From e15ffdb4d82b56417d40c5c74e0d3ca6d8616b4f Mon Sep 17 00:00:00 2001
From: Jack Case <jackacase@gmail.com>
Date: Mon, 8 Dec 2025 02:37:46 +0000
Subject: [PATCH] move to altcha dist_external to elide dependency on blob
 source in CSP

reference: https://altcha.org/docs/website-integration/#content-security-policy-csp
---
 manifest.json           | 4 ++--
 pages/action_popup.html | 5 ++++-
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/manifest.json b/manifest.json
index 2e8863d..3366adc 100644
--- a/manifest.json
+++ b/manifest.json
@@ -1,7 +1,7 @@
 {
     "manifest_version": 2,
     "name": "Slop Farmer",
-    "version": "0.5.2",
+    "version": "0.5.4",
 
     "author": "Jack Case",
     "description": "Crowd-source AI slop pages and domains",
@@ -13,7 +13,7 @@
         "*://*.duckduckgo.com/*"
     ],
 
-    "content_security_policy": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; worker-src 'self'",
+    "content_security_policy": "script-src 'self' 'wasm-unsafe-eval'; worker-src 'self'",
 
     "browser_action": {
         "default_title": "Slop Farmer",
diff --git a/pages/action_popup.html b/pages/action_popup.html
index e804de1..e6b3027 100644
--- a/pages/action_popup.html
+++ b/pages/action_popup.html
@@ -5,8 +5,11 @@
     <!-- <meta name="viewport" content="width=device-width, initial-scale=1.0"> -->
     <!-- <script async defer src="https://cdn.jsdelivr.net/gh/altcha-org/altcha/dist/altcha.min.js" type="module"></script> -->
     <script async src="/scripts/browser-action.js" type="module"></script>
-    <script async defer src="/scripts/altcha/dist/altcha.js" type="module"></script>
+    <script async defer src="/scripts/altcha/dist_external/altcha.js" type="module"></script>
+    <script async defer src="/scripts/altcha/dist_external/worker.js" type="module"></script>
+
     <link rel="stylesheet" href="/styles/bulma/bulma.min.css">
+    <link rel="stylesheet" href="/scripts/altcha/dist_external/altcha.css">
     <title>Slop Farmer</title>
 </head>