
-| 数据源 | 位置标签、凭据提示仅描述 WebDAV | 补充网盘目录 ID、百度路径、OAuth 凭据 |
-| 人物筛选 | 仅描述共享空间，但实际可选个人空间 | 按所选空间说明访问权限 |
-| AI / MQTT | AI 密钥称为设备密钥；连接状态缺译 | 独立 API 密钥标签，补齐连接状态 |
-| 错误页 | 所有失败都归因设备云端 | 改成通用页面加载失败，保留具体原因 |
-| 文档 | 照片数据源旧入口及账号独立性描述过时 | 对齐独立导航与共享 Photos 登录 |
-
-验证：305 项布局检查覆盖 320、390、844 横屏、1440 宽度，中英文与明暗主题，11 页及主要弹窗；8 组星标 / 反选回归；新增文案检查覆盖静态翻译完整性、排序 / 播放 / 型号标签、本地删除和星标作用范围。测试使用隔离 Mock，无真实设备写入、照片删除、AI 调用或部署。
-
-此前未提交的反选、总览图片放大及共享图片查看器改动保留。此报告不代表已提交或已部署。

docs/deployment/GITEA_CD.md

@@ -1,4 +1,11 @@
-# Gitea Actions production CD v1
+# Gitea Actions production CD v1 (historical)
+
+> This NAS production deployment procedure is retired. Current Gitea Actions
+> only runs isolated verification; production uses the maintainer-specific
+> Ubuntu workflow in `scripts/server-release.py`. For a new installation use
+> the Docker Compose instructions in README.md. Filesystem/NFS photo sources
+> are disabled; use Synology Photos API or WebDAV. The configuration below is
+> retained for historical reference and must not be used for new deployments.
 
 ## Audit and adoption boundary
 

docs/openapi.json

@@ -1,8 +1,8 @@
 {
   "openapi": "3.1.0",
   "info": {
-    "title": "Pigway Frame Flow API",
+    "title": "PIGWay Frame Flow API",
-    "version": "0.1.9"
+    "version": "0.1.19"
   },
   "paths": {
     "/api/v1/devices/{device_id}/widgets/selection": {
@@ -14203,6 +14203,17 @@
       },
       "Asset": {
         "properties": {
+          "source_path": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Source Path"
+          },
           "starred": {
             "type": "boolean",
             "title": "Starred",
@@ -15216,7 +15227,7 @@
           "version": {
             "type": "string",
             "title": "Version",
-            "default": "0.1.9"
+            "default": "0.1.19"
           }
         },
         "type": "object",
@@ -16227,6 +16238,17 @@
             ],
             "title": "Caption"
           },
+          "source_path": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Source Path"
+          },
           "provider_preview": {
             "type": "boolean",
             "title": "Provider Preview",
@@ -16346,6 +16368,19 @@
             "minLength": 1,
             "title": "Location"
           },
+          "nas_root_path": {
+            "anyOf": [
+              {
+                "type": "string",
+                "maxLength": 2048,
+                "pattern": "^/"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Nas Root Path"
+          },
           "recursive": {
             "type": "boolean",
             "title": "Recursive",
@@ -16394,6 +16429,20 @@
             ],
             "title": "Orientation"
           },
+          "minimum_short_edge": {
+            "type": "integer",
+            "maximum": 50000.0,
+            "minimum": 0.0,
+            "title": "Minimum Short Edge",
+            "default": 0
+          },
+          "minimum_long_edge": {
+            "type": "integer",
+            "maximum": 50000.0,
+            "minimum": 0.0,
+            "title": "Minimum Long Edge",
+            "default": 0
+          },
           "minimum_sharpness": {
             "type": "number",
             "maximum": 10000.0,
@@ -16499,6 +16548,19 @@
             "minLength": 1,
             "title": "Location"
           },
+          "nas_root_path": {
+            "anyOf": [
+              {
+                "type": "string",
+                "maxLength": 2048,
+                "pattern": "^/"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Nas Root Path"
+          },
           "recursive": {
             "type": "boolean",
             "title": "Recursive",
@@ -16547,6 +16609,20 @@
             ],
             "title": "Orientation"
           },
+          "minimum_short_edge": {
+            "type": "integer",
+            "maximum": 50000.0,
+            "minimum": 0.0,
+            "title": "Minimum Short Edge",
+            "default": 0
+          },
+          "minimum_long_edge": {
+            "type": "integer",
+            "maximum": 50000.0,
+            "minimum": 0.0,
+            "title": "Minimum Long Edge",
+            "default": 0
+          },
           "minimum_sharpness": {
             "type": "number",
             "maximum": 10000.0,
@@ -17409,12 +17485,12 @@
           "product": {
             "type": "string",
             "title": "Product",
-            "default": "Pigway Frame Flow"
+            "default": "PIGWay Frame Flow"
           },
           "version": {
             "type": "string",
             "title": "Version",
-            "default": "0.1.9"
+            "default": "0.1.19"
           },
           "api_version": {
             "type": "string",

docs/releases/v0.1.16.md

@@ -0,0 +1,12 @@
+# v0.1.16
+
+统一 PIGWay 品牌写法，优化图库、自动化、历史记录、设置、连接中心和拼图页面布局。
+
+- 图库直接点击图片查看，移除重复的查看按钮；缩略图底框为正方形，卡片宽度适配单行操作按钮。
+- 全站共用更宽的内容区域，宽屏图库可一行显示三张卡片；搜索、排序、来源和任务筛选合并排列。
+- 自动化与历史记录状态改为仅保留颜色的文字，优化列宽与操作对齐。
+- 设置与鉴权信息保持左右并排，鉴权卡片内部信息改为单列；相关设置控件紧凑排列。
+- 连接中心和自动拼图短字段合并排列，按钮按内容宽度显示，空结果提示不再占据额外空间。
+- 窄屏自动换行，保留图片预览、长文本和表格所需空间。
+
+本轮界面检查覆盖 11 个主页面、本地图库及弹窗，中英文、明暗主题和四种屏幕宽度共 289 项布局检查通过；隔离环境拼图流程 8 项检查通过。生产部署后的界面复查使用隔离数据，没有执行真实画框写入。

docs/releases/v0.1.17.md

@@ -0,0 +1,11 @@
+# v0.1.17
+
+- 总览预览改用原图，避免放大低分辨率缩略图。
+- 云端图库缩略图升级为最大 860×860，等比缩放、JPEG 质量 88；原位替换旧缓存，仍只保留一档。点击放大继续读取原图。
+- 照片源新增最小短边、最小长边参数，同时检查源照片和实际取得的预览尺寸，默认 0 不限制。
+- 本地图库显示 NAS 原照片完整路径并支持换行，保留原文件名大小写和后缀；历史四张图片已按照片 ID 核实并补齐来源。
+- 自动化新增“目标相框”列；历史记录的状态、结果、调用方及操作按钮垂直居中。
+- 左上角统一显示 PIGWay Frame Flow，移除图标和重复品牌前缀。
+- 设置与鉴权保持左右并排、卡片等高，鉴权内部单列。图片预览弹窗保留原有布局。
+
+不修改 NAS 原照片，不主动切换真实画框。清理仅针对项目临时构建物及过期镜像，保留持久数据和近期回滚资源。

docs/releases/v0.1.18.md

@@ -0,0 +1,6 @@
+# v0.1.18
+
+- Synology Photos 列表显式请求照片方向信息；按 EXIF 旋转后的宽高筛选横向、竖向和自动方向，避免存储像素为横向的竖拍照片误入横图来源。
+- 渲染前复核实际取得图片的 EXIF 方向；若元数据或缓存预览与来源方向不符，则跳过该候选。显式选择方向不符的照片时返回明确错误。
+- 保持既有水印和铺满布局，不修改 NAS 原照片、来源设置或现有图库；修复不自动重新生成、上传或切换已显示图片。
+- 源码及镜像保留 LICENSE、NOTICE；公开验证只使用合成照片和通用示例，私有部署参数与回执保存在仓库之外。

docs/releases/v0.1.5.md

@@ -1,4 +1,4 @@
-# Pigway Frame Flow v0.1.5
+# PIGWay Frame Flow v0.1.5
 
 ## 简体中文
 

docs/releases/v0.1.6.md

@@ -1,4 +1,4 @@
-# Pigway Frame Flow v0.1.6
+# PIGWay Frame Flow v0.1.6
 
 ## 简体中文
 

docs/releases/v0.1.7.md

@@ -1,4 +1,4 @@
-# Pigway Frame Flow v0.1.7
+# PIGWay Frame Flow v0.1.7
 
 ## 简体中文
 

docs/releases/v0.1.8.md

@@ -1,4 +1,4 @@
-# Pigway Frame Flow v0.1.8
+# PIGWay Frame Flow v0.1.8
 
 增加 NAS 本地图库反选、放大总览图片，并统一图片查看器与界面表达。
 

docs/releases/v0.1.9.md

@@ -10,10 +10,10 @@
 
 正式发布使用 scripts/server-release.py：仅在既有 Ubuntu Server 环境运行，从已提交源码包构建，校验依赖锁、源码哈希、T7 UUID、容器安全约束和真实写入设置；备份 SQLite、配置及 Compose 后切换镜像，失败恢复旧 Compose，不自动回写旧数据库。它不执行上传、显示、删除或恢复图片等设备操作。成功后记录正式提交号、保存源码包及审计回执，删除本次暂存目录；白名单内的 Frame 旧迁移输入归档到本次 recovery，清除无恢复引用的临时镜像别名，共享 Console 资料不动。旧镜像及历史恢复资料保留供回滚，不执行全局 prune。
 
-脚本要求由 git archive 生成的源码放在 /srv/pigway/migration-inbox 的独立子目录；目录内同时提供 RELEASE_COMMIT、RELEASE_HASHES.json 和原始 source.tar.gz。哈希清单涵盖源码与源码包，不含自身。执行 sudo python3 <暂存目录>/scripts/server-release.py；成功后读取 /srv/pigway/apps/pigway-frame-flow/release-verification.json 并独立检查线上接口。
+脚本要求由 git archive 生成的源码放在 <FRAME_FLOW_ROOT>/migration-inbox 的独立子目录；目录内同时提供 RELEASE_COMMIT、RELEASE_HASHES.json 和原始 source.tar.gz。哈希清单涵盖源码与源码包，不含自身。执行 sudo python3 <暂存目录>/scripts/server-release.py；成功后读取 <FRAME_FLOW_ROOT>/apps/pigway-frame-flow/release-verification.json 并独立检查线上接口。
 
 ## 验收范围
 
-完整后端测试、静态检查与桌面/平板/手机的中英文浏览器回归纳入发布检查。线上历史补丁已核验，真实写入保持开启；本轮正式发布不重复真实设备写入测试。隔离浏览器验证与真实设备写入证据分别记录于 docs/verification/2026-10-17-final-audit.md。
+完整后端测试、静态检查与桌面/平板/手机的中英文浏览器回归纳入发布检查。线上历史补丁已核验，真实写入保持开启；本轮正式发布不重复真实设备写入测试。隔离浏览器验证与真实设备写入证据由维护者私下保管。
 
 局域网 HTTPS、独立加密备份及恢复演练仍是后续工作；T7 recovery 不属于独立备份。没有执行 USB 断连、服务器重启或压力测试。

pigway_frame_flow/api/app.py

@@ -124,9 +124,9 @@ def create_app(settings=None, start_worker=True):
         for code in [400, 401, 403, 404, 409, 413, 422, 429, 500, 502, 503]
     }
     app = FastAPI(
-        title="Pigway Frame Flow API",
+        title="PIGWay Frame Flow API",
         docs_url=None,
-        version="0.1.15",
+        version="0.1.19",
         lifespan=lifespan,
         responses=error_responses,
     )
@@ -421,12 +421,19 @@ def create_app(settings=None, start_worker=True):
                 raise FlowError(E.INVALID_REQUEST, "Invalid cloud image") from None
         if thumbnail:
             thumb = cached.with_name(cached.stem + "-thumb.jpg")
-            if not thumb.exists():
+            from PIL import Image
-                from PIL import Image
 
-                with Image.open(cached) as img:
+            with Image.open(cached) as img:
-                    img.thumbnail((300, 400))
+                # The 430px cards need up to 860px on 2x displays. Replace the
-                    img.save(thumb, "JPEG")
+                # existing cache in place so old 300px previews are upgraded.
+                expected_edge = min(860, max(img.size))
+                regenerate = not thumb.exists()
+                if not regenerate:
+                    with Image.open(thumb) as existing:
+                        regenerate = max(existing.size) != expected_edge
+                if regenerate:
+                    img.thumbnail((860, 860), Image.Resampling.LANCZOS)
+                    img.convert("RGB").save(thumb, "JPEG", quality=88, optimize=True)
             return FileResponse(thumb, media_type="image/jpeg")
         from PIL import Image
 
@@ -1033,7 +1040,7 @@ def create_app(settings=None, start_worker=True):
                     supports_upload=True,
                 ),
             ],
-            version="0.1.15",
+            version="0.1.19",
             mock=settings.mock,
             write_enabled=settings.write_enabled,
             api_key_configured=bool(settings.api_key)
@@ -1262,7 +1269,7 @@ def create_app(settings=None, start_worker=True):
     def api_docs():
         response = get_swagger_ui_html(
             openapi_url="/openapi.json",
-            title="Pigway Frame Flow · API Docs",
+            title="PIGWay Frame Flow · API Docs",
             swagger_js_url="/ui/swagger-ui-bundle.js",
             swagger_css_url="/ui/swagger-ui.css",
             swagger_favicon_url='data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg"/>',

pigway_frame_flow/display/service.py

@@ -392,7 +392,24 @@ class DisplayService:
                         "UPDATE operations SET result=? WHERE id=?",
                         (encode({"photo_attempts": attempts}), operation_id),
                     )
-                return self.assets.put(rendered, name, "cache" if staging else "images")
+                asset = self.assets.put(
+                    rendered, name, "cache" if staging else "images"
+                )
+                self.db.execute(
+                    "INSERT OR REPLACE INTO asset_sources VALUES(?,?)",
+                    (
+                        asset["asset_id"],
+                        encode(
+                            {
+                                "type": "photo_source",
+                                "source_id": content.source_id,
+                                "item_id": item["id"],
+                                "source_path": item.get("source_path"),
+                            }
+                        ),
+                    ),
+                )
+                return self.assets.info(asset["asset_id"])
             raise FlowError(
                 E.INVALID_REQUEST, "No decodable photo found within 5 candidates"
             )

pigway_frame_flow/models.py

@@ -366,7 +366,7 @@ class SettingsView(BaseModel):
 
 class Health(BaseModel):
     status: str
-    version: str = "0.1.15"
+    version: str = "0.1.19"
 
 
 class Readiness(BaseModel):
@@ -375,6 +375,7 @@ class Readiness(BaseModel):
 
 
 class Asset(BaseModel):
+    source_path: str | None = None
     starred: bool = False
     origin: Literal["manual", "task", "external", "template", "unknown"] = "unknown"
     job_id: str | None = None
@@ -395,8 +396,8 @@ class RestoreRequest(StrictModel):
 
 
 class Version(BaseModel):
-    product: str = "Pigway Frame Flow"
+    product: str = "PIGWay Frame Flow"
-    version: str = "0.1.15"
+    version: str = "0.1.19"
     api_version: str = "v1"
     commit: str = "development"
     build_time: str = "unknown"

