inkreach-teable-cli

T

yeuimu 07836c0165 feat(plugin): dynamic CSP connect-src from plugin manifests

Bundle plugins run inside the base page (not a sandboxed iframe), so their
declared apiOrigins must be in the PAGE's connect-src. Previously the page
CSP was hardcoded static — plugins connecting to new APIs required a code
change + rebuild.

- GET /api/plugin/csp-origins: union of all plugins' manifest apiOrigins
- [[...slug]].tsx getServerSideProps: fetches origins via ssrApi, merges
  with static fallbacks ('self' + 8001 hosts), builds CSP dynamically
- PUT /api/plugin/:pluginId accepts apiOrigins (merged into manifest JSON)
- CLI: plugin csp list / plugin csp set <id> --origins '[...]'
- @DisabledPermission on plugin GET/PUT routes (default-deny guard blocked
  PAT auth); ownership still enforced via manageablePluginCreatedBy()

2026-08-14 05:48:56 +00:00

.agents/skills/inkreach-teable

docs(skill): add plugin module to SKILL.md + routing rules + description

2026-08-13 15:39:56 +00:00

dist

docs(skill): update formSubmitted trigger docs for multi-form support

2026-08-12 03:59:12 +00:00

docs

refactor: rename skill 'inkreach-teable-ops' -> 'inkreach-teable'

2026-08-05 10:35:04 +08:00

src

feat(plugin): dynamic CSP connect-src from plugin manifests