DorianandClaude Fable 5
877d1f6389
CI / check (push) Failing after 6m10s
1. server/src/app.ts: CSP img-src only allowed 'self'/data:/blob: — nostr profile pictures come from kind:0 metadata, a URL the user sets via their own client, hosted on whatever domain they picked. There's no central image host for a decentralized identity system, so every external profile pic was CSP-blocked and rendered as a broken image. Added https: (broad) — safe here since images can't execute script even from an untrusted origin, unlike script-src which stays locked to 'self'. 2. frontend/src/pages/JoinBoutPage.vue: the new AI-answer option (1.2.7) was reported as invisible — it was gated behind picking POLLING (not the default WEBHOOK) AND behind a collapsed toggle within that. Changed: POLLING is now the default mode (also the documented default in BOTFIGHTS.md), the AI section is expanded by default instead of collapsed, and the POLLING button's own description now mentions the option so it's visible without any extra click. 3. docker-compose.arena.yml: image tag 1.2.1 -> 1.2.7, matching what's actually deployed on the canonical arena (rolled live via ssh+docker compose pull/up this session — this commit just brings the repo's copy of the compose file back in sync with reality). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>