Upload 101 files

前端页面/components/图片展示测试.js

@@ -6,7 +6,7 @@
 // 接口：openImageViewer(imageUrls, startIndex, options)
 // ==========================================
 
-import { escapeHtml, API, IS_WEB_MODE } from "../core/全局配置.js";
+import { escapeHtml, API, IS_WEB_MODE, normalizeProfileImageUrl } from "../core/全局配置.js";
 import { t } from "./用户体验增强.js";
 
 // ==========================================
@@ -401,8 +401,10 @@ function _calcGridLayout(displayWidth, displayHeight, maxGridSize) {
 class CyberImageViewer {
     constructor(imageUrls, startIndex = 0) {
         // 按运行模式处理图片地址
-        this.imageUrls = imageUrls.map(url => this._proxyImageUrl(url));
-        this.currentIndex = Math.max(0, Math.min(startIndex, this.imageUrls.length - 1));
+        const sources = Array.isArray(imageUrls) ? imageUrls.map(url => this._proxyImageUrl(url)) : [];
+        const requestedIndex = Number.isInteger(startIndex) ? Math.max(0, Math.min(startIndex, sources.length - 1)) : 0;
+        this.imageUrls = sources.filter(Boolean);
+        this.currentIndex = Math.max(0, Math.min(sources.slice(0, requestedIndex).filter(Boolean).length, this.imageUrls.length - 1));
         this.preloadCache = new Map();
         this._preloadRequests = new Map();
         this._imageReads = new Set();
@@ -558,21 +560,10 @@ class CyberImageViewer {
      * 自动识别代理URL、data: URL、blob: URL和普通HTTP(S) URL
      */
     _proxyImageUrl(url) {
-        if (typeof url !== 'string' || !url) return '';
-        const prefix = API.LOCAL_IMAGE_PROXY_PREFIX;
-        if (IS_WEB_MODE) {
-            let original = url;
-            for (let depth = 0; depth < 10 && original.startsWith(prefix); depth++) {
-                let encoded = original.slice(prefix.length);
-                if (encoded.endsWith(API.COMPLETE_IMAGE_QUERY_SUFFIX)) {
-                    encoded = encoded.slice(0, -API.COMPLETE_IMAGE_QUERY_SUFFIX.length);
-                }
-                try { original = decodeURIComponent(encoded); } catch (_) { break; }
-            }
-            return original;
-        }
-        if (url.startsWith('data:') || url.startsWith('blob:') || url.startsWith(prefix)) return url;
-        return url.startsWith('http') ? prefix + encodeURIComponent(url) : url;
+        const source = normalizeProfileImageUrl(url, IS_WEB_MODE);
+        if (!source) return '';
+        return !IS_WEB_MODE && /^https?:\/\//i.test(source)
+            ? API.LOCAL_IMAGE_PROXY_PREFIX + encodeURIComponent(source) : source;
     }
 
     /**
@@ -582,6 +573,7 @@ class CyberImageViewer {
      * @param {boolean} options.opaque - 是否不透明背景，默认true
      */
     create(options = {}) {
+        if (!this.imageUrls.length) return null;
         const { background = '#0a0a0a', opaque = true } = options;
 
         // 注入样式
@@ -1791,7 +1783,7 @@ class CyberImageViewer {
  * @returns {Function} 关闭播放器的函数
  */
 export function openImageViewer(imageUrls, startIndex = 0, options = {}) {
-    if (!imageUrls || imageUrls.length === 0) {
+    if (!Array.isArray(imageUrls) || imageUrls.length === 0) {
         console.warn('图片数组为空，无法打开查看器');
         return () => {};
     }
@@ -1800,6 +1792,7 @@ export function openImageViewer(imageUrls, startIndex = 0, options = {}) {
 
     const viewer = new CyberImageViewer(imageUrls, startIndex);
     const container = viewer.create(options);
+    if (!container) return () => {};
 
     // 添加到body
     document.body.appendChild(container);

前端页面/components/图片沙盒组件.js

@@ -12,7 +12,7 @@
 // ==========================================
 
 import { t } from "./用户体验增强.js";
-import { escapeHtml, API, UI } from "../core/全局配置.js";
+import { escapeHtml, API, UI, IS_WEB_MODE, normalizeProfileImageUrl } from "../core/全局配置.js";
 import { openImageViewer } from "./图片展示测试.js";
 
 // 🔧 通用SVG占位图生成函数
@@ -71,9 +71,9 @@ export function getCoverSandboxHTML(imageSource, lazyLoad = true) {
     // 兼容：接受单个URL或数组
     let imageUrls = [];
     if (Array.isArray(imageSource)) {
-        imageUrls = imageSource.filter(url => typeof url === 'string' && url.trim());
+        imageUrls = imageSource.map(url => normalizeProfileImageUrl(url, IS_WEB_MODE)).filter(Boolean);
     } else if (typeof imageSource === 'string' && imageSource.trim()) {
-        imageUrls = [imageSource];
+        imageUrls = [normalizeProfileImageUrl(imageSource, IS_WEB_MODE)].filter(Boolean);
     }
     
     if (imageUrls.length === 0) return '';
@@ -134,10 +134,17 @@ export function setupImageSandboxEvents(detailView) {
     let imageUrls;
     try { imageUrls = JSON.parse(viewport.dataset.images || '[]'); } catch (_) { imageUrls = []; }
     if (!Array.isArray(imageUrls)) imageUrls = [];
-    imageUrls = imageUrls.filter(url => typeof url === 'string' && url.trim());
-    if (!imageUrls.length) return;
     let currentIndex = Number.parseInt(viewport.dataset.current || '0', 10);
     if (!Number.isInteger(currentIndex) || currentIndex < 0 || currentIndex >= imageUrls.length) currentIndex = 0;
+    const normalizedUrls = imageUrls.map(url => normalizeProfileImageUrl(url, IS_WEB_MODE));
+    imageUrls = normalizedUrls.filter(Boolean);
+    if (!imageUrls.length) {
+        targetImg.removeAttribute('src');
+        delete targetImg.dataset.src;
+        return;
+    }
+    currentIndex = Math.min(normalizedUrls.slice(0, currentIndex).filter(Boolean).length, imageUrls.length - 1);
+    viewport.dataset.images = JSON.stringify(imageUrls);
     let disposed = false, generation = 0, readController = null, closeViewer = null;
     let observer = null, wasMounted = false, fallbackNode = null, fallbackTimer = null;
     const stops = [];

前端页面/components/用户体验_国际化.js

@@ -13,6 +13,36 @@ let pendingLanguage = null;
 
 const translations = {
     'zh-CN': {
+        'skill.cloud_update_required': "Skill 文件检查尚未就绪，请联系管理员更新服务后重试。",
+        'skill.directory_title': "选择 Skill 安装目录",
+        'skill.directory_hint': "请选择接收插件的 skills 目录；也可以输入本机完整目录地址。",
+        'skill.directory_path': "接收目录",
+        'skill.directory_open': "打开目录",
+        'skill.directory_parent': "上一级",
+        'skill.directory_select': "使用此目录",
+        'skill.directory_folders': "子文件夹",
+        'skill.directory_verify': "目录地址已修改，请先打开核对。",
+        'skill.directory_truncated': "仅显示部分子文件夹，可直接输入完整目录地址。",
+        'skill.directory_ready': "核对当前目录后，点击“使用此目录”。",
+        'skill.local_update_required': "本地插件尚未支持目录选择，请更新并重启 ComfyUI。",
+        'skill.invalid_package': "未找到有效的 Skill 文件，请发布者检查资源内容。",
+        'skill.plan_invalid': "安装准备已失效，请重新选择目录。",
+        'skill.identity_changed': "登录状态或资源权限已变化，请重新确认后安装。",
+        'skill.source_changed': "资源地址已变化，请重新准备安装。",
+        'skill.target_changed': "接收目录或文件发生变化，请先检查目录，再重新准备。",
+        'skill.source_unavailable': "暂时无法核实资源来源，请稍后重试。",
+        'skill.directory_too_large': "目录内容过多，请输入更具体的接收目录。",
+        'skill.preview_target': "将安装到：{path}",
+        'skill.preview_hint': "以下文件夹和共用文件将写入所选目录；已有技能会被替换，共用目录保留其它文件。请确认后继续。",
+        'skill.preview_replace': "更新已有内容",
+        'skill.preview_new': "新增",
+        'skill.preview_skill': "技能",
+        'skill.preview_shared': "共用文件",
+        'skill.preparing': "正在准备 Skill 文件…",
+        'skill.prepared': "文件已准备，请核对安装内容。",
+        'skill.cancelled': "已取消；接收目录未写入。",
+        'skill.outcome_unknown': "安装结果暂时无法确认。请先检查所选接收目录，勿重复提交。",
+
         // 通用
         'common.confirm': '确认',
         'common.confirm_action': '操作确认',
@@ -1773,6 +1803,36 @@ const translations = {
     },
     
