max / goingson

Lock the inline-handler ratchet to 8 The GO-30-CSP migration finished in bd16eb3; the budget was still 389, so the gate permitted a 380-handler regression silently. The remaining 8 occurrences are doc comments and test strings, not live handlers. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Max Johnson <me@maxj.phd> · 2026-07-17 01:20 UTC

Commit: d05fd5e187eacc482ff7451aa637fc8398a41d18

Parent: 161108c

1 file changed, +8 insertions, -9 deletions

M scripts/lint-frontend.sh +8 -9

			@@ -78,15 +78,14 @@ else
78	78		fi
79	79
80	80		# 9. Inline event-handler ratchet (CSP `unsafe-inline` drawdown).
81		-	# Dropping `script-src 'unsafe-inline'` from tauri.conf.json requires
82		-	# converting every inline `on<event>="..."` handler to addEventListener — CSP
83		-	# has no nonce for inline handlers. That's a phased migration; this gate stops
84		-	# BACKSLIDING in the meantime: the occurrence count may only go DOWN. When you
85		-	# remove handlers, lower INLINE_HANDLER_BUDGET to the new count (the script
86		-	# prints the new number on progress). When it reaches 0 and the two inline
87		-	# <script> blocks (index.html, compose.html) are externalized, drop
88		-	# 'unsafe-inline' from the CSP. Tests and minified bundles are excluded.
89		-	INLINE_HANDLER_BUDGET=389
	81	+	# The migration is done: `script-src 'unsafe-inline'` is gone from
	82	+	# tauri.conf.json, so an inline `on<event>="..."` handler is now refused at
	83	+	# runtime by CSP rather than merely discouraged. Wire events with
	84	+	# addEventListener (data-* + delegation via js/dispatch.js). This gate stops
	85	+	# BACKSLIDING: the occurrence count may only go DOWN. The remaining budget is
	86	+	# doc comments and test strings naming the old pattern, not live handlers.
	87	+	# Tests and minified bundles are excluded.
	88	+	INLINE_HANDLER_BUDGET=8
90	89		inline_count=$(grep -rlE "\bon[a-z]+=[\"']" "$FRONTEND" --include='.html' --include='.js' 2>/dev/null \
91	90		\| grep -v '/tests/' \| grep -v '\.min\.' \
92	91		\| tr '\n' '\0' \| xargs -0 grep -oE "\bon[a-z]+=[\"']" 2>/dev/null \| wc -l \| tr -d ' ')