3 Commits

Author SHA1 Message Date
john ae9090948a fix(mindspace): relax published page CSP so agent HTML interactions work
Switch default MindSpace HTML delivery to a hybrid inline CSP so onclick handlers and addEventListener pages both run under real HTTP headers, and add Playwright interaction verify beyond HTTP 200 checks.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-13 15:39:39 +08:00
john 2f7bc3b6e4 fix(csp): allow page-data-client.js in WeChat WebView
WeChat UA uses a relaxed inline CSP without 'self', which blocked
/assets/page-data-client.js and broke public survey submissions.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-12 22:21:57 +08:00
john eea14c1855 Add page data delivery and publication guards 2026-07-08 21:10:47 +08:00