Show Framey settings and quick action in author sample

docs/evidence/framey-cache-browser-2026-10-25.md

@@ -1,19 +0,0 @@
-# Framey cache check, 25 October 2026
-
-The official Steam Status 1.2.3 ZIP pinned in
-`tests/fixtures/framey-official/123.zip` was loaded through Framey's local
-HTTP panel in Chromium. The iframe retained `sandbox="allow-scripts
-allow-popups"`, so its native storage remained unavailable. The new Framey
-storage facade accepted a set/get probe without a `SecurityError`. Steam
-Status rendered and issued four `get_settings` calls to a stub parent backend.
-Its `steamstat_last_status` cache entry was about 33 KiB, below the bridge's
-128 KiB cap. After reopening the iframe, the parent supplied the saved cache
-snapshot and the plugin wrote the same cache key again. The browser log had
-zero `SecurityError` or `localStorage` errors.
-
-The parent was a local test page with in-memory Decky backend replies. One
-public status fetch also failed in the test browser, so this check does not
-establish offline correctness or the freshness of Steam Status data. The
-per-plugin save/reopen protocol, stale panel session rejection, and cache
-limits are covered by `tests/page/framey_cache.mjs`. Frame OS persistence,
-live Decky settings, VR visibility, and controller input remain unverified.

docs/frame-plugin-author.md

@@ -62,7 +62,6 @@ none of these frontend controls has passed a worn-headset check yet.
 | Optional `settings`, `frameyQuickActions` | Separate settings tab; up to eight actions with result text | Host unit test; these fields are Framey additions |
 | `serverAPI.call` / `callable` | Calls only that plugin's Decky Python backend via the headset service | Fake Frame e2e for setting read/write across CEF calls, update, and reinstall; host unit test. Real Decky persistence remains unverified. |
 | `toaster.toast` | Visible toast inside the plugin panel; `dismiss` and optional `onClick` | Host unit test; no Steam system notification |
-| `localStorage` | Synchronous, per-plugin cache backed by the Frame Control panel origin. Up to 64 keys, 64 KiB per value and 128 KiB total; `clear()` removes only this plugin's cache. Falls back to memory if panel storage is denied. | Parent/iframe round-trip and reopen in the local host test; real headset persistence remains unverified. |
 | `routerHook.addRoute` / `removeRoute`, `Navigation.Navigate` / `NavigateBack` | Local routes inside this plugin panel only | Host unit test |
 | `routerHook.addPatch`, global components | No-op; cannot patch Steam routes | Not applicable |
 | Steam library/store patches, CEF tab injection | Unavailable; no matching target in the isolated panel | Frame CEF inspection |
@@ -72,8 +71,3 @@ Keep routes local to the panel and give every operation a visible result. A
 plugin that calls `Navigation.Navigate('/decky/store')` will not open the
 Frame Control store; only paths registered by that same plugin can navigate.
 Toasts stay inside the panel, so keep essential errors in the plugin UI too.
-Use the Decky Python backend for settings that must survive browser cache loss.
-The Framey `localStorage` bridge is for disposable frontend caches, including
-the cache read attempted by Steam Status 1.2.3. It does not expose another
-plugin's cache or the Frame Control UI key. A real Steam Status panel reopen
-and a worn-headset settings check are still needed.

docs/framey-loader.md

@@ -37,12 +37,11 @@ through Decky's *existing* websocket connection. Framey never opens a second
 Decky websocket, because Decky allows only one frontend connection. The iframe
 does not receive Frame Control's UI key. React and ReactDOM are bundled for
 offline use under their MIT licenses in `ui/vendor`.
-Framey gives each plugin a bounded `localStorage` substitute because browser
-storage is denied to an opaque-origin iframe. The parent panel keeps a separate
-cache for each plugin: up to 64 keys, 64 KiB per value and 128 KiB total. It
-restores the cache when a panel reopens if the parent's browser storage is
-available. If storage is denied or cleared, the cache lasts only for the current
-panel. Use the plugin backend for settings that must survive cache loss.
+Framey gives each plugin panel a bounded, in-memory `localStorage` substitute
+because browser storage is denied to an opaque-origin iframe. It supports the
+usual item methods, up to 256 entries and 512 KiB of keys and values. The data
+is cleared when the panel reloads or closes. Use the plugin backend for settings
+that must survive a new panel session.
 
