fix(web): allow image sources in CSP

[yicun]

Related Issue

Resolve #(issue_number)

Problem

What changed

Checklist

• I have read the CONTRIBUTING document.
• I have linked a related issue, or explained the problem above.
• I have added tests that prove my feature works.
• Ran gen-changesets skill, or this PR needs no changeset.
• Ran gen-docs skill, or this PR needs no doc update.

[changeset-bot]

🦋 Changeset detected

Latest commit: 15d2674

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@moonshot-ai/kimi-code	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 15d2674750

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Allow blob media sources for video previews

On non-loopback binds this relaxes only img-src; media-src is still absent and therefore falls back to default-src 'self' (MDN), so blob: URLs remain blocked for <video>/<audio>. The web UI creates blob URLs for authenticated uploaded videos in AuthMedia.vue and for local video attachment previews in Composer.vue, so users viewing video attachments over the exposed server still get broken previews unless this policy also includes media-src 'self' data: blob:.

Useful? React with 👍 / 👎.

[pkg-pr-new]

pnpm dlx https://pkg.pr.new/@moonshot-ai/kimi-code@15d2674

npx https://pkg.pr.new/@moonshot-ai/kimi-code@15d2674

commit: 15d2674