     'en-US': {
+        'skill.cloud_update_required': "Skill file checks are not ready. Ask the administrator to update the service before trying again.",
+        'skill.directory_title': "Choose Skill installation folder",
+        'skill.directory_hint': "Choose the receiving plugin’s skills folder, or enter a full local folder path.",
+        'skill.directory_path': "Destination folder",
+        'skill.directory_open': "Open folder",
+        'skill.directory_parent': "Parent folder",
+        'skill.directory_select': "Use this folder",
+        'skill.directory_folders': "Subfolders",
+        'skill.directory_verify': "The path changed. Open it to verify the folder.",
+        'skill.directory_truncated': "Only some subfolders are shown. You can enter the full folder path.",
+        'skill.directory_ready': "Check the current folder, then select “Use this folder”.",
+        'skill.local_update_required': "Update the local plugin and restart ComfyUI to enable folder selection.",
+        'skill.invalid_package': "No valid Skill files were found. Ask the publisher to check the resource.",
+        'skill.plan_invalid': "The installation preparation is no longer valid. Choose the folder again.",
+        'skill.identity_changed': "Your login or resource permissions changed. Check them before installing.",
+        'skill.source_changed': "The resource address changed. Prepare the installation again.",
+        'skill.target_changed': "The destination or its files changed. Check the folder before preparing again.",
+        'skill.source_unavailable': "The resource source could not be verified. Try again later.",
+        'skill.directory_too_large': "This folder contains too many entries. Enter a more specific destination.",
+        'skill.preview_target': "Install to: {path}",
+        'skill.preview_hint': "These folders and shared files will be written to the selected folder. Existing skills will be replaced; other files in shared folders will be preserved. Confirm to continue.",
+        'skill.preview_replace': "Update existing content",
+        'skill.preview_new': "Add",
+        'skill.preview_skill': "Skill",
+        'skill.preview_shared': "Shared files",
+        'skill.preparing': "Preparing Skill files…",
+        'skill.prepared': "Files are ready. Review the installation contents.",
+        'skill.cancelled': "Cancelled; the destination was not changed.",
+        'skill.outcome_unknown': "The installation outcome is unconfirmed. Check the selected destination before submitting again.",
+
         // Common
         'common.confirm': 'Confirm',
         'common.confirm_action': 'Confirm action',

前端页面/components/缓存管理请求.js

@@ -1,36 +1,7 @@
 // 本机缓存运维请求：单次提交、有界响应；不参与云端冷却或榜单缓存。
 import { API } from '../core/全局配置.js';
 
-async function readSmallJSON(response, controller) {
-    const declared = response.headers.get('Content-Length');
-    if (declared !== null && (!/^\d+$/.test(declared) || Number(declared) > API.LOCAL_CACHE_RESPONSE_MAX_BYTES)) {
-        throw new Error('cache_response_invalid');
-    }
-    const reader = response.body?.getReader();
-    if (!reader) throw new Error('cache_response_invalid');
-    const chunks = [];
-    let size = 0, complete = false;
-    try {
-        while (true) {
-            const chunk = await reader.read();
-            if (chunk.done) { complete = true; break; }
-            if (!chunk.value.byteLength) continue;
-            size += chunk.value.byteLength;
-            if (size > API.LOCAL_CACHE_RESPONSE_MAX_BYTES) throw new Error('cache_response_invalid');
-            chunks.push(chunk.value);
-        }
-        const body = new Uint8Array(size);
-        let offset = 0;
-        for (const chunk of chunks) { body.set(chunk, offset); offset += chunk.byteLength; }
-        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(body));
-    } finally {
-        if (!complete) {
-            controller.abort();
-            try { await reader.cancel(); } catch {}
-        }
-        reader.releaseLock();
-    }
-}
+import { readLocalJSON } from '../core/本机请求读取.js';
 
 async function requestCache(action, { signal } = {}) {
     const controller = new AbortController();
@@ -47,7 +18,7 @@ async function requestCache(action, { signal } = {}) {
             cache: 'no-store', signal: controller.signal,
         });
         if (!response.ok) throw new Error('cache_operation_unconfirmed');
-        const data = await readSmallJSON(response, controller);
+        const data = await readLocalJSON(response, controller, API.LOCAL_CACHE_RESPONSE_MAX_BYTES);
         const fields = action === 'stats' ? ['image_count', 'image_size', 'video_count', 'video_size'] : ['cleared_count', 'freed_size'];
         if (!data || typeof data !== 'object' || Array.isArray(data)
                 || fields.some(key => !Number.isSafeInteger(data[key]) || data[key] < 0)) {

前端页面/core/全局配置.js

@@ -104,6 +104,18 @@ export const API = {
 };
 
 
+export const SKILL_INSTALL = Object.freeze({
+    PATH: '/community_hub/skill_install',
+    PREFLIGHT_TIMEOUT: 30000,
+    CONTROL_TIMEOUT: 45000,
+    STREAM_TIMEOUT: 1200000,
+    RESPONSE_MAX_BYTES: 1024 * 1024,
+    PATH_MAX_BYTES: 32768,
+    MAX_DIRECTORIES: 128,
+    MAX_ITEMS: 1000,
+    MODAL_WIDTH: '640px'
+});
+
 export const CHART_LIFECYCLE = Object.freeze({
     WIDTH_WAIT_TIMEOUT: 5000,
     RESIZE_DELAY: 300
@@ -597,7 +609,7 @@ export function escapeHtml(str) {
 }
 
 /** 资料图片只接受明确的图片表示或网络地址，不相对宿主解析业务路径。 */
-export function normalizeProfileImageUrl(value, unwrapProxy = false) {
+export function normalizeProfileImageUrl(value, unwrapProxy = false, serviceBaseUrl = API.BASE_URL) {
     if (typeof value !== 'string' || !value || value.trim() !== value || /[\u0000-\u001f\u007f]/.test(value)) return '';
     let source = value;
     let layers = 0;
@@ -627,7 +639,7 @@ export function normalizeProfileImageUrl(value, unwrapProxy = false) {
         const host = url.hostname.toLowerCase().replace(/\.$/, '');
         if (/^\d+\.\d+\.\d+\.\d+$/.test(host)
             && authority.replace(/:[0-9]+$/, '').replace(/\.$/, '').toLowerCase() !== host) return '';
-        const base = new URL(API.BASE_URL);
+        const base = new URL(serviceBaseUrl);
         const baseHost = base.hostname.toLowerCase().replace(/\.$/, '');
         if (host === baseHost) {
             const expectedPath = base.pathname.replace(/\/$/, '') + API.IMAGE_PROXY_PATH;

前端页面/core/本机请求读取.js

@@ -0,0 +1,30 @@
+export async function readLocalJSON(response, controller, maxBytes) {
+    const declared = response.headers.get('Content-Length');
+    if (declared !== null && (!/^\d+$/.test(declared) || Number(declared) > maxBytes)) {
+        throw new Error('local_response_invalid');
+    }
+    const reader = response.body?.getReader();
+    if (!reader) throw new Error('local_response_invalid');
+    const chunks = [];
+    let size = 0, complete = false;
+    try {
+        while (true) {
+            const chunk = await reader.read();
+            if (chunk.done) { complete = true; break; }
+            if (!chunk.value.byteLength) continue;
+            size += chunk.value.byteLength;
+            if (size > maxBytes) throw new Error('local_response_invalid');
+            chunks.push(chunk.value);
+        }
+        const body = new Uint8Array(size);
+        let offset = 0;
+        for (const chunk of chunks) { body.set(chunk, offset); offset += chunk.byteLength; }
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(body));
+    } finally {
+        if (!complete) {
+            controller.abort();
+            try { await reader.cancel(); } catch {}
+        }
+        reader.releaseLock();
+    }
+}

