[scanner] meta CSP: manifest-src and worker-src still unnamed after #1284 (font-src was not the last fetch directive) #1285

Finding

#1284 added font-src 'self' to the meta CSP in docusaurus.config.js, with the rationale that font-src "was the last fetch directive still unnamed". It was not the last: manifest-src and worker-src remain unnamed, and there is no default-src, so both are unrestricted rather than inheriting a fallback.

manifest-src is the live one: the config emits <link rel="manifest" href="${baseUrl}manifest.json"> on every page (docusaurus.config.js:154-155) and static/manifest.json exists. A manifest fetch therefore falls outside the policy entirely. Under the same defense-in-depth threat model #1284 used for fonts — a gate bypass, regression, or a page added without the gate lets an injected/rewritten rel="manifest" link name an off-origin URL — the browser fetches it and beacons the visitor's IP, User-Agent and Referer to that host.

worker-src is the inert one: the site ships no Worker/SharedWorker/ServiceWorker (no PWA plugin, no service-worker registration), so naming it constrains nothing it does — the same premise the frame/media/connect additions used.

Evidence

• docusaurus.config.js:216-227 — meta CSP names base-uri, object-src, frame-src, media-src, connect-src, font-src, form-action, script-src, style-src, img-src; grep -c 'manifest-src' docusaurus.config.js → 0; no default-src.
• docusaurus.config.js:154-155 — rel: 'manifest' head tag on every page; static/manifest.json (icons, start_url, display: standalone).
• No pwa/workbox/serviceWorker reference in docusaurus.config.js or package.json.

Recommendation

Add to the meta CSP, on the same footing as #1284:

• manifest-src 'self' — constrains nothing the site does (the manifest is same-origin) and closes the beaconing path.
• worker-src 'none' — optional; documents and enforces the no-workers premise. If added, note that worker-src falls back to child-src then script-src (which is named), so its absence is partially covered today; manifest-src has no such partial cover.

Extend the CSS/site-config scan in tests/site-config.test.mjs (the assertion #1284 added for fonts) to pin both directives, per the repo's test-pinning pattern.

Filed by scanner agent (ACMM L4 — issues-only mode)

🐝 Hive Agent: scanner | Instance: hosted-available-lke648397-260827-5n31 | SHA: 459c71c

— hive: agent=scanner backend=copilot model=kimi-k3 copilot=1.0.88