syntaqxsudo is a React app now, hydrated in the browser as the site is: pages are still rendered on the server, then React Router takes over, so a sidebar link opens the next page without reloading. A lavender bar across the top shows while the next page loads (it appears at once, creeps, then fills and fades, as on the site) and the page dims after a moment. The phone menu closes when a link is followed, and a <Form> that was sent goes back to what the page now says, its button letting go of the spinner. The pages run only sudo's own scripts: each page's content security policy names a nonce made for that page (script-src 'self' 'nonce-…', connect-src 'self', everything else as strict as before, still no inline style), entry.server.tsx hands it to React Router's inline scripts and preloads, and every answer that is not a page (data, redirects, files) still forbids every script. The <details> folds still open before any script loads. Comments and the README that said sudo ships no JavaScript now say what is true. Checked: npm run typecheck and npm test in apps/sudo (160, new: the page policy and its nonce), npm run build, and the built worker run locally with the Access check stubbed (not committed) in headless Chrome: no CSP violations or console errors, the page hydrates, a folded section opens on click, a sidebar link navigates client-side with the bar and the dimming, the phone menu closes on navigation, and .data answers keep script-src 'none'. Posting a form was not tried locally (the same-origin check wants https://sudo.g1t.sh).5d7461bHistory
- ..
- 0001_init.sql
- 0002_own_provider.sql
- 0003_subscriptions.sql
- 0004_sandbox_time.sql
- 0005_limits.sql
- 0006_prices.sql
- 0007_pending_usage.sql
- 0008_accounts.sql
- 0009_autopay.sql
- 0010_month_close.sql
- 0011_limit_warnings.sql
- 0012_stripe_webhooks.sql
- 0013_invoices_trust_sales.sql
- 0014_custom_domain_price.sql
- 0015_sandbox_at_cost.sql
- 0016_plans_and_pools.sql
- 0017_flagon_comped.sql
- 0018_one_plan.sql
- 0019_closed_workspaces.sql
- 0020_syntaqx_standard.sql
- 0021_no_quotas.sql
- 0022_costs_and_margin.sql
- 0023_one_operation_mapping.sql
- 0024_spend_caps.sql
- 0025_run_tier.sql
- 0026_ledger_by_workspace_time.sql
- 0027_stripe_cache.sql
- 0028_drop_stripe_webhooks.sql
- 0029_audit_retention.sql
- 0030_token_usage.sql
- 0031_package_storage.sql
- 0032_workspace_value.sql
- 0033_given_away.sql
- 0034_given_by_why.sql
- 0035_cf_subscriptions.sql
- 0036_model_costs_in_full.sql
- 0037_security_activation.sql
- 0038_staff_credits.sql
- 0039_discounts_not_comped.sql
- 0040_ai_credit.sql
- 0041_agent_rate_own_key.sql
- 0042_agent_rate_weights.sql
- 0043_tax_and_card_fees.sql
- 0044_cache_reads_count_a_tenth.sql
- 0045_gateway.sql
- 0046_reset_costs.sql
- 0047_gateway_formats.sql
- 0048_model_catalogue.sql
- 0049_superseded_proposals.sql
- 0050_ledger_usage_by_time.sql
- 0051_platform_guardrails.sql
- 0052_cloudflare_cycle.sql
- 0053_models_at_cost.sql
- 0054_agent_attribution.sql
- 0055_app_containers.sql
- 0056_sandbox_standard_3.sql
- 0057_runner_minutes.sql
- 0058_payment_safety.sql
- 0059_telemetry_ingest.sql
- 0060_pending_baselines.sql
- 0061_measured_months.sql
- 0062_invoice_attempts.sql
- 0063_enterprise_attempts.sql
- 0064_complimentary.sql
- 0065_free_except_flagon.sql