glitchgrab 1.40.0 → 1.42.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/dist/index.js +624 -277
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +624 -277
- package/dist/index.mjs.map +1 -1
- package/dist/server.js.map +1 -1
- package/dist/server.mjs.map +1 -1
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -832,7 +832,7 @@ response.headers.set(
|
|
|
832
832
|
|
|
833
833
|
- `connect-src https://glitchgrab.dev` — required for `sendReport`, `enhanceText`, `transcribeAudio`, and the report-fetching hooks/REST calls. All SDK requests go to this single host by default.
|
|
834
834
|
- If you pass a custom `baseUrl` prop, allow that host instead (self-hosted or proxied deployments).
|
|
835
|
-
- Screenshot capture
|
|
835
|
+
- Screenshot capture runs entirely client-side — no network request, no extra `img-src`/`connect-src` needed for it. In Chrome and Edge the browser asks "Allow this site to see this tab?" when the dialog opens, and the screenshot is the tab's real pixels (the share stops after one frame). If the reporter clicks Cancel, or in Safari/Firefox, it falls back to re-drawing `document.body` with `html2canvas-pro`, which needs no permission but can drift from the real UI. If the SDK runs inside an iframe, the frame needs `allow="display-capture"` for the real-pixel path.
|
|
836
836
|
- `img-src` only matters if your `session` carries an avatar URL — the report dialog renders it. If your CSP blocks that host the dialog falls back to the reporter's initials, so it degrades rather than breaking.
|
|
837
837
|
- No `script-src`, `style-src`, or `frame-src` allowances are required — the SDK doesn't load remote scripts, styles, or iframes.
|
|
838
838
|
|