vcorp-chrome 1.3.1 → 1.5.0

package/extension/content.js

@@ -715,7 +715,33 @@
     const base = { bubbles: true, cancelable: true, composed: true, view: window, clientX: x, clientY: y, button: 0 };
     const ptr = { ...base, pointerId: 1, pointerType: 'mouse', isPrimary: true };
 
-    const fire = (Ctor, type, extra) => el.dispatchEvent(new Ctor(type, { ...extra }));
+    // 点在 <a href="javascript:..."> 上时，click 的默认动作会去执行这个地址。
+    // 页面的 CSP（script-src 没有 unsafe-inline）会拦住，并在控制台记
+    // 「Running the JavaScript URL」。监听器该跑的已经在派发过程里跑过了，
+    // 被拦的只是这段地址本身。这里在默认动作之前 preventDefault，地址不再执行。
+    const javascriptLink = (node) => {
+      for (let n = node; n; n = n.parentElement || n.parentNode?.host) {
+        if (n.nodeType !== 1 || !/^(A|AREA)$/i.test(n.tagName)) continue;
+        const href = n.getAttribute('href') || n.getAttribute('xlink:href') || '';
+        if (/^\s*javascript:/i.test(href)) return n;
+      }
+      return null;
+    };
+    const fire = (Ctor, type, extra) => {
+      if (type === 'click') {
+        const stop = (ev) => ev.preventDefault();
+        const link = javascriptLink(el);
+        const form = el.form || el.closest?.('form');
+        const blockForm = form && /^\s*javascript:/i.test(form.getAttribute('action') || '');
+        if (link) link.addEventListener('click', stop, true);
+        if (blockForm) form.addEventListener('submit', stop, true);
+        const sent = el.dispatchEvent(new Ctor(type, { ...extra }));
+        if (link) link.removeEventListener('click', stop, true);
+        if (blockForm) form.removeEventListener('submit', stop, true);
+        return sent;
+      }
+      return el.dispatchEvent(new Ctor(type, { ...extra }));
+    };
     try {
       fire(PointerEvent, 'pointerover', ptr);
       fire(MouseEvent, 'mouseover', base);