pigway_frame_flow/providers/photo_sources.py

@@ -32,6 +32,7 @@ class PhotoSourceInput(StrictModel):
         "local", "synology-photos", "webdav", "google-drive", "alipan", "baidu"
     ]
     location: str = Field(min_length=1, max_length=2048)
+    nas_root_path: str | None = Field(default=None, max_length=2048, pattern=r"^/")
     recursive: bool = True
     enabled: bool = True
     catalog_limit: int = Field(default=10000, ge=1, le=100000)
@@ -39,6 +40,8 @@ class PhotoSourceInput(StrictModel):
     organized_only: bool = False
     folder_caption: bool = False
     orientation: Literal["auto", "landscape", "portrait"] | None = None
+    minimum_short_edge: int = Field(default=0, ge=0, le=50000)
+    minimum_long_edge: int = Field(default=0, ge=0, le=50000)
     minimum_sharpness: float = Field(default=0, ge=0, le=10000)
     minimum_brightness: float = Field(default=0, ge=0, le=255)
     maximum_brightness: float = Field(default=255, ge=0, le=255)
@@ -60,6 +63,7 @@ class PhotoItem(StrictModel):
     id: str
     name: str
     caption: dict[str, str] | None = None
+    source_path: str | None = None
     provider_preview: bool = False
     orientation: Literal["landscape", "portrait", "square"] | None = None
     width: int | None = None
@@ -412,6 +416,8 @@ class PhotoSources:
                                         height,
                                     )
                                 )
+                            if not self.resolution_matches(source, width, height):
+                                continue
                             direction = orientation(width, height)
                             if wanted and direction != wanted:
                                 continue
@@ -475,9 +481,9 @@ class PhotoSources:
                     continue
                 size = row.get("additional", {}).get("resolution", {})
                 width, height = size.get("width", 0), size.get("height", 0)
-                rotation = row.get("additional", {}).get("orientation", 1)
+                # Photos resolution is already oriented; EXIF must not swap it twice.
-                if rotation in (5, 6, 7, 8):
+                if not self.resolution_matches(source, width, height):
-                    width, height = height, width
+                    continue
                 direction = orientation(width, height)
                 if wanted and (not width or not height or direction != wanted):
                     continue
@@ -486,6 +492,13 @@ class PhotoSources:
                         "id": str(row["id"]),
                         "name": row["filename"],
                         "provider_preview": True,
+                        "source_path": (
+                            source.nas_root_path.rstrip("/")
+                            + "/"
+                            + relative.lstrip("/")
+                            if source.nas_root_path
+                            else "/" + relative.lstrip("/")
+                        ),
                         "caption": caption if source.folder_caption else None,
                         "width": width,
                         "height": height,
@@ -560,6 +573,11 @@ class PhotoSources:
         self.cache[source_id] = (time.monotonic(), items, wanted, session_identity)
         return items
 
+    @staticmethod
+    def resolution_matches(source, width, height):
+        short, long = sorted((width, height))
+        return short >= source.minimum_short_edge and long >= source.minimum_long_edge
+
     def read(self, source_id, item_id=None, *, target_size=(1200, 1600)):
         source = self.get(source_id)
         items = self.catalog(source_id, target_size=target_size)
@@ -642,4 +660,29 @@ class PhotoSources:
             data = self.assets.fetch_url(item["id"], headers=self.headers(source))
         if len(data) > self.settings.max_bytes:
             raise FlowError(E.INVALID_REQUEST, "Image exceeds size limit")
+        if source.orientation or source.minimum_short_edge or source.minimum_long_edge:
+            from io import BytesIO
+
+            from PIL import Image
+
+            with Image.open(BytesIO(data)) as image:
+                width, height = image.size
+                if image.getexif().get(274, 1) in (5, 6, 7, 8):
+                    width, height = height, width
+                wanted = (
+                    orientation(*target_size)
+                    if source.orientation == "auto"
+                    else source.orientation
+                )
+                # Validate the fetched rendition before a crop can hide a mismatch.
+                if wanted and orientation(width, height) != wanted:
+                    raise FlowError(
+                        E.INVALID_REQUEST,
+                        "Photo direction does not match the source orientation",
+                    )
+                if not self.resolution_matches(source, width, height):
+                    raise FlowError(
+                        E.INVALID_REQUEST,
+                        "Photo is below the configured minimum resolution",
+                    )
         return data, item["name"], item.get("caption")

pigway_frame_flow/providers/synology_photos.py

@@ -299,7 +299,9 @@ class SynologyPhotos:
                 rows = self.pages(
                     prefix + ".Browse.Item",
                     7,
-                    additional=json.dumps(["folder", "thumbnail", "resolution"]),
+                    additional=json.dumps(
+                        ["folder", "thumbnail", "resolution", "orientation"]
+                    ),
                     **({"person_id": person} if person is not None else {}),
                 )
                 groups.append(

pigway_frame_flow/renderers/images.py

@@ -134,7 +134,13 @@ class Assets:
         if not row:
             raise FlowError(E.NOT_FOUND, "Asset not found", 404)
         meta = self.db.one("SELECT * FROM asset_metadata WHERE asset_id=?", (asset_id,))
+        provenance = self.db.one(
+            "SELECT payload FROM asset_sources WHERE asset_id=?", (asset_id,)
+        )
         return {
+            "source_path": json.loads(provenance["payload"]).get("source_path")
+            if provenance
+            else None,
             "starred": bool(meta and meta["starred"]),
             "origin": meta["origin"] if meta else "unknown",
             "job_id": meta["job_id"] if meta else None,

