Web terminal fails under CSP when Ghostty WASM loads via data URL #6656

Closed
opened 2026-02-16 18:04:52 -05:00 by yindo · 1 comment
Owner

Originally created by @xomaxie on GitHub (Jan 17, 2026).

Originally assigned to: @adamdotdevin on GitHub.

When running the web UI behind a strict CSP (connect-src 'self'), the terminal fails to load. Console shows "Fetch API cannot load data:application/wasm;base64,..." and "Failed to load ghostty-vt.wasm". This happens in Safari/Firefox and in Cloudflare Access setups with default CSP.

Repro:

  1. Run opencode web
  2. Serve UI with CSP connect-src 'self'
  3. Open terminal -> blank

Expected: terminal loads.
Actual: Ghostty WASM load blocked because it uses a data: URL.

Proposed fix: load ghostty-vt.wasm via asset URL instead of data: (Vite ?url).

Originally created by @xomaxie on GitHub (Jan 17, 2026). Originally assigned to: @adamdotdevin on GitHub. When running the web UI behind a strict CSP (connect-src 'self'), the terminal fails to load. Console shows "Fetch API cannot load data:application/wasm;base64,..." and "Failed to load ghostty-vt.wasm". This happens in Safari/Firefox and in Cloudflare Access setups with default CSP. Repro: 1) Run opencode web 2) Serve UI with CSP connect-src 'self' 3) Open terminal -> blank Expected: terminal loads. Actual: Ghostty WASM load blocked because it uses a data: URL. Proposed fix: load ghostty-vt.wasm via asset URL instead of data: (Vite ?url).
yindo added the web label 2026-02-16 18:04:52 -05:00
yindo closed this issue 2026-02-16 18:04:52 -05:00
Author
Owner

@github-actions[bot] commented on GitHub (Jan 17, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #6557: Web UI does not load when running opencode web - Related MIME type and module loading failures
  • #5237: opencode web mode broken: empty page - Multiple versions/OS with asset loading errors
  • #6122: Web UI fails to load - JS module blocked due to incorrect MIME type
  • #3853: Black screen when running opencode web - Security policy violations (CORS, insecure content)
  • #7578: Opencode Web: Terminal not working - Terminal component not functional in web UI
  • #8833: web terminal can not input chinese - Web terminal malfunction with asset load error

These issues describe similar problems with web content loading failures, security policy violations (CSP, CORS), and MIME type enforcement that may be related to your WASM loading issue.

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Jan 17, 2026): This issue might be a duplicate of existing issues. Please check: - #6557: Web UI does not load when running `opencode web` - Related MIME type and module loading failures - #5237: opencode web mode broken: empty page - Multiple versions/OS with asset loading errors - #6122: Web UI fails to load - JS module blocked due to incorrect MIME type - #3853: Black screen when running opencode web - Security policy violations (CORS, insecure content) - #7578: Opencode Web: Terminal not working - Terminal component not functional in web UI - #8833: web terminal can not input chinese - Web terminal malfunction with asset load error These issues describe similar problems with web content loading failures, security policy violations (CSP, CORS), and MIME type enforcement that may be related to your WASM loading issue. Feel free to ignore if none of these address your specific case.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#6656