package/extension/folders.js

@@ -0,0 +1,247 @@
+// 用户挂载的本地文件夹。句柄存在扩展自己的 IndexedDB，和配对密钥不是同一个库。
+//
+// 读文件放在 service worker 里，选文件夹和重新授权放在 mount.html 里。依据：
+//   - File System Access 规范把 queryPermission、getFile、目录 entries 暴露给 Worker
+//     （Exposed=Window,Worker）。扩展的 service worker 和扩展页面是同一个源，
+//     页面里 showDirectoryPicker 拿到的句柄写进 IndexedDB 之后，SW 读得出来。
+//     woxxom 在 StackOverflow 上给的做法也是这条：句柄进 IndexedDB，SW 复用。
+//   - showDirectoryPicker 和 requestPermission 都要用户激活，而且 SW 没有 window。
+//     这两件事只能在扩展页面里、由用户点一下来做。
+//   - 权限不保证跨过浏览器重启。Chrome 122 起用户可以选「每次访问都允许」，
+//     但 chrome-extension 源不是已安装的 PWA，重启后 queryPermission 经常回到 prompt。
+//     所以每次读之前都问一次；不是 granted 就返回 FOLDER_LOCKED，让用户在窗口里点「恢复访问」。
+//     不把「重启后仍然 granted」当成前提。
+//
+// 这里不认识云端命令。谁能读、读哪种文件、字节往哪送，由 cloud-policy.js 决定。
+
+import { cleanFolderName, fileAllowed, skipEntry, matchGlob, FS_FILE_MAX, FS_LIST_MAX, FS_FOLDERS_MAX } from './cloud-policy.js';
+
+const DB = 'hc-folders';
+
+const fail = (code, message) => Object.assign(new Error(message), { code });
+
+function idb() {
+  return new Promise((resolve, reject) => {
+    const r = indexedDB.open(DB, 1);
+    r.onupgradeneeded = () => r.result.createObjectStore('folders', { keyPath: 'id' });
+    r.onsuccess = () => resolve(r.result);
+    r.onerror = () => reject(r.error);
+  });
+}
+
+async function idbOp(mode, fn) {
+  const db = await idb();
+  try {
+    return await new Promise((resolve, reject) => {
+      const tx = db.transaction('folders', mode);
+      const req = fn(tx.objectStore('folders'));
+      tx.oncomplete = () => resolve(req?.result);
+      tx.onerror = () => reject(tx.error);
+    });
+  } finally { db.close(); }
+}
+
+const all = () => idbOp('readonly', (s) => s.getAll());
+const get = (id) => idbOp('readonly', (s) => s.get(id));
+
+function newId() {
+  const alphabet = 'abcdefghijklmnopqrstuvwxyz0123456789';
+  const bytes = crypto.getRandomValues(new Uint8Array(9));
+  return `fld_${[...bytes].map((b) => alphabet[b % alphabet.length]).join('')}`;
+}
+
+function mapFsError(e, rel) {
+  if (e?.code) return e;
+  if (e?.name === 'NotAllowedError' || e?.name === 'SecurityError') {
+    return fail('FOLDER_LOCKED', '读取权限失效了，需要你重新点一次允许');
+  }
+  if (e?.name === 'NotFoundError' || e?.name === 'TypeMismatchError') {
+    return fail('NOT_FOUND', rel ? `没有 ${rel}` : '没有这个路径');
+  }
+  return e;
+}
+
+// 给服务器的名单：只有显示名。权限状态是给侧栏的，不上报。
+export async function names() {
+  const rows = await all();
+  return rows.map((r) => ({ id: r.id, name: r.name }));
+}
+
+export async function listFolders() {
+  const rows = await all();
+  const out = [];
+  for (const row of rows.sort((a, b) => a.addedAt - b.addedAt)) {
+    let permission = 'unknown';
+    try { permission = await row.handle.queryPermission({ mode: 'read' }); } catch { /* 句柄坏了，下面照样列出来让用户移除 */ }
+    out.push({ id: row.id, name: row.name, addedAt: row.addedAt, permission });
+  }
+  return out;
+}
+
+export async function getByName(name) {
+  const rows = await all();
+  return rows.find((r) => r.name === name) || null;
+}
+
+export async function addFolder(handle, name) {
+  const clean = cleanFolderName(name) || cleanFolderName(handle?.name);
+  if (!clean) throw fail('BAD_NAME', '文件夹名字不合法');
+  const rows = await all();
+  if (rows.length >= FS_FOLDERS_MAX) throw fail('FULL', `最多挂载 ${FS_FOLDERS_MAX} 个文件夹，先移除不用的`);
+  if (rows.some((r) => r.name === clean)) throw fail('DUP', '已经有同名文件夹，换一个显示名');
+  for (const row of rows) {
+    try {
+      if (await row.handle.isSameEntry(handle)) throw fail('DUP', `这个文件夹已经挂过了，名字是「${row.name}」`);
+    } catch (e) {
+      if (e.code === 'DUP') throw e;
+    }
+  }
+  const row = { id: newId(), name: clean, handle, addedAt: Date.now() };
+  await idbOp('readwrite', (s) => s.put(row));
+  return { id: row.id, name: row.name };
+}
+
+export async function removeFolder(id) {
+  await idbOp('readwrite', (s) => s.delete(id));
+}
+
+// 必须在扩展页面里、由用户点击调用。SW 里调会因为没有用户激活而失败。
+export async function requestAccess(id) {
+  const row = await get(id);
+  if (!row?.handle) throw fail('NOT_FOUND', '没有这个文件夹');
+  return row.handle.requestPermission({ mode: 'read' });
+}
+
+async function child(dir, name, kind) {
+  try {
+    return kind === 'file' ? await dir.getFileHandle(name) : await dir.getDirectoryHandle(name);
