OpenCode Web crashes when selecting any project #19241

Activity

1. onicad

   added

   bugSomething isn't workingSomething isn't working

   on Mar 26, 2026
2. github-actions

   assigned

   Brendonovich

   on Mar 26, 2026
3. github-actions

   added

   webRelates to opencode on web / desktopRelates to opencode on web / desktop

   windows

   on Mar 26, 2026
4. github-actions commented on Mar 26, 2026

   

   github-actionsBot

   on Mar 26, 2026 – with GitHub Actions

   Contributor

   More actions

   This issue might be a duplicate of existing issues. Please check:

   • Crisis bug: The web UI suddenly crashes, while the TUI and desktop work normally (numerous reports on Discard). #19222: Same TypeError: Cannot read properties of undefined (reading 'replaceAll') error in the web UI on v1.3.2
   • OpenCode web fully unusable after JavaScript error #19240: OpenCode web fully unusable after JavaScript error (same version, same general symptoms)
   • TypeError: e.diffs.map is not a function when reopening old browser session #19217: Mentions TypeError: e.diffs.map is not a function — which you also reported as a secondary error

   Please review the above issues and comment there if your problem matches.
5. liuhezhixi commented on Mar 26, 2026

   

   liuhezhixi

   on Mar 26, 2026

   More actions

   Same problem, but I installed it using npm in a Windows environment.
6. StephaneCavallero commented on Mar 26, 2026

   

   StephaneCavallero

   on Mar 26, 2026

   Last edited by StephaneCavallero

   More actions

   Duplicate of #19217 ?
   (link to workaround)

   Edit : better workaround : #19241 (comment)
7. natewill commented on Mar 26, 2026

   

   natewill

   on Mar 26, 2026

   Last edited by natewill

   Contributor

   More actions

   Fixes bug

   1. Open DevTools.
   2. DevTools ⋮ → More tools → Request conditions
   3. In that drawer, add:
      *://127.0.0.1:4096/vcs/diff*
*://localhost:4096/vcs/diff*
   4. Turn on “Enable blocking and throttling”
   5. Reload the page

   👍React with 👍5Reacted by ODD, Stéphane Cavallero, ghiagio, Lean Junio and Josh McDonald
8. onicad commented on Mar 26, 2026

   

   onicad

   on Mar 26, 2026

   Author

   More actions

   Additional finding (likely root cause)

   I investigated further using the browser console and found a CSP-related error when selecting a project/session:

   Executing inline script violates the following Content Security Policy directive:
   "script-src 'self' 'wasm-unsafe-eval'".
   Either the 'unsafe-inline' keyword, a hash, or a nonce is required.
   

   This appears at the moment when the UI crashes.

   Observations

   • Happens when selecting a project or switching sessions
   • Reproducible across multiple projects (including a fresh empty repo)
   • Server endpoints (/project, /session, /vcs/diff) all return successfully
   • Issue seems entirely on the frontend (web UI)

   Hypothesis

   It looks like the web UI is attempting to execute an inline script generated from session data, which is blocked by CSP. This might also explain errors like:

   • e.diffs.map is not a function
   • Cannot read properties of undefined (reading 'replaceAll')

   Workaround

   • CLI works fine
   • Web sometimes works after clearing storage or restarting, but loses proper diff visualization

   Suggestion

   Possibly related to how session data is rendered into the DOM. Maybe missing nonce or unsafe inline usage.

   Let me know if you want additional logs or reproduction steps.
9. natewill commented on Mar 26, 2026

   

   natewill

   on Mar 26, 2026

   Contributor

   More actions

   @onicad just run

   1. Open DevTools.
   2. DevTools ⋮ → More tools → Request conditions
   3. In that drawer, add:
      ://127.0.0.1:4096/vcs/diff
      ://localhost:4096/vcs/diff
   4. Turn on “Enable blocking and throttling”
   5. Reload the page
10. milewski commented on Mar 26, 2026

    

    milewski

    on Mar 26, 2026

    More actions

    A few console errors:

    Executing inline script violates the following Content Security Policy directive 'script-src 'self' 'wasm-unsafe-eval''. Either the 'unsafe-inline' keyword, a hash ('sha256-QI23YWMJrD/tljM6/82tpL8EwqdBoptwZfycFHA9IiQ='), or a nonce ('nonce-...') is required to enable inline execution. The action has been blocked.

    Connecting to 'https://opencode.ai/changelog.json' violates the following Content Security Policy directive: "connect-src 'self' data:". The action has been blocked.

    Fetch API cannot load https://opencode.ai/changelog.json. Refused to connect because it violates the document's Content Security Policy.
11. onicad commented on Mar 26, 2026

    

    onicad

    on Mar 26, 2026

    Author

    More actions

    Confirmed: if I block these requests in Chrome DevTools Request Blocking,

    *://127.0.0.1:4096/vcs/diff*
    *://localhost:4096/vcs/diff*
    

    the web UI no longer crashes when selecting a project.

    So the crash appears to be triggered by /vcs/diff specifically.

    Without blocking /vcs/diff, selecting a project crashes the UI with errors like:

    • TypeError: Cannot read properties of undefined (reading 'replaceAll')
    • previously also e.diffs.map is not a function

    With /vcs/diff blocked, project selection works.

    This seems to narrow the issue down to the diff response or how the frontend processes it.
12. onicad

    closed this as completedon Mar 26, 2026
13. dongjiang1989

    added a commit that references this issue on Mar 26, 2026

    fix: add defensive checks for undefined values in diff handling

    ...

    This issue will close once commit de3b587 is merged into the 'dev' branch.

    de3b587