pigway_frame_flow/web/app.js

@@ -118,7 +118,7 @@ async function templateEditor(selected){
  const reset=document.createElement('button');reset.id='reset-template';reset.textContent=t('resetTemplate');$('#save-template').after(reset);bind('reset-template',()=>confirmDialog(t('resetConfirm'),async()=>{await api('/api/v1/templates/'+selected.id+'/config',{method:'DELETE'});await navigate();}));
  const save=$('#save-template');const oldSave=save.onclick;save.onclick=async e=>{if([...panel.querySelectorAll('textarea'),raw].some(x=>!x.checkValidity())){toast(t('INVALID_REQUEST'));return;}await oldSave(e);};
 }
-function accountSettings(){const section=$('#logout').parentElement;const form=document.createElement('form');form.id='password-form';form.innerHTML=`<h3>${t('changePassword')}</h3><div class="field"><label for="current-password">${t('currentPassword')}</label><input id="current-password" type="password" required autocomplete="current-password"></div><div class="field"><label for="new-password">${t('newPassword')}</label><input id="new-password" type="password" minlength="8" required autocomplete="new-password"></div><button type="submit">${t('changePassword')}</button>`;section.append(form);form.onsubmit=busy(async e=>{e.preventDefault();await api('/api/v1/auth/password',{method:'PUT',body:{current_password:$('#current-password').value,new_password:$('#new-password').value}});forgetLogin();shell();login();toast(t('passwordChanged'));});}
+function accountSettings(){const section=$('#logout').parentElement;const form=document.createElement('form');form.id='password-form';form.innerHTML=`<h3>${t('changePassword')}</h3><div class="form-grid password-fields"><div class="field"><label for="current-password">${t('currentPassword')}</label><input id="current-password" type="password" required autocomplete="current-password"></div><div class="field"><label for="new-password">${t('newPassword')}</label><input id="new-password" type="password" minlength="8" required autocomplete="new-password"></div></div><button type="submit">${t('changePassword')}</button>`;section.append(form);form.onsubmit=busy(async e=>{e.preventDefault();await api('/api/v1/auth/password',{method:'PUT',body:{current_password:$('#current-password').value,new_password:$('#new-password').value}});forgetLogin();shell();login();toast(t('passwordChanged'));});}
 const views={
  studio:()=>layoutStudioPage(),
  connections:()=>connectionsPage(),
@@ -128,7 +128,7 @@ const views={
  const destinations=galleryDestinations();if(!destinations.some(d=>d.id===state.tab))state.tab=destinations[0]?.id||'local';
  const key=JSON.stringify([state.device,state.tab,state.assetOffset||0,state.assetOrigin||'all',state.assetJob||'']);
  const cache=state.galleryCache||(state.galleryCache=new Map());const cached=cache.get(key);
- const render=(items,pending=false)=>{if(epoch!==state.epoch)return;state.gallery=items;$('#main').innerHTML=notice()+`<div class="section-heading"><div class="tabs gallery-tabs">${destinations.map(d=>`<button id="${esc(d.id)}-tab" data-gallery-destination="${esc(d.id)}" class="${state.tab===d.id?'active':''}">${esc(galleryDestinationName(d))}</button>`).join('')}</div><div class="actions">${buttons('gallery-refresh','refresh')}${state.tab==='cloud'?buttons('show-name','displayByName'):''}${buttons('gallery-upload','upload',true)}<span id="gallery-list-status" class="hint" role="status" ${pending?'':'hidden'}>${pending?t('galleryListLoading'):''}</span></div></div>${state.tab==='local'?`<div class="notice">${t('uploadNotice')}</div>`:''}${`<div class="gallery" aria-busy="${pending}">${items.map((x,i)=>`<article class="card image-card"><img class="thumb" alt="${esc(x.name)}" data-src="${esc(x.url+(state.tab==='cloud'?'?thumbnail=true':''))}"><h3 title="${esc(x.name)}">${esc(x.name)}</h3><small>${state.tab==='cloud'?'#'+x.image_id:t('local')} · ${esc(fmt(x.created_at))}</small><div class="actions"><button class="primary" data-show="${i}" ${x.current?'disabled':''}>${t(x.current?'current':'display')}</button><button data-original="${i}">${t('original')}</button><button class="danger" data-delete="${i}">${t('delete')}</button></div></article>`).join('')}</div>`}${!pending&&!items.length?`<div class="card empty"><strong>${t('noImages')}</strong>${t('emptyHint')}</div>`:''}`;bind('cloud-tab',()=>{state.tab='cloud';return navigate();});bind('local-tab',()=>{state.tab='local';return navigate();});bind('gallery-refresh',()=>navigate());bind('gallery-upload',()=>navigate('upload'));bind('show-name',()=>{showModal(`<h2>${t('displayByName')}</h2><div class="field"><label for="image-name">${t('name')}</label><input id="image-name" maxlength="120"></div><div class="modal-actions">${buttons('modal-cancel','cancel')}${buttons('show-name-confirm','display',true)}</div>`);bind('show-name-confirm',async()=>{const name=$('#image-name').value;$('#modal').close();displayDialog({type:'image',image_name:name});});});enhanceGallery();guardDeviceButtons();hydrateImages();document.querySelectorAll('[data-show]').forEach(b=>b.onclick=busy(()=>{const x=items[b.dataset.show];if(x.current)return;return displayDialog(state.tab==='cloud'?{type:'image',image_id:x.image_id}:{type:'image',asset_id:x.asset_id});}));document.querySelectorAll('[data-original]').forEach(b=>b.onclick=busy(async()=>{const x=items[b.dataset.original];await openImageViewer(x.url,x.name);}));document.querySelectorAll('[data-delete]').forEach(b=>b.onclick=()=>{const x=items[b.dataset.delete];confirmDialog(state.tab==='local'?t('localDeleteConfirm'):x.current?t('deleteCurrent'):t('cloudDeleteConfirm'),async()=>{if(state.tab==='local'){await api('/api/v1/assets/'+x.asset_id,{method:'DELETE'});}else{const result=await api(`/api/v1/devices/${state.device}/images/${x.image_id}?confirm_current=${x.current}`,{method:'DELETE',headers:{'Idempotency-Key':'web-'+clientUUID()}});await waitOperation(result.operation_id);}await navigate();});});};
+ const render=(items,pending=false)=>{if(epoch!==state.epoch)return;state.gallery=items;$('#main').innerHTML=notice()+`<div class="section-heading"><div class="tabs gallery-tabs">${destinations.map(d=>`<button id="${esc(d.id)}-tab" data-gallery-destination="${esc(d.id)}" class="${state.tab===d.id?'active':''}">${esc(galleryDestinationName(d))}</button>`).join('')}</div><div class="actions">${buttons('gallery-refresh','refresh')}${state.tab==='cloud'?buttons('show-name','displayByName'):''}${buttons('gallery-upload','upload',true)}<span id="gallery-list-status" class="hint" role="status" ${pending?'':'hidden'}>${pending?t('galleryListLoading'):''}</span></div></div>${state.tab==='local'?`<div class="notice">${t('uploadNotice')}</div>`:''}${`<div class="gallery" aria-busy="${pending}">${items.map((x,i)=>`<article class="card image-card"><button class="image-preview" data-original="${i}" aria-label="${t('original')} · ${esc(x.name)}"><img class="thumb" alt="${esc(x.name)}" data-src="${esc(x.url+(state.tab==='cloud'?'?thumbnail=true':''))}"></button><h3 class="${state.tab==='local'?'source-path':''}" title="${esc(x.source_path||x.name)}">${esc(state.tab==='local'?(x.source_path||x.name):x.name)}</h3><small>${state.tab==='cloud'?'#'+x.image_id:t('local')} · ${esc(fmt(x.created_at))}</small><div class="actions"><button class="primary" data-show="${i}" ${x.current?'disabled':''}>${t(x.current?'current':'display')}</button><button class="danger" data-delete="${i}">${t('delete')}</button></div></article>`).join('')}</div>`}${!pending&&!items.length?`<div class="card empty"><strong>${t('noImages')}</strong>${t('emptyHint')}</div>`:''}`;bind('cloud-tab',()=>{state.tab='cloud';return navigate();});bind('local-tab',()=>{state.tab='local';return navigate();});bind('gallery-refresh',()=>navigate());bind('gallery-upload',()=>navigate('upload'));bind('show-name',()=>{showModal(`<h2>${t('displayByName')}</h2><div class="field"><label for="image-name">${t('name')}</label><input id="image-name" maxlength="120"></div><div class="modal-actions">${buttons('modal-cancel','cancel')}${buttons('show-name-confirm','display',true)}</div>`);bind('show-name-confirm',async()=>{const name=$('#image-name').value;$('#modal').close();displayDialog({type:'image',image_name:name});});});enhanceGallery();guardDeviceButtons();hydrateImages();document.querySelectorAll('[data-show]').forEach(b=>b.onclick=busy(()=>{const x=items[b.dataset.show];if(x.current)return;return displayDialog(state.tab==='cloud'?{type:'image',image_id:x.image_id}:{type:'image',asset_id:x.asset_id});}));document.querySelectorAll('[data-original]').forEach(b=>b.onclick=busy(async()=>{const x=items[b.dataset.original];await openImageViewer(x.url,x.name);}));document.querySelectorAll('[data-delete]').forEach(b=>b.onclick=()=>{const x=items[b.dataset.delete];confirmDialog(state.tab==='local'?t('localDeleteConfirm'):x.current?t('deleteCurrent'):t('cloudDeleteConfirm'),async()=>{if(state.tab==='local'){await api('/api/v1/assets/'+x.asset_id,{method:'DELETE'});}else{const result=await api(`/api/v1/devices/${state.device}/images/${x.image_id}?confirm_current=${x.current}`,{method:'DELETE',headers:{'Idempotency-Key':'web-'+clientUUID()}});await waitOperation(result.operation_id);}await navigate();});});};
  render(cached||[],!cached);
  try{
  const items=state.tab==='cloud'?await api('/api/v1/devices/'+state.device+'/images'):await api('/api/v1/assets?limit=200&offset='+(state.assetOffset||0)+'&origin='+encodeURIComponent(state.assetOrigin||'all')+(state.assetJob?'&job_id='+encodeURIComponent(state.assetJob):''));
@@ -143,13 +143,13 @@ const views={
  async upload(){state.preview=null;$('#main').innerHTML=notice()+`<div class="notice">${t('uploadNotice')}</div><div class="columns"><section class="card"><h2>${t('upload')}</h2><div class="dropzone"><strong>${t('selectFile')}</strong><p class="hint">${t('uploadHint')}</p><input id="file" type="file" accept="image/jpeg,image/png,image/webp" aria-label="${t('selectFile')}"></div><div class="form-grid" style="margin-top:24px"><div class="field"><label for="fit">${t('mode')}</label><select id="fit">${['contain','cover','smart'].map(x=>`<option value="${x}">${t(x)}</option>`).join('')}</select></div><div class="field"><label for="profile">${t('profile')}</label><select id="profile">${['color','grayscale'].map(x=>`<option value="${x}">${t(x)}</option>`).join('')}</select></div></div>${buttons('make-preview','preview',true)}<p class="hint">${t('previewHint')}</p></section><section class="card"><h3>${t('preview')}</h3><div id="preview-box" class="empty">${t('previewHint')}</div><div class="actions" style="margin-top:18px"><button id="save-local" disabled>${t('staging')}</button><button id="display-upload" class="primary" disabled>${t('display')}</button></div></section></div>`;bind('make-preview',async()=>{const file=$('#file').files[0];if(!file)throw new Error(t('selectFile'));const form=new FormData();form.append('file',file);form.append('fit',$('#fit').value);form.append('profile',$('#profile').value);state.preview=await api('/api/v1/preview',{method:'POST',body:form});$('#preview-box').className='';$('#preview-box').innerHTML='<img id="upload-preview" class="preview" alt="Preview">';await blobImage($('#upload-preview'),state.preview.url);$('#save-local').disabled=false;$('#display-upload').disabled=!liveWriteAllowed();});for(const id of ['file','fit','profile'])$('#'+id).onchange=()=>{state.preview=null;$('#save-local').disabled=true;$('#display-upload').disabled=true;};bind('save-local',async()=>{const id=await accepted('/api/v1/devices/'+state.device+'/upload',{type:'image',asset_id:state.preview.asset_id});await waitOperation(id);state.tab='local';return navigate('gallery');});bind('display-upload',()=>displayDialog({type:'image',asset_id:state.preview.asset_id}));},
  async templates(){state.templates=await api('/api/v1/templates');const selected=state.templates.find(x=>x.id===state.selectedTemplate)||state.templates[0];state.selectedTemplate=selected.id;if(state.pendingTemplateData?.template===selected.id){selected.defaults=state.pendingTemplateData.data;state.initialProfile=state.pendingTemplateData.profile;state.pendingTemplateData=null;}state.templatePreview=null;$('#main').innerHTML=notice()+`<div class="notice">${t('templateHint')}<p>${t('templateSteps')}</p></div><div class="template-grid">${state.templates.map((x,i)=>`<div class="card template-card ${x.id===selected.id?'selected':''}" role="button" tabindex="0" data-template="${x.id}"><span>${{'daily-poetry':'詩','calendar':'▦','daily-dashboard':'☀','photo-text':'▣','quote':'❝','system-alert':'◒','weather':'☁'}[x.id]||'▦'}</span><div><h3>${esc(x.name.split(' / ')[state.lang==='zh'?1:0]||x.name)}</h3><small>1200 × 1600 · ${esc(x.id)}</small></div></div>`).join('')}</div><div class="columns"><section class="card"><h3>${t('templateData')}</h3><p class="hint">${t('templateGuideTitle')}</p><p class="hint">${t({'photo-text':'guidePhotoText','daily-dashboard':'guideDashboard',weather:'guideWeather',calendar:'guideCalendar',quote:'guideQuote','daily-poetry':'guidePoetry','system-alert':'guideAlert'}[selected.id]||'templateContentHelp')}</p>${['weather','daily-dashboard'].includes(selected.id)?`<p class="hint">${t('templateWeatherHelp')}</p>`:''}<textarea id="template-data" aria-label="${t('templateData')}">${esc(JSON.stringify(selected.defaults,null,2))}</textarea><div class="field" style="margin-top:16px"><label for="template-profile">${t('profile')}</label><select id="template-profile"><option value="color">${t('color')}</option><option value="grayscale">${t('grayscale')}</option></select><p class="hint">${t('helpProfile')}</p></div><p class="hint">${t('templateActionHelp')}</p><p class="hint">${t('templateAutomationHelp')}</p><div class="actions">${buttons('render-template','render',true)}${buttons('save-template','saveTemplate')}</div></section><section class="card"><h3>${t('preview')}</h3><div id="template-preview" class="empty">${t('templatePreviewHint')}</div><button id="display-template" class="primary" style="margin-top:18px" disabled>${t('display')}</button></section></div>`;document.querySelectorAll('[data-template]').forEach(b=>{b.onclick=()=>{state.selectedTemplate=b.dataset.template;navigate(['collage','poster'].includes(b.dataset.template)?'studio':undefined);};b.onkeydown=e=>{if(e.key==='Enter')b.click();};});bind('render-template',async()=>{const content={type:'template',template:selected.id,data:JSON.parse($('#template-data').value),profile:$('#template-profile').value};if([...document.querySelectorAll('#template-fields textarea'),$('#template-data')].some(x=>!x.checkValidity())){toast(t('INVALID_REQUEST'));return;}const id=await accepted('/api/v1/render',content);$('#template-preview').textContent=t('previewLoading');const op=await waitOperation(id);state.templatePreview=op.result.asset_id;$('#template-preview').className='';$('#template-preview').innerHTML='<img id="template-image" class="preview" alt="Template preview">';await blobImage($('#template-image'),op.result.url);$('#display-template').disabled=!liveWriteAllowed();});bind('save-template',async()=>{await api('/api/v1/templates/'+selected.id+'/config',{method:'PUT',body:{data:JSON.parse($('#template-data').value)}});toast(t('done'));});$('#template-data').oninput=()=>$('#display-template').disabled=true;$('#template-profile').onchange=()=>$('#display-template').disabled=true;bind('display-template',()=>displayDialog({type:'image',asset_id:state.templatePreview}));await templateEditor(selected);if(state.initialProfile){$('#template-profile').value=state.initialProfile;state.initialProfile=null;}},
  async playlists(epoch){const playlists=await api('/api/v1/playlists');if(epoch!==state.epoch)return;$('#main').innerHTML=notice()+`<div class="notice">${t('playlistNotice')}</div><div class="section-heading"><h2>${t('playlists')}</h2>${buttons('new-playlist','newPlaylist',true)}</div><div class="gallery">${playlists.map((p,i)=>`<section class="card"><span class="badge">${t(p.enabled?'enabled':'disabled')}</span><h3 style="margin-top:16px">${esc(p.name)}</h3><p class="hint">${p.image_ids.length} ${t('count')} · ${p.interval_minutes} ${t('minutes')} · ${t(p.mode)}</p><p><code>${esc(p.image_ids.join(' → '))}</code></p><small>${t('lastScheduled')}: ${p.position>=0?esc(p.image_ids[p.position]):'—'}</small><div class="actions" style="margin-top:16px"><button data-pl-edit="${i}">${t('edit')}</button><button class="danger" data-pl-delete="${i}">${t('remove')}</button></div></section>`).join('')||`<div class="card empty"><strong>${t('noTasks')}</strong></div>`}</div>`;bind('new-playlist',()=>playlistEditor());document.querySelectorAll('[data-pl-edit]').forEach(b=>b.onclick=()=>playlistEditor(playlists[b.dataset.plEdit]));document.querySelectorAll('[data-pl-delete]').forEach(b=>b.onclick=()=>confirmDialog(t('removeConfirm'),async()=>{await api('/api/v1/playlists/'+playlists[b.dataset.plDelete].id,{method:'DELETE'});await navigate();}));},
- async history(epoch){const ops=await api('/api/v1/operations');if(epoch!==state.epoch)return;$('#main').innerHTML=`<div class="section-heading"><h2>${t('history')}</h2>${buttons('history-refresh','refresh')}</div>${ops.some(x=>x.status==='UNKNOWN')?`<div class="notice warning">${t('unknown')}</div>`:''}<div class="card table-wrap">${ops.length?`<table><thead><tr>${['created','action','status','result','client','requestId'].map(x=>`<th>${t(x)}</th>`).join('')}</tr></thead><tbody>${ops.map((o,i)=>`<tr><td>${fmt(o.created_at)}</td><td>${esc(operationActionLabel(o.action))}<br><small>${esc(deviceNameForId(o.device_id))}</small></td><td><span class="badge ${['FAILED','UNKNOWN'].includes(o.status)?'bad':''}">${t(o.status)}</span>${o.status==='UNKNOWN'?`<div><button data-reconcile="${i}">${t('reconcile')}</button></div>`:''}</td><td>${esc(o.result?.image_id||o.result?.asset_id||operationErrorLabel(o.error)||'—')}</td><td>${esc(operationClientLabel(o.client_id))}</td><td><code>${esc(o.request_id)}<br>${esc(o.operation_id)}</code></td></tr>`).join('')}</tbody></table>`:`<div class="empty">${t('noHistory')}</div>`}</div>`;bind('history-refresh',()=>navigate());document.querySelectorAll('[data-reconcile]').forEach(b=>b.onclick=busy(async()=>{const o=ops[b.dataset.reconcile];const r=await api('/api/v1/operations/'+o.operation_id+'/reconcile',{method:'POST',body:{acknowledge:false}});showModal(`<h2>${t('reconcile')}</h2><p>${t('current')}: ${esc(r.current_image_id)}</p><p>${t('result')}: ${esc(r.expected_image_id)}</p><p class="hint">${t('unknown')}</p><div class="modal-actions">${buttons('modal-cancel','cancel')}${r.resolved?'':buttons('acknowledge','acknowledge')}</div>`);bind('acknowledge',async()=>{await api('/api/v1/operations/'+o.operation_id+'/reconcile',{method:'POST',body:{acknowledge:true}});$('#modal').close();await navigate();});}));},
+ async history(epoch){const ops=await api('/api/v1/operations');if(epoch!==state.epoch)return;$('#main').innerHTML=`<div class="section-heading"><h2>${t('history')}</h2>${buttons('history-refresh','refresh')}</div>${ops.some(x=>x.status==='UNKNOWN')?`<div class="notice warning">${t('unknown')}</div>`:''}<div class="card table-wrap">${ops.length?`<table><thead><tr>${['created','action','status','result','client','requestId'].map(x=>`<th>${t(x)}</th>`).join('')}</tr></thead><tbody>${ops.map((o,i)=>`<tr><td>${fmt(o.created_at)}</td><td>${esc(operationActionLabel(o.action))}<br><small>${esc(deviceNameForId(o.device_id))}</small></td><td><span class="history-status ${['FAILED','UNKNOWN'].includes(o.status)?'bad':''}">${t(o.status)}</span>${o.status==='UNKNOWN'?`<div><button data-reconcile="${i}">${t('reconcile')}</button></div>`:''}</td><td>${esc(o.result?.image_id||o.result?.asset_id||operationErrorLabel(o.error)||'—')}</td><td>${esc(operationClientLabel(o.client_id))}</td><td><code>${esc(o.request_id)}<br>${esc(o.operation_id)}</code></td></tr>`).join('')}</tbody></table>`:`<div class="empty">${t('noHistory')}</div>`}</div>`;bind('history-refresh',()=>navigate());document.querySelectorAll('[data-reconcile]').forEach(b=>b.onclick=busy(async()=>{const o=ops[b.dataset.reconcile];const r=await api('/api/v1/operations/'+o.operation_id+'/reconcile',{method:'POST',body:{acknowledge:false}});showModal(`<h2>${t('reconcile')}</h2><p>${t('current')}: ${esc(r.current_image_id)}</p><p>${t('result')}: ${esc(r.expected_image_id)}</p><p class="hint">${t('unknown')}</p><div class="modal-actions">${buttons('modal-cancel','cancel')}${r.resolved?'':buttons('acknowledge','acknowledge')}</div>`);bind('acknowledge',async()=>{await api('/api/v1/operations/'+o.operation_id+'/reconcile',{method:'POST',body:{acknowledge:true}});$('#modal').close();await navigate();});}));},
- async settings(){state.settings=await api('/api/v1/settings');const s=state.settings;$('#main').innerHTML=notice()+`<div class="columns"><section class="card"><h3>${t('settings')}</h3><div class="field"><label for="theme-select">${t('theme')}</label><select id="theme-select">${['system','light','dark'].map(x=>`<option value="${x}" ${state.theme===x?'selected':''}>${t(x==='system'?'systemTheme':x)}</option>`).join('')}</select></div><div class="field"><label for="language-select">${t('language')}</label><select id="language-select"><option value="zh" ${state.lang==='zh'?'selected':''}>简体中文</option><option value="en" ${state.lang==='en'?'selected':''}>English</option></select></div><p class="hint">${t('tokenHint')}</p>${buttons('logout','logout')}</section><section class="card"><h3>${t('auth')}</h3><div class="detail-grid">${detail('version',s.version)}${detail('writeProtection',t(!s.write_enabled?'yes':'no'))}${detail('keyConfigured',t(s.api_key_configured?'yes':'no'))}${detail('timezone',s.timezone)}</div><p class="hint">${t('refreshInterval')}</p><a href="/docs" target="_blank" rel="noopener">${t('apiDocs')} →</a><p class="hint">GET /openapi.json · /api/v1</p></section></div>`;$('#theme-select').onchange=()=>{state.theme=$('#theme-select').value;localStorage.setItem('ff-theme',state.theme);applyTheme();};$('#language-select').onchange=()=>{state.lang=$('#language-select').value;localStorage.setItem('ff-language',state.lang);navigate();};bind('logout',async()=>{await api('/api/v1/auth/logout',{method:'POST'});forgetLogin();shell();login();});accountSettings();}
+ async settings(){state.settings=await api('/api/v1/settings');const s=state.settings;$('#main').innerHTML=notice()+`<div class="columns settings-columns"><section class="card"><h3>${t('settings')}</h3><div class="form-grid settings-preferences"><div class="field"><label for="theme-select">${t('theme')}</label><select id="theme-select">${['system','light','dark'].map(x=>`<option value="${x}" ${state.theme===x?'selected':''}>${t(x==='system'?'systemTheme':x)}</option>`).join('')}</select></div><div class="field"><label for="language-select">${t('language')}</label><select id="language-select"><option value="zh" ${state.lang==='zh'?'selected':''}>简体中文</option><option value="en" ${state.lang==='en'?'selected':''}>English</option></select></div></div><p class="hint">${t('tokenHint')}</p>${buttons('logout','logout')}</section><section class="card"><h3>${t('auth')}</h3><div class="detail-grid">${detail('version',s.version)}${detail('writeProtection',t(!s.write_enabled?'yes':'no'))}${detail('keyConfigured',t(s.api_key_configured?'yes':'no'))}${detail('timezone',s.timezone)}</div><p class="hint">${t('refreshInterval')}</p><a href="/docs" target="_blank" rel="noopener">${t('apiDocs')} →</a><p class="hint">GET /openapi.json · /api/v1</p></section></div>`;$('#theme-select').onchange=()=>{state.theme=$('#theme-select').value;localStorage.setItem('ff-theme',state.theme);applyTheme();};$('#language-select').onchange=()=>{state.lang=$('#language-select').value;localStorage.setItem('ff-language',state.lang);navigate();};bind('logout',async()=>{await api('/api/v1/auth/logout',{method:'POST'});forgetLogin();shell();login();});accountSettings();}
 };
 function jobPayload(j,changes={}){return {name:j.name,enabled:j.enabled,device_id:j.device_id,schedule:j.schedule,source:j.source,display_duration:j.display_duration,restore_previous:j.restore_previous,priority:j.priority,cleanup_unstarred:j.cleanup_unstarred||false,...changes};}
 async function playlistEditor(p){p=p||{name:'',image_ids:[],interval_minutes:60,mode:'queue',enabled:false};showModal(`<h2>${t('playlists')}</h2><form id="playlist-form"><div class="field"><label for="playlist-name">${t('name')}</label><input id="playlist-name" required maxlength="120" value="${esc(p.name)}"></div><div class="field"><label for="playlist-images">${t('imageIds')}</label><input id="playlist-images" required value="${esc(p.image_ids.join(','))}" placeholder="1,2,3"></div><div class="form-grid"><div class="field"><label for="playlist-interval">${t('interval')}</label><input id="playlist-interval" type="number" min="5" max="10080" value="${p.interval_minutes}"></div><div class="field"><label for="playlist-mode">${t('playbackMode')}</label><select id="playlist-mode"><option value="queue" ${p.mode==='queue'?'selected':''}>${t('queue')}</option><option value="random" ${p.mode==='random'?'selected':''}>${t('random')}</option></select></div></div><label class="check-row"><input id="playlist-enabled" type="checkbox" ${p.enabled?'checked':''}>${t('enabled')}</label><div class="modal-actions">${buttons('modal-cancel','cancel')}<button type="submit" class="primary">${t('save')}</button></div></form>`);$('#playlist-form').onsubmit=busy(async e=>{e.preventDefault();await api('/api/v1/playlists'+(p.id?'/'+p.id:''),{method:p.id?'PUT':'POST',body:{name:$('#playlist-name').value,device_id:p.device_id||state.device,image_ids:$('#playlist-images').value.split(',').map(x=>Number(x.trim())),interval_minutes:Number($('#playlist-interval').value),mode:$('#playlist-mode').value,enabled:$('#playlist-enabled').checked}});$('#modal').close();await navigate();});await playlistImagePicker(p);}
 $('#lang').onclick=()=>{state.lang=state.lang==='zh'?'en':'zh';localStorage.setItem('ff-language',state.lang);navigate();};$('#theme').onclick=()=>{state.theme=document.documentElement.dataset.theme==='dark'?'light':'dark';localStorage.setItem('ff-theme',state.theme);applyTheme();};$('#device').onchange=()=>{state.device=$('#device').value;navigate();};window.addEventListener('hashchange',()=>{const page=location.hash.slice(1);if(page!==state.page)navigate(page);});matchMedia('(prefers-color-scheme:dark)').addEventListener('change',applyTheme);
-applyTheme();shell();localStorage.removeItem('ff-login');(async()=>{try{const account=await api('/api/v1/auth/me');state.token=account.username;state.csrf=account.csrf_token;await loadConnection();}catch{forgetLogin();}await navigate();})();api('/api/v1/version').then(v=>$('#footer').innerHTML=`<span>Pigway Frame Flow · ${t('footer')}</span><span>v${esc(v.version)} · ${esc(v.commit.slice(0,8))} · ${esc(v.build_time)}</span>`).catch(()=>{});
+applyTheme();shell();localStorage.removeItem('ff-login');(async()=>{try{const account=await api('/api/v1/auth/me');state.token=account.username;state.csrf=account.csrf_token;await loadConnection();}catch{forgetLogin();}await navigate();})();api('/api/v1/version').then(v=>$('#footer').innerHTML=`<span>PIGWay Frame Flow · ${t('footer')}</span><span>v${esc(v.version)} · ${esc(v.commit.slice(0,8))} · ${esc(v.build_time)}</span>`).catch(()=>{});
 setInterval(()=>{if(state.token&&state.page==='dashboard'&&!$('#modal').open)navigate();},60000);
 
