fix: set minimal CSP instead of null

All LLM/image HTTP goes through Rust (reqwest), so the webview needs almost nothing: self for assets, data: for generated-image URLs, inline styles (Vite dev + style attrs), and ws to the Vite dev server for HMR. Verify on next dev run.
2026-09-06 23:26:25 +01:00
parent 00fb901aee
commit 624d82931b
1 changed files with 1 additions and 1 deletions
@@ -23,7 +23,7 @@
      }
    ],
    "security": {
-      "csp": null
+      "csp": "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; font-src 'self'; connect-src 'self' ipc: http://ipc.localhost ws://localhost:5173"
    }
  },
  "bundle": {