Repository navigation
opencode web tries to load changelog causing CORS errors. #17604
Description
Description
Happened in OpenCode web
$ opencode --version
1.1.25
server started with
$ opencode web --port 3001 --hostname 0.0.0.0 --cors <tailscale dns name>
it worked in the beginning, then half way through a conversation I'm now getting the following error (initially in mobile web, loading the same conversation in a different desktop browser on localhost and I'm seeing the same issue. clicking the "restart" button on the bottom of this error message reloads the page and lands right back at this error.
CompileError: WebAssembly.instantiate(): Compiling or instantiating WebAssembly module violates the following Content Security policy directive because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive:
Please report this to https://github.com/markedjs/marked.
CompileError: WebAssembly.instantiate(): Compiling or instantiating WebAssembly module violates the following Content Security policy directive because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive:
at Module.E (http://localhost:3001/assets/wasm-CG6Dc4jp.js:1:622233)
at http://localhost:3001/assets/index-DybCx3KW.js:333:47240
at async p (http://localhost:3001/assets/index-DybCx3KW.js:333:42530)
at async fV (http://localhost:3001/assets/index-DybCx3KW.js:333:42638)
at async t (http://localhost:3001/assets/index-DybCx3KW.js:333:47067)
at async x8 (http://localhost:3001/assets/index-DybCx3KW.js:333:47839)
at async Promise.all (index 2)
at async iV (http://localhost:3001/assets/index-DybCx3KW.js:333:10311)
at async sV (http://localhost:3001/assets/index-DybCx3KW.js:333:10447)
at async o (http://localhost:3001/assets/index-DybCx3KW.js:333:11322)
Plugins
No response
OpenCode version
No response
Steps to reproduce
No response
Screenshot and/or share link
No response
Operating System
No response
Terminal
No response
Metadata
Metadata
Assignees
Labels
No labels
Activity
github-actions commentedon Mar 15, 2026
This issue might be a duplicate of existing issues. Please check:
WebAssembly is not definedwhen switching project folders #15327: Similar WebAssembly/markedWASM error in the web UI with the same stack trace pattern (wasm-CG6Dc4jp.js). Different root cause (CSPunsafe-evalvsWebAssembly is not defined), but likely the same underlying issue with WASM loading in the web frontend.wolf0403 commentedon Mar 15, 2026
From javascript console I found the following errors that may be relevant:
Connecting to 'https://opencode.ai/changelog.json' violates the following Content Security Policy directive: "connect-src 'self'". The action has been blocked.
Fetch API cannot load https://opencode.ai/changelog.json. Refused to connect because it violates the document's Content Security Policy.
I think my
--cors <tailscale dns name>isn't useful and probably entirely unnecessary.wolf0403 commentedon Mar 15, 2026
Upgraded to 1.2.26 and still the same. Changing start-up directory doesn't help. (not surprised as this seems to be trying to load changelog.json)
[-]WebAssembly error mid-conversation[/-][+]opencode web tries to load changelog causing CORS errors.[/+]fix(web): resolve CSP/CORS issues and enable LAN access
github-actions commentedon Jul 7, 2026
To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.