Skip to content

Commit 23f5b9c

Browse files
feat(Sky): enhance security policies and mobile PWA capabilities
- Set default document title to "FIDDEE" in Meta component to establish brand consistency - Implement strict Content Security Policy in Application.astro: - Restrict script sources to self + unsafe-eval for VS Code compatibility - Enable WebSocket connections to Tauri backend (wss://tauri.localhost) - Configure trusted types for critical UI components like editor and notebook - Allow vscode-remote-resource domains for extension assets - Add mobile web app meta tags (apple-mobile-web-app-capable) for iOS PWA support - Disable viewport scaling to ensure consistent editor UI behavior - Prepare infrastructure for future touch icon implementation (commented link) These changes strengthen security for extension execution while maintaining VS Code webview compatibility. The PWA enhancements align with Land's cross-platform goals by improving mobile device integration. The CSP policies balance security with requirements for VS Code extension host shim (Cocoon) operation.
1 parent 31b99ae commit 23f5b9c

5 files changed

Lines changed: 91 additions & 5 deletions

File tree

Source/Function/Meta.astro

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
const { Title = "", Description = "" } = Astro.props;
2+
const { Title = "FIDDEE", Description = "" } = Astro.props;
33
44
interface Props {
55
Title?: string;
@@ -11,7 +11,17 @@ interface Props {
1111

1212
<meta charset="utf-8" />
1313
<meta name="description" content={Description} />
14-
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
14+
15+
<meta name="mobile-web-app-capable" content="yes" />
16+
<meta name="apple-mobile-web-app-capable" content="yes" />
17+
<meta name="apple-mobile-web-app-title" content="FIDDEE" />
18+
19+
<!-- <link rel="apple-touch-icon" href="{{WORKBENCH_WEB_BASE_URL}}/resources/server/code-192.png" /> -->
20+
21+
<meta
22+
name="viewport"
23+
content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=no"
24+
/>
1525
<meta name="theme-color" content="#ffffff" />
1626
<meta name="format-detection" content="telephone=no" />
1727
<meta name="twitter:dnt" content="on" />

Source/pages/Application.astro

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,12 +159,88 @@ const Browser = process.env["Browser"] === "true";
159159
---
160160

161161
<Layout>
162+
<meta
163+
http-equiv="Content-Security-Policy"
164+
content="
165+
default-src
166+
'none'
167+
;
168+
img-src
169+
'self'
170+
data:
171+
blob:
172+
vscode-remote-resource:
173+
vscode-managed-remote-resource:
174+
https:
175+
;
176+
manifest-src
177+
'self'
178+
;
179+
media-src
180+
'self'
181+
;
182+
frame-src
183+
'self'
184+
vscode-webview:
185+
;
186+
script-src
187+
'self'
188+
'unsafe-eval'
189+
blob:
190+
;
191+
style-src
192+
'self'
193+
'unsafe-inline'
194+
;
195+
connect-src
196+
'self'
197+
wss://tauri.localhost
198+
https:
199+
;
200+
font-src
201+
'self'
202+
vscode-remote-resource:
203+
vscode-managed-remote-resource:
204+
;
205+
block-all-mixed-content
206+
;
207+
upgrade-insecure-requests
208+
;
209+
require-trusted-types-for
210+
'script'
211+
;
212+
trusted-types
213+
WorkerApplication
214+
amdLoader
215+
cellRendererEditorText
216+
defaultWorkerFactory
217+
diffEditorWidget
218+
diffReview
219+
domLineBreaksComputer
220+
dompurify
221+
editorGhostText
222+
editorViewLayer
223+
notebookRenderer
224+
stickyScrollViewLayer
225+
tokenizeToString
226+
notebookChatEditController
227+
;
228+
"
229+
slot="Meta"
230+
/>
231+
162232
<meta
163233
id="vscode-workbench-web-configuration"
164234
data-settings={JSON.stringify(Default)}
165235
slot="Meta"
166236
/>
167237

238+
<meta
239+
id="vscode-workbench-auth-session"
240+
data-settings={JSON.stringify({})}
241+
slot="Meta"
242+
/>
243+
168244
<script is:inline type="module" define:vars={{ Site }} slot="Head">
169245
// @ts-expect-error
170246
globalThis._VSCODE_FILE_ROOT = `${Site}/Static/Application/`;