 The host currently supplies sections, rows, buttons, toggles, text fields,
 sliders, grouped dropdowns,
@@ -66,10 +65,8 @@ The pinned official Steam Status 1.2.3 frontend also
 with a stubbed settings reply. Its public status request worked, but its cache
 logged `localStorage` errors in Framey's v0.4.34 opaque iframe. A later
 [local browser check](evidence/framey-session-cache-2026-10-25.md) confirmed
-that a panel-lifetime substitute avoids those errors while preserving the
-opaque origin. A [second browser check](evidence/framey-cache-browser-2026-10-25.md)
-tested the per-plugin cache after reopening a panel. These checks used a stub
-backend and no worn headset.
+that the panel-lifetime substitute avoids those errors while preserving the
+opaque origin. Neither check used a real Decky backend or a worn headset.
 Fake Frame CI also installs and removes pinned official ProtonDB Badges 1.3.4
 and Steam Status 1.2.3 archives, checks their API v2 manifests and frontend
 bytes, and verifies they can be packed as Framey panels. It does not execute

examples/framey-settings/README.md

@@ -5,7 +5,12 @@ This is a small Decky API v2 plugin for authors. Its panel uses the official
 backend method, stores one boolean under `decky.decky_SETTINGS_DIR`,
 and reads it back when the panel opens. The backend rejects other keys and
 values. The frontend also shows a local toast after a successful save. A
-missing, damaged, or old non-boolean value reads as the caller's default;
+Framey settings tab exposes the same toggle, and a read-only quick action
+fetches the saved value without changing it. These two fields are Framey
+additions; Decky's own menu still uses the main panel content. The quick
+action calls the backend, so it reads the persisted setting rather than a
+browser cache. A missing, damaged, or old non-boolean value reads as the
+caller's default;
 the next save atomically replaces the sample's settings file.
 
 ## Build
@@ -29,7 +34,8 @@ plugin directory does not enable its VR panel.
 
 Run `python3 -m unittest discover -s tests -p test_framey_sample.py` from the
 repository root. It checks backend persistence and evaluates the built bundle
-against Framey's actual host script. The fake Frame store flow is exercised by
+against Framey's actual host script, including the quick action's scoped
+backend call. The fake Frame store flow is exercised by
 the repository's e2e suite. No worn-headset visibility or controller-input test
 has passed for this sample yet.
 

examples/framey-settings/dist/index.js

@@ -61,10 +61,21 @@ function Content() {
     }
     return SP_JSX.jsxs(DFL.PanelSection, { title: "Framey settings sample", children: [SP_JSX.jsx(DFL.PanelSectionRow, { children: SP_JSX.jsx(DFL.ToggleField, { label: "Example setting", description: "Stored by the Decky Python backend", checked: enabled, disabled: busy, onChange: (value) => { void change(value); } }) }), SP_JSX.jsx(DFL.PanelSectionRow, { children: SP_JSX.jsx(DFL.ButtonItem, { disabled: busy, onClick: () => { void refresh(); }, children: "Reload saved setting" }) }), SP_JSX.jsx(DFL.PanelSectionRow, { children: SP_JSX.jsx("p", { role: "status", children: message }) })] });
 }
-var index = definePlugin(() => ({
+var index = definePlugin(() => Object.assign({
     name: 'Framey Settings Sample',
     icon: SP_JSX.jsx("span", { "aria-hidden": "true", children: "\u2699" }),
     content: SP_JSX.jsx(Content, {}),
+}, {
+    // Framey additions are ignored by Decky's own menu. Keep the main content
+    // usable there too, while showing authors the extra VR settings view.
+    settings: SP_JSX.jsx(Content, {}),
+    frameyQuickActions: [{
+            label: 'Read saved setting',
+            onClick: async () => {
+                const enabled = await getSetting('enabled', false);
+                return `Saved setting is ${enabled ? 'on' : 'off'}`;
+            },
+        }],
 }));
 
 export { index as default };

