[pull] main from aidenybai:main

packages/cli/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @react-grab/cli
 
+## 0.2.0
+
+### Minor Changes
+
+- f350003: Remove the Style action and panel, including its keyboard shortcuts, inline previews, CSS property controls, design-token handling, and edit-related action context and renderer types. Simplify the toolbar to its Copy control while keeping Comment available through the context menu and action menu.
+
 ## 0.1.50
 
 ## 0.1.49

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@react-grab/cli",
-  "version": "0.1.50",
+  "version": "0.2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/aidenybai/react-grab.git"

packages/grab/CHANGELOG.md

@@ -1,5 +1,16 @@
 # grab
 
+## 0.2.0
+
+### Minor Changes
+
+- f350003: Remove the Style action and panel, including its keyboard shortcuts, inline previews, CSS property controls, design-token handling, and edit-related action context and renderer types. Simplify the toolbar to its Copy control while keeping Comment available through the context menu and action menu.
+
+### Patch Changes
+
+- Updated dependencies [f350003]
+  - @react-grab/cli@0.2.0
+
 ## 0.1.50
 
 ### Patch Changes

packages/grab/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grab",
-  "version": "0.1.50",
+  "version": "0.2.0",
   "description": "Select context for coding agents directly from your website",
   "keywords": [
     "agent",

packages/react-grab/CHANGELOG.md

@@ -1,5 +1,17 @@
 # react-grab
 
+## 0.2.0
+
+### Minor Changes
+
+- f350003: Remove the Style action and panel, including its keyboard shortcuts, inline previews, CSS property controls, design-token handling, and edit-related action context and renderer types. Simplify the toolbar to its Copy control while keeping Comment available through the context menu and action menu.
+
+### Patch Changes
+
+- 4dbdee5: Improve copied element context and labels with stable semantic selectors, authored component names, nearest-source resolution, race-safe refresh-aware source caching, bounded previews and keys, nested control labels, consistent trace budgets, and lossless multi-element selection.
+- Updated dependencies [f350003]
+  - @react-grab/cli@0.2.0
+
 ## 0.1.50
 
 ### Patch Changes

packages/react-grab/e2e/csp.spec.ts

@@ -0,0 +1,46 @@
+import { expect, test } from "./fixtures.js";
+
+const STRICT_STYLE_POLICY = "style-src 'self' 'unsafe-inline'";
+const GOOGLE_FONTS_STYLESHEET_HOST = "fonts.googleapis.com";
+
+test("does not load an external font stylesheet under a strict style CSP", async ({
+  reactGrab,
+}) => {
+  const cspViolations: string[] = [];
+
+  reactGrab.page.on("console", (message) => {
+    if (
+      message.type() === "error" &&
+      message.text().includes("Content Security Policy") &&
+      message.text().includes(GOOGLE_FONTS_STYLESHEET_HOST)
+    ) {
+      cspViolations.push(message.text());
+    }
+  });
+
+  await reactGrab.page.route("**/*", async (route) => {
+    if (route.request().resourceType() !== "document") {
+      await route.continue();
+      return;
+    }
+
+    const response = await route.fetch();
+    await route.fulfill({
+      response,
+      headers: {
+        ...response.headers(),
+        "content-security-policy": STRICT_STYLE_POLICY,
+      },
+    });
+  });
+
+  await reactGrab.page.reload({ waitUntil: "domcontentloaded" });
+  await expect.poll(() => reactGrab.getOverlayHost().count()).toBe(1);
+
+  const overlayStyles = await reactGrab.getOverlayHost().evaluate((host) => {
+    return host.shadowRoot?.querySelector("style")?.textContent ?? "";
+  });
+
+  expect(overlayStyles).not.toContain(GOOGLE_FONTS_STYLESHEET_HOST);
+  expect(cspViolations).toEqual([]);
+});

packages/react-grab/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-grab",
-  "version": "0.1.50",
+  "version": "0.2.0",
   "description": "Select context for coding agents directly from your website",
   "keywords": [
     "agent",

packages/react-grab/src/utils/mount-root.ts

@@ -3,9 +3,6 @@ import { detectCspNonce } from "./detect-csp-nonce.js";
 import { hideFromThirdParties } from "./hide-from-third-parties.js";
 import { REACT_GRAB_ATTRIBUTE_NAME } from "./react-grab-attribute-name.js";
 
-const FONT_IMPORT =
-  '@import url("https://fonts.googleapis.com/css2?family=Geist:wght@500&display=swap");';
-
 // Mounting into <body> (not <html>) keeps React hydration happy: appending a
 // <div> directly to <html> throws "In HTML, <div> cannot be a child of <html>"
 // during hydration (see vercel/next.js#51242), which surfaces in Next.js's dev
@@ -93,7 +90,7 @@ export const mountRoot = (cssText?: string): MountRootResult => {
   const styleElement = document.createElement("style");
   const nonce = detectCspNonce();
   if (nonce) styleElement.nonce = nonce;
-  styleElement.textContent = `${FONT_IMPORT}\n${cssText ?? ""}`;
+  styleElement.textContent = cssText ?? "";
   shadowRoot.appendChild(styleElement);
 
   const root = document.createElement("div");