+  } catch (e) {
+    throw mapFsError(e, name);
+  }
+}
+
+async function resolve(root, rel, kind) {
+  const parts = rel ? rel.split('/') : [];
+  let cur = root;
+  for (let i = 0; i < parts.length; i++) {
+    const last = i === parts.length - 1;
+    cur = await child(cur, parts[i], last && kind === 'file' ? 'file' : 'dir');
+  }
+  return cur;
+}
+
+async function permissionOf(handle) {
+  try { return await handle.queryPermission({ mode: 'read' }); }
+  catch (e) { throw mapFsError(e); }
+}
+
+export async function assertGranted(handle) {
+  if (await permissionOf(handle) !== 'granted') {
+    throw fail('FOLDER_LOCKED', '读取权限失效了，需要你重新点一次允许');
+  }
+}
+
+function sizeText(n) {
+  if (n < 1024) return `${n} B`;
+  if (n < 1024 * 1024) return `${Math.round(n / 1024)} KB`;
+  return `${(n / 1024 / 1024).toFixed(1)} MB`;
+}
+
+// 列出一个已授权的文件夹。glob 有值时只留匹配的文件，目录用来往下走，不出现在结果里。
+export async function listTree(handle, { path = '', depth = 3, glob = '', folder }) {
+  await assertGranted(handle);
+  let root;
+  try { root = await resolve(handle, path, 'dir'); }
+  catch (e) {
+    if (e.code === 'NOT_FOUND') throw fail('NOT_FOUND', path ? `没有文件夹 ${path}` : '没有这个文件夹');
+    throw e;
+  }
+  const entries = [];
+  let truncated = false;
+
+  async function walk(dir, rel, levelsLeft) {
+    if (truncated) return;
+    let handles;
+    try { handles = dir.entries(); }
+    catch (e) { throw mapFsError(e, rel); }
+    const batch = [];
+    try {
+      for await (const [name, h] of handles) batch.push([name, h]);
+    } catch (e) { throw mapFsError(e, rel); }
+    batch.sort((a, b) => a[0].localeCompare(b[0], 'zh'));
+    for (const [name, h] of batch) {
+      if (entries.length >= FS_LIST_MAX) { truncated = true; return; }
+      if (skipEntry(name)) continue;
+      const childRel = rel ? `${rel}/${name}` : name;
+      if (h.kind === 'directory') {
+        if (!glob) entries.push({ path: childRel, dir: true });
+        if (levelsLeft > 1) await walk(h, childRel, levelsLeft - 1);
+        continue;
+      }
+      if (!fileAllowed(name)) continue;
+      if (glob && !matchGlob(childRel, glob)) continue;
+      let size = null;
+      try {
+        const file = await h.getFile();
+        size = file.size;
+      } catch (e) {
+        if (e?.name === 'NotFoundError') continue;
+        throw mapFsError(e, childRel);
+      }
+      entries.push({ path: childRel, size });
+    }
+  }
+
+  await walk(root, '', depth);
+
+  const where = `${folder}${path ? `/${path}` : ''}`;
+  const lines = [`${where}${glob ? `（${glob}）` : ''}`];
+  if (!entries.length) lines.push('（没有符合的文件）');
+  for (const ent of entries) lines.push(ent.dir ? `${ent.path}/` : `${ent.path}\t${sizeText(ent.size)}`);
+  if (truncated) lines.push(`（已到 ${FS_LIST_MAX} 条上限，后面的没列。缩小 path 或 glob 再列。）`);
+  return {
+    text: lines.join('\n'),
+    truncated,
+    audit: `list ${where}${truncated ? ' truncated' : ''} ${entries.length}`,
+  };
+}
+
+export async function readFile(handle, rel) {
+  await assertGranted(handle);
+  let file;
+  try {
+    const h = await resolve(handle, rel, 'file');
+    file = await h.getFile();
+  } catch (e) {
+    throw mapFsError(e, rel);
+  }
+  const base = rel.split('/').pop();
+  if (skipEntry(base) || !fileAllowed(base) || !fileAllowed(file.name)) {
+    throw fail('CLOUD_DENIED', `不读取这种文件：${base}`);
+  }
+  if (file.size > FS_FILE_MAX) throw fail('CLOUD_DENIED', `「${base}」有 ${sizeText(file.size)}，超过单文件 32MB 上限`);
+  return file;
+}
+
+// 把文件字节流到配对服务器的一次性地址。不经过 WebSocket：一条命令的回执上限是 3MB。
+export async function uploadFile(file, url) {
+  let res;
+  try {
+    res = await fetch(url, {
+      method: 'PUT',
+      credentials: 'omit',
+      cache: 'no-store',
+      headers: {
+        // 不用 file.type。application/json 会被服务器上的 JSON 解析器先吃掉，字节就对不上了。
+        'content-type': 'application/octet-stream',
+        'content-length': String(file.size),
+        'x-file-name': encodeURIComponent(file.name),
+      },
+      body: file,
+    });
+  } catch (e) {
+    throw fail('INTERNAL', `文件没有传到服务器：${e.message || e}`);
+  }
+  if (!res.ok) throw fail('INTERNAL', `文件没有传到服务器：${res.status}`);
+  return { bytes: file.size, name: file.name };
+}

