@hybridlabor-api/aos 4.0.2 → 4.1.0

package/skills/global_config/plan-canvas/scripts/lib/loopback-guard.js

@@ -0,0 +1,59 @@
+'use strict';
+
+/**
+ * Host/Origin gating for ECC's loopback HTTP servers (control pane, plan
+ * canvas). DNS rebinding can point an attacker-controlled hostname at
+ * 127.0.0.1, so every request must present a Host header from this
+ * allowlist before the server does any work.
+ *
+ * Source: affaan-m/ECC — MIT, see THIRD_PARTY_NOTICES.md
+ */
+
+const LOOPBACK_HOSTNAMES = new Set(['127.0.0.1', 'localhost', '[::1]', '::1']);
+
+// Extract the hostname portion of an HTTP Host header value, stripping any
+// port. Returns null when the header is missing or malformed.
+function parseHostHeader(value) {
+  if (!value || typeof value !== 'string') return null;
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+  const match = trimmed.match(/^(\[[^\]]+\]|[^:]+)(?::(\d+))?$/);
+  if (!match) return null;
+  if (match[2] !== undefined) {
+    const port = Number(match[2]);
+    if (!Number.isInteger(port) || port > 65535) return null;
+  }
+  return match[1].toLowerCase();
+}
+
+function buildAllowedHostnames(configuredHost) {
+  const set = new Set(LOOPBACK_HOSTNAMES);
+  if (configuredHost) set.add(String(configuredHost).toLowerCase());
+  return set;
+}
+
+function isAllowedHostHeader(hostHeader, allowedHostnames) {
+  const hostname = parseHostHeader(hostHeader);
+  if (!hostname) return false;
+  return allowedHostnames.has(hostname);
+}
+
+// Origin is absent on same-origin navigations and CLI clients; when present
+// it must resolve to an allowed hostname.
+function isAllowedOrigin(originHeader, allowedHostnames) {
+  if (!originHeader || typeof originHeader !== 'string') return true;
+  try {
+    const url = new URL(originHeader);
+    return allowedHostnames.has(url.hostname.toLowerCase());
+  } catch {
+    return false;
+  }
+}
+
+module.exports = {
+  LOOPBACK_HOSTNAMES,
+  buildAllowedHostnames,
+  isAllowedHostHeader,
+  isAllowedOrigin,
+  parseHostHeader
+};

package/skills/global_config/plan-canvas/scripts/lib/plan-canvas/markdown.js

@@ -0,0 +1,301 @@
+'use strict';
+
+/**
+ * Minimal GitHub-flavored-markdown subset renderer for Plan Canvas.
+ * Renders .claude/plans/*.plan.md artifacts to HTML body content.
+ *
+ * Security model: the entire source line is HTML-escaped before any inline
+ * rule runs, so raw HTML in the markdown always displays as text. Link and
+ * image URLs are validated against an allowlist of protocols.
+ *
+ * Source: affaan-m/ECC — MIT, see THIRD_PARTY_NOTICES.md
+ */
+
+// Placeholders live in the Unicode private-use area so escaped output can
+// never collide with them. Pre-existing occurrences are stripped from input.
+const TOKEN_OPEN = '\uE000';
+const TOKEN_CLOSE = '\uE001';
+const TOKEN_RE = new RegExp(TOKEN_OPEN + '(\\d+)' + TOKEN_CLOSE, 'g');
+const STRIP_RE = new RegExp('[' + TOKEN_OPEN + TOKEN_CLOSE + ']', 'g');
+
+const LIST_ITEM_RE = /^(\s*)([-*]|\d+\.)\s+(.*)$/;
+const HR_RE = /^ {0,3}(-{3,}|\*{3,})\s*$/;
+
+function escapeHtml(value) {
+  return String(value ?? '')
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
+function slugify(text) {
+  return String(text ?? '')
+    .toLowerCase()
+    .replace(/[^a-z0-9\s-]/g, '')
+    .trim()
+    .replace(/[\s-]+/g, '-')
+    .replace(/^-+|-+$/g, '');
+}
+
+// Strip whitespace/control characters so "Ja vaScript:" style tricks cannot
+// hide a scheme, then classify against the allowlist.
