Two pre-existing issues surfaced by running the smoke test:
1. CSP connect-src allowed `wss:` but not `ws:`, so ALL insecure-websocket
relays were blocked — including ws://localhost (dev + local relays + the
smoke mock relay). Add `ws://localhost:* ws://127.0.0.1:*` to connect-src in
index.html and embed.html. Remote cleartext ws:// stays blocked (deliberate
security posture — flagged for product decision).
2. smoke-test.mjs published via Promise.any(relays.map(url => pool.publish([url],
evt))). SimplePool.publish returns an ARRAY of per-relay promises, so this
Promise.any'd arrays-of-arrays — resolving on the array object immediately
without awaiting the publish and swallowing errors. Fixed to await
pool.publish(relays, evt) via Promise.allSettled and surface per-relay
results.
Smoke test now passes (publish -> relay verify). CSP policy test green; build green.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Defense-in-depth against XSS for a client that holds storage credentials in
memory. The critical directive is a strict script-src: 'self' + the hash of the
inline theme-bootstrap + the nostr-tools CDN fallbacks, with no 'unsafe-inline'
or 'unsafe-eval' (verified no bundle uses eval/Function/wasm). This blocks
injected script/object elements, inline handlers, and base-tag hijack, so an
injected payload cannot run and read the in-memory storage master key, the
signer, or DM plaintext. connect/img/media stay broad because relays, R2/S3
endpoints, and video/thumbnail URLs are user/content defined; worker-src allows
blob: for the WebTorrent module worker. Applied to index.html and embed.html.
Test (tests/csp-policy.test.mjs) locks the inline-script hash to script-src and
asserts script-src stays strict (no unsafe-inline/eval) with object-src 'none'
and base-uri 'self'.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
- Moved `<!-- VERSION_INFO -->` out of `.fade-in` container in `index.html` to prevent visibility issues if JS fails.
- Added verification in `scripts/build-dist.mjs` to ensure `dist/components` exists and is not empty.
- Added logging to `scripts/build-dist.mjs` for version injection status.
- Updated `scripts/verify-dist-deploy-artifact.mjs` regex to accommodate HTML structure change.
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaced the fragile regex-based version injection in `scripts/build-dist.mjs` with a robust placeholder method.
- Added `<!-- VERSION_INFO -->` placeholder to `index.html`.
- Updated `scripts/build-dist.mjs` to target the placeholder, while retaining regex fallback for safety.
- Ensures version info is reliably injected during local builds regardless of code formatting.
Co-authored-by: PR0M3TH3AN <[email protected]>
The documentation system relied on external CDNs for `marked` and `highlight.js`. This caused content loading failures ("Error loading content") when CDNs were blocked or unreachable.
This change:
- Adds `marked` and `highlight.js` to `package.json` dependencies.
- Vendors `marked.min.js` (from UMD build) and `highlight.min.js` (downloaded) into `vendor/`.
- Updates `index.html` to load these libraries from local `vendor/` path instead of CDN.
Verified with Playwright script ensuring docs content loads successfully.
Co-authored-by: PR0M3TH3AN <[email protected]>
Moves the sidebar density and toggle initialization logic in `js/index.js` to execute immediately after `loadSidebar` completes, rather than waiting for `applicationReadyPromise`. This resolves a race condition where the sidebar toggle was unresponsive during application startup (e.g. relay connection), causing `overlay-layers.spec.ts` to timeout.
Also updates the visual baseline for `video-modal-mobile` in `kitchen-sink.spec.ts` to match current rendering (height change), addressing the reported visual regression failure.
Verified with reproduction script and running visual tests locally.
Moves the `#mobileSearchContainer` from the bottom-right corner to the top of the viewport (`top-4`). This ensures that the search input remains visible when the virtual keyboard is active on mobile devices, preventing it from being covered.
- Updated `index.html` to change classes from `bottom-6 right-6 origin-bottom-right` to `top-4 left-4 right-4 origin-top`.
- Removed `w-[calc(...)]` in favor of `left-4 right-4` for simpler full-width behavior with margins.
- Ran `npm run build:css` to update generated CSS.
Run `npm run format` and `npm run lint`.
Fix stylelint configuration to correctly parse variables with units in their names.
Migrate raw CSS measurements to tokens in `css/tokens.css` and update usages in `css/tailwind.source.css` and HTML templates.
Improve `scripts/check-design-tokens.mjs` to handle variable names with unit-like suffixes.
Files changed:
- css/tailwind.source.css (formatted and fixed lint)
- css/tokens.css (added tokens)
- stylelint.config.cjs (fixed regex)
- scripts/check-design-tokens.mjs (improved detection logic)
- components/profile-modal.html (fixed arbitrary values)
- index.html (fixed arbitrary values)
Updates the mobile search FAB (#mobileSearchFab) to use `bg-accent-strong` instead of `bg-critical`.
This ensures the icon color matches the "Upload Video" button, respecting the active theme override (which sets the accent color to red).
Verified visually using a Playwright script and screenshot validation.
Verified by running `npm run build:css` and `npm run test:unit`.
Adds a Floating Action Button (FAB) for search on mobile devices, which expands into a full search bar upon interaction.
- Updates `index.html` to include the FAB and search container.
- Updates `js/index.js` to handle toggle logic and search submission.
- Uses `bg-critical` for the FAB to meet the "Red Circle" requirement.
- Hides the new elements on desktop to maintain existing behavior.