Target/Application/index.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
<!DOCTYPE html><html class=no-js data-beasties-container dir=ltr lang=en><head><script type=module>document.documentElement.classList.remove("no-js"),document.documentElement.classList.add("js")</script><title></title><meta charset=utf-8><meta content name=description><meta content="width=device-width,initial-scale=1" name=viewport><meta content=#ffffff name=theme-color><meta content="telephone=no" name=format-detection><meta content=on name=twitter:dnt><meta data-settings={&#34;remoteAuthority&#34;:&#34;&#34;,&#34;serverBasePath&#34;:&#34;/&#34;,&#34;connectionToken&#34;:&#34;&#34;,&#34;enableWorkspaceTrust&#34;:true,&#34;settingsSyncOptions&#34;:{&#34;enabled&#34;:false},&#34;productConfiguration&#34;:{&#34;embedderIdentifier&#34;:&#34;desktop&#34;,&#34;nameShort&#34;:&#34;FIDDEE&#34;,&#34;nameLong&#34;:&#34;FIDDEE&#34;,&#34;applicationName&#34;:&#34;fiddee&#34;},&#34;developmentOptions&#34;:{&#34;logLevel&#34;:0,&#34;enableSmokeTestDriver&#34;:false}} id=vscode-workbench-web-configuration><link href=/Manifest.json rel=manifest crossorigin=use-credentials><script type=module>const Site="https://tauri.localhost/";globalThis._VSCODE_FILE_ROOT=`${Site}/Static/Application/`</script><script type=module>const Worker="/Worker.js?BASE_REMOTE=https%3A%2F%2Ftauri.localhost%2F&Time=1746451962977";window._WORKER=Worker</script><style>:root{--vscode-sash-size:4px;--vscode-sash-hover-size:4px}@property --chat-editing-last-edit-shift{syntax:"<percentage>";initial-value:100%;inherits:false}@property --inline-chat-frame-progress{syntax:"<percentage>";initial-value:0%;inherits:false}body{height:100%;width:100%;margin:0;padding:0;overflow:hidden;font-size:11px;user-select:none;-webkit-user-select:none}</style><link href=/_astro/Browser.CRM72xFj.css rel=stylesheet media=print onload="this.media=&#34;all&#34;"><noscript><link href=/_astro/Browser.CRM72xFj.css rel=stylesheet></noscript></head><body aria-label><script type=module>window._LOAD_CSS_WORKER=e=>{const r=e+(e.includes("?")?"&":"?")+"Skip=Intercept";try{if(document.querySelector(`link[href="${r}"]`))return;const e=document.createElement("link");e.rel="stylesheet",e.type="text/css",e.href=r,e.onerror=r=>{e.remove()},e.onload=()=>{},document.head.appendChild(e)}catch{}},(()=>{if(window._POLICY_WORKER=window._POLICY_WORKER||{},window.trustedTypes&&window.trustedTypes.createPolicy&&!window._POLICY_WORKER.WorkerApplication)try{window._POLICY_WORKER.WorkerApplication=window.trustedTypes.createPolicy("WorkerApplication",{createScriptURL:e=>{if(e&&/^\/[^/\\:]+\.js(\?.*)?$/.test(e))return e;throw new TypeError(`Invalid URL format for service worker script: ${e}`)}})}catch(e){e instanceof TypeError&&e.message.includes("already exists")}})();const e="string"==typeof window._WORKER?window._WORKER:"/Worker.js",r="WorkerReload";if("serviceWorker"in navigator){navigator.serviceWorker.addEventListener("controllerchange",(()=>{"true"===sessionStorage.getItem(r)&&(sessionStorage.removeItem(r),window.location.reload())})),navigator.serviceWorker.addEventListener("message",(e=>{"New"===e.data?.Version&&window.location.reload()}));const t=async()=>{const t=!!navigator.serviceWorker.controller;try{let o;if(window.trustedTypes)try{const r=window._POLICY_WORKER?.WorkerApplication;if(!r)throw new Error("Required Trusted Types policy 'WorkerApplication' not found. Ensure Policy.js executes first and succeeds.");o=r.createScriptURL(e)}catch(e){throw e}else o=e;const i=await navigator.serviceWorker.register(o,{scope:"/Application",type:"module"});i.installing||i.waiting||i.active,await navigator.serviceWorker.ready;const n=!!navigator.serviceWorker.controller;if(t||n)sessionStorage.getItem(r)&&sessionStorage.removeItem(r);else{if(!sessionStorage.getItem(r))return sessionStorage.setItem(r,"true"),void window.location.reload();sessionStorage.removeItem(r)}}catch(e){e instanceof TypeError&&(e.message.includes("TrustedScriptURL")||e.message.includes("Trusted Type")),sessionStorage.removeItem(r)}};"loading"===document.readyState?document.addEventListener("DOMContentLoaded",t):t()}</script><script type=module src=/_astro/Browser.astro_astro_type_script_index_0_lang.Cm3WIShT.js></script></body></html>
1+
