Merge current main into Shotty compatibility branch

Show Game Theme Music settings in Framey

docs/evidence/framey-shotty-python-2026-10-26.md

@@ -0,0 +1,9 @@
+# Shotty Python compatibility, 26 October 2026
+
+The exact official Shotty 0.1.0 archive (store ID 53, SHA-256 `ab7f6618b264a0cb766525e788cef6c3e1478c0fef98a701225e5e8af441e2fe`) imports `click.get_app_dir` at startup but never calls it. The archive includes an empty `py_modules` directory and no `click` package. A prior actual Decky 3.3.0 amd64 backend check stopped at `ModuleNotFoundError: click`; its local frontend separately starts with Framey's read-only Steam library snapshot.
+
+Frame Control now writes a small Linux `click.get_app_dir` compatibility module into **only this exact digest's** managed `Shotty/py_modules` folder during staging. Decky Loader adds each plugin's `py_modules` folder to that plugin's Python search path. The staging transaction records `shotty-click-app-dir` in the receipt and removes the whole staged folder on failure. A different Shotty digest receives no module. The official ZIP bytes and their verified hash remain unchanged.
+
+An isolated transaction test installed the pinned archive, imported its unchanged `main.py` using the staged module, and called its `aggregate_all` method with a synthetic Steam screenshot under a temporary `HOME`. It copied one fixture image into that temporary home's `Pictures/Screenshots/Local Test Game` folder; reopening the copied bytes matched the source. Removal deleted the managed folder. A second synthetic Shotty archive with another digest installed without the module. The test neither started the plugin's continuous screenshot rescuer nor touched a person's Steam library or screenshots.
+
+This supports **partial** compatibility for the local frontend and a narrow backend copy path. Actual Decky 3.3.0 ARM64 plugin startup, gamescope screenshot rescue, real screenshot aggregation, VR panel visibility, and physical controller use remain unverified. No headset lock was acquired or headset state changed for this check.

docs/framey-compatibility.md

@@ -4,7 +4,7 @@ Snapshot: 2026-10-26T06:10:58.537029+00:00; 116 current visible official plugins
 
 This table and both store views use [`ui/framey-compatibility.json`](../ui/framey-compatibility.json). Results apply only to the exact store ID, version and SHA-256. A changed digest/version is **unverified**. Regenerate this document with `python3 scripts/framey-compatibility-doc.py`; use `--check` in review.
 
-**Works: 4 · Partial: 51 · Broken: 50 · N/A: 11.**
+**Works: 4 · Partial: 52 · Broken: 49 · N/A: 11.**
 
 - **Works** requires verified useful plugin behavior with its real backend. Read the reason for the verified scope and remaining limits; it does not imply worn-VR verification.
 - **Partial** means only a subset or a local fixture scope was verified, often just frontend/settings initialization. The remaining backend/device functionality is unverified; read the reason for the exact scope.
@@ -68,7 +68,7 @@ The API column shows manifest / actual bundled frontend API. Many manifests say
 | 49: Decky Cloud Save 1.4.2 | legacy / legacy | broken | Unsafe plugin archive member. | static archive, local browser, fake-Frame |
 | 50: Storage Cleaner 1.4.0 | 1 / 2 | partial | Empty-data panel rendered; cleanup was deliberately not run because it can remove local data. | static archive, local browser, fake-Frame |
 | 52: Game Theme Music 1.7.1-1 | 1 / 2 | partial | An inert local component lets the exact frontend initialize and render its Settings view in opaque Chromium. Backend get_setting and plugin network were denied in the audit; Steam game-page theme injection has no verified target in Framey. Music search, playback, downloads, settings persistence and worn VR remain unverified. | static archive, local browser, fake-Frame |
-| 53: Shotty 0.1.0 | legacy / legacy | broken | Library snapshot fixes the frontend allApps crash. Actual published Decky 3.3.0 amd64 backend fails importing click.get_app_dir (ModuleNotFoundError); the archive does not bundle click. Screenshot aggregation/rescue was not run. | static archive, local browser, fake-Frame, real Frame SSH |
+| 53: Shotty 0.1.0 | legacy / legacy | partial | The frontend starts with the read-only Frame library snapshot. Frame Control adds a digest-scoped click.get_app_dir compatibility module to the managed install; the exact backend then imports and copies a synthetic Steam screenshot into a temporary Pictures folder in isolated Python. Actual Decky 3.3.0 ARM64 loading, live screenshots/rescue, in-VR panel and physical controller use remain unverified. | static archive, local browser, fake-Frame, real Frame SSH, isolated Python backend |
 | 56: MangoPeel 0.0.7 | 1 / 2 | partial | Initializer succeeds; gamescope/MangoHud actions and backend are unverified. | static archive, local browser, fake-Frame |
 | 58: Volume Boost 0.0.7 | legacy / legacy | works | Default-sink controls pass in local Chromium through real Decky 3.3.0 ARM64: linked slider/keyboard and numeric writes, separate channels, re-link and reopen, with independent Pulse readback including 125%/150% while muted. Exact original volume/mute restored. Audible output, Bluetooth sinks and worn VR unverified. | static archive, local browser, fake-Frame, isolated Linux backend, real Frame SSH |
 | 59: Web Browser 1.4.3 | legacy / legacy | broken | The exact frontend now initializes with a null Steam React-root lookup. The browser itself still requires Steam GamepadUI CDP injection and a backend WebSocket unavailable in Framey; no working browser tab was verified. | static archive, local browser, fake-Frame, focused local browser |

