hypha-debugger 0.2.9 → 0.3.1

package/dist/utils/wrap-fn.d.ts

@@ -2,13 +2,15 @@
  * Wrap a function with correct, unminified parameter names for hypha-rpc.
  *
  * In production builds, Babel/Terser minifies parameter names (e.g. 'code' → 'e').
- * hypha-rpc's getParamNames() parses Function.toString() to map kwargs to
+ * hypha-rpc's getFunctionInfo() parses Function.toString() to map kwargs to
  * positional args. With minified names, kwargs like {code: '...'} can't be
  * mapped and args are silently dropped.
  *
- * This helper uses new Function() to create a wrapper whose parameter names
- * are taken from the function's __schema__ property, so hypha-rpc always sees
- * the real parameter names regardless of minification.
+ * CSP NOTE: this used to build the wrapper with `new Function(...)`, but that is
+ * blocked on pages whose Content Security Policy lacks `'unsafe-eval'` (the exact
+ * pages the bookmarklet targets). Instead we use a normal closure and OVERRIDE its
+ * `.toString()` so hypha-rpc still reads the real, unminified parameter names from
+ * the schema — no eval / Function constructor involved.
  *
  * Additionally, it handles the case where hypha-rpc passes kwargs as a single
  * object argument (e.g. `fn({url: "..."})` instead of `fn("...")`). The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hypha-debugger",
-  "version": "0.2.9",
+  "version": "0.3.1",
   "description": "Injectable debugger for web pages and AI agents, powered by Hypha RPC",
   "type": "module",
   "main": "dist/hypha-debugger.js",
@@ -18,6 +18,8 @@
   ],
   "scripts": {
     "build": "rollup -c && tsc --declaration --emitDeclarationOnly --outDir dist",
+    "postbuild": "node scripts/build-bookmarklet.mjs",
+    "build:bookmarklet": "node scripts/build-bookmarklet.mjs",
     "dev": "rollup -c -w",
     "test": "vitest run",
     "test:watch": "vitest",