[Bug]: Desktop stuck on loading screen — onHeadersReceived missing Access-Control-Allow-Private-Network header #27052

Description

Summary

The OpenCode desktop app opens but never leaves the loading screen.
The sidecar starts
successfully and logs "server ready", but the UI freezes
indefinitely. After ~42 seconds
the sidecar exits with code 0 (timeout waiting for a client).

Root Cause

Chrome 94+ enforces Private Network Access (PNA) preflight checks. In
Electron 41
(Chrome 146), when the renderer (oc:// origin) fetches localhost,
Chrome sends a
CORS OPTIONS preflight with:

Access-Control-Request-Private-Network: true

The sidecar responds with 204 but does NOT include:

Access-Control-Allow-Private-Network: true

The onHeadersReceived hook in out/main/index.js patches response
headers but only
adds Access-Control-Allow-Origin and Access-Control-Allow-Headers
— it does not add
Access-Control-Allow-Private-Network. Chrome blocks the actual
request, the renderer's
fetch() resolves with status 0, checkServerHealth never passes,
and the app stays
on the loading screen forever.

Verified by inspecting the Network tab in DevTools: all
/global/health requests show
status 0 with blocked: 3000ms and connect: -1 (request never
sent).

Fix

In out/main/index.js, inside the onHeadersReceived handler, add:

upsertKeyValue(responseHeaders,

"Access-Control-Allow-Private-Network", ["true"]);

Full context (around line 237 in 1.14.48):

win.webContents.session.webRequest.onHeadersReceived((details,

callback) => {
const { responseHeaders = {} } = details;
upsertKeyValue(responseHeaders, "Access-Control-Allow-Origin",
[""]);
upsertKeyValue(responseHeaders, "Access-Control-Allow-Headers",
[""]);
upsertKeyValue(responseHeaders,
"Access-Control-Allow-Private-Network", ["true"]); // <-- add this
callback({ responseHeaders });
});

This fix was confirmed to resolve the issue by patching app.asar
locally.

Environment

• OpenCode Desktop: 1.14.48
• macOS: 26.4.1 (Build 25E253) — Apple Silicon
• Electron: 41.2.1 (Chrome 146)
• Node: v22.16.0
• Arch: arm64

Steps to Reproduce

1. Install OpenCode Desktop 1.14.48 on macOS (Apple Silicon)
2. Launch the app
3. Observe: loading screen appears, never transitions to main UI
4. Check DevTools (attach to renderer) → Network tab shows repeated
   GET /global/health
   with status 0

References

• Electron issue on PNA:
  [Bug]: Electron How to avoid CORS-RFC1918 (private network)? electron/electron#33133
• Electron issue on CORS/localhost:
  [Bug]: CORS on private network ( fetch to localhost url fails due to CORS ) electron/electron#36445

Plugins

No response

OpenCode version

OpenCode Desktop: 1.14.48

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

macOS: 26.4.1 (Build 25E253) — Apple Silicon

Terminal

No response