package/extension/manifest.json

@@ -1,38 +1,38 @@
-{
-  "manifest_version": 3,
-  "name": "vcorp-chrome",
-  "version": "1.3.1",
-  "description": "让 AI agent 操控你已登录的 Chrome。基于花叔的 huashu-chrome（MIT）修改。",
-  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq6xRqEwG4yTuHRG1Zah3j//T3B72XnazyZ+9fOCa5P4bBLPmNBN7YAGL5WnjtPVJefXT9r2Ol0qvNztayDG3dMjK6AZoWccgKa5rhxcvWgFUjanXtmBBQ0qgYwNhuEJSkdinLLtyUg6YmK7Mn72NWpfa/NfqNHdK5AHslvvtJ50iQAYmabl2Nd3vOJ9DxtLBt8a2DfoGPWizgEB3+gkqm2PB8LywwwoiGKd7acr1wZEWmWK9/s0YWdzIstjlvk5AO5XFn6EtEzW8tAAOwBka9239pcyj0kEogWctHLJn7p9VFru38r+I1USyGn6u9XQ68n9edWddxBYokETCqEMT9QIDAQAB",
-  "minimum_chrome_version": "116",
-  "background": {
-    "service_worker": "background.js",
-    "type": "module"
-  },
-  "action": {
-    "default_title": "vcorp-chrome"
-  },
-  "permissions": [
-    "tabs",
-    "tabGroups",
-    "scripting",
-    "storage",
-    "alarms",
-    "offscreen",
-    "downloads",
-    "sidePanel",
-    "notifications",
-    "debugger"
-  ],
-  "host_permissions": [
-    "<all_urls>"
-  ],
-  "icons": {
-    "16": "icons/icon16.png",
-    "48": "icons/icon48.png",
-    "128": "icons/icon128.png"
-  },
-  "side_panel": {
-    "default_path": "panel.html"
-  }
-}
+{
+  "manifest_version": 3,
+  "name": "vcorp-chrome",
+  "version": "1.5.0",
+  "description": "让 AI agent 操控你已登录的 Chrome。基于花叔的 huashu-chrome（MIT）修改。",
+  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq6xRqEwG4yTuHRG1Zah3j//T3B72XnazyZ+9fOCa5P4bBLPmNBN7YAGL5WnjtPVJefXT9r2Ol0qvNztayDG3dMjK6AZoWccgKa5rhxcvWgFUjanXtmBBQ0qgYwNhuEJSkdinLLtyUg6YmK7Mn72NWpfa/NfqNHdK5AHslvvtJ50iQAYmabl2Nd3vOJ9DxtLBt8a2DfoGPWizgEB3+gkqm2PB8LywwwoiGKd7acr1wZEWmWK9/s0YWdzIstjlvk5AO5XFn6EtEzW8tAAOwBka9239pcyj0kEogWctHLJn7p9VFru38r+I1USyGn6u9XQ68n9edWddxBYokETCqEMT9QIDAQAB",
+  "minimum_chrome_version": "116",
+  "background": {
+    "service_worker": "background.js",
+    "type": "module"
+  },
+  "action": {
+    "default_title": "vcorp-chrome"
+  },
+  "permissions": [
+    "tabs",
+    "tabGroups",
+    "scripting",
+    "storage",
+    "alarms",
+    "offscreen",
+    "downloads",
+    "sidePanel",
+    "notifications",
+    "debugger"
+  ],
+  "host_permissions": [
+    "<all_urls>"
+  ],
+  "icons": {
+    "16": "icons/icon16.png",
+    "48": "icons/icon48.png",
+    "128": "icons/icon128.png"
+  },
+  "side_panel": {
+    "default_path": "panel.html"
+  }
+}

