From aa8046e56d6ee6d513e2e7b131eaf90c8b3d3fdb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=9B=B7=E7=94=B5=E8=8A=BD=E8=A1=A3?=
 <zhangyanghaha0407@outlook.com>
Date: Thu, 21 May 2026 19:54:09 -0400
Subject: [PATCH] Fix blank dev window by relaxing CSP for HMR

The global webRequest.onHeadersReceived CSP rewrite was attached to
session.defaultSession, which intercepts every Chromium request
(including devtools and network service internals) and crashed the
network service in dev. Drop the global override and rely on the
renderer-level meta tag, widened to allow Vite's localhost HMR
connections.
---
 AgentCompany-New/src/main/index.ts       | 18 +-----------------
 AgentCompany-New/src/renderer/index.html |  2 +-
 2 files changed, 2 insertions(+), 18 deletions(-)

diff --git a/AgentCompany-New/src/main/index.ts b/AgentCompany-New/src/main/index.ts
index a2742a28..779fdbf6 100644
--- a/AgentCompany-New/src/main/index.ts
+++ b/AgentCompany-New/src/main/index.ts
@@ -1,4 +1,4 @@
-import { app, session } from "electron";
+import { app } from "electron";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { DatabaseConnection } from "./database/connection";
@@ -13,22 +13,6 @@ if (!hasSingleInstanceLock) {
 }
 
 app.whenReady().then(() => {
-  session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
-    callback({
-      responseHeaders: {
-        ...details.responseHeaders,
-        "Content-Security-Policy": [
-          "default-src 'self'",
-          "script-src 'self'",
-          "style-src 'self' 'unsafe-inline'",
-          "img-src 'self' data:",
-          "connect-src 'self' http://localhost:* ws://localhost:*",
-          "font-src 'self' data:",
-        ].join("; "),
-      },
-    });
-  });
-
   const profileDir = process.env.AGENTCOMPANY_NEW_PROFILE_DIR ?? join(app.getPath("userData"), "profile");
   const connection = new DatabaseConnection(join(profileDir, "agentcompany.db"));
   const win = createMainWindow({
diff --git a/AgentCompany-New/src/renderer/index.html b/AgentCompany-New/src/renderer/index.html
index 64d9113d..89017642 100644
--- a/AgentCompany-New/src/renderer/index.html
+++ b/AgentCompany-New/src/renderer/index.html
@@ -4,7 +4,7 @@
     <meta charset="UTF-8" />
     <meta
       http-equiv="Content-Security-Policy"
-      content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:;"
+      content="default-src 'self' 'unsafe-inline' http://localhost:* ws://localhost:* data:; img-src 'self' data:; font-src 'self' data:;"
     />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>AgentCompany</title>