tests/e2e/test_framey.py

@@ -192,6 +192,10 @@ u=h/'.config/systemd/user/frame-control-decky.service'; u.parent.mkdir(parents=T
                     self.assertEqual(
                         ssh(f'sha256sum {installed}/dist/{chunk}').split()[0],
                         hashlib.sha256(expected_chunk).hexdigest())
+                if plugin['id'] == 53:
+                    self.assertEqual(ssh(f'test -f {installed}/py_modules/click.py && echo yes').strip(), 'yes')
+                    receipt = json.loads(ssh(f'cat {installed}/.frame-control-store.json'))
+                    self.assertEqual(receipt['compatShims'], ['shotty-click-app-dir'])
                 job = finished(ok('POST', '/api/decky/plugin',
                                   {'action':'remove','id':plugin['id'],'acknowledged':True}))
                 self.assertFalse(job.get('error'), job)

tests/framey_official.py

@@ -17,6 +17,8 @@ PLUGINS = (
      'folder': 'hltb-for-deck', 'sha256': 'bd54a23b0b8ec0798aa590e5be236522a593529d7680e77fb888e2971bf3d558'},
     {'id': 36, 'name': 'SteamGridDB', 'version': '1.8.1', 'api_version': 1,
      'folder': 'decky-steamgriddb', 'sha256': 'e84f5b1f111af8862b06218479491fbf61036e1bfd9f16f93f9901e9b9ebc5e0'},
+    {'id': 53, 'name': 'Shotty', 'version': '0.1.0', 'api_version': 'legacy',
+     'folder': 'Shotty', 'sha256': 'ab7f6618b264a0cb766525e788cef6c3e1478c0fef98a701225e5e8af441e2fe'},
     {'id': 63, 'name': 'Free Loader', 'version': '1.6.0', 'api_version': 1,
      'folder': 'free-loader', 'sha256': '05208aee6f6ba824391d8ddc81b1168b2599a9711e7528cdaa789f6cc710b42a'},
     {'id': 135, 'name': 'Deck Shelves', 'version': '2.0.0', 'api_version': 1,

tests/test_frame_decky_store.py

@@ -121,14 +121,14 @@ class StoreTransaction(unittest.TestCase):
         self.folder = home / '.local/share/frame-control/decky/plugins/Example'
         self.folder.parent.mkdir(parents=True)
 
