mirror of
https://github.com/pbakaus/impeccable.git
synced 2026-09-12 06:06:37 +03:00
Paul BakausandClaude Opus 4.7
05b0ac3e1f
Shape names renamed to describe the patch mechanism (what the agent does) rather than the origin (where the CSP lives). One template now covers multiple frameworks. ## Shape rename - shared-helper → append-arrays - inline-headers → append-string append-arrays applies wherever CSP is a structured directive array. append-string applies wherever CSP is a literal value string. ## New detection coverage - SvelteKit kit.csp.directives in svelte.config.js → append-arrays - Nuxt routeRules / nitro.routeRules CSP header → append-string - Nuxt-security module's contentSecurityPolicy → append-arrays ## New fixtures - sveltekit-csp/: SvelteKit config with kit.csp.directives. Includes expected-after-patch.js showing the array spread. - nuxt-csp/: Nuxt 3 config with routeRules CSP. Includes expected-after-patch.ts showing the string splice. ## Skill docs Single append-arrays template covers Next monorepo, SvelteKit, and Nuxt-security. Single append-string template covers inline Next headers() and Nuxt routeRules. Per-framework specifics listed as sub-bullets under each shape. 54 tests across 9 fixtures, all passing. Clean fixtures (plain vite, nextjs-app, astro, sveltekit, multipage-with-generator) still classify as shape: null. Astro and Vue (non-Nuxt) left unhandled by design: Astro has no first-party CSP mechanism; Vue without Nuxt is covered by the existing Vite fixture. Plain Svelte has no framework CSP primitive and inherits from its bundler (Vite/Rollup). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
33 lines
1006 B
JavaScript
33 lines
1006 B
JavaScript
// Reference output for agent/human review — not executed by tests.
|
|
// After the append-arrays CSP patch is applied, svelte.config.js should look
|
|
// like this.
|
|
|
|
import adapter from '@sveltejs/adapter-auto';
|
|
import { vitePreprocess } from '@sveltejs/vite-plugin-svelte';
|
|
|
|
// Dev-only allowance so impeccable live mode can load. Empty array in any
|
|
// non-development environment.
|
|
const __impeccableLiveDev =
|
|
process.env.NODE_ENV === 'development' ? ['http://localhost:8400'] : [];
|
|
|
|
/** @type {import('@sveltejs/kit').Config} */
|
|
const config = {
|
|
preprocess: vitePreprocess(),
|
|
kit: {
|
|
adapter: adapter(),
|
|
csp: {
|
|
mode: 'auto',
|
|
directives: {
|
|
'default-src': ['self'],
|
|
'script-src': ['self', 'unsafe-inline', ...__impeccableLiveDev],
|
|
'style-src': ['self', 'unsafe-inline'],
|
|
'img-src': ['self', 'data:', 'blob:'],
|
|
'connect-src': ['self', ...__impeccableLiveDev],
|
|
'frame-ancestors': ['self'],
|
|
},
|
|
},
|
|
},
|
|
};
|
|
|
|
export default config;
|