+function classifyUrl(rawUrl) {
+  const compact = String(rawUrl)
+    .split('')
+    .filter((ch) => ch.charCodeAt(0) > 32)
+    .join('')
+    .toLowerCase();
+  if (compact.startsWith('#')) return 'anchor';
+  if (compact.startsWith('//')) return 'blocked';
+  const scheme = compact.match(/^[a-z][a-z0-9+.-]*:/);
+  if (!scheme) return 'relative';
+  if (scheme[0] === 'http:' || scheme[0] === 'https:') return 'http';
+  if (scheme[0] === 'mailto:') return 'mailto';
+  return 'blocked';
+}
+
+function applyEmphasis(s) {
+  return s
+    .replace(/\*\*([^*]+)\*\*/g, '<strong>$1</strong>')
+    .replace(/~~([^~]+)~~/g, '<del>$1</del>')
+    .replace(/\*([^*]+)\*/g, '<em>$1</em>')
+    .replace(/(^|[^\w])_([^_]+)_(?!\w)/g, '$1<em>$2</em>');
+}
+
+function renderInline(rawText) {
+  const tokens = [];
+  const stash = (html) => {
+    tokens.push(html);
+    return TOKEN_OPEN + (tokens.length - 1) + TOKEN_CLOSE;
+  };
+
+  let s = escapeHtml(rawText);
+
+  // Code spans first: contents stay escaped and opt out of all other rules.
+  s = s.replace(/`([^`]+)`/g, (_m, code) => stash('<code>' + code + '</code>'));
+
+  s = s.replace(/!\[([^\]]*)\]\(([^)]*)\)/g, (_m, alt, src) => {
+    const kind = classifyUrl(src);
+    if (kind !== 'http' && kind !== 'relative') return alt;
+    return stash('<img src="' + src.trim() + '" alt="' + alt + '">');
+  });
+
+  s = s.replace(/\[([^\]]+)\]\(([^)]*)\)/g, (_m, label, url) => {
+    const kind = classifyUrl(url);
+    const text = applyEmphasis(label);
+    if (kind === 'blocked') return text;
+    const extra = kind === 'http' ? ' target="_blank" rel="noopener"' : '';
+    return stash('<a href="' + url.trim() + '"' + extra + '>' + text + '</a>');
+  });
+
+  s = applyEmphasis(s);
+
+  // Stashed anchors may hold code-span tokens, so resolve until none remain.
+  while (s.includes(TOKEN_OPEN)) {
+    s = s.replace(TOKEN_RE, (_m, idx) => tokens[Number(idx)]);
+  }
+  return s;
+}
+
+function splitTableRow(line) {
+  let s = line.trim();
+  if (s.startsWith('|')) s = s.slice(1);
+  if (s.endsWith('|') && !s.endsWith('\\|')) s = s.slice(0, -1);
+  return s
+    .replace(/\\\|/g, TOKEN_OPEN)
+    .split('|')
+    .map((cell) => cell.split(TOKEN_OPEN).join('|').trim());
+}
+
+function isAlignmentRow(line) {
+  if (!line || !line.includes('|')) return false;
+  const cells = splitTableRow(line);
+  return cells.length > 0 && cells.every((cell) => /^:?-+:?$/.test(cell));
+}
+
+function cellAlign(spec) {
+  const left = spec.startsWith(':');
+  const right = spec.endsWith(':');
+  if (left && right) return 'center';
+  if (right) return 'right';
+  if (left) return 'left';
+  return '';
+}
+
+function renderListItem(text) {
+  const task = text.match(/^\[([ xX])\]\s+(.*)$/);
+  if (task) {
+    const checked = task[1].trim() ? ' checked' : '';
+    return '<li class="task"><input type="checkbox" disabled' + checked + '> ' +
+      renderInline(task[2]) + '</li>';
+  }
+  return '<li>' + renderInline(text) + '</li>';
+}
+
+function listTag(marker) {
+  return /^\d/.test(marker) ? 'ol' : 'ul';
+}
+
+function buildList(items, start, indent) {
+  const tag = listTag(items[start].marker);
+  const parts = [];
+  let i = start;
+  while (i < items.length && items[i].indent >= indent) {
+    if (items[i].indent > indent) {
+      // Deeper item: nest a sublist inside the previous <li>
+      const nested = buildList(items, i, items[i].indent);
+      if (parts.length > 0) {
+        const last = parts.pop();
+        parts.push(last.replace(/<\/li>$/, '\n' + nested.html + '\n</li>'));
+      } else {
+        parts.push('<li>\n' + nested.html + '\n</li>');
+      }
+      i = nested.end;
+    } else {
+      // A marker-type change at the same indent starts a new list
+      // (CommonMark); stop here so the caller renders the next run with
+      // its own tag instead of absorbing it into this one.