examples/framey-settings/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["decky://decky/plugin/Framey%20Settings%20Sample/node_modules/.pnpm/@decky+api@1.1.3/node_modules/@decky/api/dist/index.js","decky://decky/plugin/Framey%20Settings%20Sample/src/index.tsx"],"sourcesContent":["import _manifest from '@decky/manifest';\nexport * from \"./types\";\nconst manifest = _manifest;\nconst API_VERSION = 2;\nif (!manifest?.name) {\n    throw new Error('[@decky/api]: Failed to find plugin manifest.');\n}\nconst internalAPIConnection = window.__DECKY_SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED_deckyLoaderAPIInit;\nif (!internalAPIConnection) {\n    throw new Error('[@decky/api]: Failed to connect to the loader as as the loader API was not initialized. This is likely a bug in Decky Loader.');\n}\nlet api;\ntry {\n    api = internalAPIConnection.connect(API_VERSION, manifest.name);\n}\ncatch {\n    api = internalAPIConnection.connect(1, manifest.name);\n    console.warn(`[@decky/api] Requested API version ${API_VERSION} but the running loader only supports version 1. Some features may not work.`);\n}\nif (api._version != API_VERSION) {\n    console.warn(`[@decky/api] Requested API version ${API_VERSION} but the running loader only supports version ${api._version}. Some features may not work.`);\n}\nexport const call = api.call;\nexport const callable = api.callable;\nexport const addEventListener = api.addEventListener;\nexport const removeEventListener = api.removeEventListener;\nexport const routerHook = api.routerHook;\nexport const toaster = api.toaster;\nexport const openFilePicker = api.openFilePicker;\nexport const executeInTab = api.executeInTab;\nexport const injectCssIntoTab = api.injectCssIntoTab;\nexport const removeCssFromTab = api.removeCssFromTab;\nexport const fetchNoCors = api.fetchNoCors;\nexport const getExternalResourceURL = api.getExternalResourceURL;\nexport const useQuickAccessVisible = api.useQuickAccessVisible;\nexport const definePlugin = (fn) => {\n    return (...args) => {\n        return fn(...args);\n    };\n};\n","import {callable, definePlugin, toaster} from '@decky/api';\nimport {ButtonItem, PanelSection, PanelSectionRow, ToggleField} from '@decky/ui';\nimport {useEffect, useState} from 'react';\n\nconst getSetting = callable<[key: string, fallback: boolean], boolean>('get_setting');\nconst setSetting = callable<[key: string, value: boolean], boolean>('set_setting');\n\nfunction Content() {\n  const [enabled, setEnabled] = useState(false);\n  const [busy, setBusy] = useState(true);\n  const [message, setMessage] = useState('Loading setting…');\n\n  async function refresh() {\n    setBusy(true);\n    try {\n      const value = await getSetting('enabled', false);\n      setEnabled(value);\n      setMessage(`Saved setting: ${value ? 'on' : 'off'}`);\n    } catch (error) {\n      setMessage(`Could not read setting: ${String(error)}`);\n    } finally {\n      setBusy(false);\n    }\n  }\n\n  useEffect(() => {void refresh();}, []);\n\n  async function change(value: boolean) {\n    setBusy(true);\n    try {\n      await setSetting('enabled', value);\n      setEnabled(value);\n      setMessage(`Saved setting: ${value ? 'on' : 'off'}`);\n      toaster.toast({title: 'Framey sample', body: 'Setting saved'});\n    } catch (error) {\n      setMessage(`Could not save setting: ${String(error)}`);\n    } finally {\n      setBusy(false);\n    }\n  }\n\n  return <PanelSection title=\"Framey settings sample\">\n    <PanelSectionRow>\n      <ToggleField label=\"Example setting\" description=\"Stored by the Decky Python backend\"\n        checked={enabled} disabled={busy} onChange={(value: boolean) => {void change(value);}} />\n    </PanelSectionRow>\n    <PanelSectionRow><ButtonItem disabled={busy} onClick={() => {void refresh();}}>Reload saved setting</ButtonItem></PanelSectionRow>\n    <PanelSectionRow><p role=\"status\">{message}</p></PanelSectionRow>\n  </PanelSection>;\n}\n\nexport default definePlugin(() => ({\n  name: 'Framey Settings Sample',\n  icon: <span aria-hidden=\"true\">⚙</span>,\n  content: <Content />,\n}));\n"],"names":[],"mappings":"AAEA,MAAA,QAAA,GAAiB,CAAA,MAAA,CAAA,wBAAA,CAAS;AAC1B,MAAA,WAAA,GAAA,CAAA;AAIA,MAAA,qBAAA,GAAA,MAAA,CAAA,2EAAA;AACA,IAAA,CAAA,qBAAA,EAAA;AACA,IAAA,MAAA,IAAA,KAAA,CAAA,+HAAA,CAAA;AACA;AACA,IAAA,GAAA;AACA,IAAA;AACA,IAAA,GAAA,GAAA,qBAAA,CAAA,OAAA,CAAA,WAAA,EAAA,QAAA,CAAA,IAAA,CAAA;AACA;AACA,MAAA;AACA,IAAA,GAAA,GAAA,qBAAA,CAAA,OAAA,CAAA,CAAA,EAAA,QAAA,CAAA,IAAA,CAAA;AACA,IAAA,OAAA,CAAA,IAAA,CAAA,CAAA,mCAAA,EAAA,WAAA,CAAA,4EAAA,CAAA,CAAA;AACA;AACA,IAAA,GAAA,CAAA,QAAA,IAAA,WAAA,EAAA;AACA,IAAA,OAAA,CAAA,IAAA,CAAA,CAAA,mCAAA,EAAA,WAAA,CAAA,8CAAA,EAAA,GAAA,CAAA,QAAA,CAAA,6BAAA,CAAA,CAAA;AACA;AAEA,MAAA,QAAA,GAAA,GAAA,CAAA,QAAA;AAIA,MAAA,OAAA,GAAA,GAAA,CAAA,OAAA;AAQA,MAAA,YAAA,GAAA,CAAA,EAAA,KAAA;AACA,IAAA,OAAA,CAAA,GAAA,IAAA,KAAA;AACA,QAAA,OAAA,EAAA,CAAA,GAAA,IAAA,CAAA;AACA,IAAA,CAAA;AACA,CAAA;;ACnCA,MAAA,UAAA,GAAA,QAAA,CAAA,aAAA,CAAA;AACA,MAAA,UAAA,GAAA,QAAA,CAAA,aAAA,CAAA;AAEA,SAAA,OAAA,Line truncated
