The desktop WebView no longer runs with an unexplained disabled CSP. The policy keeps scripts self-hosted, permits Tauri IPC and local Vite development connections, keeps provider/update/model networking on the Rust side, and documents the only unsafe allowance for React inline styles used by the existing pixel-aligned UI.
Constraint: Issue #226 requires csp:null to be replaced or explicitly bounded
Constraint: Provider validation, updater checks, and model downloads are Rust-side paths, not frontend fetch allowlist entries
Rejected: Keep csp:null with documentation only | weaker defense-in-depth and leaves the WebView effectively unconstrained
Confidence: high
Scope-risk: narrow
Directive: Do not add external provider domains to WebView connect-src unless a frontend fetch path is introduced
Tested: npm run build
Tested: npm run tauri -- info
Tested: cargo check --manifest-path src-tauri/Cargo.toml
H-Chris233
717e694370