castle-web-sdk 0.4.16 → 0.4.17

package/dist/runtime.js

@@ -441,6 +441,8 @@ function initHostCapture() {
     // than starting a second capture alongside the one already running.
     const inFlight = new Set();
     window.addEventListener("message", (event) => {
+        if (!isTrustedShellMessage(event))
+            return;
         const data = event.data;
         if (!data || data.type !== HOST_CAPTURE_REQUEST)
             return;
@@ -454,11 +456,17 @@ function initHostCapture() {
             if (requestId)
                 inFlight.delete(requestId);
             const target = event.source ?? window.parent;
-            target.postMessage({ type: HOST_CAPTURE_RESULT, requestId, dataUrl, ok: !!dataUrl }, "*");
+            target.postMessage({ type: HOST_CAPTURE_RESULT, requestId, dataUrl, ok: !!dataUrl }, event.origin);
         };
         void captureScreenshot().then(reply, () => reply(null));
     });
 }
+function isTrustedShellMessage(event) {
+    const expectedOrigin = window
+        .__castleShellOrigin;
+    return (event.source === window.parent &&
+        (expectedOrigin ? event.origin === expectedOrigin : event.origin !== "null"));
+}
 // ─── local dev-server socket ───────────────────────────────────────────────────
 // Reconnect policy mirrors the shell's terminal client: back off while the tab
 // is visible, stay quiet while it is hidden or offline, and force a FRESH socket
@@ -490,6 +498,7 @@ let localServeSeen = false;
 let needsWakeReconnect = false;
 const intentionallyClosed = new WeakSet();
 const connectionListeners = new Set();
+let bridgeListening = false;
 /**
  * Notified `true` on every fresh dev-server socket and `false` when one is lost.
  * What lets a queued write know the moment retrying is worth it again.
@@ -539,6 +548,10 @@ function connectLocal() {
     clearReconnectTimer();
     if (!canConnectLocal())
         return;
+    if (typeof window !== "undefined" && window.parent !== window) {
+        connectBridge();
+        return;
+    }
     fetch("/__castle/ws-port")
         .then((r) => r.json())
         .then(({ port, path }) => {
@@ -555,6 +568,48 @@ function connectLocal() {
             scheduleReconnect();
     });
 }
+function connectBridge() {
+    if (bridgeListening || ws?.readyState === WebSocket.OPEN)
+        return;
+    bridgeListening = true;
+    const onInit = (event) => {
+        const data = event.data;
+        if (!data ||
+            data.type !== "castle-bridge-init" ||
+            !isTrustedShellMessage(event) ||
+            event.ports.length !== 1) {
+            return;
+        }
+        const port = event.ports[0];
+        const socket = {
+            readyState: WebSocket.OPEN,
+            send: (value) => {
+                try {
+                    port.postMessage(JSON.parse(value));
+                }
+                catch {
+                    /* malformed local payload */
+                }
+            },
+        };
+        port.onmessage = (messageEvent) => {
+            const value = messageEvent.data;
+            if (!value || typeof value !== "object")
+                return;
+            handleLocalMessage(value);
+        };
+        port.start();
+        localServeSeen = true;
+        ws = socket;
+        for (const msg of logBuffer)
+            socket.send(JSON.stringify(msg));
+        logBuffer = [];
+        bridgeListening = false;
+        window.removeEventListener("message", onInit);
+        setConnected(true);
+    };
+    window.addEventListener("message", onInit);
+}
 function stopHeartbeat() {
     if (pingTimer !== null) {
         clearInterval(pingTimer);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "castle-web-sdk",
-  "version": "0.4.16",
+  "version": "0.4.17",
   "type": "module",
   "main": "dist/castle.js",
   "types": "dist/castle.d.ts",