1.18更新

core/iframe-messaging.js

@@ -0,0 +1,27 @@
+export function getTrustedOrigin() {
+    return window.location.origin;
+}
+
+export function getIframeTargetOrigin(iframe) {
+    const sandbox = iframe?.getAttribute?.('sandbox') || '';
+    if (sandbox && !sandbox.includes('allow-same-origin')) return 'null';
+    return getTrustedOrigin();
+}
+
+export function postToIframe(iframe, payload, source, targetOrigin = null) {
+    if (!iframe?.contentWindow) return false;
+    const message = source ? { source, ...payload } : payload;
+    const origin = targetOrigin || getTrustedOrigin();
+    iframe.contentWindow.postMessage(message, origin);
+    return true;
+}
+
+export function isTrustedIframeEvent(event, iframe) {
+    return !!iframe && event.origin === getTrustedOrigin() && event.source === iframe.contentWindow;
+}
+
+export function isTrustedMessage(event, iframe, expectedSource) {
+    if (!isTrustedIframeEvent(event, iframe)) return false;
+    if (expectedSource && event?.data?.source !== expectedSource) return false;
+    return true;
+}

core/server-storage.js

@@ -81,7 +81,7 @@ class StorageFile {
         // 🔧 核心修复：非静默模式等待当前保存完成
         if (this._saving) {
             this._pendingSave = true;
-            
+
             if (!silent) {
                 await this._waitForSaveComplete();
                 if (this._dirtyVersion > this._savedVersion) {
@@ -89,7 +89,7 @@ class StorageFile {
                 }
                 return this._dirtyVersion === this._savedVersion;
             }
-            
+
             return true;
         }
 
@@ -181,3 +181,5 @@ class StorageFile {
 export const TasksStorage = new StorageFile('LittleWhiteBox_Tasks.json');
 export const StoryOutlineStorage = new StorageFile('LittleWhiteBox_StoryOutline.json');
 export const NovelDrawStorage = new StorageFile('LittleWhiteBox_NovelDraw.json', { debounceMs: 800 });
+export const TtsStorage = new StorageFile('LittleWhiteBox_TTS.json', { debounceMs: 800 });
+export const CommonSettingStorage = new StorageFile('LittleWhiteBox_CommonSettings.json', { debounceMs: 1000 });

core/wrapper-inline.js

@@ -8,6 +8,31 @@
 export function getIframeBaseScript() {
     return `
 (function(){
+  // vh 修复：CSS注入（立即生效） + 延迟样式表遍历（不阻塞渲染）
+  (function(){
+    var s=document.createElement('style');
+    s.textContent='html,body{height:auto!important;min-height:0!important;max-height:none!important}';
+    (document.head||document.documentElement).appendChild(s);
+    // 延迟遍历样式表，不阻塞初次渲染
+    (window.requestIdleCallback||function(cb){setTimeout(cb,50)})(function(){
+      try{
+        for(var i=0,sheets=document.styleSheets;i<sheets.length;i++){
+          try{
+            var rules=sheets[i].cssRules;
+            if(!rules)continue;
+            for(var j=0;j<rules.length;j++){
+              var st=rules[j].style;
+              if(!st)continue;
+              if((st.height||'').indexOf('vh')>-1)st.height='auto';
+              if((st.minHeight||'').indexOf('vh')>-1)st.minHeight='0';
+              if((st.maxHeight||'').indexOf('vh')>-1)st.maxHeight='none';
+            }
+          }catch(e){}
+        }
+      }catch(e){}
+    });
+  })();
+
   function measureVisibleHeight(){
     try{
       var doc=document,target=doc.body;
@@ -40,7 +65,8 @@ export function getIframeBaseScript() {
     }
   }
 
-  function post(m){try{parent.postMessage(m,'*')}catch(e){}}
+  var parentOrigin;try{parentOrigin=new URL(document.referrer).origin}catch(_){parentOrigin='*'}
+  function post(m){try{parent.postMessage(m,parentOrigin)}catch(e){}}
   var rafPending=false,lastH=0,HYSTERESIS=2;
 
   function send(force){
@@ -88,6 +114,7 @@ export function getIframeBaseScript() {
   }
 
   window.addEventListener('message',function(e){
+    if(parentOrigin!=='*'&&e&&e.origin!==parentOrigin)return;
     var d=e&&e.data||{};
     if(d&&d.type==='probe')setTimeout(function(){send(true)},10);
   });
@@ -99,6 +126,7 @@ export function getIframeBaseScript() {
         if(command[0]!=='/')command='/'+command;
         var id=Date.now().toString(36)+Math.random().toString(36).slice(2);
         function onMessage(e){
+          if(parentOrigin!=='*'&&e&&e.origin!==parentOrigin)return;
           var d=e&&e.data||{};
           if(d.source!=='xiaobaix-host')return;
           if((d.type==='commandResult'||d.type==='commandError')&&d.id===id){
@@ -156,10 +184,12 @@ export function getWrapperScript() {
   function CallGenerateImpl(options){
     return new Promise(function(resolve,reject){
       try{
-        function post(m){try{parent.postMessage(m,'*')}catch(e){}}
+        var parentOrigin;try{parentOrigin=new URL(document.referrer).origin}catch(_){parentOrigin='*'}
+        function post(m){try{parent.postMessage(m,parentOrigin)}catch(e){}}
         if(!options||typeof options!=='object'){reject(new Error('Invalid options'));return}
         var id=Date.now().toString(36)+Math.random().toString(36).slice(2);
         function onMessage(e){
+          if(parentOrigin!=='*'&&e&&e.origin!==parentOrigin)return;
           var d=e&&e.data||{};
           if(d.source!=='xiaobaix-host'||d.id!==id)return;
           if(d.type==='generateStreamStart'&&options.streaming&&options.streaming.onStart){try{options.streaming.onStart(d.sessionId)}catch(_){}}
@@ -196,8 +226,10 @@ export function getWrapperScript() {
       }
     }catch(_){}
   }
-  function requestAvatars(){try{parent.postMessage({type:'getAvatars'},'*')}catch(_){}}
+  var parentOrigin;try{parentOrigin=new URL(document.referrer).origin}catch(_){parentOrigin='*'}
+  function requestAvatars(){try{parent.postMessage({type:'getAvatars'},parentOrigin)}catch(_){}}
   function onMessage(e){
+    if(parentOrigin!=='*'&&e&&e.origin!==parentOrigin)return;
     var d=e&&e.data||{};
     if(d&&d.source==='xiaobaix-host'&&d.type==='avatars'){
       applyAvatarCss(d.urls);
@@ -237,4 +269,4 @@ export function getTemplateExtrasScript() {
     };
   }
 })();`;
-}
+}