-    def apply(self, action, data=None, expected='-'):
+    def apply(self, action, data=None, expected='-', plugin_id=42, folder='Example', version='1.0'):
         token = secrets.token_hex(12)
         source = Path('/tmp/frame-control-decky-plugin-' + token)
         if data is not None:
             source.write_bytes(data)
         digest = hashlib.sha256(data or b'').hexdigest()
         try:
-            return subprocess.run([sys.executable, '-', action, token, '42', digest, 'Example', '1.0', expected],
+            return subprocess.run([sys.executable, '-', action, token, str(plugin_id), digest, folder, version, expected],
                                   input=frame_decky_store.APPLY, text=True, capture_output=True,
                                   env=self.env, timeout=15)
         finally:
@@ -161,6 +161,59 @@ class StoreTransaction(unittest.TestCase):
         self.assertNotEqual(result.returncode, 0)
         self.assertTrue(external.exists())
 
+    def test_exact_shotty_archive_gets_isolated_click_import(self):
+        from framey_official import PLUGINS, archive as official_archive
+        plugin = next(p for p in PLUGINS if p['id'] == 53)
+        data = official_archive(plugin)
+        self.assertEqual(hashlib.sha256(data).hexdigest(), plugin['sha256'])
+        shotty = self.folder.parent / plugin['folder']
+        args = {'plugin_id': plugin['id'], 'folder': plugin['folder'], 'version': plugin['version']}
+        result = self.apply('install', data, **args)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        receipt = json.loads((shotty / '.frame-control-store.json').read_text())
+        self.assertEqual(receipt['sha256'], plugin['sha256'])
+        self.assertEqual(receipt['compatShims'], ['shotty-click-app-dir'])
+        compat = shotty / 'py_modules/click.py'
+        self.assertTrue(compat.is_file())
+        source = '''import asyncio, importlib.util, logging, sys, types
+from pathlib import Path
+folder = Path(sys.argv[1])
+sys.path.insert(0, str(folder/'py_modules'))
+decky = types.ModuleType('decky_plugin')
+decky.logger = logging.getLogger('shotty-test')
+decky.DECKY_PLUGIN_DIR = str(folder)
+sys.modules['decky_plugin'] = decky
+spec = importlib.util.spec_from_file_location('shotty', folder/'main.py')
+module = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(module)
+assert module.Plugin.__name__ == 'Plugin'
+from click import get_app_dir
+assert get_app_dir('Shotty') == str(Path.home()/'.config/Shotty')
+photo = Path.home()/'.local/share/Steam/userdata/100/760/remote/42/screenshots/test.jpg'
+photo.parent.mkdir(parents=True)
+photo.write_bytes(b'local screenshot fixture')
+plugin = module.Plugin()
+assert asyncio.run(plugin.aggregate_all([[42, 'Local Test Game']])) == 1
+copied = Path.home()/'Pictures/Screenshots/Local Test Game/test.jpg'
+assert copied.read_bytes() == b'local screenshot fixture'
+'''
+        imported = subprocess.run([sys.executable, '-c', source, str(shotty)],
+                                  capture_output=True, text=True,
+                                  env={**self.env, 'XDG_CONFIG_HOME': str(Path(self.tmp.name)/'.config')}, timeout=10)
+        self.assertEqual(imported.returncode, 0, imported.stderr)
+        result = self.apply('remove', expected=plugin['sha256'], **args)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertFalse(shotty.exists())
+        stream = io.BytesIO()
+        with zipfile.ZipFile(stream, 'w') as bundle:
+            bundle.writestr('Shotty/plugin.json', json.dumps({'name': 'Shotty', 'flags': []}))
+            bundle.writestr('Shotty/dist/index.js', 'export default {};' + ' ' * 1200)
+        other = stream.getvalue()
+        result = self.apply('install', other, **args)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertFalse((shotty / 'py_modules/click.py').exists())
+        self.assertNotIn('compatShims', json.loads((shotty / '.frame-control-store.json').read_text()))
+
     def test_installed_script_entrypoints_execute_without_zip_exec_bits(self):
         data, _ = archive(extra=('Example/scripts/start.py',
                                  b'#!/bin/sh\nprintf "Framey script: %s\\n" "$1"\n'))

