✨ 增加 CSP 规则管理

AGENTS.md

@@ -37,6 +37,10 @@ This file provides guidance to AI coding agents (Claude Code, etc.) when working
 
 > **Doc map:** [`docs/README.md`](docs/README.md) indexes every contributor doc (development, architecture,
 > translation, contributing, localized READMEs).
+>
+> **Feature specifications:** [`docs/specs/csp-rule-management.md`](docs/specs/csp-rule-management.md)
+> owns the planned CSP rule-management product, UX, technical, and acceptance contract. Read it before
+> implementing or reviewing that feature; it is target behavior, not a claim that the feature is shipped.
 
 ## Project Overview
 

docs/DOC-MAINTENANCE.md

@@ -94,6 +94,7 @@ of sanitization patterns can otherwise look like matches — so don't rely on a
 | [`design.md`](./design.md) | The design system: theme mechanism, shadcn component selection, new-page recipe; tokens split to [`references/design-tokens.md`](./references/design-tokens.md), component palette to [`references/design-components.md`](./references/design-components.md), layout/motion/state/a11y patterns to [`references/design-patterns.md`](./references/design-patterns.md). |
 | [`verification.md`](./verification.md) | Lightweight end-to-end functional verification — throwaway scratch scripts driving the real built extension; report template split to [`references/verification-report-template.md`](./references/verification-report-template.md), debugging FAQ to [`references/verification-debugging.md`](./references/verification-debugging.md). |
 | [`architecture.md`](./architecture.md) | Deep internals: process model, message passing; subsystem deep-dives split to [`references/architecture-services.md`](./references/architecture-services.md), [`references/architecture-data.md`](./references/architecture-data.md), [`references/architecture-gm-api.md`](./references/architecture-gm-api.md), [`references/architecture-execution.md`](./references/architecture-execution.md), [`references/architecture-build.md`](./references/architecture-build.md), [`references/architecture-agent.md`](./references/architecture-agent.md). |
+| [`specs/csp-rule-management.md`](./specs/csp-rule-management.md) | Planned CSP rule-management product, UX, technical, acceptance, and decision contract; implementation mechanics stay in `develop.md`. |
 | [`cloud-sync.md`](./cloud-sync.md) | Cloud sync internals: sync files, digest/status semantics, provider differences, error classification, retry policy. |
 | [`translation.md`](./translation.md) | Translation / localization single source of truth. |
 | [`DOC-MAINTENANCE.md`](./DOC-MAINTENANCE.md) | This guide: doc-set organization rules, fact-check / anti-drift discipline, and policy-consistency checks — for every tracked agent/contributor Markdown file, not just `AGENTS.md` + `docs/*`. |

docs/README.md

@@ -12,6 +12,7 @@
 | [`design.md`](./design.md) | 设计系统参考:主题机制、shadcn 组件选型、新建页面配方总览;令牌完整值拆到 [`references/design-tokens.md`](./references/design-tokens.md),组件清单拆到 [`references/design-components.md`](./references/design-components.md),布局/响应式/动效/状态/无障碍范式拆到 [`references/design-patterns.md`](./references/design-patterns.md)。**做页面/对话框/区块前先读。** |
 | [`verification.md`](./verification.md) | 功能验证指南:用一次性 scratch 脚本驱动真实扩展做端到端验证(不跑全量 E2E、不加永久用例);报告模板拆到 [`references/verification-report-template.md`](./references/verification-report-template.md),调试 FAQ 拆到 [`references/verification-debugging.md`](./references/verification-debugging.md)。**验证改动是否真正跑通时读。** |
 | [`architecture.md`](./architecture.md) | 内部原理总览:多进程模型、消息传递;各子系统深入拆到 [`references/architecture-services.md`](./references/architecture-services.md)(服务层)、[`references/architecture-data.md`](./references/architecture-data.md)(数据层)、[`references/architecture-gm-api.md`](./references/architecture-gm-api.md)(GM API)、[`references/architecture-execution.md`](./references/architecture-execution.md)(脚本执行)、[`references/architecture-build.md`](./references/architecture-build.md)(构建管线)、[`references/architecture-agent.md`](./references/architecture-agent.md)(Agent 子系统)。 |
+| [`specs/csp-rule-management.md`](./specs/csp-rule-management.md) | CSP 规则管理目标规格:讨论取舍、产品边界、目标 UI/UX 交互、域名语义、DNR 技术合同、验收与实施顺序。**实现前先读。** |
 | [`cloud-sync.md`](./cloud-sync.md) | 云同步实现说明:同步文件语义、主流程、状态合并、provider 差异、错误分类、retry 策略和维护注意事项。 |
 | [`DOC-MAINTENANCE.md`](./DOC-MAINTENANCE.md) | 文档维护与事实核对指南:组织规则、逐条核对清单、跨文档政策一致性核对、隐私清理、以及在 resolved final tree 上的复核方法,覆盖全部 tracked 的 agent/contributor Markdown(不止 `AGENTS.md` + `docs/*`,还包括 `.github/*.md`、package-local README)。**改/审文档前先读。** |
 

docs/develop.md

@@ -4,7 +4,10 @@
 > principles (SOLID / high cohesion & low coupling, TDD/BDD-first, root-cause fixes, scope discipline) and the
 > architecture quick-map — those are **not** repeated here. This file is the concrete development spec: the
 > commands, structure, coding style, UI/theme rules, testing mechanics, i18n, and commit/PR workflow you follow
-> while implementing. For deep internals see [`docs/architecture.md`](./architecture.md).
+> while implementing. For deep internals see [`docs/architecture.md`](./architecture.md). Feature-specific
+> target behavior stays in its owning spec; read that spec before implementation and do not infer shipped
+> behavior from a target-only document. CSP rule management is defined in
+> [`specs/csp-rule-management.md`](./specs/csp-rule-management.md).
 
 ## Commands
 

docs/references/architecture-build.md

@@ -51,6 +51,7 @@ dist/ext/
 - `permissions` include `userScripts`, `declarativeNetRequest`, `offscreen`, `scripting`, `cookies`,
   `webRequest`, `unlimitedStorage`, …; `optional_permissions` hold `background` + `userScripts`.
 - `host_permissions: ["<all_urls>"]`, `incognito: "split"`.
+- CSP rule state is owned only by the regular service worker; the incognito service worker does not register CSP rule handlers.
 - `sandbox.pages` declares `src/sandbox.html`; `web_accessible_resources` exposes `install.html` so a
   `.user.js` page can hand off to the install flow.