feat: enhance policy firewall to block unsafe resource targets and add tests

feat: update usage data broker for improved session queries

feat: add app handle setter in widget kernel

chore: bump version to 2.2.0 in tauri configuration

feat: implement dynamic background images for app and widgets

feat: add skin settings for app and widget backgrounds in settings

feat: add retry option for loading third-party widgets

feat: implement widget refresh mechanism in widget window

feat: enhance widget client to handle media loading and local API calls

feat: add focus summary widget template for TimeLens Widget Runtime

Author: PythonSmall-Q

.github/workflows/release.yml

@@ -33,9 +33,6 @@ jobs:
 
     env:
       CARGO_INCREMENTAL: "0"
-      RUSTC_WRAPPER: "sccache"
-      SCCACHE_GHA_ENABLED: "true"
-      SCCACHE_GHA_VERSION: "${{ matrix.platform }}-release"
 
     steps:
       - uses: actions/checkout@v4
@@ -133,9 +130,6 @@ jobs:
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
 
-      - name: Run sccache-cache
-        uses: mozilla-actions/sccache-action@v0.0.7
-
       - name: Cache Rust
         uses: Swatinem/rust-cache@v2
         with:
@@ -248,9 +242,6 @@ jobs:
 
     env:
       CARGO_INCREMENTAL: "0"
-      RUSTC_WRAPPER: "sccache"
-      SCCACHE_GHA_ENABLED: "true"
-      SCCACHE_GHA_VERSION: "windows-latest-release"
 
     steps:
       - uses: actions/checkout@v4
@@ -308,9 +299,6 @@ jobs:
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
 
-      - name: Run sccache-cache
-        uses: mozilla-actions/sccache-action@v0.0.7
-
       - name: Cache Rust
         uses: Swatinem/rust-cache@v2
         with:

CHANGELOG.md

@@ -5,6 +5,34 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ---
 
+## [2.2.0] - 2026-08-28
+
+### Added
+
+- **Widget Runtime Gateway** — widgets can now use governed local API calls, public HTTP(S) fetches, safe media loading, and native notifications with scoped permissions, policy checks, timeouts, and response-size limits.
+- **Widget Center controls** — per-widget pause/resume and refresh-now actions now work across Tauri windows.
+- **Risk-aware widget consent** — runtime consent prompts classify session, browser, network, media, API, and notification access by risk level.
+- **User skins** — Appearance settings can now select and clear separate local background images for the TimeLens interface and widget windows, with live cross-window synchronization.
+- **Developer resources** — added a read-only Focus Summary TypeScript widget template using the v4 `WidgetClient` contract.
+- **Cross-platform widget notifications** — widget notification requests now use the Tauri notification provider on Windows, macOS, and Linux.
+
+### Changed
+
+- **Pet widget** — promoted from a disabled placeholder to an importable `pet.json` resource-pack widget with state-aware display, avatar assets, interactions, and configurable size.
+- **Widget SDK** — `WidgetClient.fetch()` now returns a real proxied `Response`; `loadMedia()` returns a safe data URL reference.
+- **Widget developer experience** — third-party widget failures now expose recovery guidance and a real remount/retry action; the Widget Dev Harness provides capability simulation, manifest/hash diagnostics, auto-reload, logs, and live preview.
+
+### Fixed
+
+- **Widget refresh** — Widget Center refresh no longer only reloads permission metadata; it now remounts the selected widget window.
+- **Runtime documentation drift** — marked completed pet and pause/refresh work consistently across release documentation.
+
+### Notes
+
+- Native notification delivery remains subject to the operating system's notification permission and desktop environment.
+
+---
+
 ## [2.1.0] - 2026-08-27
 
 ### Added

docs/WIDGET_RUNTIME_REWRITE_IMPLEMENTATION_PLAN.md

@@ -710,21 +710,20 @@ After this plan is reviewed, the next artifact should be a narrow RFC that freez
 
 ### 当前限制
 
-- Gateway 中的 `network_fetch`、`media_load`、`local_api_call`、`notification_send` 已占位，尚未实现完整代理逻辑，计划在 Phase D 补齐。
+- Gateway 已实现 `network_fetch`、`media_load`、`local_api_call`、`notification_send` 的受限代理逻辑：公网 HTTP(S)、5 秒超时、2 MiB 响应上限、媒体 MIME 白名单、本地 API scope 校验和 Windows 原生通知。
 - 旧 widget 的 `widget_permissions` 被 Gateway 视为已授权，保证迁移期兼容。
-- `WidgetClient.fetch` 与 `loadMedia` 为占位实现，会抛出未实现错误。
-- 同意提示目前统一按 `low` 风险等级记录；后续应结合 capability 风险分级自动映射 `low/medium/high`。
+- `WidgetClient.fetch` 返回代理后的标准 `Response`，`loadMedia` 返回受限的 `data:` URL 引用。
+- `notification_send` 已通过 Tauri notification provider 支持 Windows、macOS 和 Linux，实际显示仍受操作系统通知权限和桌面环境影响。
 - TimerWidget、QuickCaptureWidget、BrowserActivityWidget 仍使用直接 `tauriApi` 调用，待 Gateway 暴露对应能力后再迁移；但其渲染与交互已纳入官方组件测试覆盖。
 
