[Bug] CSP blocks Cloud Workstation auth manifest in web UI #18505

Description

When running OpenCode's web interface inside a Google Cloud Workstation, the browser console is flooded with Content Security Policy errors. The Cloud Workstation proxy attempts to load a manifest for auth cookie forwarding, but OpenCode's CSP directive blocks it.

Console Errors

Loading a manifest from 'https://<port>-ws-<user>.cluster-<id>.cloudworkstations.dev/_workstation/forwardAuthCookie?redirectToken=...'
violates the following Content Security Policy directive: "default-src 'self'".
Note that 'manifest-src' was not explicitly set, so 'default-src' is used as a fallback.
The action has been blocked.

These errors repeat continuously (multiple times per page load).

Root Cause

OpenCode's web app sets default-src 'self' in its CSP header but does not explicitly set manifest-src. The Cloud Workstation reverse proxy injects a manifest link for forwardAuthCookie to maintain authentication, which gets blocked by the fallback to default-src.

Expected Behavior

The CSP should allow the Cloud Workstation's auth manifest to load without errors.

Suggested Fix

Add manifest-src 'self' https://*.cloudworkstations.dev to the CSP header, or more broadly allow manifest-src * since manifests are low-risk resources.

Alternatively, make the CSP configurable so that users behind reverse proxies (Cloud Workstations, Codespaces, etc.) can adjust it for their environment.

Environment

• OpenCode web interface
• Google Cloud Workstation (with auth proxy)
• Chrome / Chromium-based browser