clone/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-05-21 03:53:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(server): restore web terminal CSP allowances (#25937)

Browse Source
This commit is contained in:
Luke Parker
2026-05-06 09:32:51 +10:00
committed by GitHub
parent 1fbc13a1b4
commit e117397d0f
3 changed files with 54 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
packages/opencode/test/server/httpapi-ui.test.ts
View File

@@ -1,3 +1,4 @@
import { createHash } from "node:crypto"
import { afterEach, describe, expect, test } from "bun:test"
import { Flag } from "@opencode-ai/core/flag/flag"
import * as Log from "@opencode-ai/core/util/log"
@@ -260,6 +261,38 @@ describe("HttpApi UI fallback", () => {
expect(await response.text()).toBe("console.log('embedded')")
})
test("allows embedded UI terminal wasm and theme preload CSP", async () => {
Flag.OPENCODE_EXPERIMENTAL_HTTPAPI = true
const script = 'document.documentElement.dataset.theme = "dark"'
const response = await Effect.runPromise(
Effect.gen(function* () {
const fs = yield* AppFileSystem.Service
return yield* serveEmbeddedUIEffect(
"/",
{
...fs,
readFile: (path) => {
return path === "/$bunfs/root/index.html"
? Effect.succeed(
new TextEncoder().encode(
`<html><head><script id="oc-theme-preload-script">${script}</script></head></html>`,
),
)
: Effect.die(`unexpected embedded UI path: ${path}`)
},
},
{ "index.html": "/$bunfs/root/index.html" },
)
}).pipe(Effect.provide(AppFileSystem.defaultLayer), Effect.map(HttpServerResponse.toWeb)),
)
const csp = response.headers.get("content-security-policy") ?? ""
expect(csp).toContain("script-src 'self' 'wasm-unsafe-eval'")
expect(csp).toContain(`'sha256-${createHash("sha256").update(script).digest("base64")}'`)
expect(csp).toContain("connect-src * data:")
})
test("keeps matched API routes ahead of the UI fallback", async () => {
Flag.OPENCODE_EXPERIMENTAL_HTTPAPI = true