+{"version":3,"file":"index.js","sources":["decky://decky/plugin/Framey%20Settings%20Sample/node_modules/.pnpm/@decky+api@1.1.3/node_modules/@decky/api/dist/index.js","decky://decky/plugin/Framey%20Settings%20Sample/src/index.tsx"],"sourcesContent":["import _manifest from '@decky/manifest';\nexport * from \"./types\";\nconst manifest = _manifest;\nconst API_VERSION = 2;\nif (!manifest?.name) {\n    throw new Error('[@decky/api]: Failed to find plugin manifest.');\n}\nconst internalAPIConnection = window.__DECKY_SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED_deckyLoaderAPIInit;\nif (!internalAPIConnection) {\n    throw new Error('[@decky/api]: Failed to connect to the loader as as the loader API was not initialized. This is likely a bug in Decky Loader.');\n}\nlet api;\ntry {\n    api = internalAPIConnection.connect(API_VERSION, manifest.name);\n}\ncatch {\n    api = internalAPIConnection.connect(1, manifest.name);\n    console.warn(`[@decky/api] Requested API version ${API_VERSION} but the running loader only supports version 1. Some features may not work.`);\n}\nif (api._version != API_VERSION) {\n    console.warn(`[@decky/api] Requested API version ${API_VERSION} but the running loader only supports version ${api._version}. Some features may not work.`);\n}\nexport const call = api.call;\nexport const callable = api.callable;\nexport const addEventListener = api.addEventListener;\nexport const removeEventListener = api.removeEventListener;\nexport const routerHook = api.routerHook;\nexport const toaster = api.toaster;\nexport const openFilePicker = api.openFilePicker;\nexport const executeInTab = api.executeInTab;\nexport const injectCssIntoTab = api.injectCssIntoTab;\nexport const removeCssFromTab = api.removeCssFromTab;\nexport const fetchNoCors = api.fetchNoCors;\nexport const getExternalResourceURL = api.getExternalResourceURL;\nexport const useQuickAccessVisible = api.useQuickAccessVisible;\nexport const definePlugin = (fn) => {\n    return (...args) => {\n        return fn(...args);\n    };\n};\n","import {callable, definePlugin, toaster} from '@decky/api';\nimport {ButtonItem, PanelSection, PanelSectionRow, ToggleField} from '@decky/ui';\nimport {useEffect, useState} from 'react';\n\nconst getSetting = callable<[key: string, fallback: boolean], boolean>('get_setting');\nconst setSetting = callable<[key: string, value: boolean], boolean>('set_setting');\n\nfunction Content() {\n  const [enabled, setEnabled] = useState(false);\n  const [busy, setBusy] = useState(true);\n  const [message, setMessage] = useState('Loading setting…');\n\n  async function refresh() {\n    setBusy(true);\n    try {\n      const value = await getSetting('enabled', false);\n      setEnabled(value);\n      setMessage(`Saved setting: ${value ? 'on' : 'off'}`);\n    } catch (error) {\n      setMessage(`Could not read setting: ${String(error)}`);\n    } finally {\n      setBusy(false);\n    }\n  }\n\n  useEffect(() => {void refresh();}, []);\n\n  async function change(value: boolean) {\n    setBusy(true);\n    try {\n      await setSetting('enabled', value);\n      setEnabled(value);\n      setMessage(`Saved setting: ${value ? 'on' : 'off'}`);\n      toaster.toast({title: 'Framey sample', body: 'Setting saved'});\n    } catch (error) {\n      setMessage(`Could not save setting: ${String(error)}`);\n    } finally {\n      setBusy(false);\n    }\n  }\n\n  return <PanelSection title=\"Framey settings sample\">\n    <PanelSectionRow>\n      <ToggleField label=\"Example setting\" description=\"Stored by the Decky Python backend\"\n        checked={enabled} disabled={busy} onChange={(value: boolean) => {void change(value);}} />\n    </PanelSectionRow>\n    <PanelSectionRow><ButtonItem disabled={busy} onClick={() => {void refresh();}}>Reload saved setting</ButtonItem></PanelSectionRow>\n    <PanelSectionRow><p role=\"status\">{message}</p></PanelSectionRow>\n  </PanelSection>;\n}\n\nexport default definePlugin(() => Object.assign({\n  name: 'Framey Settings Sample',\n  icon: <span aria-hidden=\"true\">⚙</span>,\n  content: <Content />,\n}, {\n  // Framey additions are ignored by Decky's own menu. Keep the main content\n  // usable there too, while showing authors the extra VR settings view.\n  settings: <Content />,\n  frameyQuickActions: [{\n    label: 'Read saved setting',\n    onClick: async () => {\n      const enabled = await getSetting('enabled', false);\n      return `Saved setting is ${enabled ? 'on' : 'off'}`;\n    },\n  }],\n}));\n"],"names":[],"mappings":"AAEA,MAAA,QAAA,GAAiB,CAAA,MAAA,CAAA,wBAAA,CAAS;AAC1B,MAAA,WAAA,GAAA,CAAA;AAIA,MAAA,qBAAA,GAAA,MAAA,CAAA,2EAAA;AACA,IAAA,CAAA,qBAAA,EAAA;AACA,IAAA,MAAA,IAAA,KAAA,CAAA,+HAAA,CAAA;AACA;AACA,IAAA,GAAA;AACA,IAAA;AACA,IAAA,GAAA,GAAA,qBAAA,CAAA,OAAA,CAAA,WAAA,EAAA,QAAA,CAAA,IAAA,CAAA;AACA;AACA,MAAA;AACA,IAAA,GAAA,GAAA,qBAAA,CAAA,OAAA,CAAA,CAAA,EAAA,QAAA,CAAA,IAAA,CAAA;AACA,IAAA,OAAA,CAAA,IAAA,CAAA,CAAA,mCAAA,EAAA,WAAA,CAAA,4EAAA,CAAA,CAAA;AACA;AACA,IAAA,GAAA,CAAA,QAAA,IAAA,WLine truncated