 // Keep Cron available for exceptional schedules, but make ordinary schedules form-based.
@@ -175,7 +175,7 @@ async function jobEditor(job){
 views.automation=async epoch=>{
  const jobs=await api('/api/v1/jobs');
  if(epoch!==state.epoch)return;
- $('#main').innerHTML=notice()+`<div class="section-heading"><p class="hint">${state.lang==='zh'?'上海时间':'Shanghai time'} · ${t('automation')}</p>${buttons('new-job','newJob',true)}</div><div class="card">${jobs.length?`<div class="table-wrap"><table><thead><tr>${['name','schedule','status','nextRun','lastRun','result','action'].map(key=>`<th>${t(key)}</th>`).join('')}</tr></thead><tbody>${jobs.map((job,index)=>`<tr><td><strong>${esc(job.name)}</strong><br><small>${esc(deviceDisplayName(state.devices.find(d=>d.id===job.device_id)||{id:job.device_id,name:job.device_id}))}</small></td><td>${esc(scheduleSummary(job.schedule))}</td><td><span class="badge">${t(job.enabled?'enabled':'disabled')}</span></td><td>${fmt(job.next_run)}</td><td>${fmt(job.last_run)}</td><td><code>${esc(job.last_result)}</code></td><td><div class="row-actions"><button data-job-edit="${index}">${t('edit')}</button><button data-job-toggle="${index}">${t(job.enabled?'disabled':'enabled')}</button><button class="danger" data-job-delete="${index}">${t('remove')}</button></div></td></tr>`).join('')}</tbody></table></div>`:`<div class="empty"><strong>${t('noTasks')}</strong></div>`}</div>`;
+ $('#main').innerHTML=notice()+`<div class="section-heading"><p class="hint">${state.lang==='zh'?'上海时间':'Shanghai time'} · ${t('automation')}</p>${buttons('new-job','newJob',true)}</div><div class="card">${jobs.length?`<div class="table-wrap"><table class="automation-table"><thead><tr>${['name','targetFrame','schedule','status','nextRun','lastRun','result','action'].map(key=>`<th>${key==='targetFrame'?tr('目标相框','Target frame'):t(key)}</th>`).join('')}</tr></thead><tbody>${jobs.map((job,index)=>`<tr><td><strong>${esc(job.name)}</strong></td><td>${esc(deviceDisplayName(state.devices.find(d=>d.id===job.device_id)||{id:job.device_id,name:job.device_id}))}</td><td>${esc(scheduleSummary(job.schedule))}</td><td><span class="automation-status">${t(job.enabled?'enabled':'disabled')}</span></td><td>${fmt(job.next_run)}</td><td>${fmt(job.last_run)}</td><td><code>${esc(job.last_result)}</code></td><td><div class="row-actions"><button data-job-edit="${index}">${t('edit')}</button><button data-job-toggle="${index}">${t(job.enabled?'disabled':'enabled')}</button><button class="danger" data-job-delete="${index}">${t('remove')}</button></div></td></tr>`).join('')}</tbody></table></div>`:`<div class="empty"><strong>${t('noTasks')}</strong></div>`}</div>`;
  bind('new-job',()=>jobEditor());
  document.querySelectorAll('[data-job-edit]').forEach(button=>button.onclick=()=>jobEditor(jobs[button.dataset.jobEdit]));
  document.querySelectorAll('[data-job-toggle]').forEach(button=>button.onclick=busy(async()=>{const job=jobs[button.dataset.jobToggle];await api('/api/v1/jobs/'+job.id,{method:'PUT',body:jobPayload(job,{enabled:!job.enabled})});await navigate();}));

pigway_frame_flow/web/extensions.js

@@ -49,7 +49,7 @@ async function officialWidgetControls(info,data){
  const send=cover_id=>confirmDialog(tr('此操作会改变官方订阅和画框内容，是否继续？','This changes the official subscription and frame content. Continue?'),async()=>{const args=cover_id?Object.fromEntries([...document.querySelectorAll('[data-widget-arg]')].filter(x=>x.value).map(x=>[x.dataset.widgetArg,x.value])):{};const r=await api('/api/v1/devices/'+state.device+'/widgets/selection',{method:'POST',body:{cover_id,args},headers:{'Idempotency-Key':'widget-'+clientUUID()}});await waitOperation(r.operation_id);await navigate('templates');});if(!disabled){$('#official-widget-use').onclick=busy(()=>send(Number($('#official-widget-choice').value)));$('#official-widget-cancel').onclick=busy(()=>send(null));}
 }
 function addPhotoQualityFields(source){
- const box=document.createElement('section');box.innerHTML=`<div id="source-local-quality"><h3>${tr('照片筛选','Photo filtering')}</h3><p class="hint">${tr('对 API 获取的预览图按清晰度、亮度和相似度筛选，不修改或删除 NAS 原照片；无法保证识别闭眼。建议先使用较低阈值。','Filters API previews by sharpness, brightness and similarity without modifying or deleting NAS originals. Closed-eye detection is not guaranteed. Start with low thresholds.')}</p><div class="field"><label for="source-people-space">${tr('照片空间','Photo space')}</label><select id="source-people-space"><option value="shared">${tr('共享空间','Shared space')}</option><option value="personal">${tr('个人空间','Personal space')}</option></select></div><div class="form-grid"><div class="field"><label for="source-sharpness">${tr('最低清晰度（0 不筛选）','Minimum sharpness (0 disables)')}</label><input id="source-sharpness" type="number" min="0" max="10000" value="${source?.minimum_sharpness||0}"></div><div class="field"><label for="source-bright-min">${tr('最低亮度','Minimum brightness')}</label><input id="source-bright-min" type="number" min="0" max="255" value="${source?.minimum_brightness||0}"></div><div class="field"><label for="source-bright-max">${tr('最高亮度','Maximum brightness')}</label><input id="source-bright-max" type="number" min="0" max="255" value="${source?.maximum_brightness??255}"></div></div><label class="check-row"><input id="source-dedup" type="checkbox" ${source?.avoid_duplicates?'checked':''}>${tr('避开最近 200 张的相似照片','Avoid photos similar to the last 200 selections')}</label></div><div class="field"><label for="source-oauth">${tr('网盘 OAuth 凭据 JSON（可选；仅原生网盘）','Drive OAuth credentials JSON (optional; native drives only)')}</label><input id="source-oauth" type="password" autocomplete="off" placeholder='{"access_token":"…","drive_id":"…"}'></div>`;$('#photo-source-form .modal-actions').before(box);$('#source-people-space').value=source?.people_space||'shared';
+ const box=document.createElement('section');box.innerHTML=`<div id="source-local-quality"><h3>${tr('照片筛选','Photo filtering')}</h3><p class="hint">${tr('对 API 获取的预览图按清晰度、亮度和相似度筛选，不修改或删除 NAS 原照片；无法保证识别闭眼。建议先使用较低阈值。','Filters API previews by sharpness, brightness and similarity without modifying or deleting NAS originals. Closed-eye detection is not guaranteed. Start with low thresholds.')}</p><div class="field"><label for="source-people-space">${tr('照片空间','Photo space')}</label><select id="source-people-space"><option value="shared">${tr('共享空间','Shared space')}</option><option value="personal">${tr('个人空间','Personal space')}</option></select></div><div class="form-grid">${[['short','minimum_short_edge',tr('最小短边（像素）','Minimum short edge (px)')],['long','minimum_long_edge',tr('最小长边（像素）','Minimum long edge (px)')]].map(([id,key,label])=>`<div class="field"><label for="source-min-${id}">${label}</label><input id="source-min-${id}" type="number" min="0" max="50000" step="1" value="${source?.[key]||0}"></div>`).join('')}</div><p class="hint">${tr('0 表示不限制；按源照片和实际取得的预览图像素筛选，横竖图通用。可从短边 1200、长边 1600 开始设置；分辨率不代表对焦清晰度。','0 disables. Checks source and downloaded preview dimensions regardless of orientation. Start with short edge 1200 and long edge 1600; pixel count does not measure focus.')}</p><div class="form-grid"><div class="field"><label for="source-sharpness">${tr('最低清晰度（0 不筛选）','Minimum sharpness (0 disables)')}</label><input id="source-sharpness" type="number" min="0" max="10000" value="${source?.minimum_sharpness||0}"></div><div class="field"><label for="source-bright-min">${tr('最低亮度','Minimum brightness')}</label><input id="source-bright-min" type="number" min="0" max="255" value="${source?.minimum_brightness||0}"></div><div class="field"><label for="source-bright-max">${tr('最高亮度','Maximum brightness')}</label><input id="source-bright-max" type="number" min="0" max="255" value="${source?.maximum_brightness??255}"></div></div><label class="check-row"><input id="source-dedup" type="checkbox" ${source?.avoid_duplicates?'checked':''}>${tr('避开最近 200 张的相似照片','Avoid photos similar to the last 200 selections')}</label></div><div class="field"><label for="source-oauth">${tr('网盘 OAuth 凭据 JSON（可选；仅原生网盘）','Drive OAuth credentials JSON (optional; native drives only)')}</label><input id="source-oauth" type="password" autocomplete="off" placeholder='{"access_token":"…","drive_id":"…"}'></div>`;$('#photo-source-form .modal-actions').before(box);$('#source-people-space').value=source?.people_space||'shared';
 
