Embedded web UI CSP blocks the inline theme preload script

Repro

Run opencode web
Open the web UI through a remote/Tailscale URL instead of localhost
Sign in

The page hangs and the browser console shows:

Executing inline script violates the following Content Security Policy directive: "script-src 'self' 'wasm-unsafe-eval'"...

Cause

packages/opencode/src/server/instance.ts already hashes the inline oc-theme-preload-script for proxied HTML, but the embedded UI path still returns the default CSP without that hash.

Expected

Embedded HTML should use the same hashed CSP logic as the proxied HTML path so the inline theme preload script can run.

This issue might be a duplicate of existing issues. Please check:

[Bug] CSP blocks Cloud Workstation auth manifest in web UI #18505: CSP blocks Cloud Workstation auth manifest in web UI (also a CSP issue in the web UI with similar root cause around missing CSP directives)
[Opencode WEB] Unable to add another opencode server due to CSP violation #19949: Unable to add another opencode server due to CSP violation (CSP blocks requests in the web UI)

If your issue is distinct from these, feel free to keep it open and clarify the differences.

May be fixed by #25937

To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.

Navigation Menu

Repository navigation

Embedded web UI CSP blocks the inline theme preload script #21088

Repro

Cause

Expected

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Embedded web UI CSP blocks the inline theme preload script #21088

Description

Repro

Cause

Expected

Activity

github-actions commented on Apr 5, 2026

mxl commented on May 6, 2026

github-actions commented on Jul 8, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions