fix: Allow shields.io external images in CSP

- Added https://img.shields.io to img-src in index.html CSP
- Added https://img.shields.io to img-src in nginx.conf CSP
- Replaced outdated markdownview legacy domain with textagent
- Updated README.md release notes with CSP fix

Author: ijbo

CHANGELOG-csp-fix.md

@@ -0,0 +1,26 @@
+# CSP Fix for GitHub Badges
+
+- Added `https://img.shields.io` to `img-src` in `index.html` CSP to allow README badges to load
+- Added `https://img.shields.io` to `img-src` in `nginx.conf` CSP
+- Replaced outdated `markdownview.github.io` domain with `textagent.github.io` in CSP directives
+
+---
+
+## Summary
+Updated the Content-Security-Policy to allow loading external images from shields.io so that license and version badges render correctly in the application UI without being blocked by the browser.
+
+---
+
+## 1. Content Security Policy Update
+**Files:** `index.html`, `nginx.conf`
+**What:** Appended `https://img.shields.io` to the `img-src` directive in the CSP meta tag and nginx config header. Also updated an outdated legacy domain (`markdownview.github.io`) to the current `textagent.github.io` domain.
+**Impact:** Fixes the browser security block errors preventing shields.io badge SVGs from loading, ensuring the app displays markdown badges correctly in both development and production.
+
+---
+
+## Files Changed (2 total)
+
+| File | Lines Changed | Type |
+|------|:---:|------|
+| `index.html` | +1 −1 | Config |
+| `nginx.conf` | +1 −1 | Config |

README.md

@@ -442,6 +442,7 @@ TextAgent has undergone significant evolution since its inception. What started
 
 | Date | Commits | Feature / Update |
 |------|---------|-----------------|
+| **2026-03-10** | — | 🛡️ **CSP Fix for Badges** — added `https://img.shields.io` to the `img-src` directive in `index.html` and `nginx.conf` Content-Security-Policy to allow GitHub license and version badges to render correctly; updated legacy domain to `textagent.github.io`. |
 | **2026-03-10** | — | 🧪 **Toolbar Tags Tests Fix** — fixed 4 failing Playwright tests in `toolbar-tags.spec.js` by updating expected tag syntaxes to the new `@` prefix format (`{{@AI:}}`, `{{@Image:}}`, `{{@Agent:}}`), removing the deprecated `Think` tag test, and resolving a race condition where the test suite executed too fast by explicitly waiting for Phase 3 lazy-loaded modules (`M.formattingActions`) to register; added JSDoc types to silence TypeScript execution errors. |
 | **2026-03-10** | — | 📸 **Help Mode & Feature Demos** — 6 new demo recordings (Workspace Sidebar, Context Memory, Help Mode, Email to Self, Disk Workspace, API & Linux Tags); 4 new README screenshots; 12 new Help Mode button entries (Memory Tag, File Tree, C++/Rust/Go/Java compile, 6 coding block languages); 4 updated help entries with more specific demos; Feature Demos DEMO_MAP expanded 9 → 24 entries; README now has 10 screenshots and 24 feature demos |
 | **2026-03-10** | `b40eb1f`…`413a9d9` | 📚 **Context Memory** — `{{@Memory:}}` tag and `@use:` field for workspace intelligence; `js/context-memory.js` module with SQLite FTS5 full-text search (heading-aware chunking, ~1500 chars/chunk); three storage modes: browser-only (IndexedDB blob), disk workspace (`.textagent/memory.db`), external memory (IndexedDB blob); `@use: workspace, my-docs` in AI/Think/Agent tags auto-retrieves relevant context; `@` prefix on all tag types (`{{@AI:}}`, `{{@Agent:}}`, `{{@Memory:}}`, `{{@Image:}}`) and metadata fields (`@name`, `@use`, `@think`, `@search`, `@prompt`, `@step`); re-render on page refresh; backward-compatible with old format; amber-accented Memory card with Folder/Files/Rebuild buttons + stats display; reuses existing sql.js WASM (zero bundle size increase); 40 new Playwright tests (151 total) |

changelogs/CHANGELOG-csp-fix.md

@@ -0,0 +1,26 @@
+# CSP Fix for GitHub Badges
+
+- Added `https://img.shields.io` to `img-src` in `index.html` CSP to allow README badges to load
+- Added `https://img.shields.io` to `img-src` in `nginx.conf` CSP
+- Replaced outdated `markdownview.github.io` domain with `textagent.github.io` in CSP directives
+
+---
+
+## Summary
+Updated the Content-Security-Policy to allow loading external images from shields.io so that license and version badges render correctly in the application UI without being blocked by the browser.
+
+---
+
+## 1. Content Security Policy Update
+**Files:** `index.html`, `nginx.conf`
+**What:** Appended `https://img.shields.io` to the `img-src` directive in the CSP meta tag and nginx config header. Also updated an outdated legacy domain (`markdownview.github.io`) to the current `textagent.github.io` domain.
+**Impact:** Fixes the browser security block errors preventing shields.io badge SVGs from loading, ensuring the app displays markdown badges correctly in both development and production.
+
+---
+
+## Files Changed (2 total)
+
+| File | Lines Changed | Type |
+|------|:---:|------|
+| `index.html` | +1 −1 | Config |
+| `nginx.conf` | +1 −1 | Config |

index.html

@@ -23,7 +23,7 @@
         script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://cdn.jsdelivr.net https://esm.sh https://www.gstatic.com;
         style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://cdn.jsdelivr.net;
         connect-src 'self' https: http: https://firestore.googleapis.com https://generativelanguage.googleapis.com https://api.groq.com https://openrouter.ai https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://esm.sh https://huggingface.co;
-        img-src 'self' data: blob: https://www.plantuml.com https://textagent.github.io;
+        img-src 'self' data: blob: https://www.plantuml.com https://textagent.github.io https://img.shields.io;
         font-src 'self' https://cdnjs.cloudflare.com https://cdn.jsdelivr.net;
         worker-src 'self' blob:;
         child-src 'self' blob:;

nginx.conf

@@ -20,5 +20,5 @@ server {
     add_header X-Content-Type-Options "nosniff" always;
     add_header X-XSS-Protection "1; mode=block" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://cdn.jsdelivr.net https://esm.sh https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://cdn.jsdelivr.net; connect-src 'self' https://firestore.googleapis.com https://generativelanguage.googleapis.com https://api.groq.com https://openrouter.ai https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://esm.sh https://huggingface.co; img-src 'self' data: blob: https://www.plantuml.com https://markdownview.github.io; font-src 'self' https://cdnjs.cloudflare.com https://cdn.jsdelivr.net; worker-src 'self' blob:; child-src 'self' blob:; frame-src 'self' blob:; object-src 'none'; base-uri 'self';" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://cdn.jsdelivr.net https://esm.sh https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://cdn.jsdelivr.net; connect-src 'self' https://firestore.googleapis.com https://generativelanguage.googleapis.com https://api.groq.com https://openrouter.ai https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://esm.sh https://huggingface.co; img-src 'self' data: blob: https://www.plantuml.com https://textagent.github.io https://img.shields.io; font-src 'self' https://cdnjs.cloudflare.com https://cdn.jsdelivr.net; worker-src 'self' blob:; child-src 'self' blob:; frame-src 'self' blob:; object-src 'none'; base-uri 'self';" always;
 }