前端页面/market/Skill安装流程.js

@@ -0,0 +1,202 @@
+import { SKILL_INSTALL, escapeHtml } from '../core/全局配置.js';
+import { readLocalJSON } from '../core/本机请求读取.js';
+import { requestSSE } from '../core/网络请求_基础设施.js';
+import { t } from '../components/用户体验_国际化.js';
+import { globalModal } from '../components/全局弹窗管理器.js';
+
+const object = value => value && typeof value === 'object' && !Array.isArray(value);
+const pathText = value => typeof value === 'string' && value.length > 0
+    && !/[\u0000-\u001f\u007f]/u.test(value)
+    && new TextEncoder().encode(value).length <= SKILL_INSTALL.PATH_MAX_BYTES;
+const planId = value => typeof value === 'string' && /^[a-f0-9]{32}$/.test(value);
+const versionId = value => typeof value === 'string' && /^[a-f0-9]{40}$/.test(value);
+const count = value => Number.isSafeInteger(value) && value >= 0;
+
+function failure(code) {
+    const error = new Error('skill_operation_failed');
+    error.code = code;
+    return error;
+}
+
+export function skillErrorMessage(error) {
+    const errorKeys = {
+        local_update_required: 'skill.local_update_required',
+        invalid_target: 'install.error_invalid_target',
+        invalid_repository: 'install.error_invalid_repository',
+        invalid_skill_package: 'skill.invalid_package',
+        invalid_plan: 'skill.plan_invalid',
+        plan_expired: 'skill.plan_invalid',
+        plan_owner_mismatch: 'skill.identity_changed',
+        auth_failed: 'skill.identity_changed',
+        source_changed: 'skill.source_changed',
+        target_changed: 'skill.target_changed',
+        target_conflict: 'skill.target_changed',
+        recovery_conflict: 'skill.target_changed',
+        source_unavailable: 'skill.source_unavailable',
+        invalid_metadata: 'skill.source_unavailable',
+        directory_too_large: 'skill.directory_too_large',
+        package_too_large: 'install.error_package_too_large',
+        insufficient_disk_space: 'install.error_disk_space',
+        permission_denied: 'install.error_permission_denied',
+        install_queue_full: 'install.error_queue_full',
+        install_queue_timeout: 'install.error_queue_timeout',
+    };
+    const errorKey = Object.hasOwn(errorKeys, error?.code) ? errorKeys[error.code] : 'install.error_generic';
+    return t(errorKey);
+}
+
+async function control(action, body, signal) {
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    signal?.addEventListener('abort', abort, { once: true });
+    if (signal?.aborted) controller.abort();
+    const timer = setTimeout(abort, SKILL_INSTALL.CONTROL_TIMEOUT);
+    try {
+        if (controller.signal.aborted) throw failure('operation_cancelled');
+        const response = await fetch(SKILL_INSTALL.PATH, {
+            method: 'POST', headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ ...body, action }), cache: 'no-store', signal: controller.signal,
+        });
+        if (response.status === 404 || response.status === 405) throw failure('local_update_required');
+        const value = await readLocalJSON(response, controller, SKILL_INSTALL.RESPONSE_MAX_BYTES);
+        if (!response.ok || !object(value) || value.status !== 'success' || value.installed !== false
+                || Object.hasOwn(value, 'error') || Object.hasOwn(value, 'error_code')) {
+            throw failure(object(value) && typeof value.error_code === 'string' ? value.error_code : 'invalid_metadata');
+        }
+        return value;
+    } finally {
+        clearTimeout(timer); signal?.removeEventListener('abort', abort); controller.abort();
+    }
+}
+
+function browseResult(value) {
+    return value.phase === 'browse' && pathText(value.path) && pathText(value.parent)
+        && typeof value.selectable === 'boolean' && typeof value.truncated === 'boolean'
+        && Array.isArray(value.directories) && value.directories.length <= SKILL_INSTALL.MAX_DIRECTORIES
+        && value.directories.every(row => object(row) && pathText(row.name) && pathText(row.path));
+}
+
+export function chooseSkillDirectory(scope) {
+    if (!scope.isCurrent()) return Promise.resolve(null);
+    return new Promise(resolve => {
+        const content = document.createElement('div'); content.className = 'skill-directory';
+        const hint = document.createElement('p'); hint.textContent = t('skill.directory_hint');
+        const label = document.createElement('label'); label.className = 'skill-directory__label';
+        const title = document.createElement('span'); title.textContent = t('skill.directory_path');
+        const input = document.createElement('input'); input.type = 'text'; input.autocomplete = 'off'; input.spellcheck = false;
+        label.append(title, input);
+        const actions = document.createElement('div'); actions.className = 'skill-directory__actions';
+        const button = (label, callback) => {
+            const node = document.createElement('button'); node.type = 'button'; node.textContent = label;
+            node.addEventListener('click', callback); return node;
+        };
+        const notice = document.createElement('p'); notice.setAttribute('role', 'status'); notice.setAttribute('aria-live', 'polite');
+        const list = document.createElement('ul'); list.className = 'skill-directory__list'; list.setAttribute('aria-label', t('skill.directory_folders'));
+        let closed = false, generation = 0, selected = null, controller, modal;
+        let releaseScope = () => {};
+        const current = () => !closed && scope.isCurrent();
+        const finish = value => {
+            if (closed) return;
+            closed = true; generation++; controller?.abort(); releaseScope();
+            resolve(value); if (modal) globalModal.closeModal(modal);
+        };
+        content._cleanup = () => finish(null);
+        const open = button(t('skill.directory_open'), () => browse(input.value));
+        const parent = button(t('skill.directory_parent'), () => selected && browse(selected.parent));
+        const select = button(t('skill.directory_select'), () => {
+            if (current() && selected?.selectable && input.value === selected.path) finish(selected.path);
+        });
+        select.disabled = parent.disabled = true;
+        const cancel = button(t('common.cancel'), () => finish(null));
+        actions.append(open, parent, select, cancel);
+        input.addEventListener('input', () => {
+            generation++; controller?.abort(); selected = null; select.disabled = parent.disabled = true;
+            content.removeAttribute('aria-busy'); list.replaceChildren(); notice.textContent = t('skill.directory_verify');
+        });
+        async function browse(path) {
+            if (!current()) return;
+            const own = ++generation; controller?.abort(); controller = new AbortController();
+            selected = null; select.disabled = parent.disabled = true;
+            content.setAttribute('aria-busy', 'true'); notice.textContent = t('common.loading'); list.replaceChildren();
+            try {
+                const value = await control('browse', path === undefined ? {} : { path }, controller.signal);
+                if (!current() || own !== generation) return;
+                if (!browseResult(value)) throw failure('invalid_metadata');
+                selected = value; input.value = value.path;
+                select.disabled = !value.selectable; parent.disabled = value.parent === value.path;
+                for (const row of value.directories) {
+                    const item = document.createElement('li');
+                    const folder = document.createElement('button'); folder.type = 'button'; folder.textContent = row.name;
+                    folder.addEventListener('click', () => { if (current() && own === generation) browse(row.path); });
+                    item.append(folder); list.append(item);
+                }
+                notice.textContent = t(value.truncated ? 'skill.directory_truncated' : 'skill.directory_ready');
+            } catch (error) {
+                if (current() && own === generation) notice.textContent = skillErrorMessage(error);
+            } finally {
+                if (current() && own === generation) content.removeAttribute('aria-busy');
+            }
+        }
+        content.append(hint, label, actions, notice, list);
+        modal = globalModal.openModal(t('skill.directory_title'), content, { width: SKILL_INSTALL.MODAL_WIDTH });
+        releaseScope = scope.addCleanup(() => finish(null));
+        if (!current()) { finish(null); return; }
+        input.focus(); browse();
+    });
+}
+
+function validReady(result, plan, target) {
+    return object(result) && result.status === 'success' && result.phase === 'ready'
+        && result.installed === false && (!Object.hasOwn(result, 'outcomeUnknown') || result.outcomeUnknown === false)
+        && !Object.hasOwn(result, 'error') && !Object.hasOwn(result, 'error_code') && versionId(result.installed_version)
+        && object(result.preview) && result.preview.id === plan && pathText(result.preview.target) && result.preview.target === target
+        && Array.isArray(result.preview.items) && result.preview.items.length > 0
+        && result.preview.items.length <= SKILL_INSTALL.MAX_ITEMS
+        && result.preview.items.every(row => object(row) && pathText(row.name)
+            && !/[\\/]/u.test(row.name) && typeof row.skill === 'boolean' && typeof row.exists === 'boolean'
+            && count(row.files) && count(row.bytes));
+}
+
+export async function runSkillInstall({ target, credentials, scope, confirm, onProgress, signal = scope.confirmationSignal }) {
+    let plan, committing = false;
+    try {
+        if (!scope.isCurrent() || signal.aborted) return { status: 'cancelled' };
+        const selected = await control('select', { ...credentials, target }, signal);
+        if (!planId(selected.plan_id) || selected.phase !== 'selected' || selected.target !== target
+                || !count(selected.expires_at)) throw failure('invalid_metadata');
+        plan = selected.plan_id;
+        if (!scope.isCurrent() || signal.aborted) return { status: 'cancelled' };
+        const parameters = { ...credentials, plan_id: plan };
+        const stream = action => requestSSE(SKILL_INSTALL.PATH, { ...parameters, action },
+            event => { if (scope.isCurrent()) onProgress?.({ ...event, skillAction: action }); },
+            { signal, timeout: SKILL_INSTALL.STREAM_TIMEOUT });
+        const ready = await stream('prepare');
+        if (!scope.isCurrent() || signal.aborted) return { status: 'cancelled' };
+        if (!validReady(ready, plan, target)) throw failure(ready?.error_code || 'invalid_metadata');
+        const html = `<div class="skill-install-preview"><p>${escapeHtml(t('skill.preview_target', { path: ready.preview.target }))}</p>`
+            + `<p>${escapeHtml(t('skill.preview_hint'))}</p><ul>`
+            + ready.preview.items.map(row => `<li>${escapeHtml(row.name)} — ${escapeHtml(t(row.exists ? 'skill.preview_replace' : 'skill.preview_new'))}`
+                + ` · ${escapeHtml(t(row.skill ? 'skill.preview_skill' : 'skill.preview_shared'))}</li>`).join('') + '</ul></div>';
+        if (!await confirm(html, { html: true }) || !scope.isCurrent() || signal.aborted) return { status: 'cancelled' };
+        committing = true;
+        let result;
+        try { result = await stream('commit'); }
+        catch (error) {
+            if (error?.fallbackSafe) return { status: 'error', error_code: 'local_update_required', outcomeUnknown: false };
+            return { status: 'error', outcomeUnknown: true };
+        }
+        if (object(result) && result.status === 'success' && result.phase === 'complete'
+                && result.installed === true && (!Object.hasOwn(result, 'outcomeUnknown') || result.outcomeUnknown === false)
+                && result.installed_version === ready.installed_version
+                && !Object.hasOwn(result, 'error') && !Object.hasOwn(result, 'error_code')) return result;
+        if (object(result) && result.status === 'error' && result.outcomeUnknown === false
+                && typeof result.error_code === 'string') return result;
+        return { status: 'error', outcomeUnknown: true };
+    } catch (error) {
+        throw failure(error?.fallbackSafe ? 'local_update_required' : error?.code || 'install_failed');
+    } finally {
+        if (plan && !committing) {
+            try { await control('discard', { ...credentials, plan_id: plan }); } catch {}
+        }
+    }
+}

