From 95b1955218a46fca553d29615b55b228f1cb3a9a Mon Sep 17 00:00:00 2001
From: openhands <openhands@all-hands.dev>
Date: Sat, 1 Aug 2026 21:58:13 +0200
Subject: [PATCH] fix: allow unsafe-inline for styles to fix CSP permanently

---
 src/lib/csp.ts | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/src/lib/csp.ts b/src/lib/csp.ts
index 45095764..cc17facb 100644
--- a/src/lib/csp.ts
+++ b/src/lib/csp.ts
@@ -18,17 +18,9 @@ export function buildContentSecurityPolicy(nonce: string): string {
 
 	const styleSrc = [
 		"'self'",
+		"'unsafe-inline'",
 		`'nonce-${nonce}'`,
 		"https://fonts.googleapis.com",
-		"'sha256-Kj92o2EIJOPxE06VhJbN8NBhB0Nq5lhNV8aXMMLf5fQ='",
-		"'sha256-NwXHG+Ak6jw1mAqOvXUBP4wBN4kCG04iIIqq24r5gqY='",
-		"'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='",
-		"'sha256-CIxDM5jnsGiKqXs2v7NKCY5MzdR9gu6TtiMJrDw29AY='",
-		"'sha256-599zOKM2ViWVJC0ovicF5YwQ3sRN4OtbjneHwKvkzkY='",
-		"'sha256-UifRkzR11voNslzCZpw+l/wXjkp7FPao0hrYGvsVCEk='",
-		"'sha256-AsAFs+7spEal6Iw4gatQYc0bkXTozo7yk4HpSiol8R8='",
-		"'sha256-M6jR1MdPsGRqBdQRRQhZ7bZil3pe4mO+JdrJsw1zEsY='",
-		...(isDev ? ["'unsafe-inline'"] : []),
 	].join(" ");
 
 	return [