 }
 async function aiImagePanel(){

pigway_frame_flow/web/features.js

@@ -14,7 +14,7 @@ function editTemplateSource(source){state.selectedTemplate=source.template;state
 async function enhanceDashboard(){
  const epoch=state.epoch;const frame=$('.frame-demo');const panel=document.createElement('section');panel.className='card';$('#main').append(panel);
  const current=await currentPanel(panel);if(epoch!==state.epoch)return;
- if(current.preview_url){frame.innerHTML=`<button id="current-frame-preview" class="current-frame-preview" aria-label="${t('original')} · ${t('currentContent')} #${esc(current.image_id)}"><img id="current-frame-image" alt="${t('currentContent')}"></button><span class="frame-label">${t('currentContent')} #${esc(current.image_id)}</span>`;const original=new URL(current.preview_url,location.origin);original.searchParams.delete('thumbnail');bind('current-frame-preview',()=>openImageViewer(original.pathname+original.search,`${t('currentContent')} #${current.image_id}`));void blobImage($('#current-frame-image'),current.preview_url);}else{frame.innerHTML=`<div class="mini-art"><div class="sun"></div></div><span class="frame-label">${t('testLabel')}</span>`;}
+ if(current.preview_url){frame.innerHTML=`<button id="current-frame-preview" class="current-frame-preview" aria-label="${t('original')} · ${t('currentContent')} #${esc(current.image_id)}"><img id="current-frame-image" alt="${t('currentContent')}"></button><span class="frame-label">${t('currentContent')} #${esc(current.image_id)}</span>`;const original=new URL(current.preview_url,location.origin);original.searchParams.delete('thumbnail');bind('current-frame-preview',()=>openImageViewer(original.pathname+original.search,`${t('currentContent')} #${current.image_id}`));void blobImage($('#current-frame-image'),original.pathname+original.search);}else{frame.innerHTML=`<div class="mini-art"><div class="sun"></div></div><span class="frame-label">${t('testLabel')}</span>`;}
  const weather=await api('/api/v1/providers/weather');if(epoch!==state.epoch)return;const box=document.createElement('section');box.className='card';box.innerHTML=`<h3>${t('weather')}</h3><p>${esc(weather.current.location)} · ${esc(weather.current.temperature)} · ${esc(weather.current.summary)}</p><p class="hint">${weather.current.mock?t('weatherMock'):t('weatherAttribution')}${weather.current.stale?' · '+t('stale'):''}</p>`;$('#main').append(box);
 }
 async function enhanceTemplates(){
@@ -33,14 +33,14 @@ function displayDialog(content){
 }
 function enhanceGallery(){
  const grid=$('.gallery');if(!grid)return;
- const controls=document.createElement('div');controls.className='form-grid';controls.innerHTML=`<div class="field"><label for="gallery-search">${t('searchImages')}</label><input id="gallery-search" type="search"></div><div class="field"><label for="gallery-sort">${t('sortOrder')}</label><select id="gallery-sort"><option value="newest">${t('sortNewest')}</option><option value="oldest">${t('sortOldest')}</option><option value="name">${t('sortName')}</option></select></div>`;grid.before(controls);
+ const controls=document.createElement('div');controls.className='form-grid gallery-filters';controls.innerHTML=`<div class="field"><label for="gallery-search">${t('searchImages')}</label><input id="gallery-search" type="search"></div><div class="field"><label for="gallery-sort">${t('sortOrder')}</label><select id="gallery-sort"><option value="newest">${t('sortNewest')}</option><option value="oldest">${t('sortOldest')}</option><option value="name">${t('sortName')}</option></select></div>`;grid.before(controls);
- if(state.tab==='local'){const bar=document.createElement('div');bar.className='actions';bar.innerHTML=`<select id="asset-origin" aria-label="${t('originFilter')}">${['all','manual','task','external','template','unknown'].map(x=>`<option value="${x}">${t('origin_'+x)}</option>`).join('')}</select><select id="asset-job" aria-label="${t('taskOrigin')}"><option value="">${t('allTasks')}</option></select><button id="asset-prev">${t('previousPage')}</button><button id="asset-next">${t('nextPage')}</button><button id="asset-all">${t('selectAll')}</button><button id="asset-invert">${t('invertSelection')}</button><button id="asset-batch-star">${t('star')}</button><button id="asset-batch-unstar">${t('unstar')}</button><button id="asset-batch-delete" class="danger">${t('deleteSelected')}</button>`;grid.before(bar);const help=document.createElement('p');help.className='hint';help.id='gallery-selection-help';help.textContent=t('gallerySelectionHelp')+' '+t('starHelp');grid.before(help);bar.setAttribute('aria-describedby',help.id);$('#asset-origin').value=state.assetOrigin||'all';if(state.galleryJobsEpoch!==state.epoch){state.galleryJobsEpoch=state.epoch;state.galleryJobsRequest=api('/api/v1/jobs');}void state.galleryJobsRequest.then(jobs=>{if(!bar.isConnected)return;const picker=bar.querySelector('#asset-job');for(const job of jobs){const option=document.createElement('option');option.value=job.id;option.textContent=job.name;picker.append(option);}picker.value=state.assetJob||'';}).catch(error=>{if(bar.isConnected)toast(error.message);});$('#asset-origin').onchange=()=>{state.assetOffset=0;state.assetOrigin=$('#asset-origin').value;return navigate();};$('#asset-job').onchange=()=>{state.assetOffset=0;state.assetJob=$('#asset-job').value;state.assetOrigin=state.assetJob?'task':state.assetOrigin;return navigate();};$('#asset-prev').disabled=!(state.assetOffset||0);$('#asset-next').disabled=state.gallery.length<200;bind('asset-prev',()=>{state.assetOffset=Math.max(0,(state.assetOffset||0)-200);return navigate();});bind('asset-next',()=>{state.assetOffset=(state.assetOffset||0)+200;return navigate();});const visibleSelection=()=>[...grid.querySelectorAll('.asset-select')].filter(x=>!x.closest('.image-card').hidden);$('#asset-all').onclick=()=>{const boxes=visibleSelection();const checked=boxes.some(x=>!x.checked);boxes.forEach(x=>x.checked=checked);};$('#asset-invert').onclick=()=>visibleSelection().forEach(x=>x.checked=!x.checked);for(const action of ['star','unstar','delete']){bind('asset-batch-'+action,async()=>{const ids=[...document.querySelectorAll('.asset-select:checked')].map(x=>x.dataset.asset);if(!ids.length){toast(t('selectImagesFirst'));return;}if(action==='delete'&&!confirm(t('deleteSelectedConfirm')))return;const results=[];for(let i=0;i<ids.length;i+=100){const r=await api('/api/v1/assets/batch',{method:'POST',body:{asset_ids:ids.slice(i,i+100),action}});results.push(...r.results);}const failed=results.filter(x=>x.status==='failed');if(failed.length)toast(t('batchFailed')+' '+failed.length);await navigate();});}}
+ if(state.tab==='local'){controls.classList.add('gallery-filters-local');const bar=document.createElement('div');bar.className='actions';bar.innerHTML=`<select id="asset-origin" aria-label="${t('originFilter')}">${['all','manual','task','external','template','unknown'].map(x=>`<option value="${x}">${t('origin_'+x)}</option>`).join('')}</select><select id="asset-job" aria-label="${t('taskOrigin')}"><option value="">${t('allTasks')}</option></select><button id="asset-prev">${t('previousPage')}</button><button id="asset-next">${t('nextPage')}</button><button id="asset-all">${t('selectAll')}</button><button id="asset-invert">${t('invertSelection')}</button><button id="asset-batch-star">${t('star')}</button><button id="asset-batch-unstar">${t('unstar')}</button><button id="asset-batch-delete" class="danger">${t('deleteSelected')}</button>`;grid.before(bar);for(const [id,key] of [['asset-origin','originFilter'],['asset-job','taskOrigin']]){const field=document.createElement('div');field.className='field';const label=document.createElement('label');label.htmlFor=id;label.textContent=t(key);field.append(label,bar.querySelector('#'+id));controls.append(field);}const help=document.createElement('p');help.className='hint';help.id='gallery-selection-help';help.textContent=t('gallerySelectionHelp')+' '+t('starHelp');grid.before(help);bar.setAttribute('aria-describedby',help.id);$('#asset-origin').value=state.assetOrigin||'all';if(state.galleryJobsEpoch!==state.epoch){state.galleryJobsEpoch=state.epoch;state.galleryJobsRequest=api('/api/v1/jobs');}void state.galleryJobsRequest.then(jobs=>{if(!bar.isConnected)return;const picker=bar.querySelector('#asset-job');for(const job of jobs){const option=document.createElement('option');option.value=job.id;option.textContent=job.name;picker.append(option);}picker.value=state.assetJob||'';}).catch(error=>{if(bar.isConnected)toast(error.message);});$('#asset-origin').onchange=()=>{state.assetOffset=0;state.assetOrigin=$('#asset-origin').value;return navigate();};$('#asset-job').onchange=()=>{state.assetOffset=0;state.assetJob=$('#asset-job').value;state.assetOrigin=state.assetJob?'task':state.assetOrigin;return navigate();};$('#asset-prev').disabled=!(state.assetOffset||0);$('#asset-next').disabled=state.gallery.length<200;bind('asset-prev',()=>{state.assetOffset=Math.max(0,(state.assetOffset||0)-200);return navigate();});bind('asset-next',()=>{state.assetOffset=(state.assetOffset||0)+200;return navigate();});const visibleSelection=()=>[...grid.querySelectorAll('.asset-select')].filter(x=>!x.closest('.image-card').hidden);$('#asset-all').onclick=()=>{const boxes=visibleSelection();const checked=boxes.some(x=>!x.checked);boxes.forEach(x=>x.checked=checked);};$('#asset-invert').onclick=()=>visibleSelection().forEach(x=>x.checked=!x.checked);for(const action of ['star','unstar','delete']){bind('asset-batch-'+action,async()=>{const ids=[...document.querySelectorAll('.asset-select:checked')].map(x=>x.dataset.asset);if(!ids.length){toast(t('selectImagesFirst'));return;}if(action==='delete'&&!confirm(t('deleteSelectedConfirm')))return;const results=[];for(let i=0;i<ids.length;i+=100){const r=await api('/api/v1/assets/batch',{method:'POST',body:{asset_ids:ids.slice(i,i+100),action}});results.push(...r.results);}const failed=results.filter(x=>x.status==='failed');if(failed.length)toast(t('batchFailed')+' '+failed.length);await navigate();});}}
  const cards=[...grid.querySelectorAll('.image-card')];$('#gallery-search').oninput=()=>{state.galleryQuery=$('#gallery-search').value;const query=state.galleryQuery.toLowerCase();cards.forEach(card=>card.hidden=!card.textContent.toLowerCase().includes(query));};$('#gallery-sort').onchange=()=>{const order=$('#gallery-sort').value;state.galleryOrder=order;const indexes=cards.map((card,index)=>({card,item:state.gallery[index]}));indexes.sort((a,b)=>order==='name'?a.item.name.localeCompare(b.item.name):order==='oldest'?String(a.item.created_at).localeCompare(String(b.item.created_at)):String(b.item.created_at).localeCompare(String(a.item.created_at)));indexes.forEach(x=>grid.append(x.card));};
  cards.forEach((card,i)=>{const item=state.gallery[i];if(state.tab==='local'){const star=document.createElement('button');star.textContent=t(item.starred?'unstar':'star');star.setAttribute('aria-pressed',String(item.starred));card.querySelector('.actions').append(star);star.onclick=busy(async()=>{await api('/api/v1/assets/'+item.asset_id+'/star',{method:'PUT',body:{starred:!item.starred}});await navigate();});const label=document.createElement('small');label.textContent=item.origin==='task'?t('taskOrigin')+' · '+(item.job_name||item.job_id):t('origin_'+item.origin);card.querySelector('h3').after(label);const select=document.createElement('input');select.type='checkbox';select.className='asset-select';select.dataset.asset=item.asset_id;select.setAttribute('aria-label',t('selectImage'));card.prepend(select);}if(item.width&&item.height){const dimensions=document.createElement('small');dimensions.textContent=item.width+' × '+item.height;card.querySelector('h3').after(dimensions);}const download=document.createElement('button');download.textContent=t('download');card.querySelector('.actions').append(download);download.onclick=busy(()=>downloadImage(item.url,item.name));if(state.tab==='local'){const edit=document.createElement('button');edit.textContent=t('continueEdit');card.querySelector('.actions').append(edit);edit.onclick=busy(async()=>{const meta=await api('/api/v1/assets/'+item.asset_id+'/source');if(meta.source?.type==='template')await editTemplateSource(meta.source);else toast(t('templateSourceUnavailable'));});}});
  $('#gallery-search').value=state.galleryQuery||'';$('#gallery-sort').value=state.galleryOrder||'newest';$('#gallery-search').oninput();$('#gallery-sort').onchange();
 }
 async function weatherSettings(){
- const weather=await api('/api/v1/providers/weather');const box=document.createElement('section');box.className='card';box.innerHTML=`<h3>${t('weatherSettings')}</h3><form id="weather-form"><div class="field"><label for="weather-provider">${t('weatherSettings')}</label><select id="weather-provider"><option value="mock">${t('weatherMock')}</option><option value="open-meteo">Open-Meteo</option></select></div><div class="field"><label for="weather-location">${t('location')}</label><input id="weather-location" required maxlength="120" value="${esc(weather.config.location)}"></div><div class="form-grid">${['latitude','longitude'].map(k=>`<div class="field"><label for="weather-${k}">${t(k)}</label><input id="weather-${k}" required type="number" step="any" min="${k==='latitude'?-90:-180}" max="${k==='latitude'?90:180}" value="${weather.config[k]}"></div>`).join('')}</div><button type="submit" class="primary">${t('save')}</button></form><div id="weather-result"></div>`;$('#main').append(box);$('#weather-provider').value=weather.config.provider;
+ const weather=await api('/api/v1/providers/weather');const box=document.createElement('section');box.className='card';box.innerHTML=`<h3>${t('weatherSettings')}</h3><form id="weather-form"><div class="field"><label for="weather-provider">${t('weatherSettings')}</label><select id="weather-provider"><option value="mock">${t('weatherMock')}</option><option value="open-meteo">Open-Meteo</option></select></div><div class="field"><label for="weather-location">${t('location')}</label><input id="weather-location" required maxlength="120" value="${esc(weather.config.location)}"></div><div class="form-grid weather-coordinates">${['latitude','longitude'].map(k=>`<div class="field"><label for="weather-${k}">${t(k)}</label><input id="weather-${k}" required type="number" step="any" min="${k==='latitude'?-90:-180}" max="${k==='latitude'?90:180}" value="${weather.config[k]}"></div>`).join('')}</div><button type="submit" class="primary">${t('save')}</button></form><div id="weather-result"></div>`;$('#main').append(box);$('#weather-provider').value=weather.config.provider;
  function result(w){$('#weather-result').innerHTML=`<p>${esc(w.current.temperature)} · ${esc(w.current.summary)}</p><p class="hint">${w.current.mock?t('weatherMock'):t('weatherAttribution')}${w.current.stale?' · '+t('stale'):''}</p><h4>${t('forecast')}</h4>${w.forecast.map(x=>`<p>${esc(x.date)} · ${esc(x.summary)} · ${x.minimum_c}–${x.maximum_c}°C · ${x.rain_probability}%</p>`).join('')}`;}
  result(weather);$('#weather-form').onsubmit=busy(async e=>{e.preventDefault();await api('/api/v1/settings/weather',{method:'PUT',body:{provider:$('#weather-provider').value,location:$('#weather-location').value,latitude:Number($('#weather-latitude').value),longitude:Number($('#weather-longitude').value)}});result(await api('/api/v1/providers/weather'));toast(t('done'));});
 }
@@ -150,9 +150,9 @@ async function photoSourcesPanel(){
  section.querySelectorAll('[data-source-job]').forEach(b=>b.onclick=()=>sourceJobForm(b.dataset.sourceJob));
 }
 async function photoSourceForm(source=null){
- showModal(`<h2>${t(source?'edit':'addSource')}</h2><p class="notice">${t('sourceIndependentHelp')}</p><form id="photo-source-form"><input id="source-id" type="hidden" value="${esc(source?.id||'photos-'+clientUUID())}"><div class="field"><label for="source-name">${t('name')}</label><input id="source-name" required maxlength="120" value="${esc(source?.name||'')}"></div><div class="field" ${!source||source.kind==='synology-photos'?'hidden':''}><label for="source-kind">${t('sourceKind')}</label><select id="source-kind"><option value="synology-photos">${t('synologyAPISource')}</option><option value="webdav">WebDAV</option><option value="google-drive">Google Drive</option><option value="alipan">阿里云盘 / AliPan</option><option value="baidu">百度网盘 / Baidu</option></select></div><div class="field"><label for="source-location">${t('sourceLocation')}</label><input id="source-location" required maxlength="2048" value="${esc(source?.location||'.')}"><p class="hint">${t('sourceLocationHint')}</p></div><div class="field"><label for="source-credential">${t('sourceCredential')}</label><input id="source-credential" pattern="FRAME_FLOW_SOURCE_[A-Z0-9_]+" value="${esc(source?.credential_env||'')}" placeholder="FRAME_FLOW_SOURCE_CLOUD"><p class="hint">${t('sourceCredentialHint')}</p></div><div class="field"><label for="source-orientation">${t('photoOrientation')}</label><select id="source-orientation">${source&&!source.orientation?`<option value="">${t('orientationLegacy')}</option>`:''}<option value="auto">${t('orientationAuto')}</option><option value="landscape">${t('orientationLandscape')}</option><option value="portrait">${t('orientationPortrait')}</option></select><p class="hint">${t('orientationHint')}</p></div><div class="field"><label class="check-row"><input id="source-organized" type="checkbox" ${source?.organized_only?'checked':''}>${t('organizedPhotos')}</label><label class="check-row"><input id="source-caption" type="checkbox" ${!source||source.folder_caption?'checked':''}>${t('folderCaption')}</label><label hidden><input id="source-synology-previews" type="checkbox" disabled></label><p class="hint">${t('folderCaptionHint')}</p></div><div class="field"><label class="check-row"><input id="source-people-filter" type="checkbox" ${source?.people_filter?'checked':''}>${t('peopleFilter')}</label><p class="hint">${t('peopleHint')}</p><button id="source-people-load" type="button">${t('choosePeople')}</button><div id="source-people-panel"><p class="hint">${t('peopleSelected')}${(source?.person_ids||[]).length}</p></div><label for="source-person-match">${t('personMatch')}</label><select id="source-person-match"><option value="any">${t('personAny')}</option><option value="all">${t('personAll')}</option></select></div><div class="field"><label class="check-row"><input id="source-recursive" type="checkbox" ${source?.recursive===false?'':'checked'}>${t('sourceRecursive')}</label><label class="check-row"><input id="source-enabled" type="checkbox" ${source?.enabled===false?'':'checked'}>${t('enabled')}</label></div><div class="modal-actions">${buttons('modal-cancel','cancel')}<button type="submit" class="primary">${t('save')}</button></div></form>`);
+ showModal(`<h2>${t(source?'edit':'addSource')}</h2><p class="notice">${t('sourceIndependentHelp')}</p><form id="photo-source-form"><input id="source-id" type="hidden" value="${esc(source?.id||'photos-'+clientUUID())}"><div class="field"><label for="source-name">${t('name')}</label><input id="source-name" required maxlength="120" value="${esc(source?.name||'')}"></div><div class="field" ${!source||source.kind==='synology-photos'?'hidden':''}><label for="source-kind">${t('sourceKind')}</label><select id="source-kind"><option value="synology-photos">${t('synologyAPISource')}</option><option value="webdav">WebDAV</option><option value="google-drive">Google Drive</option><option value="alipan">阿里云盘 / AliPan</option><option value="baidu">百度网盘 / Baidu</option></select></div><div class="field"><label for="source-location">${t('sourceLocation')}</label><input id="source-location" required maxlength="2048" value="${esc(source?.location||'.')}"><p class="hint">${t('sourceLocationHint')}</p></div><div class="field" id="source-nas-root-field"><label for="source-nas-root">${tr('NAS 原照片根目录（仅用于显示路径）','NAS original root (display only)')}</label><input id="source-nas-root" pattern="/.*" maxlength="2048" placeholder="/volume1/photo" value="${esc(source?.nas_root_path||'')}"><p class="hint">${tr('共享空间通常为 /volume1/photo，请填写实际 NAS 根目录；留空时显示 Photos 空间内路径。','Enter the actual NAS root; shared space is commonly /volume1/photo. Blank shows the path within Photos.')}</p></div><div class="field"><label for="source-credential">${t('sourceCredential')}</label><input id="source-credential" pattern="FRAME_FLOW_SOURCE_[A-Z0-9_]+" value="${esc(source?.credential_env||'')}" placeholder="FRAME_FLOW_SOURCE_CLOUD"><p class="hint">${t('sourceCredentialHint')}</p></div><div class="field"><label for="source-orientation">${t('photoOrientation')}</label><select id="source-orientation">${source&&!source.orientation?`<option value="">${t('orientationLegacy')}</option>`:''}<option value="auto">${t('orientationAuto')}</option><option value="landscape">${t('orientationLandscape')}</option><option value="portrait">${t('orientationPortrait')}</option></select><p class="hint">${t('orientationHint')}</p></div><div class="field"><label class="check-row"><input id="source-organized" type="checkbox" ${source?.organized_only?'checked':''}>${t('organizedPhotos')}</label><label class="check-row"><input id="source-caption" type="checkbox" ${!source||source.folder_caption?'checked':''}>${t('folderCaption')}</label><label hidden><input id="source-synology-previews" type="checkbox" disabled></label><p class="hint">${t('folderCaptionHint')}</p></div><div class="field"><label class="check-row"><input id="source-people-filter" type="checkbox" ${source?.people_filter?'checked':''}>${t('peopleFilter')}</label><p class="hint">${t('peopleHint')}</p><button id="source-people-load" type="button">${t('choosePeople')}</button><div id="source-people-panel"><p class="hint">${t('peopleSelected')}${(source?.person_ids||[]).length}</p></div><label for="source-person-match">${t('personMatch')}</label><select id="source-person-match"><option value="any">${t('personAny')}</option><option value="all">${t('personAll')}</option></select></div><div class="field"><label class="check-row"><input id="source-recursive" type="checkbox" ${source?.recursive===false?'':'checked'}>${t('sourceRecursive')}</label><label class="check-row"><input id="source-enabled" type="checkbox" ${source?.enabled===false?'':'checked'}>${t('enabled')}</label></div><div class="modal-actions">${buttons('modal-cancel','cancel')}<button type="submit" class="primary">${t('save')}</button></div></form>`);
- $('#source-orientation').value=source?(source.orientation||''):'auto';const selectedPeople=new Set(source?.person_ids||[]);$('#source-person-match').value=source?.person_match||'any';$('#source-people-load').onclick=busy(async()=>{await photosPeoplePicker(selectedPeople);});$('#source-kind').value=source?.kind||'synology-photos';const update=()=>{const photosAPI=$('#source-kind').value==='synology-photos';$('#source-location').labels[0].textContent=photosAPI?tr('照片目录','Photo folder'):t('sourceLocation');$('#source-location').nextElementSibling.textContent=photosAPI?tr('填写所选空间内的目录路径，. 表示整个空间。按需获取 XL 预览图，不下载原图。','Folder path within the selected space; . means the whole space. Downloads XL previews on demand, not originals.'):t('sourceLocationHint');const dav=!['local','synology-photos'].includes($('#source-kind').value);$('#source-orientation').disabled=dav;$('#source-credential').disabled=!dav;$('#source-credential').closest('.field').hidden=$('#source-kind').value!=='webdav';const oauth=$('#source-oauth');if(oauth)oauth.closest('.field').hidden=!['google-drive','alipan','baidu'].includes($('#source-kind').value);const quality=$('#source-local-quality');if(quality)quality.hidden=dav;$('#source-recursive').disabled=$('#source-kind').value==='webdav';$('#source-synology-previews').disabled=$('#source-kind').value!=='local';$('#source-organized').disabled=dav;$('#source-caption').disabled=dav;$('#source-people-filter').disabled=dav;$('#source-people-load').disabled=dav;};addPhotoQualityFields(source);$('#source-location').closest('.field').before($('#source-people-space').closest('.field'));update();$('#source-kind').onchange=update;$('#source-people-space').onchange=()=>{selectedPeople.clear();$('#source-people-panel').innerHTML='';};
+ $('#source-orientation').value=source?(source.orientation||''):'auto';const selectedPeople=new Set(source?.person_ids||[]);$('#source-person-match').value=source?.person_match||'any';$('#source-people-load').onclick=busy(async()=>{await photosPeoplePicker(selectedPeople);});$('#source-kind').value=source?.kind||'synology-photos';const update=()=>{const photosAPI=$('#source-kind').value==='synology-photos';$('#source-nas-root-field').hidden=!photosAPI;$('#source-location').labels[0].textContent=photosAPI?tr('照片目录','Photo folder'):t('sourceLocation');$('#source-location').nextElementSibling.textContent=photosAPI?tr('填写所选空间内的目录路径，. 表示整个空间。按需获取 XL 预览图，不下载原图。','Folder path within the selected space; . means the whole space. Downloads XL previews on demand, not originals.'):t('sourceLocationHint');const dav=!['local','synology-photos'].includes($('#source-kind').value);$('#source-orientation').disabled=dav;$('#source-credential').disabled=!dav;$('#source-credential').closest('.field').hidden=$('#source-kind').value!=='webdav';const oauth=$('#source-oauth');if(oauth)oauth.closest('.field').hidden=!['google-drive','alipan','baidu'].includes($('#source-kind').value);const quality=$('#source-local-quality');if(quality)quality.hidden=dav;$('#source-recursive').disabled=$('#source-kind').value==='webdav';$('#source-synology-previews').disabled=$('#source-kind').value!=='local';$('#source-organized').disabled=dav;$('#source-caption').disabled=dav;$('#source-people-filter').disabled=dav;$('#source-people-load').disabled=dav;};addPhotoQualityFields(source);$('#source-location').closest('.field').before($('#source-people-space').closest('.field'));update();$('#source-kind').onchange=update;$('#source-people-space').onchange=()=>{selectedPeople.clear();$('#source-people-panel').innerHTML='';};
- $('#photo-source-form').onsubmit=busy(async e=>{e.preventDefault();const oauth=$('#source-oauth').value;const sourceId=$('#source-id').value;const native=['google-drive','alipan','baidu'].includes($('#source-kind').value);if(oauth&&native)JSON.parse(oauth);const dav=!['local','synology-photos'].includes($('#source-kind').value);await api('/api/v1/photo-sources/'+$('#source-id').value,{method:'PUT',body:{name:$('#source-name').value,kind:$('#source-kind').value,location:$('#source-location').value,recursive:$('#source-kind').value!=='webdav'&&$('#source-recursive').checked,synology_previews:false,catalog_limit:$('#source-organized').checked?100000:(source?.catalog_limit||10000),organized_only:!dav&&$('#source-organized').checked,folder_caption:!dav&&$('#source-caption').checked,orientation:dav?null:($('#source-orientation').value||null),people_filter:!dav&&$('#source-people-filter').checked,person_ids:[...selectedPeople],person_match:$('#source-person-match').value,people_space:$('#source-people-space').value,minimum_sharpness:Number($('#source-sharpness').value),minimum_brightness:Number($('#source-bright-min').value),maximum_brightness:Number($('#source-bright-max').value),avoid_duplicates:$('#source-dedup').checked,enabled:$('#source-enabled').checked,credential_env:dav?($('#source-credential').value||null):null}});if(oauth&&native){$('#source-oauth').value='';await api('/api/v1/photo-sources/'+sourceId+'/credentials',{method:'PUT',body:{key:oauth}});}$('#modal').close();await navigate('photo-sources');});
+ $('#photo-source-form').onsubmit=busy(async e=>{e.preventDefault();const oauth=$('#source-oauth').value;const sourceId=$('#source-id').value;const native=['google-drive','alipan','baidu'].includes($('#source-kind').value);if(oauth&&native)JSON.parse(oauth);const dav=!['local','synology-photos'].includes($('#source-kind').value);await api('/api/v1/photo-sources/'+$('#source-id').value,{method:'PUT',body:{name:$('#source-name').value,kind:$('#source-kind').value,location:$('#source-location').value,nas_root_path:$('#source-nas-root').value||null,recursive:$('#source-kind').value!=='webdav'&&$('#source-recursive').checked,synology_previews:false,catalog_limit:$('#source-organized').checked?100000:(source?.catalog_limit||10000),organized_only:!dav&&$('#source-organized').checked,folder_caption:!dav&&$('#source-caption').checked,orientation:dav?null:($('#source-orientation').value||null),people_filter:!dav&&$('#source-people-filter').checked,person_ids:[...selectedPeople],person_match:$('#source-person-match').value,people_space:$('#source-people-space').value,minimum_short_edge:Number($('#source-min-short').value),minimum_long_edge:Number($('#source-min-long').value),minimum_sharpness:Number($('#source-sharpness').value),minimum_brightness:Number($('#source-bright-min').value),maximum_brightness:Number($('#source-bright-max').value),avoid_duplicates:$('#source-dedup').checked,enabled:$('#source-enabled').checked,credential_env:dav?($('#source-credential').value||null):null}});if(oauth&&native){$('#source-oauth').value='';await api('/api/v1/photo-sources/'+sourceId+'/credentials',{method:'PUT',body:{key:oauth}});}$('#modal').close();await navigate('photo-sources');});
 }
 async function browseSource(id,offset=0,refresh=false){
  const result=await api('/api/v1/photo-sources/'+id+'/images?device_id='+encodeURIComponent(state.device)+'&offset='+offset+'&limit=50&refresh='+refresh);const box=$('#source-browser');if(!box)return;