+      if (listTag(items[i].marker) !== tag) break;
+      parts.push(renderListItem(items[i].text));
+      i += 1;
+    }
+  }
+  return { html: '<' + tag + '>\n' + parts.join('\n') + '\n</' + tag + '>', end: i };
+}
+
+function buildListBlock(items) {
+  let lists = [];
+  let i = 0;
+  while (i < items.length) {
+    const list = buildList(items, i, items[i].indent);
+    lists = [...lists, list.html];
+    i = list.end;
+  }
+  return lists.join('\n');
+}
+
+function startsBlock(line, nextLine) {
+  return /^```/.test(line) ||
+    /^#{1,6}\s/.test(line) ||
+    HR_RE.test(line) ||
+    /^ {0,3}>/.test(line) ||
+    LIST_ITEM_RE.test(line) ||
+    (line.includes('|') && isAlignmentRow(nextLine || ''));
+}
+
+function renderMarkdown(text) {
+  if (!text) return '';
+  const lines = String(text)
+    .replace(STRIP_RE, '')
+    .replace(/\r\n?/g, '\n')
+    .split('\n');
+  const out = [];
+  let i = 0;
+
+  while (i < lines.length) {
+    const line = lines[i];
+
+    if (!line.trim()) {
+      i += 1;
+      continue;
+    }
+
+    const fence = line.match(/^```(.*)$/);
+    if (fence) {
+      const lang = fence[1].trim().split(/\s+/)[0].toLowerCase().replace(/[^a-z0-9-]/g, '');
+      const body = [];
+      i += 1;
+      while (i < lines.length && !/^```\s*$/.test(lines[i])) {
+        body.push(lines[i]);
+        i += 1;
+      }
+      i += 1; // skip closing fence (or run off EOF)
+      if (lang === 'mermaid') {
+        // Mermaid reads the element's textContent, and the browser decodes
+        // character references there — so escaping keeps `-->`/`<` intact for
+        // the renderer while preventing HTML injection or a </pre> breakout.
+        out.push('<pre class="mermaid">' + escapeHtml(body.join('\n')) + '</pre>');
+        continue;
+      }
+      const cls = lang ? ' class="language-' + lang + '"' : '';
+      out.push('<pre><code' + cls + '>' + escapeHtml(body.join('\n')) + '</code></pre>');
+      continue;
+    }
+
+    const heading = line.match(/^(#{1,6})\s+(.+?)\s*$/);
+    if (heading) {
+      const level = heading[1].length;
+      out.push('<h' + level + ' id="' + slugify(heading[2]) + '">' +
+        renderInline(heading[2]) + '</h' + level + '>');
+      i += 1;
+      continue;
+    }
+
+    // Horizontal rule (alignment rows never reach here: tables consume them)
+    if (HR_RE.test(line)) {
+      out.push('<hr>');
+      i += 1;
+      continue;
+    }
+
+    // Blockquote: strip one `>` level and recurse, which handles nesting
+    if (/^ {0,3}>/.test(line)) {
+      const inner = [];
+      while (i < lines.length && /^ {0,3}>/.test(lines[i])) {
+        inner.push(lines[i].replace(/^ {0,3}> ?/, ''));
+        i += 1;
+      }
+      out.push('<blockquote>\n' + renderMarkdown(inner.join('\n')) + '\n</blockquote>');
+      continue;
+    }
+
+    // Table: header row followed by an alignment row
+    if (line.includes('|') && isAlignmentRow(lines[i + 1] || '')) {
+      const aligns = splitTableRow(lines[i + 1]).map(cellAlign);
+      const row = (tag, cells) => '<tr>' + cells.map((cell, idx) => {
+        const style = aligns[idx] ? ' style="text-align:' + aligns[idx] + '"' : '';
+        return '<' + tag + style + '>' + renderInline(cell) + '</' + tag + '>';
+      }).join('') + '</tr>';
+      const head = row('th', splitTableRow(line));
+      const body = [];
+      i += 2;
+      while (i < lines.length && lines[i].trim() && lines[i].includes('|')) {
+        body.push(row('td', splitTableRow(lines[i])));
+        i += 1;
+      }
+      out.push('<table>\n<thead>\n' + head + '\n</thead>\n<tbody>\n' +
+        body.join('\n') + '\n</tbody>\n</table>');
+      continue;
+    }
+
+    if (LIST_ITEM_RE.test(line)) {
+      const items = [];
+      while (i < lines.length) {
+        const m = lines[i].match(LIST_ITEM_RE);
+        if (!m) break;
+        items.push({ indent: m[1].length, marker: m[2], text: m[3] });
+        i += 1;
+      }
+      // An outdent below the first item's indentation ends that list. Render
+      // the remaining run as a sibling list so malformed indentation cannot
+      // silently drop content or create an empty parent item.