<!DOCTYPE html><html class=no-js data-beasties-container dir=ltr lang=en><head><script type=module>document.documentElement.classList.remove("no-js"),document.documentElement.classList.add("js")</script><title>FIDDEE</title><meta charset=utf-8><meta content name=description><meta content=yes name=mobile-web-app-capable><meta content=yes name=apple-mobile-web-app-capable><meta content=FIDDEE name=apple-mobile-web-app-title><meta content="width=device-width,initial-scale=1,maximum-scale=1,minimum-scale=1,user-scalable=no" name=viewport><meta content=#ffffff name=theme-color><meta content="telephone=no" name=format-detection><meta content=on name=twitter:dnt><meta content=" default-src 'none' ; img-src 'self' data: blob: vscode-remote-resource: vscode-managed-remote-resource: https: ; manifest-src 'self' ; media-src 'self' ; frame-src 'self' vscode-webview: ; script-src 'self' 'unsafe-eval' blob: ; style-src 'self' 'unsafe-inline' ; connect-src 'self' wss://tauri.localhost https: ; font-src 'self' vscode-remote-resource: vscode-managed-remote-resource: ; block-all-mixed-content ; upgrade-insecure-requests ; require-trusted-types-for 'script' ; trusted-types WorkerApplication amdLoader cellRendererEditorText defaultWorkerFactory diffEditorWidget diffReview domLineBreaksComputer dompurify editorGhostText editorViewLayer notebookRenderer stickyScrollViewLayer tokenizeToString notebookChatEditController ; " http-equiv=Content-Security-Policy><meta data-settings={&#34;remoteAuthority&#34;:&#34;&#34;,&#34;serverBasePath&#34;:&#34;/&#34;,&#34;connectionToken&#34;:&#34;&#34;,&#34;enableWorkspaceTrust&#34;:true,&#34;settingsSyncOptions&#34;:{&#34;enabled&#34;:false},&#34;productConfiguration&#34;:{&#34;embedderIdentifier&#34;:&#34;desktop&#34;,&#34;nameShort&#34;:&#34;FIDDEE&#34;,&#34;nameLong&#34;:&#34;FIDDEE&#34;,&#34;applicationName&#34;:&#34;fiddee&#34;},&#34;developmentOptions&#34;:{&#34;logLevel&#34;:0,&#34;enableSmokeTestDriver&#34;:false}} id=vscode-workbench-web-configuration><meta data-settings={} id=vscode-workbench-auth-session><link href=/Manifest.json rel=manifest crossorigin=use-credentials><script type=module>const Site="https://tauri.localhost/";globalThis._VSCODE_FILE_ROOT=`${Site}/Static/Application/`</script><script type=module>const Worker="/Worker.js?BASE_REMOTE=https%3A%2F%2Ftauri.localhost%2F&Time=1746516769390";window._WORKER=Worker</script><style>:root{--vscode-sash-size:4px;--vscode-sash-hover-size:4px}@property --chat-editing-last-edit-shift{syntax:"<percentage>";initial-value:100%;inherits:false}@property --inline-chat-frame-progress{syntax:"<percentage>";initial-value:0%;inherits:false}body{height:100%;width:100%;margin:0;padding:0;overflow:hidden;font-size:11px;user-select:none;-webkit-user-select:none}</style><link href=/_astro/Browser.CRM72xFj.css rel=stylesheet media=print onload="this.media=&#34;all&#34;"><noscript><link href=/_astro/Browser.CRM72xFj.css rel=stylesheet></noscript></head><body aria-label><script type=module>window._LOAD_CSS_WORKER=e=>{const r=e+(e.includes("?")?"&":"?")+"Skip=Intercept";try{if(document.querySelector(`link[href="${r}"]`))return;const e=document.createElement("link");e.rel="stylesheet",e.type="text/css",e.href=r,e.onerror=r=>{e.remove()},e.onload=()=>{},document.head.appendChild(e)}catch{}},(()=>{if(window._POLICY_WORKER=window._POLICY_WORKER||{},window.trustedTypes&&window.trustedTypes.createPolicy&&!window._POLICY_WORKER.WorkerApplication)try{window._POLICY_WORKER.WorkerApplication=window.trustedTypes.createPolicy("WorkerApplication",{createScriptURL:e=>{if(e&&/^\/[^/\\:]+\.js(\?.*)?$/.test(e))return e;throw new TypeError(`Invalid URL format for service worker script: ${e}`)}})}catch(e){e instanceof TypeError&&e.message.includes("already exists")}})();const e="string"==typeof window._WORKER?window._WORKER:"/Worker.js",r="WorkerReload";if("serviceWorker"in navigator){navigator.serviceWorker.addEventListener("controllerchange",(()=>{"true"===sessionStorage.getItem(r)&&(sessionStorage.removeItem(r),window.location.reload())})),navigator.serviceWorker.addEventListener("message",(e=>{"New"===e.data?.Version&&window.location.reload()}));const t=async()=>{const t=!!navigator.serviceWorker.controller;try{let o;if(window.trustedTypes)try{const r=window._POLICY_WORKER?.WorkerApplication;if(!r)throw new Error("Required Trusted Types policy 'WorkerApplication' not found. Ensure Policy.js executes first and succeeds.");o=r.createScriptURL(e)}catch(e){throw e}else o=e;const i=await navigator.serviceWorker.register(o,{scope:"/Application",type:"module"});i.installing||i.waiting||i.active,await navigator.serviceWorker.ready;const n=!!navigator.serviceWorker.controller;if(t||n)sessionStorage.getItem(r)&&sessionStorage.removeItem(r);else{if(!sessionStorage.getItem(r))return sessionStorage.setItem(r,"true"),void window.location.reload();sessionStorage.removeItem(r)}}catch(e){e instanceof TypeError&&(e.message.includes("TrustedScriptURL")||e.message.includes("Trusted Type")),sessionStorage.removeItem(r)}};"loading"===document.readyState?document.addEventListener("DOMContentLoaded",t):t()}</script><script type=module src=/_astro/Browser.astro_astro_type_script_index_0_lang.Cm3WIShT.js></script></body></html>