前端页面/market/资源安装引擎.js

@@ -3,7 +3,7 @@ import { showToast, showConfirm, createInstallProgress } from "../components/UI
 import { api } from "../core/网络请求API.js";
 import { requestSSE, request } from "../core/网络请求_基础设施.js";
 import { openUserProfileModal } from "../profile/个人中心视图.js";
-import { API, CACHE, IS_WEB_MODE, escapeHtml } from "../core/全局配置.js";
+import { API, CACHE, SKILL_INSTALL, IS_WEB_MODE, escapeHtml } from "../core/全局配置.js";
 import { t } from "../components/用户体验增强.js";
 import { createResourceOperationScope } from "./资源操作生命周期.js";
 import { isValidPurchaseStatus } from "./购买状态生命周期.js";
@@ -363,13 +363,16 @@ export function setupResourceInstall(btnUse, itemData, currentUser, inlineStatus
         activeOperations.set(operationKey, scope);
         ++latestWalletRefresh;  // 新操作使先前余额补新失效。
         phase = "preflight"; btnUse.disabled = true; btnUse.setAttribute("aria-busy", "true");
+        let restoreFocus = false;
         try {
             const price = itemData.price ?? 0;
             if (!Number.isSafeInteger(price) || price < 0 || !itemData.id) {
                 showToast(t('acquire.invalid_id'), "error"); return;
             }
             const isFree = price === 0 || account === itemData.author;
-            const isTool = itemData.type === 'tool' || itemData.type === 'recommend_tool' || itemData.type === 'skill' || itemData.type === 'recommend_skill';
+            const isTool = itemData.type === 'tool' || itemData.type === 'recommend_tool';
+            const isSkill = itemData.type === 'skill' || itemData.type === 'recommend_skill';
+            let skillFlow, skillTarget;
             const isApp = itemData.type === 'app' || itemData.type === 'recommend_app';
             if (IS_WEB_MODE && isFree) return showToast(t('web.install_on_desktop'), "warning");
 
@@ -390,6 +393,14 @@ export function setupResourceInstall(btnUse, itemData, currentUser, inlineStatus
             }
             if (IS_WEB_MODE && alreadyOwned) return showToast(t('item.owned_purchased'), "warning");
 
+            if (!IS_WEB_MODE && isSkill && itemData.is_netdisk !== true) {
+                skillFlow = await import('./Skill安装流程.js');
+                if (!isCurrent()) return;
+                skillTarget = await skillFlow.chooseSkillDirectory(scope);
+                if (!isCurrent()) return;
+                if (!skillTarget) { restoreFocus = true; return; }
+            }
+
             if (!isFree && !alreadyOwned) {
                 let balance;
                 try {
@@ -413,7 +424,8 @@ export function setupResourceInstall(btnUse, itemData, currentUser, inlineStatus
                     inlineStatusBox.textContent = t('acquire.validation_running');
                     const validationController = new AbortController();
                     const removeValidationCleanup = scope.addCleanup(() => validationController.abort());
-                    const timeout = setTimeout(() => validationController.abort(), API.BACKGROUND_TIMEOUT);
+                    const timeout = setTimeout(() => validationController.abort(), isSkill ? SKILL_INSTALL.PREFLIGHT_TIMEOUT : API.BACKGROUND_TIMEOUT);
+                    let validationMessage = t('common.network_error_retry');
                     try {
                         const response = await fetch(`${API.BASE_URL}/api/validate_resource`, {
                             method: "POST", headers: { "Content-Type": "application/json", "Authorization": `Bearer ${token}` },
@@ -423,9 +435,17 @@ export function setupResourceInstall(btnUse, itemData, currentUser, inlineStatus
                         if (!isCurrent()) return;
                         const data = await response.json();
                         if (!isCurrent()) return;
+                        if (isSkill && !response.ok) {
+                            validationMessage = t(data?.error_code === 'invalid_skill_package' ? 'skill.invalid_package' : 'skill.source_unavailable');
+                            throw new Error();
+                        }
                         if (!response.ok || data?.status !== "success" || data.error) throw new Error();
+                        if (isSkill && data.skill_manifest_verified !== true) {
+                            validationMessage = t('skill.cloud_update_required');
+                            throw new Error();
+                        }
                     } catch (_) {
-                        if (isCurrent()) inlineStatusBox.textContent = t('acquire.validation_blocked', { message: t('common.network_error_retry') });
+                        if (isCurrent()) inlineStatusBox.textContent = t('acquire.validation_blocked', { message: validationMessage });
                         return;
                     } finally { clearTimeout(timeout); removeValidationCleanup(); }
                 }
@@ -493,6 +513,55 @@ export function setupResourceInstall(btnUse, itemData, currentUser, inlineStatus
                 return;  // ← 提前返回，不进入 Git 安装流程
             }
 
+            if (isSkill) {
+                if (!skillFlow) {
+                    skillFlow = await import('./Skill安装流程.js');
+                    if (!isCurrent()) return;
+                    skillTarget = await skillFlow.chooseSkillDirectory(scope);
+                    if (!isCurrent()) return;
+                    if (!skillTarget) { restoreFocus = true; return; }
+                }
+                phase = 'install';
+                const progress = trackProgress();
+                const controller = new AbortController();
+                const removeCancel = scope.addCleanup(() => controller.abort());
+                progress.addCancelButton(t('install.cancel_in_progress'), () => controller.abort());
+                try {
+                    const result = await skillFlow.runSkillInstall({
+                        target: skillTarget, credentials: { account, token, item_id: String(itemData.id) }, scope,
+                        signal: controller.signal,
+                        confirm: (html, options) => showConfirm(html, { ...options, signal: controller.signal }),
+                        onProgress: event => {
+                            if (!isCurrent()) return;
+                            const stageKey = Object.hasOwn(INSTALL_STAGE_KEYS, event.stage) ? INSTALL_STAGE_KEYS[event.stage] : 'skill.preparing';
+                            progress.update(event.progress, event.skillAction === 'prepare' && event.stage === 'complete' ? t('skill.prepared') : t(stageKey));
+                        }
+                    });
+                    if (!isCurrent()) return;
+                    if (result.status === 'cancelled') { restoreFocus = true; progress.error(t('skill.cancelled')); return; }
+                    if (result.outcomeUnknown) {
+                        phase = 'unknown'; btnUse.removeAttribute('aria-busy');
+                        progress.error(t('skill.outcome_unknown')); return;
+                    }
+                    if (result.status !== 'success' || result.installed !== true) {
+                        progress.error(skillFlow.skillErrorMessage({ code: result.error_code })); return;
+                    }
+                    progress.complete(t('install.complete'));
+                    _recordToolInstalledVersion(itemData.id, result);
+                    saveAcquiredItem(itemData);
+                    btnUse.textContent = `✅ ${t('common.installed')}`;
+                    btnUse.setAttribute('data-install-state', 'success');
+                    try { await api.recordItemUse(itemData.id); if (isCurrent()) clearUsesCache(); } catch {}
+                } catch (error) {
+                    if (isCurrent()) progress.error(controller.signal.aborted ? t('skill.cancelled') : skillFlow.skillErrorMessage(error));
+                } finally {
+                    removeCancel(); controller.abort();
+                    if (phase === 'install') phase = 'idle';
+                    releaseButton();
+                }
+                return;
+            }
+
             if (isTool) {
                 inlineStatusBox.style.display = "block";
                 inlineStatusBox.textContent = t('install.preview_loading');
@@ -946,7 +1015,11 @@ export function setupResourceInstall(btnUse, itemData, currentUser, inlineStatus
             }
         } catch (_) {
             if (isCurrent()) { inlineStatusBox.style.display = "block"; inlineStatusBox.textContent = t('common.error'); }
-        } finally { if (phase === "preflight") phase = "idle"; releaseButton(); }
+        } finally {
+            if (phase === "preflight") phase = "idle";
+            releaseButton();
+            if (restoreFocus && phase === "idle" && isCurrent()) btnUse.focus();
+        }
     };
     return scope;
 }