+      out.push(buildListBlock(items));
+      continue;
+    }
+
+    // Paragraph: run of plain lines up to a blank line or block start
+    const para = [line.trim()];
+    i += 1;
+    while (i < lines.length && lines[i].trim() && !startsBlock(lines[i], lines[i + 1])) {
+      para.push(lines[i].trim());
+      i += 1;
+    }
+    out.push('<p>' + renderInline(para.join('\n')) + '</p>');
+  }
+
+  return out.join('\n');
+}
+
+module.exports = { renderMarkdown, escapeHtml, slugify };

package/skills/global_config/plan-canvas/scripts/lib/plan-canvas/sdk.js

@@ -0,0 +1,239 @@
+'use strict';
+
+/**
+ * Plan Canvas artifact SDK — the script injected into the reviewed artifact.
+ *
+ * The artifact runs in a sandboxed iframe without allow-same-origin, so this
+ * script can only talk to the chrome via postMessage. It renders all of its
+ * own UI inside a shadow root so it never annotates itself and never leaks
+ * styles into the artifact.
+ *
+ * Source: affaan-m/ECC — MIT, see THIRD_PARTY_NOTICES.md
+ */
+
+function artifactSdkJs() {
+  return `'use strict';
+(() => {
+  if (window.parent === window) return; // only meaningful inside the canvas
+  if (window.__eccPlanCanvasSdk) return;
+  window.__eccPlanCanvasSdk = true;
+
+  let annotate = true;
+  let card = null;
+
+  const post = msg => window.parent.postMessage(msg, '*');
+
+  // --- shadow-root UI host --------------------------------------------
+  const host = document.createElement('div');
+  host.setAttribute('data-ecc-plan-canvas', 'ui');
+  host.style.cssText = 'position:absolute;top:0;left:0;width:0;height:0;z-index:2147483647';
+  const root = host.attachShadow({ mode: 'open' });
+  root.innerHTML = \`
+  <style>
+    :host{all:initial}
+    .hl{position:fixed;pointer-events:none;border:1.5px solid #6885e8;background:rgba(104,133,232,0.12);border-radius:4px;display:none;z-index:2147483646;transition:all .06s ease-out}
+    .selhint{position:absolute;display:none;z-index:2147483647;background:#101218;color:#dfe2e9;border:1px solid #272c3e;border-radius:6px;padding:4px 10px;font:600 11.5px -apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;cursor:pointer;box-shadow:0 8px 32px rgba(0,0,0,0.6)}
+    .selhint:hover{border-color:#6885e8}
+    .card{position:absolute;display:none;z-index:2147483647;width:300px;background:#101218;border:1px solid #272c3e;border-radius:8px;box-shadow:0 8px 32px rgba(0,0,0,0.6);font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;color:#dfe2e9}
+    .card h4{margin:0;padding:10px 12px 0;font-size:11px;font-weight:600;text-transform:uppercase;letter-spacing:.05em;color:#80859a}
+    .card .snippet{padding:4px 12px 0;font:10.5px 'SF Mono','Fira Code',monospace;color:#4acbbe;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}
+    .card textarea{display:block;width:calc(100% - 24px);margin:8px 12px;min-height:56px;resize:vertical;background:#13161e;border:1px solid #1d2130;border-radius:6px;color:#dfe2e9;font:12.5px -apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;padding:7px 9px;outline:none;box-sizing:border-box}
+    .card textarea:focus{border-color:#6885e8}
+    .card .row{display:flex;justify-content:flex-end;gap:8px;padding:0 12px 12px}
+    .card button{border-radius:6px;font:600 11.5px -apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;padding:5px 12px;cursor:pointer}
+    .card .cancel{background:none;border:1px solid #1d2130;color:#80859a}
+    .card .cancel:hover{color:#dfe2e9;border-color:#272c3e}
+    .card .queue{background:#6885e8;border:1px solid #6885e8;color:#fff}
+    .card .queue:hover{background:#3d5ab8}
+    .card .keys{padding:0 12px 10px;font-size:9.5px;color:#4c5168}
+  </style>
+  <div class="hl"></div>
+  <button class="selhint" type="button">Annotate selection</button>
+  <div class="card">
