From 91b7ee7c7260d36d524f81bdf5acf0f22a41a9b8 Mon Sep 17 00:00:00 2001
From: dpdev69 <4314475+dpdev69@users.noreply.github.com>
Date: Tue, 20 Oct 2026 07:32:00 +0000
Subject: [PATCH 1/2] Site: allow Cloudflare's injected check script, drop the
 unused font preload

Cloudflare adds an inline Bot Fight Mode script to every page on the proxied
domain, and the CSP blocked it. Chrome also flagged the 500 preload as unused.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LnkjoXP333uqMXUsNjoote
---
 site/_headers   | 4 +++-
 site/index.html | 1 -
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/site/_headers b/site/_headers
index d9693e7..95d65e0 100644
--- a/site/_headers
+++ b/site/_headers
@@ -1,5 +1,7 @@
+# The pages run no scripts of their own. 'unsafe-inline' in script-src is for the
+# scripts Cloudflare injects (Bot Fight Mode check, Web Analytics beacon).
 /*
-  Content-Security-Policy: default-src 'self'; img-src 'self' data:; style-src 'self'; font-src 'self'; script-src 'self' https://static.cloudflareinsights.com; connect-src 'self' https://cloudflareinsights.com; base-uri 'self'; form-action 'none'; frame-ancestors 'none'
+  Content-Security-Policy: default-src 'self'; img-src 'self' data:; style-src 'self'; font-src 'self'; script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com; connect-src 'self' https://cloudflareinsights.com; object-src 'none'; base-uri 'self'; form-action 'none'; frame-ancestors 'none'
   Strict-Transport-Security: max-age=31536000; includeSubDomains
   X-Content-Type-Options: nosniff
   X-Frame-Options: DENY
diff --git a/site/index.html b/site/index.html
index ef0721a..1c30c43 100644
--- a/site/index.html
+++ b/site/index.html
@@ -28,7 +28,6 @@
 
 <link rel="icon" type="image/png" href="/assets/favicon.png">
 <link rel="apple-touch-icon" href="/assets/icon-256.png">
-<link rel="preload" href="/assets/fonts/eb-garamond-latin-500-normal.woff2" as="font" type="font/woff2" crossorigin>
 <link rel="stylesheet" href="/assets/site.css?v=1">
 <script type="application/ld+json">{"@context": "https://schema.org", "@type": "SoftwareApplication", "name": "Folio", "description": "A free, open-source desktop app for opencode that sets each coding-agent session as a chapter of a book: commands as footnotes, edits as plates you accept or reject.", "applicationCategory": "DeveloperApplication", "operatingSystem": "macOS 12 or later, Windows 10 or later, Linux", "softwareVersion": "0.3.0", "url": "https://folio.hellobasalt.dev/", "downloadUrl": "https://github.com/dpdev69/folio/releases/latest", "installUrl": "https://github.com/dpdev69/folio/releases/latest", "image": "https://folio.hellobasalt.dev/assets/og-image.png", "screenshot": "https://folio.hellobasalt.dev/assets/shot-plate.webp", "license": "https://opensource.org/licenses/MIT", "isAccessibleForFree": true, "offers": {"@type": "Offer", "price": "0", "priceCurrency": "USD"}, "author": {"@type": "Organization", "name": "Folio contributors", "url": "https://github.com/dpdev69/folio"}, "publisher": {"@type": "Organization", "@id": "https://hellobasalt.dev/#org", "name": "Basalt Studio", "alternateName": "Basalt", "url": "https://hellobasalt.dev/", "sameAs": ["https://x.com/hellobasalt", "https://www.youtube.com/@hellobasalt"]}, "sameAs": ["https://github.com/dpdev69/folio"]}</script>
 <script type="application/ld+json">{"@context": "https://schema.org", "@type": "WebSite", "name": "Folio", "url": "https://folio.hellobasalt.dev/", "publisher": {"@id": "https://hellobasalt.dev/#org"}}</script>

From f016bb6b952fba2c1fd2cd65cc850eca71de2357 Mon Sep 17 00:00:00 2001
From: dpdev69 <4314475+dpdev69@users.noreply.github.com>
Date: Tue, 20 Oct 2026 07:36:11 +0000
Subject: [PATCH 2/2] Site: keep the CSP as it was for now

The script-src rule for Cloudflare's injected script is being decided for all
hellobasalt.dev sites; it goes in a separate change.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LnkjoXP333uqMXUsNjoote
---
 site/_headers | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/site/_headers b/site/_headers
index 95d65e0..d9693e7 100644
--- a/site/_headers
+++ b/site/_headers
@@ -1,7 +1,5 @@
-# The pages run no scripts of their own. 'unsafe-inline' in script-src is for the
-# scripts Cloudflare injects (Bot Fight Mode check, Web Analytics beacon).
 /*
-  Content-Security-Policy: default-src 'self'; img-src 'self' data:; style-src 'self'; font-src 'self'; script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com; connect-src 'self' https://cloudflareinsights.com; object-src 'none'; base-uri 'self'; form-action 'none'; frame-ancestors 'none'
+  Content-Security-Policy: default-src 'self'; img-src 'self' data:; style-src 'self'; font-src 'self'; script-src 'self' https://static.cloudflareinsights.com; connect-src 'self' https://cloudflareinsights.com; base-uri 'self'; form-action 'none'; frame-ancestors 'none'
   Strict-Transport-Security: max-age=31536000; includeSubDomains
   X-Content-Type-Options: nosniff
   X-Frame-Options: DENY