前端页面/post/帖子详情组件.js

@@ -16,7 +16,7 @@ import { getVideoPlayerHTML, setupVideoPlayerEvents, cleanupVideoPlayer } from "
 import { renderTipLevelHTML } from "../components/打赏等级工具.js";
 import { openOtherUserProfileModal } from "../profile/个人中心视图.js";
 import { t } from "../components/用户体验增强.js";
-import { PLACEHOLDERS, getCachedProfile, getProfileWithSWR, IS_WEB_MODE, API, CACHE } from "../core/全局配置.js";
+import { PLACEHOLDERS, getCachedProfile, getProfileWithSWR, normalizeProfileImageUrl, IS_WEB_MODE, API, CACHE } from "../core/全局配置.js";
 import { removeCache, findInListCache } from "../components/性能优化工具.js";
 import { globalModal } from "../components/全局弹窗管理器.js";
 import { recordView, handleToggleLike, handleToggleFavorite, renderTipBoardHTML as renderCommonTipBoardHTML, escapeHtml, formatTime } from "../components/互动工具函数.js";  // 🧹 P2归一：局部 formatTime 已移除
@@ -47,6 +47,7 @@ function openOwnedModal(node, title, content, options) {
  * @param {string} [extraStyle] - 额外内联样式（img 时追加）
  */
 function _generateAvatarHtml(avatar, name, size, extraStyle = '') {
+    avatar = normalizeProfileImageUrl(avatar);
     const initial = (name || 'U')[0].toUpperCase();
     // 🔒 XSS防护：avatar / name 均来自他人可修改的资料（昵称首字母可能是 < ），写入 HTML 前必须转义
     if (avatar) {
@@ -64,11 +65,12 @@ function _generateAvatarHtml(avatar, name, size, extraStyle = '') {
  * @param {string} [extraStyle] - img 额外内联样式
  */
 function _updateAvatarElement(avatarEl, profile, size, extraStyle = '') {
-    if (!avatarEl || !profile.avatar) return;
+    const avatar = normalizeProfileImageUrl(profile?.avatar);
+    if (!avatarEl || !avatar) return;
     if (avatarEl.tagName === 'IMG') {
-        avatarEl.src = profile.avatar;
+        avatarEl.src = avatar;
     } else {
-        avatarEl.outerHTML = `<img alt="" class="swr-avatar post-detail-avatar ${extraStyle === 'border: 2px solid #444;' ? 'post-detail-avatar--border' : extraStyle === 'background: var(--comfy-input-bg);' ? 'post-detail-avatar--panel' : ''}" src="${escapeHtml(profile.avatar)}" style="width: ${size}px; height: ${size}px; ${['border: 2px solid #444;', 'background: var(--comfy-input-bg);'].includes(extraStyle) ? '' : extraStyle}">`;
+        avatarEl.outerHTML = `<img alt="" class="swr-avatar post-detail-avatar ${extraStyle === 'border: 2px solid #444;' ? 'post-detail-avatar--border' : extraStyle === 'background: var(--comfy-input-bg);' ? 'post-detail-avatar--panel' : ''}" src="${escapeHtml(avatar)}" style="width: ${size}px; height: ${size}px; ${['border: 2px solid #444;', 'background: var(--comfy-input-bg);'].includes(extraStyle) ? '' : extraStyle}">`;
     }
 }
 
@@ -307,7 +309,7 @@ async function loadPostDetail(container, postId, currentUser) {
             
             const account = post.author;
             const cached = getCachedProfile(account);
-            const avatar = cached?.avatar || post.author_avatar || '';
+            const avatar = [cached?.avatar, post.author_avatar].map(value => normalizeProfileImageUrl(value)).find(Boolean) || '';
             const name = cached?.name || post.author_name || account || '';
             const initial = (name || 'U')[0].toUpperCase();
             
@@ -569,7 +571,7 @@ async function loadComments(container, postId, currentUser) {
             // 🚀 SWR 头像渲染：评论作者头像
             commentsList.innerHTML = comments.map((c, idx) => {
                 const cached = getCachedProfile(c.author);
-                const avatar = cached?.avatar || c.author_avatar || '';
+                const avatar = [cached?.avatar, c.author_avatar].map(value => normalizeProfileImageUrl(value)).find(Boolean) || '';
                 const name = cached?.name || c.author_name || c.author || '';
 
                 const avatarHtml = _generateAvatarHtml(avatar, name, 24, 'background: var(--comfy-input-bg);');

前端页面/post/讨论区组件.js

@@ -21,7 +21,7 @@ import { showToast } from "../components/UI交互提示组件.js";
 import { readListCache, writeListCache, requireListResponseData, isEmptyListRefreshWithExistingData, createSkeleton, createPaginationLoader, lazyLoadImages, renderListLoadError, renderListSearchMessage } from "../components/性能优化工具.js";
 import { applyViewportAnimations, stopViewportAnimations } from "../components/动画音效引擎.js";
 import { t } from "../components/用户体验增强.js";
-import { API, CACHE, getCachedProfile, getProfileWithSWR } from "../core/全局配置.js";
+import { API, CACHE, getCachedProfile, getProfileWithSWR, normalizeProfileImageUrl } from "../core/全局配置.js";
 import { createRatingStars } from "../social/评论与互动组件.js";
 import { escapeHtml, formatTime, getCacheTTL } from "../components/互动工具函数.js";  // 🧹 P2归一：局部副本已移除
 
@@ -75,6 +75,7 @@ function _renderEmptyState(t) {
  * @param {string} name - 用户名（用于首字母回退）
  */
 function _generateAvatarHtml(avatar, name) {
+    avatar = normalizeProfileImageUrl(avatar);
     const initial = (name || 'U')[0].toUpperCase();
     if (avatar) {
         return `<img class="swr-avatar posts-card__avatar" alt="" src="${escapeHtml(avatar)}">`;
@@ -670,7 +671,7 @@ function createPostCard(post, currentUser = currentUserCache, isCurrent = () =>
         
         const account = post.author;
         const cached = initialAuthor;
-        const avatar = [cached?.avatar, post.author_avatar].find(value => typeof value === 'string' && value) || '';
+        const avatar = [cached?.avatar, post.author_avatar].map(value => normalizeProfileImageUrl(value)).find(Boolean) || '';
         const name = initialAuthorName;
         const initial = (name || 'U')[0].toUpperCase();
         
@@ -684,11 +685,12 @@ function createPostCard(post, currentUser = currentUserCache, isCurrent = () =>
             if (!isCurrent() || !card.isConnected) return;
             const avatarEl = authorContainer.querySelector('.swr-avatar');
             const nameEl = authorContainer.querySelector('.swr-name');
-            if (avatarEl && typeof profile.avatar === 'string' && profile.avatar) {
+            const avatar = normalizeProfileImageUrl(profile?.avatar);
+            if (avatarEl && avatar) {
                 if (avatarEl.tagName === 'IMG') {
-                    if (avatarEl.getAttribute('src') !== profile.avatar) avatarEl.src = profile.avatar;
+                    if (avatarEl.getAttribute('src') !== avatar) avatarEl.src = avatar;
                 } else {
-                    avatarEl.outerHTML = _generateAvatarHtml(profile.avatar, typeof profile.name === 'string' && profile.name ? profile.name : name);
+                    avatarEl.outerHTML = _generateAvatarHtml(avatar, typeof profile.name === 'string' && profile.name ? profile.name : name);
                 }
             }
             if (nameEl && typeof profile.name === 'string' && profile.name && nameEl.textContent !== profile.name) {

