Two-task nav, key generation out of the app, and three CSP/theme faults

[0c-coder]

Everything here is already live — GitHub Pages serves from fix/drop-req-press-opcodes /docs, so the pushes released it. This is the integration merge, the same as #7.

Two tasks in the header, the method picked inside the page

The header carried seven links, presenting four transports as four destinations. It is now Encrypt | Decrypt | Search, with a segmented Message / File / PQC-PGP / AGE selector inside each page.

The selector is real hrefs to real routes, not a JS show/hide. pages.js already takes over every <a> inserted into the DOM, so a click swaps the view client-side with no page load while the URL still deep-links and the back button still works — and a tab that JS cannot reach is a tab that breaks when JS fails.

Both combined pages split to match:

age-derive  ->  age-encrypt  (label, plaintext, Encrypt)
                age-decrypt  (label, age file, Decrypt)
pgp-pqc     ->  pqc-encrypt  (recipient key, Encrypt, Sign)
                pqc-decrypt  (public key + slot, Decrypt, Verify)

Sign under Encrypt, Verify under Decrypt — the split classic PGP already uses.

The splits are markup only. Each pair shares one init/setup, the same thing encrypt.js and decrypt.js already do for their -file siblings, so every crypto handler is byte-for-byte the code the hardware brief exercised.

⚠️ /app/age-derive.html and /app/pgp-pqc.html no longer exist — they are age-encrypt, age-decrypt, pqc-encrypt, pqc-decrypt. The transit-v2 test brief has been updated.

Key generation leaves the web app

Encrypt › PQC-PGP carried Generate Composite Key, an assembled setpqc command, a download button for the 160-byte private blob, and two paragraphs about config mode. All gone, markup and handlers both.

Generating a key in a browser puts the private half in a JS heap in a tab, and the handoff then asks the user to carry it to the device by hand — clipboard, a file on disk, a command in shell history. The CLI does this properly against config mode over the vendor interface, which a browser cannot reach anyway.

Worth recording from the firmware read this prompted: the browser transport cannot write keys at all. ok_extension.cpp dispatches exactly OKCONNECT, OKPING, OKDECRYPT and OKSIGN; OKSETPRIV has no branch there.

Three CSP/theme faults, all measured on the live site rather than reasoned about

Every inline style attribute in this app is refused. The CSP is style-src 'self' with nonces and no 'unsafe-inline'. It does not block JS writing element.style.x — CSP does not police CSSOM — so the two look identical in code and behave completely differently. Measured before the fix:

Element	attribute in markup	computed
.oa-cta-row	margin-top:26px	8px
.oa-cta-row a.btn	max-width:260px	none
footer link group	display:flex;gap:20px	block

The one that mattered: the derived-decap challenge box carried style="display:none" and was therefore open on every page load, telling the user to press buttons for a request nobody had made. Its JS toggle worked fine, which is why it went unnoticed. There are now zero style= attributes in any shell or fragment.

The stylesheets had no version in their URL. hash: true stamps the script tag html-webpack-plugin injects; the <link> tags are hand-written, so onlyagent-theme.css never moved. Caught red-handed — after deploying, the browser still computed the old values while fetch() with a query string returned a file that did contain the new rules. So every CSS change shipped so far, the monochrome rebrand included, reached returning visitors only when their cache happened to expire. webpack.config.js now content-hashes src/assets/css into a css_v on all four links.

A random tint on every fieldset. encrypt.js, decrypt.js and search.js each ran fieldset.style.backgroundColor = app.randomColor({luminosity:'bright'}) on every render — olive on one page, navy on the next. It predates the theme and fought it. Removed from all three. (It hid behind the same CSSOM-vs-attribute distinction as the challenge box.)

Also: the xterm log panel was black-on-white — it paints to a canvas so CSS cannot reach it, and the theme is set at construction now; input[type="number"] was missing from the form-control list; tokenizer.css hard-codes a white wrapper on the recipient field.

Landing page

Five tool cards became three — Encrypt & Sign, Decrypt & Verify, Find a Recipient — matching the app's header. The -file routes still work, they are just no longer sold as separate tools.

Verified live

Full AGE round trip on onlyagent.app through the new split routes: Encrypt › AGE produced a 2264-char age file, Decrypt › AGE returned the exact plaintext. That exercises the derive path, transit v2 framing, the 7-chunk 171-byte reassembly and the sealed 32-byte secret after the reorganisation. The challenge box computed a code and cleared itself on success.

One finding from that run: it completed with no button press and no challenge entry, so field 30 is still 2 (USER_INPUT_NONE) — never restored after the 2026-09-15 step 7 test.