fix: 修复公告中心崩溃、皮肤预览错乱、分组不刷新与地图被拦

- 补回公告中心缺失的配图状态与加载函数，组件此前因引用未定义变量而崩溃
- 皮肤预览按玩家与纹理重建渲染器，避免切换后纹理错位
- 设置分组后同步本地实例分组字段，无需刷新页面
- 地图 iframe 的 CSP frame-src 放开 https，适配服务端可配置的地图地址

apps/app-frontend/src/components/ui/RemoteAnnouncements.vue

@@ -219,6 +219,32 @@ function saveCache(next: RemoteAnnouncement[]) {
 		// localStorage may be unavailable (private mode / quota)
 	}
 }
+const imageUrls = reactive<Record<string, string>>({})
+
+async function loadImage(item: RemoteAnnouncement, token: string) {
+	const name = item.image_name
+	if (!name || imageUrls[item.id]) return
+	try {
+		const url = `https://skin.starlight.cool/starlight/skin/image/BROADCAST_ATTACHMENT/${encodeURIComponent(name)}`
+		const response = await tauriFetch(url, {
+			method: 'GET',
+			headers: { Authorization: `Bearer ${token}` },
+		})
+		if (!response.ok) return
+		const type = response.headers.get('content-type') ?? ''
+		if (type.includes('application/json') || type.includes('text/')) return
+		const blob = await response.blob()
+		imageUrls[item.id] = URL.createObjectURL(blob)
+	} catch {
+		// 图片加载失败不影响公告本身展示
+	}
+}
+
+function revokeImages() {
+	for (const url of Object.values(imageUrls)) URL.revokeObjectURL(url)
+	for (const key of Object.keys(imageUrls)) delete imageUrls[key]
+}
+
 async function refresh() {
 	if (disposed) return
 	loadCache()

apps/app-frontend/src/components/ui/skin-site/SkinSiteProfileView.vue

@@ -622,6 +622,7 @@ watch(signedIn, (value) => {
 						</div>
 						<SkinPreviewRenderer
 							v-else
+							:key="`${selectedPlayer.uuid}:${texture.skin ?? ''}:${texture.cape ?? ''}`"
 							:texture-src="texture.skin ?? ''"
 							:cape-src="texture.cape"
 							:variant="skinVariant"

apps/app-frontend/src/composables/useInstanceGroups.ts

@@ -157,6 +157,13 @@ export function useInstanceGroups(instances: Ref<{ id: string; groups: string[]
 
 	async function setMemberships(updates: InstanceGroupMembershipUpdate[]): Promise<boolean> {
 		await set_group_memberships(updates)
+		// 接口成功后同步本地实例的 groups 字段，否则依赖 instances 的分组视图不会重算，
+		// 用户必须刷新页面才能看到新的分组归属。
+		const byId = new Map(updates.map((update) => [update.instance_id, update.group_ids]))
+		instances.value = instances.value.map((instance) => {
+			const nextGroups = byId.get(instance.id)
+			return nextGroups ? { ...instance, groups: [...nextGroups] } : instance
+		})
 		return true
 	}
 

apps/app/tauri.conf.json

@@ -126,7 +126,7 @@
         "script-src": "'self' 'unsafe-eval' 'wasm-unsafe-eval'",
         "worker-src": "'self' blob:",
 
-        "frame-src": "https://www.youtube.com https://www.youtube-nocookie.com https://discord.com 'self' http://axolotl-skin.localhost axolotl-skin://localhost https://skin.starlight.cool https://map.starlight.cool",
+        "frame-src": "https: http://axolotl-skin.localhost axolotl-skin://localhost 'self'",
         "media-src": "'self' data: https://*.githubusercontent.com"
       },
       "csp": {
@@ -136,7 +136,7 @@
         "img-src": "https: 'unsafe-inline' 'self' asset: http://asset.localhost http://textures.minecraft.net blob: data:",
         "style-src": "'unsafe-inline' 'self'",
         "script-src": "'self' 'unsafe-eval' 'wasm-unsafe-eval'",
-        "frame-src": "https://www.youtube.com https://www.youtube-nocookie.com https://discord.com 'self' axolotl-skin://localhost http://axolotl-skin.localhost https://skin.starlight.cool https://map.starlight.cool",
+        "frame-src": "https: axolotl-skin://localhost http://axolotl-skin.localhost 'self'",
         "media-src": "'self' data: https://*.githubusercontent.com"
       }
     }