移除导入时的缩略图生成

tests/security-privacy.test.js

@@ -64,14 +64,16 @@ try {
 	fs.writeFileSync(path.join(maliciousDir, 'evil.atlas'), '../../../secret.png\nsize: 64,64\n');
 	assert.throws(() => utils.discoverAssets(maliciousSkeleton), (error) => error && error.code === 'UNSAFE_ATLAS_PATH');
 
-	const thumbnailSource = fs.readFileSync(path.join(__dirname, '../thumbnail/spine.js'), 'utf8');
-	assert.doesNotMatch(thumbnailSource, /setCustomThumbnail|refreshRelatedThumbnails|spine-reconcile-worker|relatedDataPaths/);
+	const manifest = JSON.parse(fs.readFileSync(path.join(__dirname, '../manifest.json'), 'utf8'));
+	const preview = Object.values(manifest.preview || {});
+	assert.equal(preview.some((entry) => entry && entry.thumbnail), false, 'import-time thumbnail handler must stay disabled');
+	assert.equal(fs.existsSync(path.join(__dirname, '../thumbnail/spine.js')), false);
 	assert.equal(fs.existsSync(path.join(__dirname, '../js/spine-reconcile-worker.js')), false);
 	const viewerSource = fs.readFileSync(path.join(__dirname, '../viewer/spine.html'), 'utf8');
 	assert.match(viewerSource, /currentItem\.data\.customThumbnail === true && !window\.confirm/);
 	assert.match(viewerSource, /path\.join\(os\.tmpdir\(\), 'spineviewer-current-'/);
 	assert.doesNotMatch(viewerSource, /fs\.writeFileSync\(outPath/);
-	console.log('PASS: atlas traversal, absolute paths, symlink escape, validated Eagle pairing, and no automatic cross-item thumbnail writes');
+	console.log('PASS: atlas path boundaries, validated Eagle pairing, no import thumbnail handler, and manual current-item confirmation');
 } finally {
 	fs.rmSync(root, { recursive: true, force: true });
 }