examples/framey-settings/src/index.tsx

@@ -49,8 +49,19 @@ function Content() {
   </PanelSection>;
 }
 
-export default definePlugin(() => ({
+export default definePlugin(() => Object.assign({
   name: 'Framey Settings Sample',
   icon: <span aria-hidden="true">⚙</span>,
   content: <Content />,
+}, {
+  // Framey additions are ignored by Decky's own menu. Keep the main content
+  // usable there too, while showing authors the extra VR settings view.
+  settings: <Content />,
+  frameyQuickActions: [{
+    label: 'Read saved setting',
+    onClick: async () => {
+      const enabled = await getSetting('enabled', false);
+      return `Saved setting is ${enabled ? 'on' : 'off'}`;
+    },
+  }],
 }));

tests/page/framey_actions.mjs

@@ -19,6 +19,23 @@ const context=vm.createContext({window,document:{getElementById:id=>{
   navigator:{language:'en'}, parent,addEventListener:(type,handler)=>listeners.push({type,handler}),
   setTimeout:()=>1,clearTimeout(){}});
 vm.runInContext(testSource,context);
+// A plugin gets bounded, panel-lifetime storage without the parent's origin.
+const storage=window.localStorage;
+assert.equal(storage.getItem('missing'),null);
+storage.setItem('theme','dark');
+storage.setItem('count',2);
+assert.equal(storage.length,2);
+assert.equal(storage.key(0),'theme');
+assert.equal(storage.getItem('count'),'2');
+storage.setItem('theme','light');
+assert.equal(storage.getItem('theme'),'light');
+assert.throws(()=>storage.setItem('large','x'.repeat(262144)),{name:'QuotaExceededError'});
+assert.equal(storage.getItem('theme'),'light');
+storage.removeItem('count');
+assert.equal(storage.length,1);
+storage.clear();
+assert.equal(storage.length,0);
+assert.throws(()=>Object.defineProperty(window,'localStorage',{value:{}}),TypeError);
 // Official @decky/rollup bundles use the automatic JSX runtime, including keyed lists.
 const jsx=window.SP_JSX.jsx('p',{id:'message',children:'Saved'},'message-key');
 assert.equal(jsx.type,'p');
@@ -85,10 +102,9 @@ assert.equal(nodes(window.__surface({plugin:{settings:{type:'settings'}}}),'nav'
 // API v2 backend calls remain request-scoped and errors return to the caller.
 const api=window.__DECKY_SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED_deckyLoaderAPIInit.connect(2,'Test');
 const reply=api.call('get_setting','mode','default');
-const call=messages.find(message=>message.type==='framey:call');
-assert.equal(call.method,'get_setting');
-assert.deepEqual(Array.from(call.args),['mode','default']);
-listeners.find(x=>x.type==='message').handler({source:parent,data:{type:'framey:reply',id:call.id,result:'dark'}});
+assert.equal(messages[0].method,'get_setting');
+assert.deepEqual(Array.from(messages[0].args),['mode','default']);
+listeners.find(x=>x.type==='message').handler({source:parent,data:{type:'framey:reply',id:messages[0].id,result:'dark'}});
 assert.equal(await reply,'dark');
 await assert.rejects(api.call('x;alert(1)'),/Invalid backend method/);
 