pigway_frame_flow/web/index.html

@@ -1,3 +1,3 @@
 <!doctype html>
-<html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover"><meta name="color-scheme" content="light dark"><title>Pigway Frame Flow</title><link rel="stylesheet" href="/ui/style.css"></head>
+<html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover"><meta name="color-scheme" content="light dark"><title>PIGWay Frame Flow</title><link rel="stylesheet" href="/ui/style.css"></head>
-<body><aside class="sidebar"><a class="brand" href="/"><span class="brand-icon">F<span>↗</span></span><span>Frame Flow<small>Pigway · Smart Frame Automation</small></span></a><nav id="nav"></nav><div class="sidebar-bottom"><small>Version 0.1.15</small></div></aside><div class="workspace"><header><div><span class="eyebrow">PIGWAY FRAME FLOW</span><h1 id="page-title"></h1></div><div class="toolbar"><select id="device" aria-label="Device"></select><button id="lang" class="icon-button" aria-label="Change language">EN</button><button id="theme" class="icon-button" aria-label="Change theme">◐</button></div></header><main id="main"></main><footer id="footer"></footer></div><div id="toast" role="status" aria-live="polite"></div><dialog id="modal"><div id="modal-content"></div></dialog><script src="/ui/i18n.js?v=upload-retries-v0115"></script><script src="/ui/features.js?v=upload-retries-v0115"></script><script src="/ui/extensions.js?v=upload-retries-v0115"></script><script src="/ui/app.js?v=upload-retries-v0115"></script></body></html>
+<body><aside class="sidebar"><a class="brand" href="/"><span>PIGWay Frame Flow<small>Smart Frame Automation</small></span></a><nav id="nav"></nav><div class="sidebar-bottom"><small>Version 0.1.19</small></div></aside><div class="workspace"><header><div><span class="eyebrow">PIGWay Frame Flow</span><h1 id="page-title"></h1></div><div class="toolbar"><select id="device" aria-label="Device"></select><button id="lang" class="icon-button" aria-label="Change language">EN</button><button id="theme" class="icon-button" aria-label="Change theme">◐</button></div></header><main id="main"></main><footer id="footer"></footer></div><div id="toast" role="status" aria-live="polite"></div><dialog id="modal"><div id="modal-content"></div></dialog><script src="/ui/i18n.js?v=photo-quality-v0117"></script><script src="/ui/features.js?v=photo-quality-v0117"></script><script src="/ui/extensions.js?v=photo-quality-v0117"></script><script src="/ui/app.js?v=photo-quality-v0117"></script></body></html>

pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "pigway-frame-flow"
-version = "0.1.15"
+version = "0.1.19"
-requires-python = ">=3.12"
+requires-python = ">=3.14,<3.15"
 dependencies = ["paho-mqtt==2.1.0", "python-dateutil==2.9.0.post0", "fastapi==0.142.2", "uvicorn==0.54.0", "pillow==12.3.0", "requests==2.34.2", "croniter==6.2.4", "python-multipart==0.0.32", "pyyaml==6.0.3"]
 [project.optional-dependencies]
 test = ["pytest==9.1.1", "httpx2==2.13.1", "mypy==2.3.1", "pip-audit==2.10.1", "types-requests==2.33.0.20260906", "types-PyYAML==6.0.12.20260906", "types-croniter==6.2.4.20260711", "ruff==0.16.9"]
@@ -9,6 +9,8 @@ test = ["pytest==9.1.1", "httpx2==2.13.1", "mypy==2.3.1", "pip-audit==2.10.1", "
 pythonpath = ["."]
 testpaths = ["tests"]
 [tool.ruff]
+# Preserve existing syntax/formatting independently of runtime support.
+target-version = "py312"
 exclude = ["vendor", ".venv"]
 [build-system]
 requires = ["setuptools>=75"]

scripts/server-release.py

@@ -13,10 +13,11 @@ import time
 import urllib.request
 from pathlib import Path
 
-APP = Path("/srv/pigway/apps/pigway-frame-flow")
+ROOT = Path(os.getenv("FRAME_FLOW_ROOT", "/srv/frameflow"))
-RECOVERY = Path("/srv/pigway/recovery/frame-flow")
+APP = ROOT / "apps/pigway-frame-flow"
+RECOVERY = ROOT / "recovery/frame-flow"
 CONTAINER = "pigway-frame-flow"
-ORIGIN = "http://192.0.2.10:81"
+ORIGIN = os.getenv("FRAME_FLOW_ORIGIN", "http://127.0.0.1:6005").rstrip("/")
 
