Web UI CSP blocks blob-backed attachments

[rexdotsh]

Description

Starting in OpenCode 1.18.13, attachments in the web UI use blob: URLs after #40207.

The CSP sent by opencode serve currently allows:

img-src 'self' data: https:
connect-src * data:

It does not allow the blob: scheme.

As a result, the browser blocks both parts of the new attachment flow:

• Attachment previews use a blob: URL as the image source.
• Submission fetches the blob: URL to convert it into a data URL.

The browser reports the requests as blocked:csp, and the attachment cannot be previewed or submitted.

This also affects secure HTTPS deployments. I reproduced it while accessing opencode serve through a Cloudflare Tunnel.

Plugins

N/A

OpenCode version

1.18.13

Steps to reproduce

1. Start opencode serve.
2. Access the web UI through HTTPS.
3. Add an image attachment to the prompt composer.
4. Observe that the preview or attachment submission is blocked by CSP.
5. Check the browser developer tools and observe the blocked blob: request.

Screenshot and/or share link

No response

Operating System

Ubuntu 22.04

Terminal

Ghostty

[CallMeJaja]

I ran into this exact issue on opencode 1.18.13 while trying to upload images/files via the Web UI behind Nginx reverse proxy.

Besides the CSP connect-src / img-src blocking blob: URLs, I also observed an IndexedDB console error during the attachment flow:
Uncaught InvalidStateError: Failed to execute 'delete' on 'IDBCursor': The cursor is a key cursor. (from draft-store.ts).

Thanks a lot @rexdotsh for reporting this and opening PR #40692!