From 600c46f67317a377e0357d08a3cb84715e8e84c6 Mon Sep 17 00:00:00 2001
From: Jared Vititoe <jjvititoe1@gmail.com>
Date: Tue, 30 Jun 2026 09:04:57 -0400
Subject: [PATCH] Fix CSP-blocked command palette trigger (inline onclick ->
 addEventListener)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The ⌘K header button used an inline onclick handler, which the CSP
(script-src-attr, nonce-based, no unsafe-inline) blocks, so clicking the
button did nothing. Move the handler into the existing nonce'd script
block and bind it via addEventListener on #lt-cmd-trigger.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 views/layout_header.php | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/views/layout_header.php b/views/layout_header.php
index 0113d02..d5be680 100644
--- a/views/layout_header.php
+++ b/views/layout_header.php
@@ -205,7 +205,6 @@ $_lt_assetVer  = $GLOBALS['config']['ASSET_VERSION'] ?? '20260329';
               class="lt-btn lt-btn-ghost lt-btn-sm"
               title="Command palette (Ctrl+K)"
               aria-label="Open command palette"
-              onclick="if(window.lt&&lt.cmdPalette)lt.cmdPalette.open()"
               style="font-size:0.65rem;opacity:0.65;letter-spacing:0.03em;padding:0.2rem 0.45rem">&#x2315;&nbsp;K</button>
       <button type="button" class="lt-theme-btn" id="lt-theme-btn"
               aria-label="Switch to light mode" title="Switch to light mode">&#x2600;</button>
@@ -258,6 +257,13 @@ $_lt_assetVer  = $GLOBALS['config']['ASSET_VERSION'] ?? '20260329';
         });
       } catch(_) {}
       if (window.lt && lt.cmdPalette) lt.cmdPalette.init(commands);
+      // Bind the header ⌘K trigger here (no inline onclick — CSP blocks inline handlers)
+      var cmdTrigger = document.getElementById('lt-cmd-trigger');
+      if (cmdTrigger) {
+        cmdTrigger.addEventListener('click', function() {
+          if (window.lt && lt.cmdPalette) lt.cmdPalette.open();
+        });
+      }
     });
     // Keyboard shortcut: Ctrl+K / Cmd+K
     document.addEventListener('keydown', function(e) {