前端页面/prompt/提示词组件.js

@@ -24,7 +24,7 @@ import { showToast } from "../components/UI交互提示组件.js";
 import { setCache, getCacheWithMeta, readListCache, writeListCache, requireListResponseData, isEmptyListRefreshWithExistingData, createPaginationLoader, lazyLoadImages, renderListLoadError, renderListSearchMessage } from "../components/性能优化工具.js";
 import { applyViewportAnimations, stopViewportAnimations } from "../components/动画音效引擎.js";
 import { t, tIfExists } from "../components/用户体验增强.js";
-import { API, CACHE, getCachedProfile, getProfileWithSWR } from "../core/全局配置.js";
+import { API, CACHE, getCachedProfile, getProfileWithSWR, normalizeProfileImageUrl } from "../core/全局配置.js";
 import { escapeHtml, formatTime, getCacheTTL } from "../components/互动工具函数.js";  // 🧹 P2归一：局部副本已移除
 
 // 缓存配置
@@ -111,6 +111,7 @@ function _renderEmptyState() {
  * 🖼️ 生成头像 HTML 字符串
  */
 function _generateAvatarHtml(avatar, name) {
+    avatar = normalizeProfileImageUrl(avatar);
     const initial = (name || 'U')[0].toUpperCase();
     // 🔒 XSS防护：avatar / name 均来自他人可修改的资料（昵称首字母可能是 < ），写入 HTML 前必须转义
     if (avatar) {
@@ -824,7 +825,7 @@ function createPromptCard(prompt, currentUser = currentUserCache, isCurrent = ()
 
         const account = prompt.author;
         const cached = initialAuthor;
-        const avatar = [cached?.avatar, prompt.author_avatar].find(value => typeof value === 'string' && value) || '';
+        const avatar = [cached?.avatar, prompt.author_avatar].map(value => normalizeProfileImageUrl(value)).find(Boolean) || '';
         const name = initialAuthorName;
 
         // 渲染初始头像
@@ -837,11 +838,12 @@ function createPromptCard(prompt, currentUser = currentUserCache, isCurrent = ()
             if (!isCurrent() || !card.isConnected) return;
             const avatarEl = authorContainer.querySelector('.swr-avatar');
             const nameEl = authorContainer.querySelector('.swr-name');
-            if (avatarEl && typeof profile.avatar === 'string' && profile.avatar) {
+            const avatar = normalizeProfileImageUrl(profile?.avatar);
+            if (avatarEl && avatar) {
                 if (avatarEl.tagName === 'IMG') {
-                    if (avatarEl.getAttribute('src') !== profile.avatar) avatarEl.src = profile.avatar;
+                    if (avatarEl.getAttribute('src') !== avatar) avatarEl.src = avatar;
                 } else {
-                    avatarEl.outerHTML = _generateAvatarHtml(profile.avatar, typeof profile.name === 'string' && profile.name ? profile.name : name);
+                    avatarEl.outerHTML = _generateAvatarHtml(avatar, typeof profile.name === 'string' && profile.name ? profile.name : name);
                 }
             }
             if (nameEl && typeof profile.name === 'string' && profile.name && nameEl.textContent !== profile.name) {

前端页面/prompt/提示词详情组件.js

@@ -18,7 +18,7 @@ import { getCoverSandboxHTML, setupImageSandboxEvents, cleanupImageSandbox } fro
 import { getVideoPlayerHTML, setupVideoPlayerEvents, cleanupVideoPlayer } from "../components/视频播放器组件.js";
 import { openOtherUserProfileModal } from "../profile/个人中心视图.js";
 import { t, tIfExists } from "../components/用户体验增强.js";
-import { getCachedProfile, getProfileWithSWR, IS_WEB_MODE, API, CACHE } from "../core/全局配置.js";
+import { getCachedProfile, getProfileWithSWR, normalizeProfileImageUrl, IS_WEB_MODE, API, CACHE } from "../core/全局配置.js";
 import { findInListCache } from "../components/性能优化工具.js";
 import { globalModal } from "../components/全局弹窗管理器.js";
 import { recordView, handleToggleLike, handleToggleFavorite, renderTipBoardHTML as renderCommonTipBoardHTML, escapeHtml, formatTime } from "../components/互动工具函数.js";  // 🧹 P2归一：局部 formatTime 已移除
@@ -44,6 +44,7 @@ function openOwnedModal(node, title, content, options) {
  * 🖼️ 生成头像 HTML 字符串
  */
 function _generateAvatarHtml(avatar, name, size, extraStyle = '') {
+    avatar = normalizeProfileImageUrl(avatar);
     const initial = (name || 'U')[0].toUpperCase();
     // 🔒 XSS防护：avatar / name 均来自他人可修改的资料（昵称首字母可能是 < ），写入 HTML 前必须转义
     if (avatar) {
@@ -56,11 +57,12 @@ function _generateAvatarHtml(avatar, name, size, extraStyle = '') {
  * 🔄 用 SWR 回调更新已渲染的头像元素
  */
 function _updateAvatarElement(avatarEl, profile, size, extraStyle = '') {
-    if (!avatarEl || !profile.avatar) return;
+    const avatar = normalizeProfileImageUrl(profile?.avatar);
+    if (!avatarEl || !avatar) return;
     if (avatarEl.tagName === 'IMG') {
-        avatarEl.src = profile.avatar;
+        avatarEl.src = avatar;
     } else {
-        avatarEl.outerHTML = `<img class="swr-avatar prompt-detail__avatar ${size === 24 ? 'prompt-detail__avatar--small' : 'prompt-detail__avatar--large'}" alt="" src="${escapeHtml(profile.avatar)}">`;
+        avatarEl.outerHTML = `<img class="swr-avatar prompt-detail__avatar ${size === 24 ? 'prompt-detail__avatar--small' : 'prompt-detail__avatar--large'}" alt="" src="${escapeHtml(avatar)}">`;
     }
 }
 
@@ -327,7 +329,7 @@ async function loadPromptDetail(container, promptId, currentUser) {
 
             const account = prompt.author;
             const cached = getCachedProfile(account);
-            const avatar = cached?.avatar || prompt.author_avatar || '';
+            const avatar = [cached?.avatar, prompt.author_avatar].map(value => normalizeProfileImageUrl(value)).find(Boolean) || '';
             const name = cached?.name || prompt.author_name || account || '';
 
             if (avatarContainer) {
@@ -735,7 +737,7 @@ async function loadComments(container, promptId, currentUser) {
             // 🚀 SWR 头像渲染：评论作者头像
             commentsList.innerHTML = comments.map((c, idx) => {
                 const cached = getCachedProfile(c.author);
-                const avatar = cached?.avatar || c.author_avatar || '';
+                const avatar = [cached?.avatar, c.author_avatar].map(value => normalizeProfileImageUrl(value)).find(Boolean) || '';
                 const name = cached?.name || c.author_name || c.author || '';
 
                 const avatarHtml = _generateAvatarHtml(avatar, name, 24, 'background: var(--comfy-input-bg);');

前端页面/social/评论与互动组件.js

@@ -1,7 +1,7 @@
 // 前端页面/social/评论与互动组件.js
 import { api } from "../core/网络请求API.js";
 import { t } from "../components/用户体验增强.js";
-import { getCachedProfile, getProfileWithSWR, isAdmin } from "../core/全局配置.js";
+import { getCachedProfile, getProfileWithSWR, normalizeProfileImageUrl, isAdmin } from "../core/全局配置.js";
 import { showToast, showConfirm } from "../components/UI交互提示组件.js";
 // 🧹 P2归一：escapeHtml 局部副本已移除，改用统一版
 import { escapeHtml } from "../components/互动工具函数.js";
@@ -109,7 +109,7 @@ export function createCommentSection(itemId, commentsData, currentUser, onCountC
             // 🚀 SWR 缓存优先获取头像
             const account = comment.author;
             const cached = getCachedProfile(account);
-            const avatar = cached?.avatar || comment.avatar || '';
+            const avatar = [cached?.avatar, comment.avatar].map(value => normalizeProfileImageUrl(value)).find(Boolean) || '';
             const avatarSrc = avatar || DEFAULT_AVATAR_SVG;
 
             itemDiv.innerHTML = `
@@ -132,8 +132,9 @@ export function createCommentSection(itemId, commentsData, currentUser, onCountC
                 const nameEl = itemDiv.querySelector('.swr-name');
                 if (profileGeneration !== generation || !profileCurrent() || !profile || typeof profile !== 'object' || Array.isArray(profile)
                     || (profile.account != null && profile.account !== account)) return;
-                if (avatarEl && typeof profile.avatar === 'string' && profile.avatar) {
-                    avatarEl.src = profile.avatar;
+                const avatar = normalizeProfileImageUrl(profile.avatar);
+                if (avatarEl && avatar) {
+                    avatarEl.src = avatar;
                 }
                 if (nameEl && typeof profile.name === 'string' && profile.name) {
                     nameEl.textContent = profile.name;

