name	boss-frontend-analysis
description	Capture, archive, diff, and assess Boss/Zhipin frontend JavaScript for boss-cli safety gates and anti-debug guard updates. Use when Codex needs to re-analyze current Boss frontend scripts, compare online JS with docs/research/boss-online-js baselines, update boss_availability, or recommend code changes after Boss changes zhipin-boss, zhipin-sign, risk-detection, remoteEntry, or security scripts.

Boss Frontend Analysis

Use this skill when Boss online frontend assets changed and boss-cli must decide whether to stay disabled, update the verified baseline, or change page guards.

Workflow

Run the capture script from the repository root:

node skills/boss-frontend-analysis/scripts/capture_boss_frontend.mjs

Read the generated files under docs/research/boss-online-js/<date>/:

manifest.json: captured URLs, final URLs, byte sizes, SHA-256 hashes, and source category.
analysis.md: version changes, high-risk script notes, and code-change recommendations.
raw/: unmodified script bodies for diffing.

Compare against the previous verified baseline, usually the latest dated folder under docs/research/boss-online-js/.
Inspect these repo files before recommending or changing code:

src/common/boss_availability.ts
src/common/boss_page_guards.ts
docs/anti-detection.md
docs/browser-session.md

Keep the policy strict:

Do not add fallback or bypass switches for availability checks.
If online entry pages reference unverified Boss JS versions, boss-cli must remain disabled.
Only update boss_availability.ts after raw scripts are archived and the risk strategy has been reviewed.
Puppeteer page.evaluate / page.waitForFunction additions must use string scripts, not callback functions.

Analysis Checklist

Chat entry page: identify current zhipin-boss/index/v*/static/js/app.js, polyfill.js, and risk-detection.js.
Remote bundle: identify current zhipin-boss/bundle/v*/static/remoteEntry.js and downloaded chunks.
Sign/login page: identify zhipin-sign/v*/static/js/app.*.js, iframe-core.*.js, and vendors~app.*.js.
Security scripts: note zhipin-security, browser-check, Warlock, APM, MQTT, and reporting SDK version changes.
Risk detector: search for codes such as 99001, 99002, 99004, 99005, srcdoc, MutationObserver, isTrusted, sendAction, and security redirects.
Sign vendor anti-debug: search for debugger, Function(, constructor, setInterval, console, devtools, and obfuscated modules around those hits.
Guard coverage: verify request-blocking patterns in boss_page_guards.ts still cover risk scripts and security redirects.

Output Guidance

When reporting results, include:

Current online versions and whether they match the verified baseline.
Whether boss-cli should remain disabled.
Exact files or constants that need updates.
Any selectors, request patterns, or script guards that changed.
Build and runtime checks performed.

Boss Frontend Analysis

Use this skill when Boss online frontend assets changed and boss-cli must decide whether to stay disabled, update the verified baseline, or change page guards.

Workflow

Run the capture script from the repository root:

node skills/boss-frontend-analysis/scripts/capture_boss_frontend.mjs

Read the generated files under docs/research/boss-online-js/<date>/:

manifest.json: captured URLs, final URLs, byte sizes, SHA-256 hashes, and source category.

analysis.md: version changes, high-risk script notes, and code-change recommendations.

raw/: unmodified script bodies for diffing.

Compare against the previous verified baseline, usually the latest dated folder under docs/research/boss-online-js/.

Inspect these repo files before recommending or changing code:

src/common/boss_availability.ts

src/common/boss_page_guards.ts

docs/anti-detection.md

docs/browser-session.md

Keep the policy strict:

Do not add fallback or bypass switches for availability checks.

If online entry pages reference unverified Boss JS versions, boss-cli must remain disabled.

Only update boss_availability.ts after raw scripts are archived and the risk strategy has been reviewed.

Puppeteer page.evaluate / page.waitForFunction additions must use string scripts, not callback functions.

Analysis Checklist

Chat entry page: identify current zhipin-boss/index/v*/static/js/app.js, polyfill.js, and risk-detection.js.

Remote bundle: identify current zhipin-boss/bundle/v*/static/remoteEntry.js and downloaded chunks.

Sign/login page: identify zhipin-sign/v*/static/js/app.*.js, iframe-core.*.js, and vendors~app.*.js.

Security scripts: note zhipin-security, browser-check, Warlock, APM, MQTT, and reporting SDK version changes.

Risk detector: search for codes such as 99001, 99002, 99004, 99005, srcdoc, MutationObserver, isTrusted, sendAction, and security redirects.

Sign vendor anti-debug: search for debugger, Function(, constructor, setInterval, console, devtools, and obfuscated modules around those hits.

Guard coverage: verify request-blocking patterns in boss_page_guards.ts still cover risk scripts and security redirects.

Output Guidance

When reporting results, include:

Current online versions and whether they match the verified baseline.

Whether boss-cli should remain disabled.

Exact files or constants that need updates.

Any selectors, request patterns, or script guards that changed.

Build and runtime checks performed.