diff --git a/internal/server/dashboard_csp_test.go b/internal/server/dashboard_csp_test.go index db6b39ad..98c10349 100644 --- a/internal/server/dashboard_csp_test.go +++ b/internal/server/dashboard_csp_test.go @@ -249,8 +249,8 @@ func TestDashboardCSP_JsdelivrNpmPathScoped(t *testing.T) { // handler surface in static/dashboard.html (R236-SEC-02 / #479, also tracked // as #922). The dashboard CSP still ships `script-src 'unsafe-inline'` // because the static HTML contains a fixed set of `onclick=` attributes on -// header buttons (sidebar search, history, new session, cron panel, -// sidebar-search-clear, sidebar-toggle resizer). Migrating to +// header buttons (history, new session, cron panel, +// sidebar-toggle resizer). Migrating to // hash/nonce CSP requires moving those handlers into dashboard.js as // addEventListener bindings. // @@ -276,8 +276,8 @@ func TestDashboardCSP_InlineHandlerSurfaceDoesNotGrow(t *testing.T) { html := string(body) // Cap on `onclick=` attributes. R249-SEC-9 (#922) migration: the static - // HTML's header/sidebar handlers (sidebar-search, history, new-session, - // cron, sidebar-search-clear, sidebar-toggle) plus the + // HTML's header/sidebar handlers (history, new-session, cron, + // sidebar-toggle) plus the // quick-ask form's onsubmit were moved into dashboard.js as // addEventListener binds (DOMContentLoaded header binder + wireQuickAskInput // for the repaint-prone quick-ask form), driving the static surface to 0. @@ -365,10 +365,8 @@ func TestDashboardCSP_StaticHandlersWiredInJS(t *testing.T) { id string handler string }{ - {"btn-sidebar-search", "toggleSidebarSearch"}, {"btn-history", "toggleHistory"}, {"btn-new-session", "createNewSession"}, - {"sidebar-search-clear", "closeSidebarSearch"}, {"btn-sidebar-toggle", "toggleSidebarCollapsed"}, {"quick-ask-form", "submitQuickAsk"}, } diff --git a/internal/server/static/dashboard.html b/internal/server/static/dashboard.html index f30dff4f..e2cabceb 100644 --- a/internal/server/static/dashboard.html +++ b/internal/server/static/dashboard.html @@ -1292,27 +1292,8 @@ .hdr-btns{display:flex;gap:4px;align-items:center} .hdr-btn{background:none;border:1px solid var(--nz-border);border-radius:var(--nz-radius-ms);color:var(--nz-text-mute);cursor:pointer;padding:0;position:relative;transition:all .15s;line-height:1;white-space:nowrap;width:32px;height:32px;display:flex;align-items:center;justify-content:center} .hdr-btn:hover{background:var(--nz-bg-2);color:var(--nz-text);border-color:var(--nz-text-faint)} -/* Active state indicates the toggleable pane (currently sidebar search) is - open. Matches the accent color used on focus rings across the dashboard - so a keyboard user can tell which toggle the button drives. */ .hdr-btn.active{background:var(--nz-bg-2);color:var(--nz-accent);border-color:var(--nz-accent)} .hdr-btn svg{width:18px;height:18px;stroke:currentColor;fill:none;stroke-width:2;stroke-linecap:round;stroke-linejoin:round} -/* UX-P3 sidebar search: toggle-revealed input row under the header-row. - Lives inside .sidebar-header (outside #session-list) so sessions_update - repaints don't clobber the input value/focus — the renderer reads the - input's current value on each repaint and filters accordingly. */ -.sidebar-search{display:flex;gap:6px;align-items:center;margin-top:8px;padding:0 4px} -.sidebar-search-input{flex:1;padding:6px 10px;background:var(--nz-bg-1);border:1px solid var(--nz-border);border-radius:var(--nz-radius-ms);color:var(--nz-text);font-size:var(--nz-fs-sm2);font-family:inherit;outline:none;transition:border-color .1s} -.sidebar-search-input:focus{border-color:var(--nz-accent)} -.sidebar-search-input::placeholder{color:var(--nz-text-faint)} -.sidebar-search-clear{background:transparent;border:1px solid transparent;color:var(--nz-text-mute);font-size:var(--nz-fs-md);line-height:1;padding:4px 8px;border-radius:var(--nz-radius-sm);cursor:pointer;transition:all .1s} -.sidebar-search-clear:hover{background:var(--nz-bg-2);color:var(--nz-text);border-color:var(--nz-border)} -/* When the filter is active AND empty (no matches), paint a friendly hint - instead of the legacy "no sessions" CTA which would mislead operators - into thinking they have zero sessions. .session-list-filter-empty is - emitted by the renderer's filter branch. */ -.session-list-filter-empty{padding:24px 16px;text-align:center;color:var(--nz-text-dim);font-size:var(--nz-fs-sm)} -.session-list-filter-empty .slfe-hint{display:block;margin-top:6px;color:var(--nz-text-faint);font-size:var(--nz-fs-xs)} /* Header badges (history count, cron attention count) are neutral by default — red is opt-in via .is-alert (see Track D variants below). Before Round 127 this rule hard-coded --nz-red, then a later Track D @@ -2837,18 +2818,10 @@