@aiyiran/myclaw 1.0.191 → 1.0.193

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiyiran/myclaw",
-  "version": "1.0.191",
+  "version": "1.0.193",
   "description": "",
   "main": "index.js",
   "bin": {

package/patch.js

@@ -246,6 +246,51 @@ function patch() {
     console.error('[myclaw-patch] ⚠ Permissions-Policy 修复失败 (非致命): ' + err.message);
   }
 
+  // 8. Patch X-Frame-Options + frame-ancestors（允许同域 iframe 嵌入）
+  try {
+    const distParent = path.resolve(uiDir, '..');
+    const distFiles = fs.readdirSync(distParent);
+    let framePatched = false;
+
+    for (const f of distFiles) {
+      if (f.endsWith('.js' + BACKUP_SUFFIX)) continue;  // 跳过备份文件
+      const isTarget = (f.startsWith('gateway-cli-') || f.startsWith('server-')) && f.endsWith('.js');
+      if (!isTarget) continue;
+
+      const filePath = path.join(distParent, f);
+      let content = fs.readFileSync(filePath, 'utf8');
+      let modified = false;
+
+      // X-Frame-Options: DENY → SAMEORIGIN
+      if (content.includes('"DENY"')) {
+        const backupFile = filePath + BACKUP_SUFFIX;
+        if (!fs.existsSync(backupFile)) {
+          fs.copyFileSync(filePath, backupFile);
+        }
+        content = content.replace(/"X-Frame-Options",\s*"DENY"/g, '"X-Frame-Options", "SAMEORIGIN"');
+        modified = true;
+      }
+
+      // frame-ancestors 'none' → 'self'
+      if (content.includes("'none'") && content.includes("frame-ancestors")) {
+        content = content.replace(/frame-ancestors\s*'none'/g, "frame-ancestors 'self'");
+        modified = true;
+      }
+
+      if (modified) {
+        fs.writeFileSync(filePath, content, 'utf8');
+        console.log('[myclaw-patch] ✅ 已修复 iframe 安全头 (X-Frame-Options + frame-ancestors): ' + f);
+        framePatched = true;
+      }
+    }
+
+    if (!framePatched) {
+      console.log('[myclaw-patch] ⚠ 未找到 iframe 安全头配置');
+    }
+  } catch (err) {
+    console.error('[myclaw-patch] ⚠ iframe 安全头修复失败 (非致命): ' + err.message);
+  }
+
   console.log('[myclaw-patch] ✅ 注入完成，重启 Gateway 后生效');
   return { success: true, uiDir: uiDir, version: version };
 }