mirror of
https://github.com/PR0M3TH3AN/bitvid.git
synced 2026-10-27 16:02:26 +00:00
thePR0M3TH3ANandClaude Opus 4.8
b844b71f55
Two pre-existing issues surfaced by running the smoke test: 1. CSP connect-src allowed `wss:` but not `ws:`, so ALL insecure-websocket relays were blocked — including ws://localhost (dev + local relays + the smoke mock relay). Add `ws://localhost:* ws://127.0.0.1:*` to connect-src in index.html and embed.html. Remote cleartext ws:// stays blocked (deliberate security posture — flagged for product decision). 2. smoke-test.mjs published via Promise.any(relays.map(url => pool.publish([url], evt))). SimplePool.publish returns an ARRAY of per-relay promises, so this Promise.any'd arrays-of-arrays — resolving on the array object immediately without awaiting the publish and swallowing errors. Fixed to await pool.publish(relays, evt) via Promise.allSettled and surface per-relay results. Smoke test now passes (publish -> relay verify). CSP policy test green; build green. Co-Authored-By: Claude Opus 4.8 <[email protected]>