autosnippet 2.19.5 → 2.19.7

package/lib/http/HttpServer.js

@@ -123,8 +123,21 @@ export class HttpServer {
       this.app.use(this.performanceMonitor.middleware());
     }
 
-    // 安全头
-    this.app.use(helmet());
+    // 安全头（放宽 CSP 以兼容 Vite 构建的 Dashboard SPA：script/style 需要内联和 crossorigin）
+    this.app.use(helmet({
+      contentSecurityPolicy: {
+        directives: {
+          defaultSrc: ["'self'"],
+          scriptSrc: ["'self'", "'unsafe-inline'"],
+          styleSrc: ["'self'", "'unsafe-inline'", "https:"],
+          imgSrc: ["'self'", "data:", "blob:"],
+          connectSrc: ["'self'", "ws:", "wss:"],
+          fontSrc: ["'self'", "https:", "data:"],
+          objectSrc: ["'none'"],
+          frameSrc: ["'none'"],
+        },
+      },
+    }));
 
     // 请求日志
     this.app.use(requestLogger(this.logger));
@@ -268,13 +281,13 @@ export class HttpServer {
       });
     });
 
-    // 404 处理
-    this.app.use('*', (req, res) => {
+    // 404 处理（使用 app.all 确保 layer.route 存在，mountDashboard 依赖此属性定位并重排路由栈）
+    this.app.all('*', (req, res) => {
       res.status(404).json({
         success: false,
         error: {
           code: 'NOT_FOUND',
-          message: `Route not found: ${req.method} ${req.path}`,
+          message: `Route not found: ${req.method} ${req.originalUrl}`,
         },
       });
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "autosnippet",
-  "version": "2.19.5",
+  "version": "2.19.7",
   "description": "AutoSnippet - 连接开发者、AI 与项目知识库的工具",
   "type": "module",
   "main": "lib/bootstrap.js",