 
 def run(*args):
@@ -112,11 +113,14 @@ def verify_runtime(commit):
 
 def main():
     assert os.geteuid() == 0, "Run with sudo on the Ubuntu Server"
+    expected_uuid = os.environ.get("FRAME_FLOW_MOUNT_UUID", "")
+    assert expected_uuid, "Set FRAME_FLOW_MOUNT_UUID to the verified storage UUID"
+    assert os.environ.get("FRAME_FLOW_ORIGIN"), (
+        "Set FRAME_FLOW_ORIGIN to the verified listener"
+    )
     os.umask(0o077)
     run("/usr/local/libexec/pigway-guard-mount")
-    assert run("findmnt", "-n", "-o", "UUID", "/srv/pigway") == (
+    assert run("findmnt", "-n", "-o", "UUID", str(ROOT)) == expected_uuid
-        "00000000-0000-4000-8000-000000000001"
-    )
     with (RECOVERY / ".release.lock").open("a") as lock:
         fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
         release(lock)
@@ -124,7 +128,7 @@ def main():
 
 def release(lock):
     ctx = Path(__file__).resolve().parent.parent
-    assert ctx.parent == Path("/srv/pigway/migration-inbox")
+    assert ctx.parent == ROOT / "migration-inbox"
     commit = (ctx / "RELEASE_COMMIT").read_text().strip()
     assert re.fullmatch("[0-9a-f]{40}", commit)
     hashes = json.loads((ctx / "RELEASE_HASHES.json").read_text())
@@ -151,7 +155,7 @@ def release(lock):
             assert dst.execute("pragma quick_check").fetchone()[0] == "ok"
     base = "pigway-frame-flow:release-base-" + commit[:12]
     run("docker", "image", "tag", before["Image"], base)
-    image = "pigway-frame-flow:0.1.15-" + commit[:12]
+    image = "pigway-frame-flow:0.1.19-" + commit[:12]
     try:
         run(
             "docker",
@@ -193,7 +197,7 @@ def release(lock):
             n: h
             for n, h in hashes.items()
             if n.startswith(("pigway_frame_flow/", "vendor/"))
-            or n == "requirements.lock"
+            or n in {"requirements.lock", "LICENSE", "NOTICE.md"}
         }
         code = 'import hashlib,json,pathlib,sys; h=json.load(sys.stdin); assert all(hashlib.sha256((pathlib.Path("/app")/n).read_bytes()).hexdigest()==v for n,v in h.items())'
         subprocess.run(

scripts/ui-dashboard-preview.cjs

@@ -1,6 +1,6 @@
 /* Isolated Mock only: dashboard and gallery share the same read-only image viewer. */
 const assert=require('assert'),{chromium}=require('playwright');
 (async()=>{const browser=await chromium.launch({headless:true,executablePath:'/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'});let checks=0;
-try{for(const width of [1440,768,390]){const p=await browser.newPage({viewport:{width,height:1000}}),errors=[];p.on('pageerror',e=>errors.push(e.message));await p.route('**/api/v1/devices/*/current-content',r=>r.fulfill({json:{image_id:42,preview_url:'/fixture-preview.svg?thumbnail=true',synced:true,source_known:false,overrides:[]}}));await p.route('**/fixture-preview.svg*',r=>r.fulfill({contentType:'image/svg+xml',body:'<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="900"><rect width="1200" height="900" fill="#6c9c83"/><circle cx="600" cy="450" r="220" fill="#e9d9af"/></svg>'}));await p.route('**/api/v1/devices/*/images',r=>r.fulfill({json:[{image_id:42,name:'Fixture gallery',current:true,url:'/fixture-preview.svg'}]}));
+try{for(const width of [1440,768,390]){const p=await browser.newPage({viewport:{width,height:1000}}),errors=[];p.on('pageerror',e=>errors.push(e.message));await p.route('**/api/v1/devices/*/current-content',r=>r.fulfill({json:{image_id:42,preview_url:'/fixture-preview.svg?thumbnail=true',synced:true,source_known:false,overrides:[]}}));await p.route('**/fixture-preview.svg*',r=>{return r.fulfill({contentType:'image/svg+xml',body:'<svg xmlns="http://www.w3.org/2000/svg" width="WIDTH" height="900"><rect width="1200" height="900" fill="#6c9c83"/><circle cx="600" cy="450" r="220" fill="#e9d9af"/></svg>'.replace('WIDTH',new URL(r.request().url()).searchParams.has('thumbnail')?'300':'1200')});});await p.route('**/api/v1/devices/*/images',r=>r.fulfill({json:[{image_id:42,name:'Fixture gallery',current:true,url:'/fixture-preview.svg'}]}));
 await p.goto(process.env.FRAME_FLOW_URL||'http://127.0.0.1:6005');await p.locator('#username').fill(process.env.FRAME_FLOW_TEST_USERNAME);await p.locator('#password').fill(process.env.FRAME_FLOW_TEST_PASSWORD);await p.locator('#login-form button').click();await p.locator('#current-frame-preview').waitFor();assert(await p.evaluate(()=>state.settings.mock));
 for(const lang of ['zh','en'])for(const theme of ['dark','light']){await p.evaluate(async({lang,theme})=>{state.lang=lang;document.documentElement.dataset.theme=theme;await navigate('dashboard')},{lang,theme});await p.waitForFunction(()=>document.querySelector('#current-frame-image')?.naturalWidth===1200);assert(await p.locator('#current-frame-preview').evaluate(e=>e.getBoundingClientRect().height)>=(width<=720?320:400));assert(await p.evaluate(()=>document.documentElement.scrollWidth<=innerWidth));await p.locator('#current-frame-preview').focus();const fullImage=p.waitForRequest(r=>new URL(r.url()).pathname==='/fixture-preview.svg'&&!new URL(r.url()).searchParams.has('thumbnail'));await p.keyboard.press('Enter');await fullImage;await p.locator('dialog.image-viewer[open]').waitFor();await p.waitForFunction(()=>document.querySelector('#original-image')?.naturalWidth===1200);assert.equal(await p.locator('.image-viewer-name').textContent(),(lang==='zh'?'当前显示内容':'Currently displayed content')+' #42');assert.equal(await p.locator('.image-viewer-actions button').count(),3);const sizing=p.locator('.image-viewer-actions button[aria-pressed]');await sizing.nth(1).click();assert(await p.locator('.image-viewer-viewport').evaluate(e=>e.classList.contains('actual-size')));await sizing.nth(0).click();assert(!await p.locator('.image-viewer-viewport').evaluate(e=>e.classList.contains('actual-size')));await p.keyboard.press('Escape');assert(!await p.locator('#modal').evaluate(e=>e.open));await p.waitForFunction(()=>!document.body.classList.contains('image-viewer-open'));if(process.env.FRAME_FLOW_SCREENSHOT_DIR&&lang==='zh'&&theme==='dark'){require('fs').mkdirSync(process.env.FRAME_FLOW_SCREENSHOT_DIR,{recursive:true});await p.screenshot({path:process.env.FRAME_FLOW_SCREENSHOT_DIR+'/dashboard-'+width+'.png',fullPage:true});}await p.evaluate(()=>navigate('gallery'));await p.locator('[data-original="0"]').click();await p.locator('dialog.image-viewer[open]').waitFor();assert.equal(await p.locator('.image-viewer-actions button').count(),3);await p.locator('#modal-cancel').click();checks++;}assert.deepEqual(errors,[]);await p.close();}console.log('Dashboard preview: '+checks+' profiles PASS; larger preview, keyboard opening, shared gallery viewer, fit/actual size, Escape, no overflow');}finally{await browser.close()}})().catch(e=>{console.error(e);process.exit(1)});

scripts/ui-layout-audit.cjs

@@ -9,12 +9,12 @@ const assert=require('assert');const fs=require('fs');const {chromium}=require('
  await page.route('**/api/v1/integrations/synology-photos',async route=>{if(route.request().method()==='POST'){assert.deepStrictEqual(route.request().postDataJSON(),{username:'fixture-nas',password:'fixture-only'});connected=true;logins++;}await route.fulfill({json:{configured:true,connected}});});
  await page.route('**/api/v1/photo-sources',async route=>{assert(route.request().method()==='GET');await route.fulfill({json:[{id:'fixture-source',name:'NAS photos / NAS 照片',kind:'local',location:'.',enabled:false,people_filter:true,orientation:'auto'}]});});
  await page.goto(base);await page.locator('#username').fill(process.env.FRAME_FLOW_TEST_USERNAME);await page.locator('#password').fill(process.env.FRAME_FLOW_TEST_PASSWORD);await page.locator('#login-form button').click();await page.locator('.hero').waitFor();
- const viewports=process.env.FRAME_FLOW_VIEWPORTS?JSON.parse(process.env.FRAME_FLOW_VIEWPORTS):[1440,768,390].map(width=>({width,height:900}));
+ const viewports=process.env.FRAME_FLOW_VIEWPORTS?JSON.parse(process.env.FRAME_FLOW_VIEWPORTS):[1920,1440,768,390].map(width=>({width,height:900}));
  let checks=0;const failures=[];const out=process.env.FRAME_FLOW_SCREENSHOT_DIR;if(out)fs.mkdirSync(out,{recursive:true});
  async function inspect(label){
   const result=await page.evaluate(()=>{
-   const root=document.querySelector('dialog[open]')||document.querySelector('#main');const controls=[...root.querySelectorAll('button,select,input:not([type=checkbox]):not([type=radio]):not([type=file]),textarea')].filter(e=>e.checkVisibility({checkOpacity:true,checkVisibilityCSS:true})&&!e.closest('[hidden]')).map(e=>({id:e.id||e.textContent.trim().slice(0,24),r:e.getBoundingClientRect()}));const close=[];
+   const root=document.querySelector('dialog[open]')||document.querySelector('#main');const controls=[...root.querySelectorAll('button,select,input:not([type=checkbox]):not([type=radio]):not([type=file]),textarea')].filter(e=>e.checkVisibility({checkOpacity:true,checkVisibilityCSS:true})&&!e.closest('[hidden]')).map(e=>({id:e.id||e.textContent.trim().slice(0,24),compact:!!e.closest('.image-card .actions'),r:e.getBoundingClientRect()}));const close=[];
-   for(let i=0;i<controls.length;i++)for(let j=i+1;j<controls.length;j++){const a=controls[i].r,b=controls[j].r;const x=Math.min(a.right,b.right)-Math.max(a.left,b.left),y=Math.min(a.bottom,b.bottom)-Math.max(a.top,b.top);const dx=Math.max(a.left,b.left)-Math.min(a.right,b.right),dy=Math.max(a.top,b.top)-Math.min(a.bottom,b.bottom);if((x>1&&dy<7.5)||(y>1&&dx<7.5))close.push([controls[i].id,controls[j].id]);}
+   for(let i=0;i<controls.length;i++)for(let j=i+1;j<controls.length;j++){const a=controls[i].r,b=controls[j].r;const x=Math.min(a.right,b.right)-Math.max(a.left,b.left),y=Math.min(a.bottom,b.bottom)-Math.max(a.top,b.top);const dx=Math.max(a.left,b.left)-Math.min(a.right,b.right),dy=Math.max(a.top,b.top)-Math.min(a.bottom,b.bottom);const gap=controls[i].compact&&controls[j].compact?5.5:7.5;if((x>1&&dy<gap)||(y>1&&dx<gap))close.push([controls[i].id,controls[j].id]);}
    const dialog=document.querySelector('dialog[open]');const rect=dialog?.getBoundingClientRect();
    const clippedDialog=!!rect&&(rect.left<0||rect.right>innerWidth||rect.top<0||rect.bottom>innerHeight);
    const clippedNav=innerWidth<=720&&[...document.querySelectorAll('nav button')].some(button=>{const r=button.getBoundingClientRect();return button.scrollHeight>button.clientHeight||r.height<44;});
@@ -25,7 +25,7 @@ const assert=require('assert');const fs=require('fs');const {chromium}=require('
   await page.setViewportSize({width,height});await page.evaluate(({lang,theme})=>{state.lang=lang;document.documentElement.dataset.theme=theme;shell();},{lang,theme});
   for(const view of ['dashboard','gallery','photo-sources','upload','templates','automation','playlists','history','settings','studio','connections']){await page.evaluate(view=>navigate(view),view);await inspect(`${view}/${width}/${lang}/${theme}`);}
   await page.evaluate(()=>navigate('studio'));await page.locator('.manual-collage summary').click();await inspect(`Manual collage/${width}/${lang}/${theme}`);await page.evaluate(()=>navigate('photo-sources'));await page.locator('#photos-login').click();await inspect(`Photos login/${width}/${lang}/${theme}`);await page.locator('#modal-cancel').click();
-  await page.locator('#add-photo-source').click();assert(await page.locator('#source-credential').isHidden());assert(await page.locator('#source-oauth').isHidden());await inspect(`NAS source/${width}/${lang}/${theme}`);await page.locator('#source-kind').selectOption('google-drive');assert(await page.locator('#source-oauth').isVisible());assert(await page.locator('#source-local-quality').isHidden());await inspect(`Drive source/${width}/${lang}/${theme}`);await page.locator('#modal-cancel').click();
+  await page.locator('#add-photo-source').click();assert(await page.locator('#source-credential').isHidden());assert(await page.locator('#source-oauth').isHidden());await inspect(`NAS source/${width}/${lang}/${theme}`);await page.locator('#modal-cancel').click();
   await page.evaluate(()=>navigate('automation'));await page.locator('#new-job').click();await inspect(`Job/${width}/${lang}/${theme}`);await page.locator('#modal-cancel').click();
   await page.evaluate(()=>navigate('playlists'));await page.locator('#new-playlist').click();await inspect(`Playlist/${width}/${lang}/${theme}`);await page.locator('#modal-cancel').click();
   await page.evaluate(()=>displayDialog({type:'image',image_id:1}));await inspect(`Display options/${width}/${lang}/${theme}`);await page.locator('#modal-cancel').click();
@@ -33,6 +33,6 @@ const assert=require('assert');const fs=require('fs');const {chromium}=require('
   if(out&&lang==='zh'&&theme==='dark'){await page.evaluate(()=>navigate('photo-sources'));await page.screenshot({path:out+`/photos-${width}.png`,fullPage:true});}
  }
  await page.evaluate(()=>navigate('photo-sources'));await page.locator('#photos-login').click();await page.locator('#photos-login-user').fill('fixture-nas');await page.locator('#photos-login-password').fill('fixture-only');await page.locator('#photos-login-form button[type=submit]').click();await page.locator('#photos-login').filter({hasText:'Sign in again'}).waitFor();assert(logins===1);checks++;
- assert.deepStrictEqual(errors,[]);assert.deepStrictEqual(failures,[],JSON.stringify(failures));console.log('Layout audit:',checks,'passed; 11 pages plus local gallery, 6 modal states, '+(viewports.length*4)+' viewport/language/theme combinations; console errors:',errors.length);
+ assert.deepStrictEqual(errors,[]);assert.deepStrictEqual(failures,[],JSON.stringify(failures));console.log('Layout audit:',checks,'passed; 11 pages plus local gallery, 5 modal states, '+(viewports.length*4)+' viewport/language/theme combinations; console errors:',errors.length);
  }finally{await browser.close();}
 })().catch(e=>{console.error(e.message);process.exit(1)});

