diff --git a/internal/middleware/security.go b/internal/middleware/security.go
index 2c320d7..08c43ce 100644
--- a/internal/middleware/security.go
+++ b/internal/middleware/security.go
@@ -10,14 +10,14 @@ func SecurityHeaders() gin.HandlerFunc {
return func(c *gin.Context) {
// Content-Security-Policy
// script-src: 本站 + esm.sh CDN (CodeMirror 6 ESM 模块)
- // connect-src: 本站 (Markdown 预览等 fetch 请求)
+ // connect-src: 本站 + esm.sh (source map 请求)
// img-src: 本站 + data: URI (头像裁切) + blob: (粘贴图片)
c.Header("Content-Security-Policy",
"default-src 'self'; "+
"script-src 'self' 'unsafe-inline' https://esm.sh; "+
"style-src 'self' 'unsafe-inline'; "+
"img-src 'self' data: blob:; "+
- "connect-src 'self'")
+ "connect-src 'self' https://esm.sh")
// 禁止 MIME 类型嗅探
c.Header("X-Content-Type-Options", "nosniff")
diff --git a/templates/MetaLab-2026/html/posts/new.html b/templates/MetaLab-2026/html/posts/new.html
index 15a47d8..8d8e981 100644
--- a/templates/MetaLab-2026/html/posts/new.html
+++ b/templates/MetaLab-2026/html/posts/new.html
@@ -124,6 +124,27 @@
{{template "layout/footer.html" .}}
-{{/* CodeMirror 6 (MIT License, via esm.sh bundle) */}}
+{{/* CodeMirror 6 importmap — 所有 @codemirror/@lezer 指向 esm.sh 同一构建树,共享依赖单例 */}}
+
diff --git a/templates/MetaLab-2026/static/js/editor.js b/templates/MetaLab-2026/static/js/editor.js
index eb22388..7aceff1 100644
--- a/templates/MetaLab-2026/static/js/editor.js
+++ b/templates/MetaLab-2026/static/js/editor.js
@@ -1,28 +1,17 @@
/**
* MetaLab Markdown Editor — CodeMirror 6 版
*
- * 功能:
- * - CodeMirror 6 编辑器,Markdown 语法高亮
- * - 工具栏:加粗/斜体/删除线/行内代码/标题/链接/图片/引用/代码块/列表/表格/分割线
- * - 快捷键:Ctrl+B/I/K/` Shift+I Tab Shift+Tab Ctrl+S Ctrl+Shift+P F11
- * - 粘贴图片 / 拖拽上传 / 进度反馈
- * - 分屏实时预览(Ctrl+Shift+P 切换)
- * - 代码块语言下拉选择器
- * - 自动保存草稿(localStorage + 后端)
- * - 字数/行数/阅读时间统计
- * - 全屏编辑模式(F11)
- * - 滚动同步(分屏模式下)
- *
- * CodeMirror 6 通过 esm.sh bundle 加载,所有依赖自动解析。
+ * 依赖通过 importmap 指向 esm.sh,所有 @codemirror/@lezer 共享同一构建树,
+ * 避免多实例导致的 "Unrecognized extension value" 错误。
*/
-import { EditorState } from 'https://esm.sh/@codemirror/state@6.5.2';
-import { EditorView, keymap, lineNumbers, highlightActiveLine, drawSelection } from 'https://esm.sh/@codemirror/view@6.36.4';
-import { defaultKeymap, history, historyKeymap, indentWithTab } from 'https://esm.sh/@codemirror/commands@6.8.1';
-import { markdown, markdownLanguage } from 'https://esm.sh/@codemirror/lang-markdown@6.3.2';
-import { languages } from 'https://esm.sh/@codemirror/language-data@6.5.1';
-import { syntaxHighlighting, defaultHighlightStyle } from 'https://esm.sh/@codemirror/language@6.11.0';
-import { searchKeymap } from 'https://esm.sh/@codemirror/search@6.5.10';
-import { autocompletion } from 'https://esm.sh/@codemirror/autocomplete@6.18.6';
+import { EditorState } from '@codemirror/state';
+import { EditorView, keymap, lineNumbers, highlightActiveLine, drawSelection } from '@codemirror/view';
+import { defaultKeymap, history, historyKeymap, indentWithTab } from '@codemirror/commands';
+import { markdown, markdownLanguage } from '@codemirror/lang-markdown';
+import { languages } from '@codemirror/language-data';
+import { syntaxHighlighting, defaultHighlightStyle } from '@codemirror/language';
+import { searchKeymap } from '@codemirror/search';
+import { autocompletion } from '@codemirror/autocomplete';
/* ================================================================
DOM 引用