前端页面/styles/主题基础.css

@@ -2748,7 +2748,21 @@ button.ranking-rating__star { cursor: pointer; min-width: 28px; min-height: 28px
 
 .comfy-ranking-root .profile-view { display:flex; flex-direction:column; gap:.9375rem; padding:.9375rem; flex:1; min-width:0; min-height:0; box-sizing:border-box; overflow-y:auto; background:var(--rk-bg,var(--comfy-menu-bg,#202020)); color:var(--rk-text,var(--fg-color,#eee)); font-size:.875rem; overflow-wrap:anywhere; }
 
-.comfy-ranking-root .resource-trend { --resource-trend-text: var(--rk-text); --resource-trend-border: var(--rk-border); --resource-trend-line: var(--rk-text); --resource-trend-panel: var(--rk-panel); min-width:0; min-height:10rem; max-width:100%; transition-property:none; font-family:inherit; font-size:.75rem; color:var(--rk-text); }
+.skill-directory { display:flex; flex-direction:column; gap:.75rem; min-width:0; color:inherit; overflow-wrap:anywhere; }
+.skill-directory p { margin:0; }
+.skill-directory__label { display:flex; flex-direction:column; gap:.375rem; min-width:0; }
+.skill-directory input { box-sizing:border-box; width:100%; min-width:0; padding:.5rem; font:inherit; color:inherit; background:var(--rk-panel,var(--comfy-input-bg,#222)); border:1px solid var(--rk-border,var(--border-color,#555)); border-radius:.375rem; }
+.skill-directory__actions { display:flex; flex-wrap:wrap; gap:.5rem; }
+.skill-directory button { min-height:2.25rem; padding:.375rem .625rem; font:inherit; text-align:start; white-space:normal; overflow-wrap:anywhere; cursor:pointer; color:inherit; background:var(--rk-panel,var(--comfy-input-bg,#222)); border:1px solid var(--rk-border,var(--border-color,#555)); border-radius:.375rem; }
+.skill-directory button:disabled { opacity:.55; cursor:default; }
+.skill-directory :is(button,input):focus-visible { outline:2px solid var(--rk-accent,#4c9ffe); outline-offset:2px; }
+.skill-directory__list { list-style:none; padding:0; margin:0; max-height:18rem; overflow-y:auto; }
+.skill-directory__list button { width:100%; margin-bottom:.25rem; }
+.skill-install-preview { min-width:0; text-align:start; overflow-wrap:anywhere; }
+.skill-install-preview ul { max-height:18rem; overflow-y:auto; padding-inline-start:1.5rem; }
+@media (forced-colors:active) { .skill-directory :is(input,button) { border-color:ButtonText; } .skill-directory :is(input,button):focus-visible { outline-color:Highlight; } }
+
+.comfy-ranking-root .resource-trend { --resource-trend-text: var(--rk-text); --resource-trend-border: var(--rk-border); --resource-trend-line: var(--rk-text); --resource-trend-panel: var(--rk-panel); min-width:0; min-height:10rem; max-width:100%; transition-property:none; font-family:inherit; font-size:.75rem; color:var(--rk-text); }
 .comfy-ranking-root .resource-trend__state { display:flex; justify-content:center; align-items:center; min-height:160px; box-sizing:border-box; padding:1rem; text-align:center; font:inherit; line-height:1.5; overflow-wrap:anywhere; color:var(--rk-text); }
 .comfy-ranking-root .resource-trend__state[role=alert] { border-inline-start:2px solid var(--rk-danger); }
 @media (forced-colors:active) { .comfy-ranking-root .resource-trend { --resource-trend-text:CanvasText; --resource-trend-border:CanvasText; --resource-trend-line:CanvasText; --resource-trend-panel:Canvas; } .comfy-ranking-root .resource-trend__state { color:CanvasText; } .comfy-ranking-root .resource-trend__state[role=alert] { border-color:CanvasText; } }

前端页面/task/任务榜组件.js

@@ -23,7 +23,7 @@ import { showToast } from "../components/UI交互提示组件.js";
 import { readListCache, writeListCache, requireListResponseData, isEmptyListRefreshWithExistingData, createSkeleton, createPaginationLoader, lazyLoadImages, renderListLoadError, renderListSearchMessage } from "../components/性能优化工具.js";
 import { applyViewportAnimations, stopViewportAnimations } from "../components/动画音效引擎.js";
 import { t } from "../components/用户体验增强.js";
-import { API, CACHE, getCachedProfile, getProfileWithSWR } from "../core/全局配置.js";
+import { API, CACHE, getCachedProfile, getProfileWithSWR, normalizeProfileImageUrl } from "../core/全局配置.js";
 import { escapeHtml, formatTime, getCacheTTL } from "../components/互动工具函数.js";  // 🧹 P2归一：局部副本已移除
 
 // 缓存配置
@@ -660,7 +660,7 @@ function createTaskCard(task, currentUser = currentUserCache, isCurrent = () =>
         
         const account = task.publisher;
         const cached = initialAuthor;
-        const avatar = [cached?.avatar, task.publisher_avatar].find(value => typeof value === 'string' && value) || '';
+        const avatar = [cached?.avatar, task.publisher_avatar].map(value => normalizeProfileImageUrl(value)).find(Boolean) || '';
         const name = initialAuthorName;
         
         
@@ -676,8 +676,9 @@ function createTaskCard(task, currentUser = currentUserCache, isCurrent = () =>
             if (!isCurrent() || !card.isConnected) return;
             const avatarEl = authorContainer.querySelector('.swr-avatar');
             const nameEl = authorContainer.querySelector('.swr-name');
-            if (avatarEl && typeof profile.avatar === 'string' && profile.avatar) {
-                if (avatarEl.getAttribute('src') !== profile.avatar) avatarEl.src = profile.avatar;
+            const avatar = normalizeProfileImageUrl(profile?.avatar);
+            if (avatarEl && avatar) {
+                if (avatarEl.getAttribute('src') !== avatar) avatarEl.src = avatar;
             }
             if (nameEl && typeof profile.name === 'string' && profile.name && nameEl.textContent !== profile.name) {
                 nameEl.textContent = profile.name;

前端页面/task/任务详情组件.js

@@ -6,13 +6,14 @@
 // ==========================================
 
 import { api, proxyImages, captureRequestSession, requestCancelManager } from "../core/网络请求API.js";
+import { disputeImageURL } from "./申诉数据工具.js";
 import { hasAppliedToTask } from "./任务数据工具.js";
 import { loadTaskSnapshot } from "./任务详情加载.js";
 import { eventBus, EVENTS } from "../core/状态管理.js";
 import { createTaskViewScope, subscribeTaskSessionChanges } from "./任务视图生命周期.js";
 import { showToast } from "../components/UI交互提示组件.js";
 import { t } from "../components/用户体验增强.js";
-import { API, CACHE, PLACEHOLDERS, TASK_LIMITS, getCachedProfile, getProfileWithSWR, isAdmin, IS_WEB_MODE } from "../core/全局配置.js";
+import { API, CACHE, PLACEHOLDERS, TASK_LIMITS, getCachedProfile, getProfileWithSWR, normalizeProfileImageUrl, isAdmin, IS_WEB_MODE } from "../core/全局配置.js";
 import { removeCache, findInListCache, requireListResponseData } from "../components/性能优化工具.js";
 import { globalModal } from "../components/全局弹窗管理器.js";
 import { compressImageForUpload } from "../market/发布内容_提交引擎.js";
@@ -240,7 +241,7 @@ function renderTaskDetail(contentEl, task, currentUser, preview = false) {
         