ui/frame_decky_store.py

@@ -208,6 +208,26 @@ try:
                     entry.chmod(entry.stat().st_mode|0o100)
             unpacked=stage/folder
             if not unpacked.is_dir(): raise RuntimeError('Missing plugin folder')
+            compat_shims=[]
+            # Shotty 0.1.0 imports click.get_app_dir but never calls it. Its
+            # official ZIP omits click and Decky's bundled Python lacks it.
+            # Supply the Linux function only inside this exact plugin's
+            # py_modules path; other plugins keep their original imports.
+            if int(plugin_id)==53 and digest=='ab7f6618b264a0cb766525e788cef6c3e1478c0fef98a701225e5e8af441e2fe' and folder=='Shotty':
+                compat=unpacked/'py_modules/click.py'
+                if compat.exists(): raise RuntimeError('Shotty compatibility module collides with archive')
+                compat.parent.mkdir(parents=True,exist_ok=True)
+                compat.write_text(
+                    '"""Frame Control Linux compatibility for Shotty 0.1.0."""\n'
+                    'import os\n'
+                    'def get_app_dir(app_name, roaming=True, force_posix=False):\n'
+                    '    if not isinstance(app_name, str) or not app_name:\n'
+                    '        raise ValueError("app_name must be a nonempty string")\n'
+                    '    base = os.environ.get("XDG_CONFIG_HOME")\n'
+                    '    if not base or not os.path.isabs(base):\n'
+                    '        base = os.path.join(os.path.expanduser("~"), ".config")\n'
+                    '    return os.path.join(base, app_name)\n',encoding='utf-8')
+                compat_shims.append('shotty-click-app-dir')
             # Recheck under the transaction lock. Another store operation may
             # have installed a colliding name while this archive downloaded.
             proposed_name=json.loads((unpacked/'plugin.json').read_text()).get('name')
@@ -221,7 +241,9 @@ try:
                     if isinstance(peer_data,dict) and peer_data.get('name')==proposed_name:
                         raise RuntimeError('A different plugin with this name is already installed')
                 except (OSError,ValueError,UnicodeError): continue
-            (unpacked/marker).write_text(json.dumps({'storeId':int(plugin_id),'sha256':digest,'version':version})+'\n')
+            record={'storeId':int(plugin_id),'sha256':digest,'version':version}
+            if compat_shims: record['compatShims']=compat_shims
+            (unpacked/marker).write_text(json.dumps(record)+'\n')
     # Stop even a failed unit before removal to cancel any pending auto-restart.
     if running or action=='remove': service('stop','frame-control-decky.service')
     try:

ui/framey-compatibility.json

@@ -3882,14 +3882,15 @@
       "sourceURLs": [
         "https://github.com/safijari/Shotty"
       ],
-      "status": "broken",
-      "reason": "Library snapshot fixes the frontend allApps crash. Actual published Decky 3.3.0 amd64 backend fails importing click.get_app_dir (ModuleNotFoundError); the archive does not bundle click. Screenshot aggregation/rescue was not run.",
+      "status": "partial",
+      "reason": "The frontend starts with the read-only Frame library snapshot. Frame Control adds a digest-scoped click.get_app_dir compatibility module to the managed install; the exact backend then imports and copies a synthetic Steam screenshot into a temporary Pictures folder in isolated Python. Actual Decky 3.3.0 ARM64 loading, live screenshots/rescue, in-VR panel and physical controller use remain unverified.",
       "blockInstall": false,
       "verification": [
         "static archive",
         "local browser",
         "fake-Frame",
-        "real Frame SSH"
+        "real Frame SSH",
+        "isolated Python backend"
       ],
       "browser": {
         "id": 53,
@@ -3920,6 +3921,13 @@
         "evidence": "docs/evidence/framey-library-context-2026-10-26.json",
         "mode": "real Frame read-only CEF projection; local Chromium snapshot replay; scoped actual amd64 backends",
         "frontendReady": true
+      },
+      "backendFollowUp": {
+        "evidence": "docs/evidence/framey-shotty-python-2026-10-26.md",
+        "mode": "exact archive managed transaction and isolated Python import/copy with temporary HOME",
+        "compatShim": "shotty-click-app-dir",
+        "syntheticScreenshotCopied": true,
+        "actualDeckyArm64": false
       }
     },
     {