harden: drop 'unsafe-inline' from style-src (closes #328 )

The popup's markup no longer carries style attributes. The 42 in index.html and in the HTML the view helpers build are now Tailwind classes, each computing to the value it replaced, so style-src is 'self' in both manifests, pinned in tests/manifest.test.js. The address dot's 16 colours are written out as whole classes, because Tailwind builds only the classes it finds in the source. The Settings debug well is shown and hidden with the hidden class, since clearing an inline display no longer uncovers it. Two tests that found the colour dot by its inline style now find it by its class. Script that sets element.style is unaffected. Model: opus-5-5
chore: drop an AI vendor's tool directory from .prettierignore (closes #363 )
2026-10-05 13:00:03 +00:00 · 2026-10-05 14:59:16 +02:00
2 changed files with 4 additions and 1 deletions
@@ -2,4 +2,3 @@ node_modules/
 yarn.lock
 dist/
 release/
-.claude/
@@ -56,6 +56,10 @@ but the review is broader than any of them.
  `display` no longer uncovers it. Script that sets `element.style` is
  unaffected.

+- 2026-10-05: `.prettierignore` no longer lists an AI vendor's tool directory
+  ([#363](https://git.eeqj.de/sneak/AutistMask/issues/363)). The directory is
+  not tracked, so the line ignored nothing.
+
 - 2026-10-05: The Chrome end-to-end suite drives both ways the wait for a
  transaction's receipt ends on the error screen
  ([#315](https://git.eeqj.de/sneak/AutistMask/issues/315)): lookups that still