         <!-- 发布者信息 -->
         <div class="task-detail__publisher">
-            <img src="${escapeHtml(task.publisher_avatar || PLACEHOLDERS.AVATAR_SMALL)}"
+            <img src="${escapeHtml(normalizeProfileImageUrl(task.publisher_avatar) || PLACEHOLDERS.AVATAR_SMALL)}"
                  class="task-detail__avatar-main" id="publisher-avatar" alt="">
             <div class="task-detail__grow">
                 <div class="task-detail__publisher-name">${escapeHtml(task.publisher_name || task.publisher)}</div>
@@ -348,7 +349,7 @@ ${escapeHtml(task.description)}</div>
             <div class="task-detail__assignee">
                 <div class="task-detail__assignee-heading">👷 ${t('task.assignee')}</div>
                 <div class="task-detail__person">
-                    <img alt="" src="${escapeHtml(task.assignee_avatar || PLACEHOLDERS.AVATAR_SMALL)}"
+                    <img alt="" src="${escapeHtml(normalizeProfileImageUrl(task.assignee_avatar) || PLACEHOLDERS.AVATAR_SMALL)}"
                          class="task-detail__avatar">
                     <span class="task-detail__person-name">${escapeHtml(task.assignee_name || task.assignee)}</span>
                 </div>
@@ -373,7 +374,7 @@ ${escapeHtml(task.description)}</div>
                 <div id="applicants-list" class="task-detail__applicants">
                     ${applicants.map(app => `
                         <div class="task-detail__applicant">
-                            <img alt="" src="${escapeHtml(app.avatar || PLACEHOLDERS.AVATAR_SMALL)}"
+                            <img alt="" src="${escapeHtml(normalizeProfileImageUrl(app.avatar) || PLACEHOLDERS.AVATAR_SMALL)}"
                                  class="task-detail__avatar">
                             <div class="task-detail__grow">
                                 <div class="task-detail__applicant-name">${escapeHtml(app.name || app.account)}</div>
@@ -1118,6 +1119,7 @@ function renderTipBoard(tipBoard) {
  * 🖼️ 渲染评论头像HTML
  */
 function _renderCommentAvatar(name, avatarUrl) {
+    avatarUrl = normalizeProfileImageUrl(avatarUrl);
     const initial = String(name || 'U')[0].toUpperCase();
     // 🔒 XSS防护：评论者昵称与头像均来自他人可修改的资料，写入 HTML 前必须转义
     return avatarUrl 
@@ -1173,7 +1175,7 @@ async function loadTaskComments(container, taskId, currentUser) {
             // 🚀 SWR 头像渲染：评论作者头像
             commentsList.innerHTML = comments.map((c, idx) => {
                 const cached = getCachedProfile(c.author);
-                const avatar = cached?.avatar || c.author_avatar || '';
+                const avatar = [cached?.avatar, c.author_avatar].map(value => normalizeProfileImageUrl(value)).find(Boolean) || '';
                 const name = cached?.name || c.author_name || c.author || '';
                 const avatarHtml = _renderCommentAvatar(name, avatar);
                 
@@ -1208,8 +1210,9 @@ async function loadTaskComments(container, taskId, currentUser) {
                     const avatarContainer = commentEl.querySelector('.swr-avatar-container');
                     const nameEl = commentEl.querySelector('.swr-name');
                     
-                    if (avatarContainer && profile.avatar) {
-                        avatarContainer.innerHTML = _renderCommentAvatar(profile.name || nameEl?.textContent || c.author_name || c.author, profile.avatar);
+                    const avatar = normalizeProfileImageUrl(profile.avatar);
+                    if (avatarContainer && avatar) {
+                        avatarContainer.innerHTML = _renderCommentAvatar(profile.name || nameEl?.textContent || c.author_name || c.author, avatar);
                     }
                     if (nameEl && profile.name) nameEl.textContent = profile.name;
                 });
@@ -1517,10 +1520,9 @@ function showDisputeDialog(task, currentUser) {
                 if (!taskModalCurrent(content)) return;
                 const res = await api.uploadFile(processedFile, "dispute");
                 if (!taskModalCurrent(content)) return;
-                if (res?.status !== "success" || typeof res.url !== "string" || !res.url.trim()) {
-                    throw new Error("Invalid evidence upload response");
-                }
-                evidenceUrls.push(res.url);
+                const url = res?.status === "success" ? disputeImageURL(res.url) : "";
+                if (!url) throw new Error("Invalid evidence upload response");
+                evidenceUrls.push(url);
             }
             
             // 提交申诉

前端页面/task/申诉数据工具.js

@@ -1,39 +1,38 @@
-import { API, UI } from "../core/全局配置.js";
-
-export function disputeImageURL(value) {
-    if (typeof value !== "string" || !value.trim()) return "";
-    const input = value.trim();
-    if (/^uploads\/[a-zA-Z0-9_./-]+$/.test(input) && !input.split('/').includes('..')) {
-        return `${API.BASE_URL}${API.IMAGE_PROXY_PATH}?path=${encodeURIComponent(input)}`;
-    }
-    // 只接受既有本地图片代理相对路径，不把任意同源 GET 当作图片执行。
-    if (input.startsWith('/community_hub/image?')) return input;
-    try {
-        const url = new URL(input);
-        if (!["https:", "http:"].includes(url.protocol) || url.username || url.password) return "";
-        return url.href;
-    } catch (_) { return ""; }
-}
-
-export function normalizeDispute(value, expectedId) {
-    if (!value || typeof value !== "object" || Array.isArray(value) || value.id !== expectedId
-        || !["pending", "responded", "resolved"].includes(value.status)
-        || !["publisher", "assignee"].includes(value.initiator_role)
-        || !["publisher", "assignee", "initiator"].every(key => typeof value[key] === "string" && value[key].trim())
-        || value.initiator !== value[value.initiator_role]) return null;
-    const result = { ...value };
-    for (const key of ["task_id", "task_title", "publisher_name", "assignee_name", "reason", "response", "resolution_note"]) {
-        result[key] = typeof value[key] === "string" ? value[key] : "";
-    }
-    for (const key of ["evidence", "response_evidence"]) {
-        result[key] = Array.isArray(value[key])
-            ? value[key].map(disputeImageURL).filter(Boolean).slice(0, UI.MAX_DISPUTE_EVIDENCE) : [];
-    }
-    for (const key of ["publisher_avatar", "assignee_avatar"]) result[key] = disputeImageURL(value[key]);
-    for (const key of ["created_at", "responded_at", "resolved_at"]) {
-        result[key] = typeof value[key] === "number" && Number.isFinite(value[key]) && value[key] >= 0 ? value[key] : null;
-    }
-    result.resolution_ratio = typeof value.resolution_ratio === "number" && Number.isFinite(value.resolution_ratio)
-        && value.resolution_ratio >= 0 && value.resolution_ratio <= 100 ? value.resolution_ratio : null;
-    return result;
-}
+import { API, UI, normalizeProfileImageUrl } from "../core/全局配置.js";
+
+export function disputeImageURL(value, serviceBaseUrl = API.BASE_URL) {
+    if (typeof value !== "string" || !value || value.trim() !== value) return "";
+    let input = value;
+    if (/^uploads\/[a-zA-Z0-9_./-]+$/.test(input) && !input.split('/').includes('..')) {
+        input = `${serviceBaseUrl.replace(/\/$/, "")}${API.IMAGE_PROXY_PATH}?path=${encodeURIComponent(input)}`;
+    }
+    if (/^(?:data:|blob:)/i.test(input)) return "";
+    return normalizeProfileImageUrl(input, false, serviceBaseUrl);
+}
+
+export function normalizeDisputeEvidence(value, serviceBaseUrl = API.BASE_URL) {
+    return Array.isArray(value)
+        ? value.map(image => disputeImageURL(image, serviceBaseUrl)).filter(Boolean).slice(0, UI.MAX_DISPUTE_EVIDENCE) : [];
+}
+
+export function normalizeDispute(value, expectedId) {
+    if (!value || typeof value !== "object" || Array.isArray(value) || value.id !== expectedId
+        || !["pending", "responded", "resolved"].includes(value.status)
+        || !["publisher", "assignee"].includes(value.initiator_role)
+        || !["publisher", "assignee", "initiator"].every(key => typeof value[key] === "string" && value[key].trim())
+        || value.initiator !== value[value.initiator_role]) return null;
+    const result = { ...value };
+    for (const key of ["task_id", "task_title", "publisher_name", "assignee_name", "reason", "response", "resolution_note"]) {
+        result[key] = typeof value[key] === "string" ? value[key] : "";
+    }
+    for (const key of ["evidence", "response_evidence"]) {
+        result[key] = normalizeDisputeEvidence(value[key]);
+    }
+    for (const key of ["publisher_avatar", "assignee_avatar"]) result[key] = normalizeProfileImageUrl(value[key]);
+    for (const key of ["created_at", "responded_at", "resolved_at"]) {
+        result[key] = typeof value[key] === "number" && Number.isFinite(value[key]) && value[key] >= 0 ? value[key] : null;
+    }
+    result.resolution_ratio = typeof value.resolution_ratio === "number" && Number.isFinite(value.resolution_ratio)
+        && value.resolution_ratio >= 0 && value.resolution_ratio <= 100 ? value.resolution_ratio : null;
+    return result;
+}