tests/schema-contract.json

@@ -883,6 +883,19 @@
         "minLength": 1,
         "title": "Location"
       },
+      "nas_root_path": {
+        "anyOf": [
+          {
+            "type": "string",
+            "maxLength": 2048,
+            "pattern": "^/"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "title": "Nas Root Path"
+      },
       "recursive": {
         "type": "boolean",
         "title": "Recursive",
@@ -931,6 +944,20 @@
         ],
         "title": "Orientation"
       },
+      "minimum_short_edge": {
+        "type": "integer",
+        "maximum": 50000.0,
+        "minimum": 0.0,
+        "title": "Minimum Short Edge",
+        "default": 0
+      },
+      "minimum_long_edge": {
+        "type": "integer",
+        "maximum": 50000.0,
+        "minimum": 0.0,
+        "title": "Minimum Long Edge",
+        "default": 0
+      },
       "minimum_sharpness": {
         "type": "number",
         "maximum": 10000.0,
@@ -1036,6 +1063,19 @@
         "minLength": 1,
         "title": "Location"
       },
+      "nas_root_path": {
+        "anyOf": [
+          {
+            "type": "string",
+            "maxLength": 2048,
+            "pattern": "^/"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "title": "Nas Root Path"
+      },
       "recursive": {
         "type": "boolean",
         "title": "Recursive",
@@ -1084,6 +1124,20 @@
         ],
         "title": "Orientation"
       },
+      "minimum_short_edge": {
+        "type": "integer",
+        "maximum": 50000.0,
+        "minimum": 0.0,
+        "title": "Minimum Short Edge",
+        "default": 0
+      },
+      "minimum_long_edge": {
+        "type": "integer",
+        "maximum": 50000.0,
+        "minimum": 0.0,
+        "title": "Minimum Long Edge",
+        "default": 0
+      },
       "minimum_sharpness": {
         "type": "number",
         "maximum": 10000.0,
@@ -1192,6 +1246,17 @@
         ],
         "title": "Caption"
       },
+      "source_path": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "title": "Source Path"
+      },
       "provider_preview": {
         "type": "boolean",
         "title": "Provider Preview",

tests/test_gallery_thumbnail.py

@@ -0,0 +1,28 @@
+import io
+
+from PIL import Image
+
+
+def test_gallery_thumbnail_upgrades_existing_cache_and_reuses_it(client, settings):
+    cache = settings.data_dir / "cache"
+    original = cache / "living-room-1.original"
+    thumb = cache / "living-room-1-thumb.jpg"
+    Image.new("RGB", (1600, 1200), "blue").save(original, "JPEG")
+    Image.new("RGB", (300, 225), "blue").save(thumb, "JPEG")
+    url = "/api/v1/devices/living-room/images/1/file?thumbnail=true"
+    result = client.get(url)
+    assert result.status_code == 200
+    assert Image.open(io.BytesIO(result.content)).size == (860, 645)
+    modified = thumb.stat().st_mtime_ns
+    assert client.get(url).content == result.content
+    assert thumb.stat().st_mtime_ns == modified
+    assert len(list(cache.glob("living-room-1-thumb*"))) == 1
+    assert Image.open(original).size == (1600, 1200)
+
+
+def test_gallery_thumbnail_does_not_upscale_small_source(client, settings):
+    original = settings.data_dir / "cache" / "living-room-1.original"
+    Image.new("RGBA", (200, 400), (255, 0, 0, 255)).save(original, "PNG")
+    result = client.get("/api/v1/devices/living-room/images/1/file?thumbnail=true")
+    assert result.status_code == 200
+    assert Image.open(io.BytesIO(result.content)).size == (200, 400)

tests/test_photo_paths.py

@@ -0,0 +1,59 @@
+import io
+
+from PIL import Image
+
+from pigway_frame_flow.models import PhotoSourceContent
+from pigway_frame_flow.providers.photo_sources import PhotoSourceInput
+
+
+def test_photo_path_survives_render_and_asset_listing(client, service, monkeypatch):
+    photos = service.photo_sources
+    photos.save(
+        "family",
+        PhotoSourceInput(
+            name="Family",
+            kind="synology-photos",
+            location=".",
+            nas_root_path="/volume1/photo",
+        ),
+    )
+    monkeypatch.setattr(photos.synology, "sid", lambda: "fixture")
+    monkeypatch.setattr(
+        photos.synology,
+        "items",
+        lambda *a, **kw: [
+            {
+                "id": 42,
+                "filename": "original.PNG",
+                "additional": {
+                    "folder": "/家庭/20190130",
+                    "resolution": {"width": 1600, "height": 1200},
+                },
+            }
+        ],
+    )
+    out = io.BytesIO()
+    Image.new("RGB", (1600, 1200)).save(out, "PNG")
+    monkeypatch.setattr(photos.synology, "download", lambda *a, **kw: out.getvalue())
+    assert (
+        photos.catalog("family")[0]["source_path"]
+        == "/volume1/photo/家庭/20190130/original.PNG"
+    )
+    asset = service.content_asset(
+        PhotoSourceContent(type="photo_source", source_id="family", item_id="42")
+    )
+    assert asset["source_path"] == "/volume1/photo/家庭/20190130/original.PNG"
+    assert client.get("/api/v1/assets").json()[0]["source_path"] == asset["source_path"]
+    assert (
+        client.get("/api/v1/assets/" + asset["asset_id"] + "/source").json()["source"][
+            "item_id"
+        ]
+        == "42"
+    )
+
+
+def test_missing_photo_path_is_not_invented(service):
+    out = io.BytesIO()
+    Image.new("RGB", (20, 20)).save(out, "JPEG")
+    asset = service.assets.put(out.getvalue(), "manual.jpg")
+    assert asset["source_path"] is None

tests/test_photo_resolution.py

@@ -0,0 +1,123 @@
+import io
+
+import pytest
+from PIL import Image
+
+from pigway_frame_flow.errors import FlowError
+from pigway_frame_flow.providers.photo_sources import PhotoSourceInput
+
+
+def test_minimum_resolution_filters_catalog_and_persists(
+    client, service, settings, legacy_photo_engine
+):
+    root = settings.data_dir.parent / "photos"
+    root.mkdir()
+    settings.photo_root = root
+    for name, size in [
+        ("small.jpg", (160, 120)),
+        ("wide.jpg", (800, 600)),
+        ("tall.jpg", (600, 800)),
+    ]:
+        Image.new("RGB", size).save(root / name)
+    response = client.put(
+        "/api/v1/photo-sources/family",
+        json={
+            "name": "Family",
+            "kind": "local",
+            "location": ".",
+            "minimum_short_edge": 600,
+            "minimum_long_edge": 800,
+        },
+    )
+    assert response.status_code == 200
+    assert response.json()["minimum_short_edge"] == 600
+    assert service.photo_sources.get("family").minimum_long_edge == 800
+    assert {x["name"] for x in service.photo_sources.catalog("family")} == {
+        "wide.jpg",
+        "tall.jpg",
+    }
+    response = client.put(
+        "/api/v1/photo-sources/family",
+        json={
+            "name": "Family",
+            "kind": "local",
+            "location": ".",
+        },
+    )
+    assert response.status_code == 200
+    assert len(service.photo_sources.catalog("family")) == 3
+
+
+def test_resolution_rejects_small_synology_preview(service, monkeypatch):
+    photos = service.photo_sources
+    photos.save(
+        "family",
+        PhotoSourceInput(
+            name="Family",
+            kind="synology-photos",
+            location=".",
+            minimum_short_edge=600,
+            minimum_long_edge=800,
+        ),
+    )
+    row = {"id": "1", "name": "photo.jpg"}
+    monkeypatch.setattr(photos, "catalog", lambda *args, **kwargs: [row])
+    photos.api_items["family"] = {"1": {}}
+    monkeypatch.setattr(photos.synology, "item_people", lambda *a, **kw: [])
+
+    def image(size):
+        out = io.BytesIO()
+        Image.new("RGB", size).save(out, "JPEG")
+        return out.getvalue()
+
+    monkeypatch.setattr(photos.synology, "download", lambda *a, **kw: image((300, 400)))
+    with pytest.raises(FlowError, match="minimum resolution"):
+        photos.read("family", "1")
+    monkeypatch.setattr(photos.synology, "download", lambda *a, **kw: image((800, 600)))
+    assert photos.read("family", "1")[1] == "photo.jpg"
+
+
+def test_minimum_resolution_rejects_negative_value(client):
+    response = client.put(
+        "/api/v1/photo-sources/family",
+        json={
+            "name": "Family",
+            "kind": "synology-photos",
+            "location": ".",
+            "minimum_short_edge": -1,
+        },
+    )
+    assert response.status_code == 422
+
+
+def test_synology_metadata_resolution_filters_before_catalog_limit(
+    client, service, monkeypatch
+):
+    photos = service.photo_sources
+    monkeypatch.setattr(photos.synology, "sid", lambda: "fixture")
+    rows = [
+        {
+            "id": i,
+            "filename": f"{i}.jpg",
+            "additional": {
+                "folder": "/family",
+                "resolution": {"width": w, "height": h},
+            },
+        }
+        for i, w, h in [(1, 300, 400), (2, 800, 600), (3, 0, 0)]
+    ]
+    monkeypatch.setattr(photos.synology, "items", lambda *a, **kw: rows)
+    response = client.put(
+        "/api/v1/photo-sources/family",
+        json={
+            "name": "Family",
+            "kind": "synology-photos",
+            "location": ".",
+            "minimum_short_edge": 600,
+            "minimum_long_edge": 800,
+            "catalog_limit": 1,
+        },
+    )
+    assert response.status_code == 200
+    assert response.json()["minimum_long_edge"] == 800
+    assert [x["id"] for x in photos.catalog("family")] == ["2"]

tests/test_publication_security.py

@@ -34,3 +34,22 @@ def test_actions_downloads_do_not_depend_on_personal_server():
             r"https://github\.com/actions/(checkout|setup-python)@[0-9a-f]{40}",
             action,
         )
+
+
+def test_community_checks_are_isolated_from_private_runners():
+    import yaml
+
+    private = yaml.safe_load(Path(".github/workflows/verify.yml").read_text())
+    public = yaml.safe_load(Path(".github/workflows/community.yml").read_text())
+    assert (
+        "github.server_url != 'https://github.com'" in private["jobs"]["verify"]["if"]
+    )
+    job = public["jobs"]["verify"]
+    assert job["if"] == "github.server_url == 'https://github.com'"
+    assert job["runs-on"] == "ubuntu-latest"
+    assert public["permissions"] == {"contents": "read"}
+    workflow = Path(".github/workflows/community.yml").read_text()
+    assert "secrets." not in workflow
+    assert "production-deploy" not in workflow
+    assert "pull_request_target" not in workflow
+    assert "persist-credentials: false" in workflow

tests/test_server_release.py

@@ -63,7 +63,7 @@ def test_release_readiness_retries_on_actual_listener(release_tool, monkeypatch)
 
     def listener(url, timeout):
         calls.append(url)
-        if url != "http://192.0.2.10:81/ready" or len(calls) == 1:
+        if url != release_tool.ORIGIN + "/ready" or len(calls) == 1:
             raise urllib.error.URLError("Connection refused during restart")
         return io.BytesIO(b'{"status":"ready"}')
 
@@ -71,3 +71,24 @@ def test_release_readiness_retries_on_actual_listener(release_tool, monkeypatch)
     monkeypatch.setattr(release_tool.time, "sleep", lambda _: None)
     release_tool.wait_ready()
     assert len(calls) == 2
+
+
+def test_release_requires_private_storage_identity_before_host_actions(
+    release_tool, monkeypatch
+):
+    calls = []
+    monkeypatch.setattr(release_tool.os, "geteuid", lambda: 0)
+    monkeypatch.setattr(release_tool, "run", lambda *args: calls.append(args))
+    monkeypatch.delenv("FRAME_FLOW_MOUNT_UUID", raising=False)
+    with pytest.raises(AssertionError, match="FRAME_FLOW_MOUNT_UUID"):
+        release_tool.main()
+    assert calls == []
+
+
+def test_release_rejects_wrong_storage_uuid(release_tool, monkeypatch):
+    monkeypatch.setattr(release_tool.os, "geteuid", lambda: 0)
+    monkeypatch.setenv("FRAME_FLOW_MOUNT_UUID", "expected-storage-uuid")
+    monkeypatch.setenv("FRAME_FLOW_ORIGIN", release_tool.ORIGIN)
+    monkeypatch.setattr(release_tool, "run", lambda *args: "different-storage-uuid")
+    with pytest.raises(AssertionError):
+        release_tool.main()

tests/test_synology_photos_api.py

@@ -69,12 +69,12 @@ def test_people_pagination_does_not_stop_at_500(settings, monkeypatch):
         return {
             "list": [
                 {"id": i}
-                for i in range(params["offset"], min(1334, params["offset"] + 500))
+                for i in range(params["offset"], min(1203, params["offset"] + 500))
             ]
         }
 
     monkeypatch.setattr(p, "request", request)
-    assert len(p.people()) == 1334
+    assert len(p.people()) == 1203
     assert calls == [0, 500, 1000]
 
 
@@ -401,3 +401,79 @@ def test_explicit_offline_conversion_preserves_task_reference(service, settings)
         and after.person_match == "all"
         and after.location == "family"
     )
+
+
+@pytest.mark.parametrize("space", ["shared", "personal"])
+@pytest.mark.parametrize("exif", [5, 6, 7, 8])
+def test_api_filters_already_oriented_resolution_without_rotating_twice(
+    service, settings, monkeypatch, space, exif
+):
+    session(settings)
+    photos = service.photo_sources
+    requested = []
+
+    def pages(api, version, **params):
+        requested[:] = json.loads(params["additional"])
+        item = row(1)
+        # Photos returns display dimensions even when EXIF retains a rotation.
+        item["additional"]["resolution"] = {"width": 16, "height": 24}
+        if "orientation" in requested:
+            item["additional"]["orientation"] = exif
+        return [item]
+
+    monkeypatch.setattr(photos.synology, "pages", pages)
+    photos.save(
+        "direction",
+        PhotoSourceInput(
+            name="Fixture",
+            kind="synology-photos",
+            location=".",
+            people_space=space,
+            orientation="landscape",
+        ),
+    )
+    assert photos.catalog("direction") == []
+    photos.save(
+        "direction",
+        photos.get("direction").model_copy(update={"orientation": "portrait"}),
+    )
+    items = photos.catalog("direction")
+    assert "orientation" in requested
+    assert [(x["width"], x["height"]) for x in items] == [(16, 24)]
+
+
+@pytest.mark.parametrize("rotation", [1, 8])
+def test_fetched_photo_direction_is_checked_before_cropping(
+    service, settings, monkeypatch, rotation
+):
+    session(settings)
+    photos = service.photo_sources
+    monkeypatch.setattr(photos.synology, "items", lambda *a, **k: [row(1)])
+    out = io.BytesIO()
+    exif = Image.Exif()
+    exif[274] = rotation
+    size = (16, 24) if rotation == 1 else (24, 16)
+    Image.new("RGB", size, "blue").save(out, "JPEG", exif=exif)
+    monkeypatch.setattr(photos.synology, "download", lambda *a, **k: out.getvalue())
+    photos.save(
+        "direction",
+        PhotoSourceInput(
+            name="Fixture",
+            kind="synology-photos",
+            location=".",
+            orientation="landscape",
+        ),
+    )
+    with pytest.raises(FlowError, match="direction"):
+        photos.read("direction", "1")
+
+    # A correctly selected portrait remains readable, including EXIF-only rotation.
+    item = row(1)
+    item["additional"]["orientation"] = 8
+    item["additional"]["resolution"] = {"width": 16, "height": 24}
+    monkeypatch.setattr(photos.synology, "items", lambda *a, **k: [item])
+    photos.save(
+        "direction",
+        photos.get("direction").model_copy(update={"orientation": "portrait"}),
+    )
+    assert photos.read("direction", "1")[0] == out.getvalue()