+    <h4></h4>
+    <div class="snippet"></div>
+    <textarea placeholder="What should change here?"></textarea>
+    <div class="row">
+      <button class="cancel" type="button">Cancel</button>
+      <button class="queue" type="button">Queue</button>
+    </div>
+    <div class="keys">Enter to queue &middot; Cmd/Ctrl+Enter to queue &amp; send</div>
+  </div>\`;
+  const attach = () => document.body ? document.body.appendChild(host) : null;
+  if (document.body) attach();
+  else document.addEventListener('DOMContentLoaded', attach);
+
+  const hl = root.querySelector('.hl');
+  const selhint = root.querySelector('.selhint');
+  const cardEl = root.querySelector('.card');
+  const cardTitle = cardEl.querySelector('h4');
+  const cardSnippet = cardEl.querySelector('.snippet');
+  const cardText = cardEl.querySelector('textarea');
+
+  // --- selectors & context ---------------------------------------------
+  const esc = v => (window.CSS && CSS.escape) ? CSS.escape(v) : v.replace(/[^a-zA-Z0-9_-]/g, '\\\\$&');
+  function selectorFor(el) {
+    const parts = [];
+    let node = el;
+    for (let depth = 0; node && node.nodeType === 1 && depth < 6; depth++) {
+      if (node.id) { parts.unshift('#' + esc(node.id)); return parts.join(' > '); }
+      const tag = node.tagName.toLowerCase();
+      if (tag === 'body' || tag === 'html') { parts.unshift(tag); break; }
+      let nth = 1;
+      let sib = node;
+      while ((sib = sib.previousElementSibling)) if (sib.tagName === node.tagName) nth++;
+      parts.unshift(tag + ':nth-of-type(' + nth + ')');
+      node = node.parentElement;
+    }
+    return parts.join(' > ');
+  }
+  function snippetFor(el) {
+    return (el.innerText || el.textContent || '').replace(/\\s+/g, ' ').trim().slice(0, 200);
+  }
+  const INTERACTIVE = new Set(['button', 'input', 'select', 'textarea', 'option', 'label', 'summary', 'a']);
+  function isInteractive(el) {
+    let node = el;
+    while (node && node.nodeType === 1) {
+      if (INTERACTIVE.has(node.tagName.toLowerCase()) || node.isContentEditable) return true;
+      node = node.parentElement;
+    }
+    return false;
+  }
+  const isOurs = el => el === host || host.contains(el);
+
+  // --- annotation card ---------------------------------------------------
+  function openCard(target) {
+    card = target;
+    cardTitle.textContent = target.kindLabel;
+    cardSnippet.textContent = target.anchor.snippet || target.anchor.selector;
+    cardText.value = '';
+    cardEl.style.display = 'block';
+    const x = Math.min(target.x, window.innerWidth - 320) + window.scrollX;
+    const y = target.y + 12 + window.scrollY;
+    cardEl.style.left = Math.max(8, x) + 'px';
+    cardEl.style.top = y + 'px';
+    cardText.focus();
+  }
+  function closeCard() {
+    card = null;
+    cardEl.style.display = 'none';
+  }
+  function queueCard(sendNow) {
+    if (!card) return;
+    const text = cardText.value.trim();
+    if (!text) { cardText.focus(); return; }
+    post({
+      type: sendNow ? 'pc:queue-and-send' : 'pc:queue',
+      item: { kind: 'annotation', text, anchor: card.anchor }
+    });
+    closeCard();
+  }
+  cardEl.querySelector('.cancel').addEventListener('click', closeCard);
+  cardEl.querySelector('.queue').addEventListener('click', () => queueCard(false));
+  cardText.addEventListener('keydown', e => {
+    if (e.key === 'Enter' && (e.metaKey || e.ctrlKey)) { e.preventDefault(); queueCard(true); }
+    else if (e.key === 'Enter' && !e.shiftKey) { e.preventDefault(); queueCard(false); }
+    else if (e.key === 'Escape') closeCard();
+  });
+
+  // --- element hover / click ---------------------------------------------
+  document.addEventListener('mousemove', e => {
+    if (!annotate || card) { hl.style.display = 'none'; return; }