package/extension/mount.html

@@ -0,0 +1,61 @@
+<!doctype html>
+<html lang="zh-CN">
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>挂载本地文件夹</title>
+<style>
+  :root {
+    color-scheme: light dark;
+    --bg: #fafaf9; --card: #ffffff; --ink: #1c1917; --mute: #78716c; --line: rgba(0,0,0,.07);
+    --soft: rgba(0,0,0,.04); --ok: #16a34a; --warn: #d97706; --bad: #dc2626; --accent: #2563eb;
+  }
+  @media (prefers-color-scheme: dark) {
+    :root { --bg: #161616; --card: #1f1f1f; --ink: #f2f2f2; --mute: #a1a1aa; --line: rgba(255,255,255,.08);
+            --soft: rgba(255,255,255,.05); --ok: #22c55e; --warn: #f59e0b; --bad: #f87171; --accent: #60a5fa; }
+  }
+  * { box-sizing: border-box; }
+  [hidden] { display: none !important; }
+  body { margin: 0; background: var(--bg); color: var(--ink);
+         font: 13px/1.6 -apple-system, BlinkMacSystemFont, "PingFang SC", "Microsoft YaHei", sans-serif; }
+  main { padding: 16px; display: flex; flex-direction: column; gap: 12px; }
+  h1 { margin: 0; font-size: 15px; }
+  p { margin: 0; color: var(--mute); }
+  section { background: var(--card); border: 1px solid var(--line); border-radius: 12px; padding: 12px 14px; }
+  button.btn { font: inherit; font-size: 12.5px; border: 0; border-radius: 7px; padding: 6px 12px; cursor: pointer;
+               background: var(--accent); color: #fff; }
+  button.btn.ghost { background: var(--soft); color: var(--ink); }
+  button.btn:disabled { opacity: .45; cursor: default; }
+  .row { display: flex; gap: 8px; align-items: center; margin-top: 8px; }
+  input[type=text] { font: inherit; flex: 1; padding: 6px 8px; border-radius: 7px; border: 1px solid var(--line);
+                     background: var(--bg); color: var(--ink); }
+  .item { display: flex; align-items: center; gap: 8px; padding: 8px 0; border-top: 1px solid var(--line); }
+  .item:first-child { border-top: 0; }
+  .item .name { font-weight: 600; flex: 1; word-break: break-all; }
+  .item .sub { color: var(--mute); font-size: 11.5px; }
+  .dot { width: 8px; height: 8px; border-radius: 50%; background: #a8a29e; flex: none; }
+  .dot.ok { background: var(--ok); } .dot.warn { background: var(--warn); } .dot.bad { background: var(--bad); }
+  .msg { color: var(--bad); font-size: 12.5px; }
+  .empty { color: var(--mute); }
+</style>
+<main>
+  <div>
+    <h1>挂载本地文件夹</h1>
+    <p>选一个文件夹之后，配对的网站可以申请读取里面的文档。每次申请你都会在通知里看到文件夹的名字。只读，不会改你的文件。</p>
+  </div>
+  <section>
+    <button class="btn" id="pick" type="button">选择文件夹</button>
+    <div id="naming" hidden>
+      <p style="margin-top:8px">给它一个显示名。网站和任务看到的是这个名字，不是磁盘路径。</p>
+      <div class="row">
+        <input type="text" id="name" maxlength="40" autocomplete="off" spellcheck="false" />
+        <button class="btn" id="save" type="button">挂载</button>
+        <button class="btn ghost" id="cancel" type="button">取消</button>
+      </div>
+    </div>
+  </section>
+  <section>
+    <div id="list"><div class="empty">读取中…</div></div>
+  </section>
+  <p class="msg" id="err" hidden></p>
+</main>
+<script type="module" src="mount.js"></script>

