mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
30f24bb346
Both flags gain the rationale the lint requires, in the same form as
896b72428. Neither is a justification: both state that the flag was set when
the role first deployed with no console error recorded against it, and carry
a TODO to re-verify against the running Control UI.
unsafe-eval is the sharper of the two, permitting eval and its relatives. A
WebSocket SPA plausibly needs it; that it does has not been established.
Three roles now carry this unanswered TODO: hermes, litellm and openclaw.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
10 lines
554 B
YAML
10 lines
554 B
YAML
---
|
|
flags:
|
|
script-src:
|
|
unsafe-eval: true # nocheck: csp-unsafe Reason: set when the role first deployed, with no console error recorded against it; TODO: re-verify against the running Control UI and drop the flag if the WebSocket SPA works without it
|
|
script-src-elem:
|
|
unsafe-inline: true # nocheck: csp-unsafe Reason: set when the role first deployed, with no console error recorded against it; TODO: re-verify against the running Control UI and drop the flag if the dashboard renders without it
|
|
whitelist:
|
|
font-src: []
|
|
connect-src: []
|