Lets the Browser pane preview the site locally (python -m http.server)
without needing a full deploy to check CSP/console behavior.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Two conflicting <meta> CSP tags in index.html (plus a separate _headers
policy) meant the browser enforced their intersection, which blocked
the Cloudflare Insights beacon script and its inline bootstrap. k5bss.html
had the same gap in its own CSP. Consolidated to one consistent policy per
surface that allows static.cloudflareinsights.com / cloudflareinsights.com,
and moved index.html's inline script and onerror handler into js/main.js
so script-src no longer needs 'unsafe-inline' there.
Also added the missing fonts/ibm-plex-mono-400.woff2 that style.css has
referenced since it was wired up, which was 404ing.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Lets the site be served on localhost for testing (e.g. verifying
font/CSP fixes) without needing a separate dev setup.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
index.html carried two Content-Security-Policy meta tags that were
never reconciled, so browsers enforced their intersection: the
Cloudflare beacon script/connect endpoints, the profile photo from
ki5bhv.com, and the page's own inline script/onerror handler all got
silently blocked depending on which policy line was checked.
Collapse index.html down to a single correct policy, and add the
same static.cloudflareinsights.com / cloudflareinsights.com
allowances to _headers (the actual Cloudflare Pages response header)
and to k5bss.html's policy, since Cloudflare injects that beacon
site-wide.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Download the actual woff2 file so it exists at the path style.css
already references, instead of relying on the unused Google Fonts
preconnect hints.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Two duplicate <meta> CSP tags in index.html conflicted with the
_headers HTTP header, and browsers enforce the intersection of all
active policies. That blocked the profile photo, the inline nav-
highlight script, and the Cloudflare Insights beacon.
Consolidate to a single CSP in _headers, allow the actual external
resources the page needs (ki5bhv.com image, cloudflareinsights.com
beacon), and move the inline script/onerror handler into js/main.js
so script-src no longer needs 'unsafe-inline'.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds explicit favicon link tags for all sizes and the missing
fonts.gstatic.com crossorigin preconnect required by Google Fonts
for optimal font load performance.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add 1024px tablet breakpoint with narrower sidebar, expand mobile styles
with horizontal nav reflow, and add 480px small-phone breakpoint with
tighter spacing. Document all three breakpoints in README.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Justin