tests/page/framey_cache.mjs

@@ -1,63 +0,0 @@
-import assert from 'node:assert/strict';
-import {readFileSync} from 'node:fs';
-import vm from 'node:vm';
-
-const html=readFileSync(new URL('../../ui/headset.html',import.meta.url),'utf8');
-const parentSource=html.match(/<script>([\s\S]*?)<\/script>/)[1].split('refresh();refreshGames();')[0];
-const hostSource=readFileSync(new URL('../../ui/framey-host.js',import.meta.url),'utf8')
-  .replace(/\n  start\(\);\n\}\)\(\);\s*$/, '\n})();');
-assert.match(hostSource,/framey:cache:init/);
-const values=new Map();
-const localStorage={getItem:key=>values.get(key)??null,setItem:(key,value)=>values.set(key,value)};
-const elements=new Map();
-const el=id=>{if(!elements.has(id))elements.set(id,{id,hidden:false,removeAttribute(){},scrollIntoView(){}});
-  return elements.get(id);};
-const parentListeners=[];
-const parent=vm.createContext({document:{getElementById:el,createElement:()=>({})},
-  location:{hash:'',pathname:'/'},history:{replaceState(){}},
-  sessionStorage:{getItem:()=>null,setItem(){}},localStorage,
-  window:{addEventListener:(type,fn)=>parentListeners.push({type,fn})},
-  setTimeout(){},setInterval(){},fetch(){throw Error('No network expected');},console});
-vm.runInContext(parentSource,parent);
-vm.runInContext('deckyState={plugins:[{storeId:14}]};openFrameyPanel(14,"Steam Status")',parent);
-let session=vm.runInContext('frameySession',parent);
-const onParent=parentListeners.find(x=>x.type==='message').fn;
-
-function iframe(){
-  const listeners=[];const queued=[];let live=false;
-  const frameWindow={location:{hash:`#${session}`},React:{Fragment:'fragment',Component:class {},createElement:()=>({}),isValidElement:()=>true},
-    ReactDOM:{createRoot:()=>({render(){}})}};
-  const proxy={postMessage:message=>listeners.find(x=>x.type==='message')?.fn({source:hostParent,data:message})};
-  el('frameyFrame').contentWindow=proxy;
-  const hostParent={postMessage:message=>live?onParent({source:proxy,data:message}):queued.push(message)};
-  const context=vm.createContext({window:frameWindow,document:{getElementById:()=>({})},
-    navigator:{language:'en'},parent:hostParent,DOMException,
-    addEventListener:(type,fn)=>listeners.push({type,fn}),setTimeout(){},clearTimeout(){}});
-  vm.runInContext(hostSource,context);
-  for(const message of queued)onParent({source:proxy,data:message});
-  live=true;
-  const send=message=>onParent({source:proxy,data:message});
-  return {storage:frameWindow.localStorage,send};
-}
-let first=iframe();
-assert.equal(first.storage.getItem('status-cache'),null);
-first.storage.setItem('status-cache','{"online":true}');
-assert.equal(values.get('framey-plugin-cache-v1:14'),'{"status-cache":"{\\"online\\":true}"}');
-first.storage.setItem('temporary','discard');
-first.storage.removeItem('temporary');
-const oldSession=session;
-vm.runInContext('openFrameyPanel(14,"Steam Status")',parent);
-session=vm.runInContext('frameySession',parent);
-assert.notEqual(session,oldSession);
-let reopened=iframe();
-assert.equal(reopened.storage.getItem('status-cache'),'{"online":true}');
-assert.equal(reopened.storage.length,1);
-assert.equal(reopened.storage.key(0),'status-cache');
-assert.throws(()=>reopened.storage.setItem('huge','x'.repeat(65537)),/Framey plugin cache is full/);
-// A malformed or over-limit message from a plugin must not poison saved data.
-reopened.send({type:'framey:cache:save',session,entries:{huge:'x'.repeat(65537)}});
-assert.equal(values.get('framey-plugin-cache-v1:14'),'{"status-cache":"{\\"online\\":true}"}');
-reopened.send({type:'framey:cache:save',session:oldSession,entries:{poison:'yes'}});
-assert.equal(values.get('framey-plugin-cache-v1:14'),'{"status-cache":"{\\"online\\":true}"}');
-reopened.storage.clear();
-assert.equal(values.get('framey-plugin-cache-v1:14'),'{}');

tests/page/framey_sample.mjs

@@ -10,8 +10,16 @@ const React={Fragment:Symbol('fragment'),Component:class {},
   createElement:(type,props,...children)=>({type,props:props||{},children}),
   useState:value=>[value,()=>{}],useEffect(){},isValidElement:value=>!!value?.type};
 const window={React,ReactDOM:{createRoot:()=>({render(){}})},addEventListener(){}};
+const listeners=[];
+const calls=[];
+const parent={postMessage(message){
+  if(message.type!=='framey:call')return;
+  calls.push(message);
+  listeners.find(x=>x.type==='message').handler({source:parent,
+    data:{type:'framey:reply',id:message.id,result:true}});
+}};
 const context=vm.createContext({window,document:{getElementById:()=>({})},
-  navigator:{language:'en'},parent:{postMessage(){}},addEventListener(){},
+  navigator:{language:'en'},parent,addEventListener:(type,handler)=>listeners.push({type,handler}),
   setTimeout:()=>1,clearTimeout(){}});
 vm.runInContext(host,context);
 Object.assign(context,{SP_REACT:window.SP_REACT,SP_JSX:window.SP_JSX,DFL:window.DFL});
@@ -23,3 +31,8 @@ const content=plugin.content.type();
 assert.equal(content.type,window.DFL.PanelSection);
 assert.equal(content.props.title,'Framey settings sample');
 assert.equal(content.children[0][0].type,window.DFL.PanelSectionRow);
+assert.equal(plugin.settings.type,plugin.content.type);
+assert.equal(plugin.frameyQuickActions[0].label,'Read saved setting');
+assert.equal(await plugin.frameyQuickActions[0].onClick(),'Saved setting is on');
+assert.equal(calls[0].method,'get_setting');
+assert.deepEqual(Array.from(calls[0].args),['enabled',false]);

