From 7c3b289f92f18a738b16addf0e4f3e4fd071a5fc Mon Sep 17 00:00:00 2001
From: Duncan
 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
Date: Fri, 7 Aug 2026 17:02:33 -0400
Subject: [PATCH 1/2] fix(desktop): externalize boot <style> to prevent CSP
 nonce override
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Tauri's build-time asset processor finds the inline <style> in
index.html, computes its SHA256, and injects a 'sha256-…' source into
style-src at compile time. Per the CSP spec, once a hash or nonce is
present in a directive the browser ignores 'unsafe-inline' for that
directive — so TipTap's runtime createStyleTag call and emoji-mart's
shadow-root style injection were both blocked in packaged builds,
manifesting as two v0.5.6 regressions:

  • Tab-complete caret landing inside @Name instead of after the
    trailing space (whitespace collapses without TipTap's
    white-space: break-spaces stylesheet).
  • Emoji picker rendering unstyled/janky.

Fix: move html { background-color: #000; } from an inline <style> to
desktop/public/boot.css and link it from <head>. A linked stylesheet
is not subject to Tauri's build-time hash injection, so 'unsafe-inline'
in style-src applies as written. The stylesheet is render-blocking, so
boot-flash behaviour is identical to before.

Also add devCsp matching the production policy with dev-appropriate
script-src allowances so future packaged-only CSP regressions are
visible in the csp.rs tests even before a release build.

The production CSP string itself is unchanged; the security policy is
unaffected. Will's follow-up with the security team (Jordan Mecom /
Eli Foster, authors of #4614) is noted for post-ship.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
---
 desktop/index.html                | 13 ++++++++-----
 desktop/public/boot.css           | 15 +++++++++++++++
 desktop/src-tauri/tauri.conf.json |  3 ++-
 desktop/src-tauri/tests/csp.rs    |  6 +++++-
 4 files changed, 30 insertions(+), 7 deletions(-)
 create mode 100644 desktop/public/boot.css
diff --git a/desktop/index.html b/desktop/index.html
index 4b58bd43264..f18299f0e47 100644
--- a/desktop/index.html
+++ b/desktop/index.html
@@ -12,6 +12,13 @@
       in tauri.conf.json. The body paints its own themed background once the app
       CSS loads, so this never shows through after boot.
 
