[v1.14.39] Web terminal broken due to CSP blocking ghostty WASM data: URL #25945

Summary

The web terminal (Ghostty) is completely broken when accessing OpenCode web UI via non-localhost address. The Ghostty WASM module fails to load due to CSP restrictions.

Environment

• OpenCode version: v1.14.39 (latest as of 2026-05-06)
• Runtime: Bun, baseline variant (CPU lacks AVX/AVX2)
• Access method: HTTP Basic Auth, via IP address (http://10.10.22.22:43218)
• Browser: Chrome on Linux

Error

Connecting to 'data:application/wasm;base64,...' violates the following Content Security Policy directive: "connect-src *". Note that '*' matches only URLs with network schemes ('http', 'https', 'ws', 'wss'), or URLs whose scheme matches self's scheme. The scheme 'data:' must be added explicitly.

Current CSP

Server returns:

Content-Security-Policy: default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; media-src 'self' data:; connect-src *

The issue is ghostty-web-*.js loads the WASM module via a data: URL, but connect-src * does not allow data: scheme.

Related

• PR fix(app): load ghostty wasm via asset url #9186 proposed loading ghostty wasm via asset URL instead of data URL, but was closed without being merged
• Old issue Opencode Web: Terminal not working #7578 was closed but the underlying CSP issue persists in v1.14.39

Suggested Fix

Either:

1. Add data: to connect-src in CSP header: connect-src * data:
2. Or merge the approach from PR fix(app): load ghostty wasm via asset url #9186 to load WASM via asset URL instead of data URL

This makes the web terminal completely unusable for remote/headless server deployments.