tests/test_framey_panel.py

@@ -20,11 +20,6 @@ import server
 
 
 class Panel(unittest.TestCase):
-    def test_opaque_origin_plugin_cache_is_scoped_and_bounded(self):
-        result = subprocess.run(['node', str(Path(__file__).parent/'page/framey_cache.mjs')],
-                                capture_output=True, text=True, timeout=10)
-        self.assertEqual(result.returncode, 0, result.stderr)
-
     def test_vr_store_browsing_and_search(self):
         result = subprocess.run(['node', str(Path(__file__).parent/'page/framey_store.mjs')],
                                 capture_output=True, text=True, timeout=10)

ui/framey-host.js

@@ -1,6 +1,31 @@
 /* Framey panel compatibility layer. The iframe has an opaque origin and no UI key. */
 (() => {
   'use strict';
+  // Opaque-origin iframes throw on localStorage access. Give plugins a small
+  // panel-lifetime cache without granting their code the parent page's origin.
+  const cache = new Map();
+  const cacheLimit = 262144; // UTF-16 code units: at most 512 KiB of keys and values.
+  const cacheQuotaError = () => {
+    const error = new Error('Framey panel cache is full');
+    error.name = 'QuotaExceededError';
+    return error;
+  };
+  const panelStorage = Object.freeze({
+    get length() { return cache.size; },
+    key(index) { return Number.isInteger(Number(index)) ? [...cache.keys()][Number(index)] ?? null : null; },
+    getItem(key) { return cache.get(String(key)) ?? null; },
+    setItem(key, value) {
+      key = String(key); value = String(value);
+      const previous = cache.get(key);
+      const size = [...cache].reduce((total, [name, data]) => total + name.length + data.length, 0)
+        - (previous === undefined ? 0 : key.length + previous.length) + key.length + value.length;
+      if ((previous === undefined && cache.size >= 256) || size > cacheLimit) throw cacheQuotaError();
+      cache.set(key, value);
+    },
+    removeItem(key) { cache.delete(String(key)); },
+    clear() { cache.clear(); },
+  });
+  Object.defineProperty(window, 'localStorage', {value:panelStorage, enumerable:true});
   const R = window.SP_REACT = window.React;
   window.SP_REACTDOM = window.ReactDOM;
   const jsx = (type, props, key) => {
@@ -21,36 +46,6 @@
   let currentRoute = null;
   let nextId = 0;
   let plugin;
-  // A sandboxed iframe has an opaque origin, so its native localStorage getter
-  // throws SecurityError. Keep the familiar synchronous API inside the iframe;
-  // the parent stores only this plugin's bounded snapshot under its own origin.
-  const cache = new Map();
-  const cacheLimit = 128 * 1024;
-  const cacheSession = window.location?.hash.slice(1) || '';
-  let acceptSeed;
-  const seeded = new Promise(resolve => {acceptSeed = resolve;});
-  const storage = {
-    get length() {return cache.size;},
-    key(index) {return [...cache.keys()][index] ?? null;},
-    getItem(key) {return cache.get(String(key)) ?? null;},
-    setItem(key, value) {
-      const name = String(key), data = String(value);
-      const next = new Map(cache); next.set(name, data);
-      if (next.size > 64 || name.length > 256 || data.length > 65536 ||
-          JSON.stringify(Object.fromEntries(next)).length > cacheLimit)
-        throw new DOMException('Framey plugin cache is full', 'QuotaExceededError');
-      cache.set(name, data); persistCache();
-    },
-    removeItem(key) {cache.delete(String(key)); persistCache();},
-    clear() {cache.clear(); persistCache();},
-  };
-  function persistCache() {
-    parent.postMessage({type:'framey:cache:save', session:cacheSession,
-      entries:Object.fromEntries(cache)}, '*');
-  }
-  Object.defineProperty(window, 'localStorage', {configurable:true, value:storage});
-  parent.postMessage({type:'framey:cache:init', session:cacheSession}, '*');
-  setTimeout(() => {acceptSeed?.(); acceptSeed = null;}, 1000); // Open if storage is unavailable.
 
