From d986959927a4738cdb37ca709b88d523ca40086a Mon Sep 17 00:00:00 2001
From: Bruno Charest <bruno.charest@gmail.com>
Date: Sun, 13 Sep 2026 09:51:54 -0400
Subject: [PATCH] fix(cloudflare): protect agent panel, workspaces & shell
 scripts from Rocket Loader; trust proxy headers

---
 Dockerfile                               | 2 +-
 app/templates/_header.html               | 2 +-
 app/templates/_page_editor_realtime.html | 2 +-
 app/templates/agent_panel.html           | 4 ++--
 app/templates/base.html                  | 6 +++---
 app/templates/workspaces.html            | 2 +-
 6 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index a3f06ff..32eff4f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -41,4 +41,4 @@ EXPOSE 8080
 HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
   CMD curl -f http://localhost:8080/api/health || exit 1
 
-CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8080"]
\ No newline at end of file
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8080", "--proxy-headers", "--forwarded-allow-ips", "*"]
\ No newline at end of file
diff --git a/app/templates/_header.html b/app/templates/_header.html
index 24c982f..e10e79e 100644
--- a/app/templates/_header.html
+++ b/app/templates/_header.html
@@ -142,7 +142,7 @@
   </div>
 </header>
 
-<script>
+<script data-cfasync="false">
 document.addEventListener('alpine:init', function () {
   if (window.Alpine && window.Alpine.__fdBreadcrumbRegistered) return;
   if (window.Alpine) window.Alpine.__fdBreadcrumbRegistered = true;
diff --git a/app/templates/_page_editor_realtime.html b/app/templates/_page_editor_realtime.html
index 4db6882..ec9999e 100644
--- a/app/templates/_page_editor_realtime.html
+++ b/app/templates/_page_editor_realtime.html
@@ -9,7 +9,7 @@
 .rt-cursor .rt-cursor-name{position:absolute;top:-14px;left:4px;white-space:nowrap;font-size:9px;line-height:12px;padding:0 4px;border-radius:4px;color:#fff;font-weight:600;letter-spacing:.2px;}
 .rt-offline{font-size:11px;color:var(--text-tertiary,#999);margin-right:6px;display:none;}
 </style>
-<script>
+<script data-cfasync="false">
 /* eslint-disable */
 /* ═══════════ v5.13.0 Realtime — WS gateway, présence, curseurs, merge LWW ═══════════ */
 window.__fdRT = (function () {
diff --git a/app/templates/agent_panel.html b/app/templates/agent_panel.html
index 752c516..bb00fc1 100644
--- a/app/templates/agent_panel.html
+++ b/app/templates/agent_panel.html
@@ -204,7 +204,7 @@
 </style>
 
 {# ── Global Agent API (available before Alpine for the FAB / shortcut) ── #}
-<script>
+<script data-cfasync="false">
 (function(){
   var defaultAPI = {
     open: function(){ document.dispatchEvent(new CustomEvent('fd-agent-toggle')); },
@@ -456,7 +456,7 @@
   </div>
 </div>
 
-<script>
+<script data-cfasync="false">
 (function(){
   // ── Skills intégrés (workflows « / ») et commandes admin du panneau ──
   var FD_ADMIN_CMDS = [
diff --git a/app/templates/base.html b/app/templates/base.html
index 4a797f0..c4c2808 100644
--- a/app/templates/base.html
+++ b/app/templates/base.html
@@ -108,9 +108,9 @@
     body.embed-mode .page-editor-wrapper { padding: 8px 16px !important; max-width: 100% !important; }
     body.embed-mode .page-cover-area { padding-top: 0 !important; }
   </style>
-  <script src="/static/js/htmx.min.js"></script>
+  <script src="/static/js/htmx.min.js" data-cfasync="false"></script>
   <script src="/static/js/alpine.min.js" defer data-cfasync="false"></script>
-  <script src="/static/js/sortable.min.js" defer></script>
+  <script src="/static/js/sortable.min.js" defer data-cfasync="false"></script>
 </head>
 <body hx-headers='{"X-CSRF-Token":"__CSRF_PLACEHOLDER__"}'{% if embed_mode %} class="embed-mode"{% endif %}>
 <div class="app-layout" x-data="appState()">
@@ -1942,7 +1942,7 @@
     }
   });
 </script>
-<script src="/static/js/app.js?v=2.4.8" defer></script>
+<script src="/static/js/app.js?v=2.4.8" defer data-cfasync="false"></script>
 
 <style>
 .flowdeck-modal-overlay{position:fixed;top:0;left:0;right:0;bottom:0;background:rgba(0,0,0,0.6);z-index:2000;display:flex;align-items:center;justify-content:center;}
diff --git a/app/templates/workspaces.html b/app/templates/workspaces.html
index 3a68a25..576a490 100644
--- a/app/templates/workspaces.html
+++ b/app/templates/workspaces.html
@@ -172,7 +172,7 @@
 
 </div>
 
-<script>
+<script data-cfasync="false">
 function workspacesPage() {
   return {
     workspaces: [],