v0.3.2 — CSP-resilient tooling | 工具链 CSP 兼容性修复

v0.3.2 — 2026-06-27

🇺🇸 English

CSP-resilient tooling — page_evaluate and uploaded skills now work on strict-CSP sites (HN, GitHub, Twitter, etc.).

• page_evaluate runs in the page's MAIN world via Service Worker — uses chrome.scripting.executeScript({world:'MAIN'}), which is a Chrome extension privilege and bypasses page CSP entirely. v0.3.1 used ISOLATED-world eval(), which strict CSPs reject.
• Uploaded skills compile via new Function in ISOLATED world — rawCode is passed as a string (not a Function object) so structured clone doesn't strip it. On strict-CSP sites where new Function fails, the new SYSTEM_PROMPT rule (below) tells the LLM to fall back to built-in tools.
• SYSTEM_PROMPT rule #6 — "switch paths on tool failure" — when a tool returns CSP / 执行失败 / timeout, the LLM immediately switches to built-in DOM tools (page_query / page_list_elements / page_click / page_fill) instead of retrying the same call 3 times.
• Better page_evaluate result serialization — DOM elements → outerHTML (truncated to 2000 chars); objects → JSON.stringify. Previously returned useless [object HTMLDivElement].
• Imported skills take effect immediately — no page refresh needed.
• page_query description nudges LLM toward index=-1 batch queries — saves tool calls and tokens when extracting lists (e.g. HN front page titles).