anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Bug: Web Terminal & Styles fail to load due to strict CSP (WASM/data: URI blocked) #6805

New Issue
Closed
opened 2026-02-16 18:05:19 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 18:05:19 -05:00
Owner
Copy Link
Copy Source

Originally created by @wbe7 on GitHub (Jan 19, 2026).

Originally assigned to: @adamdotdevin on GitHub.

Bug Report: Web Terminal & Styles fail to load due to strict CSP

Description:
The opencode web interface is broken in standard browsers because the Content Security Policy (CSP) header sent by the server is too strict. It blocks:

  1. WebAssembly: The ghostty-vt.wasm module (loaded via data: URI) is blocked by connect-src.
  2. Styles: Inline styles are blocked because 'unsafe-inline' is missing from style-src.

Environment:

  • Version: opencode-ai v1.1.25
  • OS: Linux (Ubuntu)
  • Browser: Safari / Chrome (latest)

Steps to Reproduce:

  1. Run opencode web --hostname 0.0.0.0.
  2. Open the web interface in a browser.
  3. Observe broken UI (missing styles) or open the terminal (blank screen).

Error Log (Browser Console):

[Error] Refused to apply a stylesheet because its hash, its nonce, or 'unsafe-inline' appears in neither the style-src directive nor the default-src directive...
[Error] Refused to connect to data:application/wasm... because it does not appear in the connect-src directive...

Required Fix:
The server should send a more permissive CSP for the web interface, explicitly allowing:

  • connect-src data: (for WASM)
  • style-src 'unsafe-inline' (for UI styles)
  • script-src 'unsafe-eval' (if required for WASM glue code)

Temporary Workaround:
We are using an Nginx reverse proxy to strip the original CSP and inject a permissive one.

Originally created by @wbe7 on GitHub (Jan 19, 2026). Originally assigned to: @adamdotdevin on GitHub. ### Bug Report: Web Terminal & Styles fail to load due to strict CSP **Description:** The `opencode web` interface is broken in standard browsers because the Content Security Policy (CSP) header sent by the server is too strict. It blocks: 1. **WebAssembly**: The `ghostty-vt.wasm` module (loaded via `data:` URI) is blocked by `connect-src`. 2. **Styles**: Inline styles are blocked because `'unsafe-inline'` is missing from `style-src`. **Environment:** - **Version:** opencode-ai v1.1.25 - **OS:** Linux (Ubuntu) - **Browser:** Safari / Chrome (latest) **Steps to Reproduce:** 1. Run `opencode web --hostname 0.0.0.0`. 2. Open the web interface in a browser. 3. Observe broken UI (missing styles) or open the terminal (blank screen). **Error Log (Browser Console):** ``` [Error] Refused to apply a stylesheet because its hash, its nonce, or 'unsafe-inline' appears in neither the style-src directive nor the default-src directive... [Error] Refused to connect to data:application/wasm... because it does not appear in the connect-src directive... ``` **Required Fix:** The server should send a more permissive CSP for the web interface, explicitly allowing: - `connect-src data:` (for WASM) - `style-src 'unsafe-inline'` (for UI styles) - `script-src 'unsafe-eval'` (if required for WASM glue code) **Temporary Workaround:** We are using an Nginx reverse proxy to strip the original CSP and inject a permissive one.
yindo added the web label 2026-02-16 18:05:19 -05:00
yindo closed this issue 2026-02-16 18:05:19 -05:00
yindo commented 2026-02-16 18:05:19 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 19, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #9185: Web terminal fails under CSP when Ghostty WASM loads via data URL - same issue about Ghostty WASM blocked under strict CSP with data: URL
  • #6557: Web UI does not load when running opencode web - related web UI loading issues
  • #5237: opencode web mode broken: empty page - related blank page/broken web UI issues

Feel free to ignore if these don't address your specific case.

@github-actions[bot] commented on GitHub (Jan 19, 2026): This issue might be a duplicate of existing issues. Please check: - #9185: Web terminal fails under CSP when Ghostty WASM loads via data URL - same issue about Ghostty WASM blocked under strict CSP with data: URL - #6557: Web UI does not load when running `opencode web` - related web UI loading issues - #5237: opencode web mode broken: empty page - related blank page/broken web UI issues Feel free to ignore if these don't address your specific case.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label web
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#6805
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?