+    const el = e.target;
+    if (!el || isOurs(el) || el === document.body || el === document.documentElement || isInteractive(el)) {
+      hl.style.display = 'none';
+      return;
+    }
+    const rect = el.getBoundingClientRect();
+    hl.style.display = 'block';
+    hl.style.left = rect.left - 2 + 'px';
+    hl.style.top = rect.top - 2 + 'px';
+    hl.style.width = rect.width + 'px';
+    hl.style.height = rect.height + 'px';
+  }, true);
+
+  document.addEventListener('click', e => {
+    if (!annotate) return;
+    const el = e.target;
+    if (isOurs(el)) return;
+    if (card) { if (!cardEl.contains(e.composedPath()[0])) closeCard(); return; }
+    if (isInteractive(el)) return; // let controls behave natively
+    const selection = window.getSelection();
+    if (selection && !selection.isCollapsed) return; // handled by selection flow
+    if (el === document.body || el === document.documentElement) return;
+    e.preventDefault();
+    e.stopPropagation();
+    hl.style.display = 'none';
+    openCard({
+      kindLabel: 'Annotate <' + el.tagName.toLowerCase() + '>',
+      anchor: { selector: selectorFor(el), tag: el.tagName.toLowerCase(), snippet: snippetFor(el) },
+      x: e.clientX,
+      y: e.clientY
+    });
+  }, true);
+
+  // --- text selection -------------------------------------------------------
+  document.addEventListener('mouseup', e => {
+    if (!annotate || card || isOurs(e.target)) return;
+    setTimeout(() => {
+      const selection = window.getSelection();
+      const text = selection ? String(selection).replace(/\\s+/g, ' ').trim() : '';
+      if (!text || !selection.rangeCount) { selhint.style.display = 'none'; return; }
+      const rect = selection.getRangeAt(0).getBoundingClientRect();
+      selhint.style.display = 'block';
+      selhint.style.left = rect.left + window.scrollX + 'px';
+      selhint.style.top = rect.bottom + 6 + window.scrollY + 'px';
+      selhint.onclick = () => {
+        selhint.style.display = 'none';
+        const anchorNode = selection.anchorNode;
+        const el = anchorNode && anchorNode.nodeType === 1 ? anchorNode : anchorNode && anchorNode.parentElement;
+        openCard({
+          kindLabel: 'Annotate selection',
+          anchor: {
+            selector: el ? selectorFor(el) : 'body',
+            tag: 'text',
+            snippet: text.slice(0, 200),
+            textRange: { text: text.slice(0, 1000) }
+          },
+          x: rect.left,
+          y: rect.bottom
+        });
+      };
+    }, 0);
+  }, true);
+  document.addEventListener('selectionchange', () => {
+    const selection = window.getSelection();
+    if (!selection || selection.isCollapsed) selhint.style.display = 'none';
+  });
+
+  // --- chrome bridge ---------------------------------------------------------
+  window.addEventListener('message', e => {
+    const msg = e.data || {};
+    if (msg.type === 'pc:set-mode') {
+      annotate = Boolean(msg.annotate);
+      if (!annotate) { hl.style.display = 'none'; selhint.style.display = 'none'; closeCard(); }
+    } else if (msg.type === 'pc:restore-scroll') {
+      window.scrollTo(msg.x || 0, msg.y || 0);
+    }
+  });
+  document.addEventListener('keydown', e => {
+    if ((e.metaKey || e.ctrlKey) && e.key.toLowerCase() === 'i') {
+      e.preventDefault();
+      post({ type: 'pc:toggle-mode' });
+    } else if (e.key === 'Escape' && card) closeCard();
+  }, true);
+
+  let scrollTimer = null;
+  window.addEventListener('scroll', () => {
+    if (scrollTimer) return;
+    scrollTimer = setTimeout(() => {
+      scrollTimer = null;
+      post({ type: 'pc:scroll', x: window.scrollX, y: window.scrollY });
+    }, 150);
+  }, { passive: true });
+
+  post({ type: 'pc:ready' });
+})();`;
+}
+
+module.exports = { artifactSdkJs };