UX audit fixes: CSP hash validity, Check error state, a11y contrast, i18n, copy#43
Merged
Merged
Conversation
hashInlineScript emitted a bare `sha256-…`, which browsers reject as an "invalid source" (console errors on every page). Under Report-Only this is invisible, but once CSP_MODE=enforce flips on, the inline scripts would fail to match their hashes and be blocked. Quote at the single producer so each hash is a complete, valid CSP source expression; extend the unit test to assert every script-src hash is single-quoted. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LVPyHAtQ1cdK76RpFasafP
…lean"
A `{`-leading blob that fails JSON.parse fell through to line-parsing and was
reported as one clean dependency — a false all-clear on the dependency checker.
Add dependencyInputError() (additive; parseDependencyInput and its tests are
untouched) and surface it in PolicyChecker with a distinct error state plus a
neutral empty state. Valid package.json and name lists are unaffected.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LVPyHAtQ1cdK76RpFasafP
F3: `.mc__meta dt` dimmed labels with opacity:0.8, dropping them below WCAG AA (axe: 89 serious color-contrast nodes). Differentiate labels by weight only — axe color-contrast now 0 in both light and dark themes. F7: Model Compass and the cost estimator each re-rendered the page's title + intro as an in-island <h2>/lead, duplicating the frontmatter H1. Remove the duplicates (keep the functional sorting note + section aria-label). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LVPyHAtQ1cdK76RpFasafP
The "Try one" example prompts were a flat English array, so es/ar builders saw English chips; and the es/ar /build/ page titles were literally "Build Studio" while the sidebar label was translated. Move EXAMPLES to a per-locale map (es/ar a careful first pass, flagged for native review — no protocol/product terms) and translate the two frontmatter titles to match the sidebar. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LVPyHAtQ1cdK76RpFasafP
The Check card promised only "package.json" though the tool also accepts a dependency list; the catalog card's "1,300+ verified tools" understated the live catalog. Align both to the catalog page's own maintained phrasing (a thousand-plus tools + 800+ datasets) and mention the dependency-list input. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LVPyHAtQ1cdK76RpFasafP
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
wecanjustbuildthings | 8b4716b | Commit Preview URL Branch Preview URL |
Jul 03 2026, 06:41 PM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Implements six findings from a UX audit of the live site (Astro/Starlight + the client-side islands), triangulating the browser against the source. Each fix is one commit. Verified against the repo's own gates and a localhost walkthrough (Chromium couldn't reach the deployed domain through this environment's egress proxy, so the walkthrough ran against
wrangler dev).1cd4d46sha256-…) → "invalid source"hashInlineScript) so each hash is a valid CSP source; would otherwise block inline scripts the momentCSP_MODE=enforceflips on2225183package.jsonreported as "✓ all clean"dependencyInputError()(additive) + a distinct error/empty state inPolicyChecker0033ee8opacity:0.8on.mc__meta dt— axecolor-contrast89 → 0 (light + dark)0033ee8<h2>aria-label)01da939/build/H1 on es/arEXAMPLESper locale; translate the two page titles to match the sidebar8b4716bDecisions confirmed by the owner: F4 — translate the es/ar "Build Studio" H1 to match the sidebar; F5 — use a number that matches the catalog page.
Verification:
npm run check0 errors ·typecheck:workerclean ·npm test250/250 ·npm run build6652 pages · F3 re-confirmed via axe on/build/models/in both themes · F2/F4/F7 confirmed live on localhost.Constraints: CLAUDE.md honored — no new runtime inference, no Meta/OpenAI/xAI deps, Cloudflare-native,
operational_advisory+ gates untouched.parseDependencyInputand its existing tests are unchanged (F2 is purely additive).Type of change
Required checks
npm run checkpasses (schema validation) — 0 errorsnpm run enforcepasses — N/A to these files, CI runs itnpm testpasses — 250/250npm run buildsucceeds — 6652 pagesFor catalog entries
N/A — no catalog entries changed.
For recipes
N/A — no recipes changed.
🤖 Generated with Claude Code
Generated by Claude Code