   function ask(method, args) {
     if (!/^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(method)) return Promise.reject(Error('Invalid backend method'));
@@ -62,17 +57,6 @@
     });
   }
   addEventListener('message', event => {
-    if (event.source === parent && event.data?.type === 'framey:cache:seed' &&
-        event.data.session === cacheSession && acceptSeed) {
-      const entries = event.data.entries;
-      if (entries && typeof entries === 'object' && !Array.isArray(entries)) {
-        for (const [key, value] of Object.entries(entries))
-          if (key.length <= 256 && typeof value === 'string' && value.length <= 65536)
-            cache.set(key, value);
-      }
-      acceptSeed(); acceptSeed = null;
-      return;
-    }
     if (event.source !== parent || !event.data || event.data.type !== 'framey:reply') return;
     const item = pending.get(event.data.id);
     if (!item) return;
@@ -238,7 +222,6 @@
   };
   async function start() {
     try {
-      await seeded;
       const bytes = Uint8Array.from(atob(document.getElementById('framey-bundle').textContent), c=>c.charCodeAt(0));
       const url = URL.createObjectURL(new Blob([bytes], {type:'text/javascript'}));
       let module;

ui/headset.html

@@ -103,7 +103,7 @@ async function refreshGames(){const list=byId('games');try{const data=await api(
       catch(error){byId('actionStatus').textContent=error.message;quit.disabled=false;}};
     row.append(name,quit);list.append(row);}if(!data.running.length)list.textContent='No games are running.';
   }catch(error){list.textContent=error.message;}}
-let deckyState=null, deckyStore=[], deckyStoreIndex=0, activeFrameyId=null, frameySession=null, deckyBusy=false;
+let deckyState=null, deckyStore=[], deckyStoreIndex=0, activeFrameyId=null, deckyBusy=false;
 async function refreshDecky(){try{deckyState=await api('/api/decky');
   byId('deckyState').textContent=deckyState.running?'Decky loader is running. Backend loading is not a VR menu check.':
     deckyState.managed?'Decky is stopped. You can remove a managed plugin to recover, then start Decky from Frame Control on your computer.':
@@ -186,42 +186,17 @@ async function checkDeckyJob(){let saved;try{saved=JSON.parse(sessionStorage.get
 byId('deckyJobCheck').onclick=checkDeckyJob;
 function openFrameyPanel(id,name){
   if(!(deckyState?.plugins||[]).some(p=>p.storeId===id))return;
-  activeFrameyId=id;frameySession=`${Date.now()}-${Math.random()}`;byId('frameyTitle').textContent=name;
+  activeFrameyId=id;byId('frameyTitle').textContent=name;
   byId('frameyPanelStatus').textContent='Loading plugin panel…';
-  byId('frameyFrame').src=`/framey/panel/${id}#${frameySession}`;
+  byId('frameyFrame').src=`/framey/panel/${id}`;
   byId('frameyPanel').hidden=false;byId('frameyPanel').scrollIntoView();
   setTimeout(()=>{if(activeFrameyId===id&&byId('frameyPanelStatus').textContent==='Loading plugin panel…')
     byId('frameyPanelStatus').textContent='No compatible API v2 panel loaded. This plugin may need Steam UI features Framey cannot provide.';},12000);
 }
-byId('frameyClose').onclick=()=>{activeFrameyId=null;frameySession=null;byId('frameyFrame').removeAttribute('src');byId('frameyPanel').hidden=true;};
-function frameyCacheKey(id){return `framey-plugin-cache-v1:${id}`;}
-function frameyCacheRead(id){
-  try{const data=JSON.parse(localStorage.getItem(frameyCacheKey(id))||'{}');
-    if(!data||typeof data!=='object'||Array.isArray(data))return {};
-    const pairs=Object.entries(data);
-    return pairs.length<=64&&pairs.every(([key,value])=>key.length<=256&&typeof value==='string'&&value.length<=65536)&&
-      JSON.stringify(data).length<=128*1024?data:{};
-  }catch(_){return {};}
-}
-function frameyCacheSave(id,entries){
-  if(!entries||typeof entries!=='object'||Array.isArray(entries))return;
-  const pairs=Object.entries(entries);
-  if(pairs.length>64||pairs.some(([key,value])=>key.length>256||typeof value!=='string'||value.length>65536))return;
-  const encoded=JSON.stringify(entries);
-  if(encoded.length>128*1024)return;
-  try{localStorage.setItem(frameyCacheKey(id),encoded);}catch(_){} // Private browsing can deny storage.
-}
+byId('frameyClose').onclick=()=>{activeFrameyId=null;byId('frameyFrame').removeAttribute('src');byId('frameyPanel').hidden=true;};
 window.addEventListener('message',async event=>{
   if(activeFrameyId===null||event.source!==byId('frameyFrame').contentWindow)return;
   const req=event.data;if(!req||typeof req!=='object')return;
-  if(req.type==='framey:cache:init'&&req.session===frameySession){
-    event.source.postMessage({type:'framey:cache:seed',session:frameySession,
-      entries:frameyCacheRead(activeFrameyId)},'*');return;
-  }
-  if(req.type==='framey:cache:save'){
-    if(req.session===frameySession)frameyCacheSave(activeFrameyId,req.entries);
-    return;
-  }
   if(req.type==='framey:ready'){byId('frameyPanelStatus').textContent='Plugin panel ready';
     api('/api/framey/check',{kind:'panel',pluginId:activeFrameyId}).catch(()=>{});return;}
   if(req.type==='framey:input'){api('/api/framey/check',{kind:'input'}).catch(()=>{});return;}