package/extension/mount.js

@@ -0,0 +1,132 @@
+// 选文件夹和恢复权限只发生在这个窗口里：这两件事都要用户点一下。
+// 句柄写进 IndexedDB 之后，service worker 才能在没有这个窗口的情况下读文件。
+// 浏览器重启后权限可能回到 prompt，那时「恢复访问」再调一次 requestPermission。
+
+import { listFolders, addFolder, removeFolder, requestAccess } from './folders.js';
+
+const $ = (id) => document.getElementById(id);
+const focusId = new URLSearchParams(location.search).get('id');
+let pending = null;
+
+const showErr = (text) => {
+  $('err').hidden = !text;
+  $('err').textContent = text || '';
+};
+
+const permWord = {
+  granted: ['ok', '可读'],
+  prompt: ['warn', '需要恢复访问'],
+  denied: ['bad', '已拒绝'],
+  unknown: ['bad', '打不开'],
+};
+
+async function tell() {
+  await chrome.runtime.sendMessage({ __hcCloud: 'foldersChanged' }).catch(() => {});
+}
+
+async function render() {
+  const rows = await listFolders();
+  const box = $('list');
+  box.textContent = '';
+  if (!rows.length) {
+    const empty = document.createElement('div');
+    empty.className = 'empty';
+    empty.textContent = '还没有挂载的文件夹。';
+    box.appendChild(empty);
+    return;
+  }
+  for (const row of rows) {
+    const [cls, word] = permWord[row.permission] || permWord.unknown;
+    const item = document.createElement('div');
+    item.className = 'item';
+    if (row.id === focusId) item.style.outline = '1px solid var(--warn)';
+    const dot = document.createElement('span');
+    dot.className = `dot ${cls}`;
+    const name = document.createElement('div');
+    name.className = 'name';
+    name.textContent = row.name;
+    const sub = document.createElement('div');
+    sub.className = 'sub';
+    sub.textContent = word;
+    const text = document.createElement('div');
+    text.append(name, sub);
+    text.style.flex = '1';
+    item.append(dot, text);
+    if (row.permission !== 'granted') {
+      const restore = document.createElement('button');
+      restore.className = 'btn';
+      restore.type = 'button';
+      restore.textContent = '恢复访问';
+      restore.onclick = async () => {
+        restore.disabled = true;
+        showErr('');
+        try {
+          const state = await requestAccess(row.id);
+          if (state !== 'granted') showErr(state === 'denied' ? '没有允许，这个文件夹读不了。' : '还没有允许。');
+        } catch (e) {
+          showErr(e.message || String(e));
+        }
+        restore.disabled = false;
+        await render();
+      };
+      item.appendChild(restore);
+    }
+    const del = document.createElement('button');
+    del.className = 'btn ghost';
+    del.type = 'button';
+    del.textContent = '移除';
+    del.onclick = async () => {
+      if (!confirm(`移除「${row.name}」？已经批准的任务也不能再读它。文件夹本身不会被删除。`)) return;
+      await removeFolder(row.id);
+      await tell();
+      await render();
+    };
+    item.appendChild(del);
+    box.appendChild(item);
+  }
+}
+
+function showNaming(on) {
+  $('naming').hidden = !on;
+  $('pick').disabled = on;
+  if (!on) pending = null;
+}
+
+$('pick').onclick = async () => {
+  showErr('');
+  try {
+    pending = await showDirectoryPicker({ mode: 'read', id: 'vcorp-local-folder' });
+  } catch (e) {
+    if (e?.name === 'AbortError') return;
+    // 系统目录（桌面、文档、下载）在有的系统上会直接拒绝，换一个普通文件夹。
+    showErr(e?.name === 'SecurityError' || e?.name === 'AbortError'
+      ? '这个文件夹选不了。换一个普通文件夹，不要选桌面、文档或下载目录本身。'
+      : (e.message || String(e)));
+    return;
+  }
+  $('name').value = pending.name.slice(0, 40);
+  showNaming(true);
+  $('name').focus();
+  $('name').select();
+};
+
+$('cancel').onclick = () => showNaming(false);
+
+$('save').onclick = async () => {
+  if (!pending) return;
+  $('save').disabled = true;
+  showErr('');
+  try {
+    await addFolder(pending, $('name').value);
+    showNaming(false);
+    await tell();
+    await render();
+  } catch (e) {
+    showErr(e.message || String(e));
+  }
+  $('save').disabled = false;
+};
+
+$('name').onkeydown = (e) => { if (e.key === 'Enter') $('save').click(); };
+
+render().catch((e) => showErr(e.message || String(e)));

