From fcaf03597d0f79e04e568d77140e3baf0fefe3b7 Mon Sep 17 00:00:00 2001
From: POWERFULMOVES <142271328+POWERFULMOVES@users.noreply.github.com>
Date: Mon, 1 Jun 2026 20:18:46 -0400
Subject: [PATCH] fix(website): repair hyperdim gallery CSP (frame-src 'self' +
 'unsafe-eval')
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The homepage hologram gallery rendered as solid black tiles. Two independent
CSP defects, both root-caused live via chrome-devtools:

1. Parent / `frame-src` whitelisted only YouTube, omitting 'self', so the
   same-origin /hyperdim/ gallery iframes were blocked outright
   ("Framing ... violates ... frame-src"). Add 'self' to /* frame-src.

2. Child /hyperdim/* `script-src` allowed 'unsafe-inline' but not 'unsafe-eval',
   while the viewer compiles each preset's parametric surface.code at runtime
   via new Function(code + '; return surface;') (fork index.html ~L1696/L1886).
   Every preset threw "EvalError ... 'unsafe-eval' is not an allowed source"
   and the canvas stayed black. Add 'unsafe-eval' to /hyperdim/* script-src.

Blast radius is bounded: eval'd code is first-party (our saves/*.json presets),
the viewer frame is locked to frame-ancestors 'self', and the relaxed eval
policy is scoped to /hyperdim/* only — root / keeps script-src 'self'.

Verified on preview deploy (fix-csp-eval.pmoves-ai.pages.dev): standalone
viewer renders the beats_c5 toroidal constellation, console clean of CSP errors.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 website/_headers | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/website/_headers b/website/_headers
index e4098aa51c..a38478bf91 100644
--- a/website/_headers
+++ b/website/_headers
@@ -14,12 +14,15 @@
   # Content-Security-Policy
   #   - default-src 'self' blocks everything unless explicitly allowed.
   #   - 'self' covers index.html, styles.css, main.js, assets/.
+  #   - frame-src 'self' is required: index.html embeds the /hyperdim/ viewer as
+  #     same-origin gallery iframes. Without 'self' the browser blocks them
+  #     ("Framing ... violates ... frame-src") and the gallery shows black boxes.
   #   - YouTube frames allowed (optional; remove if you don't embed).
   #   - Inline <style> and <script> disallowed — we ship external files only.
   #   - TODO(founder): when Cloudflare Web Analytics is enabled, add
   #     https://static.cloudflareinsights.com to script-src and the
   #     matching connect-src host.
-  Content-Security-Policy: default-src 'self'; base-uri 'self'; form-action 'self' mailto:; frame-ancestors 'none'; img-src 'self' data:; style-src 'self'; script-src 'self'; font-src 'self' data:; connect-src 'self'; frame-src https://www.youtube.com https://www.youtube-nocookie.com; object-src 'none'; upgrade-insecure-requests
+  Content-Security-Policy: default-src 'self'; base-uri 'self'; form-action 'self' mailto:; frame-ancestors 'none'; img-src 'self' data:; style-src 'self'; script-src 'self'; font-src 'self' data:; connect-src 'self'; frame-src 'self' https://www.youtube.com https://www.youtube-nocookie.com; object-src 'none'; upgrade-insecure-requests
 
 # --- Hyperdimensions WebGL viewer (embedded as gallery iframes on /) ---
 #   - This sub-app is framed same-origin by index.html, and loads three.js
@@ -32,11 +35,18 @@
 #     + script-src 'self' still win and the embeds/CDN scripts stay blocked.
 #   - 'unsafe-inline' is required: the viewer ships one inline <script type=module>
 #     and inline <style> (single-file toy app, no nonce pipeline).
+#   - 'unsafe-eval' is required: the viewer compiles each preset's parametric
+#     `surface.code` at runtime via `new Function(code + '; return surface;')`
+#     (see fork index.html ~L1696/L1886). Without it the surface never compiles
+#     ("EvalError ... 'unsafe-eval' is not an allowed source") and the canvas
+#     renders solid black. The eval'd code is first-party (our own saves/*.json
+#     presets), the frame is locked to frame-ancestors 'self', and this relaxed
+#     policy is scoped to /hyperdim/* only — root / keeps script-src 'self'.
 /hyperdim/*
   ! X-Frame-Options
   ! Content-Security-Policy
   X-Frame-Options: SAMEORIGIN
-  Content-Security-Policy: default-src 'self'; base-uri 'self'; frame-ancestors 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://unpkg.com; font-src 'self' data:; connect-src 'self' https://unpkg.com https://cdnjs.cloudflare.com; object-src 'none'; upgrade-insecure-requests
+  Content-Security-Policy: default-src 'self'; base-uri 'self'; frame-ancestors 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://unpkg.com; font-src 'self' data:; connect-src 'self' https://unpkg.com https://cdnjs.cloudflare.com; object-src 'none'; upgrade-insecure-requests
 
 # --- Long-cache static assets ---
 /assets/*