+      The linked stylesheet (boot.css) applies the initial black background.
+      Keeping it as a <link> rather than an inline <style> prevents Tauri's
+      build-time asset processing from adding a 'sha256-…' source to style-src:
+      per the CSP spec a hash in a directive makes the browser ignore
+      'unsafe-inline', which would block TipTap's runtime stylesheet injection
+      and emoji-mart's shadow-root styles in packaged builds.
+
       The inline script below reads the cached theme background (same
       `buzz-theme-cache` entry ThemeProvider writes) and applies it synchronously
       so the boot color matches the themed loading gate — no black flash on light
@@ -20,11 +27,7 @@
       that ThemeProvider applies moments later — no wrong-scheme flash before
       it loads.
     -->
-    <style>
-      html {
-        background-color: #000;
-      }
-    </style>
+    <link rel="stylesheet" href="/boot.css" />
     <script>
       (() => {
         var cached, bg, parsed;
diff --git a/desktop/public/boot.css b/desktop/public/boot.css
new file mode 100644
index 00000000000..7adf2236871
--- /dev/null
+++ b/desktop/public/boot.css
@@ -0,0 +1,15 @@
+/*
+ * Boot background — applied before the app bundle loads so the window never
+ * flashes an unstyled background on cold start. The inline script in
+ * index.html overwrites this with the cached theme color once ThemeProvider's
+ * state is available; on first-ever launch it falls back to this black default.
+ *
+ * Kept as a linked stylesheet (not an inline <style>) so that Tauri's
+ * build-time asset processing does not add a 'sha256-…' source to style-src.
+ * Per the CSP spec a hash or nonce in a directive causes the browser to ignore
+ * 'unsafe-inline', which would block TipTap's runtime stylesheet injection and
+ * emoji-mart's shadow-root styles in packaged builds.
+ */
+html {
+  background-color: #000;
+}
diff --git a/desktop/src-tauri/tauri.conf.json b/desktop/src-tauri/tauri.conf.json
index 693be1ef347..5ecd3f3f8b8 100644
--- a/desktop/src-tauri/tauri.conf.json
+++ b/desktop/src-tauri/tauri.conf.json
@@ -36,7 +36,8 @@
     ],
     "macOSPrivateApi": true,
     "security": {
-      "csp": "default-src 'self'; base-uri 'self'; form-action 'none'; frame-ancestors 'none'; object-src 'none'; script-src 'self' 'wasm-unsafe-eval' https://cdn.jsdelivr.net/npm/@mediapipe/; style-src 'self' 'unsafe-inline'; font-src 'self' data:; connect-src 'self' ipc: http://ipc.localhost buzz-media: http://buzz-media.localhost https: http: wss: ws:; img-src 'self' buzz-media: http://buzz-media.localhost data: blob: https: http:; media-src 'self' buzz-media: http://buzz-media.localhost data: blob: https: http:; worker-src 'self' blob:"
+      "csp": "default-src 'self'; base-uri 'self'; form-action 'none'; frame-ancestors 'none'; object-src 'none'; script-src 'self' 'wasm-unsafe-eval' https://cdn.jsdelivr.net/npm/@mediapipe/; style-src 'self' 'unsafe-inline'; font-src 'self' data:; connect-src 'self' ipc: http://ipc.localhost buzz-media: http://buzz-media.localhost https: http: wss: ws:; img-src 'self' buzz-media: http://buzz-media.localhost data: blob: https: http:; media-src 'self' buzz-media: http://buzz-media.localhost data: blob: https: http:; worker-src 'self' blob:",
+      "devCsp": "default-src 'self'; base-uri 'self'; form-action 'none'; frame-ancestors 'none'; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' https://cdn.jsdelivr.net/npm/@mediapipe/; style-src 'self' 'unsafe-inline'; font-src 'self' data:; connect-src 'self' ipc: http://ipc.localhost buzz-media: http://buzz-media.localhost https: http: wss: ws:; img-src 'self' buzz-media: http://buzz-media.localhost data: blob: https: http:; media-src 'self' buzz-media: http://buzz-media.localhost data: blob: https: http:; worker-src 'self' blob:"
     }
   },
   "plugins": {
diff --git a/desktop/src-tauri/tests/csp.rs b/desktop/src-tauri/tests/csp.rs
index a8cc880e41d..f33b60ee261 100644
--- a/desktop/src-tauri/tests/csp.rs
+++ b/desktop/src-tauri/tests/csp.rs
@@ -195,7 +195,11 @@ fn connect_src_allows_ipc_and_cleartext_relays() {
 fn script_src_stays_free_of_unsafe_inline_and_eval() {
     let allowed = sources("script-src");
     // The inline boot script in index.html is covered by Tauri's build-time
-    // sha256 hashing, so neither escape hatch is ever needed here.
+    // sha256 hashing, so neither escape hatch is ever needed here. Note: the
+    // boot background was previously an inline <style>, but it was moved to
+    // public/boot.css (a linked stylesheet) so that Tauri does not also hash
+    // style-src — a hash in style-src would override 'unsafe-inline' and block
+    // TipTap's runtime stylesheet injection in packaged builds.
     assert!(!allowed.contains(&"'unsafe-inline'".to_owned()));
     assert!(!allowed.contains(&"'unsafe-eval'".to_owned()));
 }

From 3fdb8211e15ebdf6498932e984740324e4825e81 Mon Sep 17 00:00:00 2001
From: Duncan
 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
Date: Fri, 7 Aug 2026 17:25:38 -0400
Subject: [PATCH 2/2] fix(desktop): correct nonce wording, remove inert devCsp

Thufir pass-1 corrections:
- Replace sha256 with nonce throughout comments: Tauri nonces inline
  <style> elements (not SHA-256 hashes them); only inline scripts get
  the SHA-256 treatment.
- Remove devCsp field from tauri.conf.json: Tauri only applies devCsp to
  assets it serves via its custom protocol; the Buzz dev webview navigates
  directly to Vite's devUrl, so the field has no effect. Dev CSP detection
  is deferred to a separate Tauri-faithful Vite middleware follow-up.
- Deduplicate rationale: boot-order context in index.html (one line
  pointer to boot.css), full externalization reason in boot.css,
  script-policy invariant only in csp.rs.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
---
 desktop/index.html                |  7 ++-----
 desktop/public/boot.css           | 11 +++++++----
 desktop/src-tauri/tauri.conf.json |  3 +--
 desktop/src-tauri/tests/csp.rs    |  9 ++++-----
 4 files changed, 14 insertions(+), 16 deletions(-)

diff --git a/desktop/index.html b/desktop/index.html
index f18299f0e47..a8baf91d3b9 100644
--- a/desktop/index.html
+++ b/desktop/index.html
@@ -13,11 +13,8 @@
       CSS loads, so this never shows through after boot.
 
       The linked stylesheet (boot.css) applies the initial black background.
-      Keeping it as a <link> rather than an inline <style> prevents Tauri's
-      build-time asset processing from adding a 'sha256-…' source to style-src:
-      per the CSP spec a hash in a directive makes the browser ignore
-      'unsafe-inline', which would block TipTap's runtime stylesheet injection
-      and emoji-mart's shadow-root styles in packaged builds.
+      Kept as a <link> rather than an inline <style> to avoid Tauri's nonce
+      injection for style-src (see boot.css for the full rationale).
 
