4 Commits

Author	SHA1	Message	Date
john	53c5f6d9c2	fix(wechat): scrub image_url from sessions and harden vision handoff. ... Strip image_url from persisted session payloads, keep image turns scoped to the active request, and align proxy/vision/page-data paths so WeChat image history does not leak into fresh sessions. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-07-30 10:43:24 +08:00
john	aede1e6fcb	fix(mindspace): guard published pages against blocked CDN scripts ... Pre-bundle Chart.js, auto-rewrite common CDN references at publish and serve time, and block unknown external script src during publication scans so interactive dashboards keep working under CSP. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-07-10 10:27:42 +08:00
john	eea14c1855	Add page data delivery and publication guards	2026-07-08 21:10:47 +08:00
john	6b0c633a75	feat(page-data): complete Phase 4-5, ops UI, and publish integration ... Add visitor roles, row-level scope, owner ops APIs, MySQL policy index, Turnstile captcha, browser client SDK, publish-panel dataset binding, acceptance tests, and usage documentation. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-07-08 14:52:49 +08:00