package/extension/net-hook.js

@@ -11,23 +11,52 @@
   const MAX_ENTRIES = 300;
   const MAX_BODY = 400000;
 
+  // 页面冻结（freeze）期间，浏览器只放行 keepalive:true 的 fetch，其它调用会同步抛
+  // 「Only fetch keepalive is allowed during onfreeze」，并把调用栈算在真正执行
+  // fetch 的那一层。这里若是 async 包装再转调，控制台就指到本文件。
+  // GitHub 的 RUM 会在冻结时用 fetch 把积压发出去，体积一大就不带 keepalive。
+  // 那种请求浏览器反正会拒，这里直接拒绝、不再调用原生 fetch，控制台就不会记那一行。
+  // keepalive 的则原样同步转交，不读响应体——冻结回调里多做一次 body 读取也会被拒。
+  let pageFrozen = false;
+  window.addEventListener('freeze', () => { pageFrozen = true; }, true);
+  window.addEventListener('resume', () => { pageFrozen = false; }, true);
+
   const push = (r) => {
     window.__hcNet.push(r);
     if (window.__hcNet.length > MAX_ENTRIES) window.__hcNet.shift();
   };
 
+  const keepaliveOf = (args) => {
+    const init = args[1];
+    if (init && typeof init === 'object' && init.keepalive === true) return true;
+    const input = args[0];
+    return typeof Request !== 'undefined' && input instanceof Request && input.keepalive === true;
+  };
+
   const origFetch = window.fetch;
   if (origFetch) {
-    window.fetch = async function (...a) {
-      const res = await origFetch.apply(this, a);
-      try {
-        const url = typeof a[0] === 'string' ? a[0] : a[0]?.url;
-        const ct = res.headers.get('content-type') || '';
-        // clone() 是必须的：响应体只能被读一次，直接读会把页面自己的那份吃掉
-        const body = /json|text|javascript/.test(ct) ? (await res.clone().text()).slice(0, MAX_BODY) : '';
-        push({ t: Date.now(), method: a[1]?.method || 'GET', url, status: res.status, ct, body });
-      } catch { /* 记录失败绝不能影响页面本身 */ }
-      return res;
+    window.fetch = function (...args) {
+      if (pageFrozen && !keepaliveOf(args)) return Promise.reject(new TypeError('Failed to fetch'));
+      let pending;
+      try { pending = origFetch.apply(this, args); }
+      catch (e) { return Promise.reject(e); }
+      if (pageFrozen) return pending;
+      // 不 await：页面拿到响应的时机必须和没挂钩之前一样。记录在旁边读 clone。
+      Promise.resolve(pending).then((res) => {
+        try {
+          const url = typeof args[0] === 'string' ? args[0] : args[0]?.url;
+          const ct = res.headers.get('content-type') || '';
+          if (!/json|text|javascript/.test(ct)) {
+            push({ t: Date.now(), method: args[1]?.method || 'GET', url, status: res.status, ct, body: '' });
+            return;
+          }
+          // clone() 是必须的：响应体只能被读一次，直接读会把页面自己的那份吃掉
+          res.clone().text().then((text) => {
+            push({ t: Date.now(), method: args[1]?.method || 'GET', url, status: res.status, ct, body: text.slice(0, MAX_BODY) });
+          }).catch(() => {});
+        } catch { /* 记录失败绝不能影响页面本身 */ }
+      }).catch(() => {});
+      return pending;
     };
   }