 ### 建议下一步
 
-进入 **Phase D — Media 与 Sensitive Access Hardening**：
+后续可选的 Runtime 强化工作：
 
-1. 实现 Gateway `network_fetch` 代理与域名策略防火墙。
-2. 实现 Gateway `media_load` 代理与本地/远程媒体白名单。
-3. 实现高风险数据访问的二次确认提示。
-4. 处理 widget 被撤销权限（revoked）后的降级 UI 与事件通知。
-5. 评估是否将 `buildLegacyChannel` 标记为 deprecated，并更新 `WIDGET_SDK_v2_MIGRATION.md`。
+1. 为非 Windows 平台补充统一的原生通知 provider。
+2. 为高风险详细数据访问增加更细粒度的二次确认和降级 UI。
+3. 处理撤权后的长连接主动终止与显式 revoked 事件。
+4. 评估是否将 `buildLegacyChannel` 标记为 deprecated，并更新 `WIDGET_SDK_v2_MIGRATION.md`。
 
 ---
 

examples/focus-summary-widget-template/README.md

@@ -0,0 +1,12 @@
+# Focus Summary Widget Template
+
+A minimal TypeScript widget template for the TimeLens Widget Runtime v4.
+
+It reads the `metrics` namespace through `WidgetClient`, displays today's tracked minutes, and refreshes every 30 seconds.
+
+1. Copy this directory.
+2. Compile `index.ts` to `dist/index.js`.
+3. Import the directory from Widget Center.
+4. Use Widget Dev Harness to test permissions and reload behavior.
+
+The template is intentionally read-only and requests only `screen-time:read`.

examples/focus-summary-widget-template/index.ts

@@ -0,0 +1,38 @@
+interface WidgetClient {
+  query<T>(namespace: string, payload?: Record<string, unknown>): Promise<T>;
+}
+
+interface WidgetContext {
+  client: WidgetClient;
+}
+
+interface MetricsRow {
+  app_name: string;
+  total_seconds: number;
+}
+
+export function createWidget() {
+  let timer: number | undefined;
+
+  return {
+    async mount(container: HTMLElement, context: WidgetContext) {
+      const title = document.createElement("strong");
+      const value = document.createElement("div");
+      title.textContent = "Focus Summary";
+      container.replaceChildren(title, value);
+
+      const refresh = async () => {
+        const rows = await context.client.query<MetricsRow[]>("metrics");
+        const total = rows.reduce((sum, row) => sum + row.total_seconds, 0);
+        value.textContent = `${Math.round(total / 60)} minutes tracked today`;
+      };
+
+      await refresh();
+      timer = window.setInterval(() => void refresh(), 30000);
+    },
+
+    unmount() {
+      if (timer !== undefined) window.clearInterval(timer);
+    },
+  };
+}

examples/focus-summary-widget-template/manifest.json

@@ -0,0 +1,14 @@
+{
+  "manifest_version": "v4",
+  "widget_type": "focus_summary",
+  "name": "Focus Summary",
+  "publisher": "TimeLens Example",
+  "entry": "dist/index.js",
+  "runtime": {
+    "language": "typescript",
+    "version": "5.0",
+    "entry": "dist/index.js"
+  },
+  "ui": { "model": "web-sandbox" },
+  "capabilities": ["screen-time:read"]
+}

examples/focus-summary-widget-template/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "timelens-focus-summary-widget",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "tsc --target ES2022 --module ES2022 --moduleResolution Bundler --outDir dist index.ts"
+  },
+  "devDependencies": {
+    "typescript": "^5.0.0"
+  }
+}

examples/third-party-widget-template/README.md

@@ -36,8 +36,8 @@ This template is a complete TypeScript showcase for the rewritten TimeLens widge
 
 In v4, capability strings are runtime scopes. The top-level `entry` must match
 `runtime.entry`. This example declares all implemented scopes because it
-demonstrates every available API. Network and media calls only demonstrate their
-current unimplemented response.
+demonstrates every available API. Network and media calls are mediated by the
+Gateway and are subject to public-target, MIME, timeout, and response-size policy.
 
 ## Build
 

package-lock.json

@@ -1,7 +1,7 @@
 {
   "name": "timelens",
   "private": true,
-  "version": "2.1.0",
+  "version": "2.2.0",
   "license": "MIT",
   "authors": [
     "Shan Wenxiao"