fix(website): repair hyperdim gallery CSP (frame-src 'self' + 'unsafe-eval')

[POWERFULMOVES]

Problem

The homepage hologram gallery (/#gallery) rendered as solid black tiles, and the standalone /hyperdim/ viewer showed an empty/black canvas. Root-caused live with chrome-devtools-mcp (console + network) against a preview deploy.

Two independent CSP defects were hiding behind the same symptom:

1. Parent / frame-src omitted 'self' — it whitelisted only YouTube. The same-origin /hyperdim/ gallery iframes were blocked outright:
   Framing '…/hyperdim/?preset=beats_c5.json&ui=none' violates … "frame-src https://www.youtube.com …".
2. Child /hyperdim/* script-src lacked 'unsafe-eval' — the viewer compiles each preset's parametric surface.code at runtime via new Function(code + '; return surface;') (fork index.html ~L1696/L1886). Every preset threw EvalError … 'unsafe-eval' is not an allowed source → no geometry → black canvas.

#1672 correctly detached the inherited /* policy on /hyperdim/*, but the relaxed child policy was missing 'unsafe-eval', and the parent / policy was never updated to permit framing its own viewer.

Fix

website/_headers:

• /* → add 'self' to frame-src (so / can embed its own /hyperdim/ iframes).
• /hyperdim/* → add 'unsafe-eval' to script-src (so preset surfaces compile).

Blast radius

Bounded:

• Eval'd code is first-party (our own saves/*.json presets), not user input.
• The viewer frame stays locked to frame-ancestors 'self' + X-Frame-Options: SAMEORIGIN.
• The relaxed 'unsafe-eval' is scoped to /hyperdim/* only — root / keeps script-src 'self'.

Verification (live, preview deploy fix-csp-eval.pmoves-ai.pages.dev)

• ✅ Served / CSP now includes frame-src 'self' … (curl-confirmed).
• ✅ Standalone /hyperdim/?preset=beats_c5.json&ui=none — console clean of CSP errors; renders the beats_c5 toroidal constellation (screenshot).
• ✅ Homepage /#gallery — all 3 iframes load Hyperdimensional Functions (no chrome-error); each tile renders its hologram (Cluster 5 / 3 / 1).

_headers edge behavior is only testable against a live deploy, so this was validated on a non-production preview branch before opening the PR.

Follow-up (not blocking)

• The geometry sits low-left and clips inside the square gallery tiles — a camera-framing nicety in the beats_c{1,3,5}.json display.camera presets / embed aspect ratio. Cosmetic; tracked for a polish pass.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@POWERFULMOVES, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 23 minutes and 40 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 11336041-475f-4a1b-af79-12320783e26f

📥 Commits

Reviewing files that changed from the base of the PR and between 82324d9 and fcaf035.

📒 Files selected for processing (1)

• website/_headers

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/hyperdim-gallery-csp

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[POWERFULMOVES]

VERDICT: APPROVE-WITH-NITS (mergeable; non-approving review per self-approval block — gh is authed as PR author)

Control-Body merge-gate review. Single file changed (website/_headers), two CSP edits. Verified against the actual viewer source at website/hyperdim/index.html in the PR branch.

Correctness — verified

• frame-src 'self' on /*: Correct. index.html embeds /hyperdim/ as same-origin gallery iframes; without 'self' in frame-src the browser blocks the frames (CSP framing violation -> black boxes). Edit is minimal and additive; YouTube hosts preserved.
• 'unsafe-eval' on /hyperdim/*: Correct and necessary. Confirmed three new Function(...) call sites that compile preset surface code at runtime: L1717 and L1903 (new Function(code + '; return surface;')) plus L1495 (identifier validation). Without 'unsafe-eval' the surface factory throws EvalError -> solid black canvas. Comment's L1696/L1886 line refs are slightly off (actual L1717/L1903) — cosmetic nit only.
• CF Pages syntax: Valid. The /hyperdim/* block correctly uses ! X-Frame-Options / ! Content-Security-Policy to detach the stacked /* rules before re-setting the relaxed policy. This is the right mechanism — without the detach, /*'s frame-ancestors 'none' + script-src 'self' would win the intersection and the embeds would still break.

Security blast radius — acceptable

'unsafe-eval' is scoped to /hyperdim/* ONLY; root / retains script-src 'self' (no eval). I traced every input that can reach the eval path:

• ?preset= URL param (the one attacker-influenceable vector): feeds loadPresetFromFile, which is regex-guarded /^[\w-]+\.json$/ and fetches only same-origin saves/*.json. No path traversal, no remote/cross-origin fetch. Eval'd code is therefore first-party repo content. Good.
• CodeMirror editor + file upload (FileReader, L2028): both are explicit local user actions that affect only the user's own session. This is self-XSS, not a delivery vector — no way for third-party content to reach another user's eval context.
• The frame is double-locked: frame-ancestors 'self' (CSP) + X-Frame-Options: SAMEORIGIN. object-src 'none', base-uri 'self', upgrade-insecure-requests all retained.
• frame-src 'self' on /* permits same-origin framing only — not a meaningful expansion of attack surface.

No way found for untrusted/user-controlled content to reach the eval sink across a trust boundary.

CI

All required checks green (merge-gate, hardening-validation, verify, CodeRabbit, etc.). mergeStateStatus: BLOCKED is the expected signoff-gate hold, not a failing check.

Nits (non-blocking follow-ups)

1. Comment line refs ~L1696/L1886 are stale — actual sites are L1717 / L1903.
2. Optional future hardening: a Trusted Types / nonce pipeline would let you drop 'unsafe-inline'/'unsafe-eval', but that's a real refactor of the single-file toy app and out of scope here.

Recommendation: safe to merge once the multi-agent signoff checklist (AGNOTE4482_SIGNOFF_CHECKLIST.md) is satisfied. No blockers.