Target/Worker.js

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Target/index.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
<!DOCTYPE html><html class=no-js data-beasties-container dir=ltr lang=en><head><script type=module>document.documentElement.classList.remove("no-js"),document.documentElement.classList.add("js")</script><title></title><meta charset=utf-8><meta content name=description><meta content="width=device-width,initial-scale=1" name=viewport><meta content=#ffffff name=theme-color><meta content="telephone=no" name=format-detection><meta content=on name=twitter:dnt><link crossorigin=use-credentials href=/Manifest.json rel=manifest></head><body aria-label><a href=/Application>Application</a></body></html>
1+
<!DOCTYPE html><html class=no-js data-beasties-container dir=ltr lang=en><head><script type=module>document.documentElement.classList.remove("no-js"),document.documentElement.classList.add("js")</script><title>FIDDEE</title><meta charset=utf-8><meta content name=description><meta content=yes name=mobile-web-app-capable><meta content=yes name=apple-mobile-web-app-capable><meta content=FIDDEE name=apple-mobile-web-app-title><meta content="width=device-width,initial-scale=1,maximum-scale=1,minimum-scale=1,user-scalable=no" name=viewport><meta content=#ffffff name=theme-color><meta content="telephone=no" name=format-detection><meta content=on name=twitter:dnt><link crossorigin=use-credentials href=/Manifest.json rel=manifest></head><body aria-label><a href=/Application>Application</a></body></html>

0 commit comments

Comments
 (0)