[hongducdev]

Summary

Fixes from a review of the plugin, in priority order.

Security: the debug port is no longer installed for users

.debug turns on Chromium remote debugging (port 9004) for a panel that has cep.fs and evalScript. Because the installer also enables PlayerDebugMode, every user install had this port open.

• install/Cai-dat-SCCTLM_Foto.bat and .command copy only the runtime set (index.html, style.css, loader.jsx, CSXS/ js/ jsx/ css/ img/ presets/) plus LICENSE and NOTICE.md. They also remove tests/, docs/, .github/ and README.md that older installers copied.
• .debug is copied only when installing from a git checkout. .gitattributes keeps it out of the release zip (export-ignore).
• Existing users who update through ⤓: the panel deletes .debug at startup (scctlmFotoDropDebugPort, js/dev-source-sync.js), unless .git or a dev-source record exists. The port closes from the next Photoshop start.
• Also fixed an existing installer line that broke on source paths containing ), such as SCCTLM_Foto (1).

Update check

The silent check reuses GitHub's answer for 6 hours (localStorage) and revalidates with If-None-Match (a 304 doesn't count against the 60/hour limit). The ⤓ button always asks GitHub.

Before / After refresh

The button now refreshes on documentAfterActivate and on History selection (slct via PhotoshopRegisterEvent). Tested live in Photoshop 23.2: one state read per change and none when idle. Photoshop sends no event for Ctrl+Z, Ctrl+Shift+Z or layer show/hide (checked with an event logger, even with undoEvent/Shw/Hd registered), so the code registers only what fires and the docs say so.

Other changes

• run() in js/panel.js uses a lookup table instead of chained ternaries. The generated ExtendScript is byte-identical to the old code across 23 valid and invalid inputs.
• index.html has <!DOCTYPE html> and lang="vi". I measured 758 elements across all 5 tabs at 300 px in quirks vs standards mode, and they are identical.
• README and site now say Photoshop 2021+ instead of CC 2015. The panel CSS (flex gap, :focus-visible, aspect-ratio) needs a Chromium that CC 2015 doesn't have. manifest.xml host versions are unchanged, so no host gets blocked.
• Supporters without a photo get a neutral avatar instead of another supporter's photo and a # link. The README tab list now includes Watermark.
• package.json (no dependencies) adds npm test → tests/run-checks.js, and CI uses it.

Testing

• npm test: 24/24 pass. New: tests/check-debug-port.js, plus additions to check-github-updater.js (cache/ETag) and check-before-after.js (event registration and debounce).
• Windows installer run into temp folders from a git source, from a git archive source and from a path containing (1). macOS installer run with a stub rsync; bash -n ok.
• Live in Photoshop 23.2 on temporary images (closed afterwards): the panel loads in standards mode with no core load errors, image switching and History selection update the button, and .debug survives a reload on the junction dev install.

Reviewer notes

• Release: runtime files changed, so release-manifest.json must be re-signed (node scripts/release-sign.js) before tagging. release-verify reports hash mismatches until then.
• Not tested on a real Mac (rsync/cp path) or on Photoshop older than 23.2.
• Not done: the clean-room rewrite of the legacy jsx/ files (TC next). It needs the separate clean-room process.