       The inline script below reads the cached theme background (same
       `buzz-theme-cache` entry ThemeProvider writes) and applies it synchronously
diff --git a/desktop/public/boot.css b/desktop/public/boot.css
index 7adf2236871..db1ee047ac7 100644
--- a/desktop/public/boot.css
+++ b/desktop/public/boot.css
@@ -5,10 +5,13 @@
  * state is available; on first-ever launch it falls back to this black default.
  *
  * Kept as a linked stylesheet (not an inline <style>) so that Tauri's
- * build-time asset processing does not add a 'sha256-…' source to style-src.
- * Per the CSP spec a hash or nonce in a directive causes the browser to ignore
- * 'unsafe-inline', which would block TipTap's runtime stylesheet injection and
- * emoji-mart's shadow-root styles in packaged builds.
+ * build-time asset processing does not inject a nonce token into this element.
+ * Tauri nonces inline <style> elements and adds the corresponding 'nonce-…'
+ * source to style-src at runtime; per the CSP spec a nonce in a directive
+ * causes the browser to ignore 'unsafe-inline', which would block TipTap's
+ * runtime stylesheet injection and emoji-mart's shadow-root styles in packaged
+ * builds. The inline boot script is SHA-256 hashed (not nonced) — that path
+ * only applies to scripts, not stylesheets.
  */
 html {
   background-color: #000;
diff --git a/desktop/src-tauri/tauri.conf.json b/desktop/src-tauri/tauri.conf.json
index 5ecd3f3f8b8..693be1ef347 100644
--- a/desktop/src-tauri/tauri.conf.json
+++ b/desktop/src-tauri/tauri.conf.json
@@ -36,8 +36,7 @@
     ],
     "macOSPrivateApi": true,
     "security": {
-      "csp": "default-src 'self'; base-uri 'self'; form-action 'none'; frame-ancestors 'none'; object-src 'none'; script-src 'self' 'wasm-unsafe-eval' https://cdn.jsdelivr.net/npm/@mediapipe/; style-src 'self' 'unsafe-inline'; font-src 'self' data:; connect-src 'self' ipc: http://ipc.localhost buzz-media: http://buzz-media.localhost https: http: wss: ws:; img-src 'self' buzz-media: http://buzz-media.localhost data: blob: https: http:; media-src 'self' buzz-media: http://buzz-media.localhost data: blob: https: http:; worker-src 'self' blob:",
-      "devCsp": "default-src 'self'; base-uri 'self'; form-action 'none'; frame-ancestors 'none'; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' https://cdn.jsdelivr.net/npm/@mediapipe/; style-src 'self' 'unsafe-inline'; font-src 'self' data:; connect-src 'self' ipc: http://ipc.localhost buzz-media: http://buzz-media.localhost https: http: wss: ws:; img-src 'self' buzz-media: http://buzz-media.localhost data: blob: https: http:; media-src 'self' buzz-media: http://buzz-media.localhost data: blob: https: http:; worker-src 'self' blob:"
+      "csp": "default-src 'self'; base-uri 'self'; form-action 'none'; frame-ancestors 'none'; object-src 'none'; script-src 'self' 'wasm-unsafe-eval' https://cdn.jsdelivr.net/npm/@mediapipe/; style-src 'self' 'unsafe-inline'; font-src 'self' data:; connect-src 'self' ipc: http://ipc.localhost buzz-media: http://buzz-media.localhost https: http: wss: ws:; img-src 'self' buzz-media: http://buzz-media.localhost data: blob: https: http:; media-src 'self' buzz-media: http://buzz-media.localhost data: blob: https: http:; worker-src 'self' blob:"
     }
   },
   "plugins": {
diff --git a/desktop/src-tauri/tests/csp.rs b/desktop/src-tauri/tests/csp.rs
index f33b60ee261..3497c368632 100644
--- a/desktop/src-tauri/tests/csp.rs
+++ b/desktop/src-tauri/tests/csp.rs
@@ -195,11 +195,10 @@ fn connect_src_allows_ipc_and_cleartext_relays() {
 fn script_src_stays_free_of_unsafe_inline_and_eval() {
     let allowed = sources("script-src");
     // The inline boot script in index.html is covered by Tauri's build-time
-    // sha256 hashing, so neither escape hatch is ever needed here. Note: the
-    // boot background was previously an inline <style>, but it was moved to
-    // public/boot.css (a linked stylesheet) so that Tauri does not also hash
-    // style-src — a hash in style-src would override 'unsafe-inline' and block
-    // TipTap's runtime stylesheet injection in packaged builds.
+    // SHA-256 hashing (scripts only — Tauri nonces inline <style> elements via
+    // a different path), so neither escape hatch is ever needed here. The boot
+    // background style was moved to public/boot.css to avoid the nonce path for
+    // style-src; see boot.css for the full rationale.
     assert!(!allowed.contains(&"'unsafe-inline'".to_owned()));
     assert!(!allowed.contains(&"'unsafe-eval'".to_owned()));
 }
