fix(server): allow blob attachments in web UI (#40692)

[DevFlex-AI]

Issue for this PR

Closes #

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Please provide a description of the issue, the changes you made to fix it, and why they work. It is expected that you understand why your changes work and if you do not understand why at least say as much so a maintainer knows how much to value the PR.

If you paste a large clearly AI generated description here your PR may be IGNORED or CLOSED!

How did you verify your code works?

Screenshots / recordings

If this is a UI change, please include a screenshot or recording.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

If you do not follow this template your PR will be automatically rejected.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

Summary by CodeRabbit

• Bug Fixes
  • Improved embedded UI security policy support for image and media content loaded from temporary browser sources.
  • Enabled terminal functionality, attachments, and theme preloading to work correctly within the embedded UI.

[vercel]

@rexdotsh is attempting to deploy a commit to the adevloper152's projects Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0be23fc0-3416-4772-852d-7e755b928650

📥 Commits

Reviewing files that changed from the base of the PR and between 06ef4dc and 23bbc5c.

📒 Files selected for processing (2)

• packages/opencode/src/server/shared/ui.ts
• packages/opencode/test/server/httpapi-ui.test.ts

---

📝 Walkthrough

Walkthrough

The embedded UI Content Security Policy now permits blob: sources for images and media. Tests cover terminal WASM, blob attachments, theme preload CSP, and the updated img-src and connect-src directives.

Changes

UI CSP updates

Layer / File(s)	Summary
CSP policy and validation packages/opencode/src/server/shared/ui.ts, packages/opencode/test/server/httpapi-ui.test.ts	The UI CSP allows blob: URLs for images and media. The embedded UI test validates terminal WASM, blob attachments, theme preload CSP, and blob: in img-src and connect-src.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: thdxr, jlongster

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in 06ef4dc...23bbc5c on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

Important

Some issues found as part of this review are outside of the diff in this pull request and aren't shown in the inline review comments due to GitHub's API limitations. You can see those issues on the DeepSource dashboard.

PR Report Card

Overall Grade   Focus Area: Reliability

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Aug 5, 2026 11:10p.m.	Review ↗
Shell		Aug 5, 2026 11:10p.m.	Review ↗
Secrets		Aug 5, 2026 11:10p.m.	Review ↗
Docker		Aug 5, 2026 11:10p.m.	Review ↗
Python		Aug 5, 2026 11:10p.m.	Review ↗
CSS		Aug 5, 2026 11:10p.m.	Review ↗
Rust		Aug 5, 2026 11:10p.m.	Review ↗
Ruby		Aug 5, 2026 11:10p.m.	Review ↗
Swift		Aug 5, 2026 11:10p.m.	Review ↗
PHP		Aug 5, 2026 11:10p.m.	Review ↗
Lua		Aug 5, 2026 11:10p.m.	Review ↗
Java		Aug 5, 2026 11:10p.m.	Review ↗
Go		Aug 5, 2026 11:10p.m.	Review ↗
C & C++		Aug 5, 2026 11:10p.m.	Review ↗
Ansible		Aug 5, 2026 11:10p.m.	Review ↗
Apex		Aug 5, 2026 11:10p.m.	Review ↗
Elixir		Aug 5, 2026 11:10p.m.	Review ↗
Groovy		Aug 5, 2026 11:10p.m.	Review ↗
Objective-C		Aug 5, 2026 11:10p.m.	Review ↗
PowerShell		Aug 5, 2026 11:10p.m.	Review ↗
Terraform		Aug 5, 2026 11:10p.m.	Review ↗
VB.NET		Aug 5, 2026 11:10p.m.	Review ↗
SQL		Aug 5, 2026 11:10p.m.	Review ↗
Scala		Aug 5, 2026 11:10p.m.	Review ↗
Perl		Aug 5, 2026 11:10p.m.	Review ↗
Kotlin		Aug 5, 2026 11:10p.m.	Review ↗
Helm		Aug 5, 2026 11:10p.m.	Review ↗
Erlang		Aug 5, 2026 11:10p.m.	Review ↗
Dart		Aug 5, 2026 11:10p.m.	Review ↗
C#		Aug 5, 2026 11:10p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.