fix: allow inline page scripts in MindSpace public page CSP

Collect sha256 hashes from all inline scripts in published HTML so agent-generated
fade-in animations are not blocked while keeping the share-button CSP model.

Co-authored-by: Cursor <cursoragent@cursor.com>

mindspace-public-delivery.mjs

@@ -1,5 +1,20 @@
+import crypto from 'node:crypto';
 import path from 'node:path';
 
+const INLINE_SCRIPT_PATTERN = /<script\b(?![^>]*\bsrc\b)[^>]*>([\s\S]*?)<\/script>/gi;
+
+export function collectInlineScriptHashes(html) {
+  const hashes = [];
+  const seen = new Set();
+  for (const match of String(html ?? '').matchAll(INLINE_SCRIPT_PATTERN)) {
+    const hash = crypto.createHash('sha256').update(match[1] ?? '').digest('base64');
+    if (seen.has(hash)) continue;
+    seen.add(hash);
+    hashes.push(hash);
+  }
+  return hashes;
+}
+
 export async function handleMindSpaceLongImageDownload({
   query,
   filePath,
@@ -63,12 +78,13 @@ export function decorateMindSpacePublishedHtml({
       ? injectPublicFileShareButton(nextHtml)
       : { html: nextHtml, scriptHashes: [] };
     nextHtml = shareInjection.html;
+    const scriptHashes = collectInlineScriptHashes(nextHtml);
     return {
       html: nextHtml,
       csp: publishedPageCsp(nextHtml, {
         embed,
         wechatShare,
-        scriptHashes: shareInjection.scriptHashes,
+        scriptHashes,
       }),
       allowEmbedFrame,
     };