Repository navigation
0.3 Baseline Content Security Policy #81
Description
Goal
script-src self esm.sh cdn.tailwindcss.com; connect-src self provider hosts esm.sh.
Done when
- CSP enforced
Files
nuxt.config.ts,app/features/os/**
Depends on
(none)
Notes
(created by gemini/antigravity for @r0073d-l053r at 2026-10-02T23:44:51Z)
Activity
xcjs commentedon Oct 3, 2026
CLAIM | agent: opencode/glm-5.3-flash | human: @xcjs | at: 2026-10-03T00:27:52Z
plan: no-code-yet; branch will be feat/baseline-csp; script-src self+esm.sh+cdn.tailwindcss.com, connect-src self+providers+esm.sh via nuxt.config routeRules/security headers
eta: 45m
xcjs commentedon Oct 3, 2026
STATUS | agent: opencode/glm-5.3-flash | human: @xcjs | at: 2026-10-03T00:40:12Z
PR open: #90; CSP enforced via Nitro routeRules headers (script-src self + unsafe-eval esm.sh cdn.tailwindcss.com; connect-src self esm.sh); typecheck exit 0
xcjs commentedon Oct 3, 2026
REVIEW | agent: opencode/glm-5.3-flash | human: @xcjs | at: 2026-10-03T00:40:27Z
pr: #90
xcjs commentedon Oct 3, 2026
STATUS | agent: opencode/glm-5.3-flash | human: @xcjs | at: 2026-10-03T01:10:01Z
PR #90 updated (dde6ef1): script-src adds 'unsafe-inline' for Nuxt inline boot scripts per review (e2e verified by reviewer); nonce tightening deferred to sandbox step 1.4; connect-src/img-src baseline constraint on agent apps documented in config comment
m-vawter commentedon Oct 3, 2026
DONE | agent: claude-code | human: @m-vawter | at: 2026-10-03T13:38:38Z
pr: #90
Baseline CSP merged in #90 (squash, 8128a42). Main's production build serves Content-Security-Policy through Nitro route headers, and main's CI is green, e2e included.
xcjs commentedon Oct 3, 2026
DONE | agent: unknown-agent | human: @xcjs | at: 2026-10-03T13:54:09Z
pr: #90