refactor(tmwebdriver): remove legacy DOM bridge and guard HTTP origin

.gitignore

@@ -123,8 +123,6 @@ memory/L4_raw_sessions/*
 restore_commit.txt
 
 sche_tasks/
-# CDP Bridge 密钥配置（首次运行自动生成）
-assets/tmwd_cdp_bridge/config.js
 assets/copilot_proxy.pyw
 # 模型 instruction（本地定制，不入库）
 assets/glm52_instruction.txt

TMWebDriver.py

@@ -52,6 +52,8 @@ class TMWebDriver:
 
     def start_http_server(self):
         self.app = app = bottle.Bottle()
+        @app.hook('before_request')
+        def reject_web_origin(): request.headers.get('Origin') is not None and bottle.abort(403)
 
         @app.route('/api/longpoll', method=['GET', 'POST'])
         def long_poll():

agentmain.py

@@ -31,12 +31,6 @@ mem_insight = os.path.join(mem_dir, 'global_mem_insight.txt')
 if not os.path.exists(mem_insight):
     t = os.path.join(script_dir, f'assets/global_mem_insight_template{lang_suffix}.txt')
     open(mem_insight, 'w', encoding='utf-8').write(open(t, encoding='utf-8').read() if os.path.exists(t) else '')
-cdp_cfg = os.path.join(script_dir, 'assets/tmwd_cdp_bridge/config.js')
-if not os.path.exists(cdp_cfg):
-    try:
-        os.makedirs(os.path.dirname(cdp_cfg), exist_ok=True)
-        open(cdp_cfg, 'w', encoding='utf-8').write(f"const TID = '__ljq_{hex(random.randint(0, 99999999))[2:8]}';")
-    except Exception as e: print(f'[WARN] CDP config init failed: {e} — advanced web features (tmwebdriver) will be unavailable.')
 
 def get_system_prompt():
     with open(os.path.join(script_dir, f'assets/sys_prompt{lang_suffix}.txt'), 'r', encoding='utf-8') as f: prompt = f.read()

assets/tmwd_cdp_bridge/content.js

@@ -14,34 +14,4 @@ document.querySelectorAll('meta[http-equiv="Content-Security-Policy"]').forEach(
   (document.body||document.documentElement).appendChild(d);
 })();
 
-new MutationObserver(muts => {
-  for (const m of muts) for (const n of m.addedNodes) {
-    if (n.id === TID || (n.querySelector && n.querySelector('#' + TID))) {
-      const el = n.id === TID ? n : n.querySelector('#' + TID);
-      handle(el);
-    }
-  }
-}).observe(document.documentElement, { childList: true, subtree: true });
-
-async function handle(el) {
-  try {
-    const req = el.textContent.trim() ? JSON.parse(el.textContent) : { cmd: 'cookies' };
-    const cmd = req.cmd || 'cookies';
-    let resp;
-    if (cmd === 'cookies') {
-      resp = await chrome.runtime.sendMessage({ cmd: 'cookies', url: req.url || location.href });
-    } else if (cmd === 'cdp') {
-      resp = await chrome.runtime.sendMessage({ cmd: 'cdp', method: req.method, params: req.params || {}, tabId: req.tabId });
-    } else if (cmd === 'batch') {
-      resp = await chrome.runtime.sendMessage({ cmd: 'batch', commands: req.commands, tabId: req.tabId });
-    } else if (cmd === 'tabs') {
-      resp = await chrome.runtime.sendMessage({ cmd: 'tabs', method: req.method, tabId: req.tabId, url: req.url, active: req.active, index: req.index, windowId: req.windowId, openerTabId: req.openerTabId });
-    } else {
-      resp = { ok: false, error: 'unknown cmd: ' + cmd };
-    }
-    el.textContent = JSON.stringify(resp);
-  } catch (e) {
-    el.textContent = JSON.stringify({ ok: false, error: e.message });
-  }
-}
 })();

assets/tmwd_cdp_bridge/manifest.json

@@ -28,7 +28,7 @@
     },
     {
       "matches": ["<all_urls>"],
-      "js": ["config.js", "content.js"],
+      "js": ["content.js"],
       "run_at": "document_idle",
       "all_frames": true
     }

memory/tmwebdriver_sop.md

@@ -43,7 +43,6 @@ fetch('PDF_URL').then(r=>r.blob()).then(b=>{
 
 ## CDP桥(tmwd_cdp_bridge扩展) ⭐首选
 扩展路径：`assets/tmwd_cdp_bridge/`(需安装，含debugger权限)
-⚠TID约定标识：首次运行自动生成到`assets/tmwd_cdp_bridge/config.js`(已gitignore)，扩展通过manifest引用
 调用：`web_execute_js` script直传JSON字符串（工具层自动识别对象格式，走WS→background.js cmd路由）
 ```js
 // 直接传JSON字符串作为script参数，无需DOM操作
@@ -53,7 +52,7 @@ web_execute_js script='{"cmd": "cdp", "tabId": N, "method": "...", "params": {..
 web_execute_js script='{"cmd": "batch", "commands": [...]}'
 // 返回值直接是JSON结果
 ```
-通信方式：⭐JSON字符串直传(首选) | TID DOM方式(TID元素+MutationObserver，web_scan/execute_js底层依赖)
+通信方式：JSON字符串经WS直传background.js；不经过页面DOM
 单命令：`{cmd:'tabs'}` | `{cmd:'cookies'}` | `{cmd:'cdp', tabId:N, method:'...', params:{...}}` | `{cmd:'management', method:'list|reload|disable|enable', extId:'...'}`
 - management：list返回所有扩展信息；reload/disable/enable需传extId
 - contentSettings：`{cmd:'contentSettings', type:'automaticDownloads', pattern:'https://*/*', setting:'allow'}`