Windows desktop annotation screenshots are dropped because fetch(dataUrl) violates CSP

[vedprakash2302]

Bug

In the Windows desktop app, selecting an element in the in-app browser, adding a comment, and attaching or sending the annotation drops the screenshot. T3 shows:

Could not capture the picked element
The annotation was kept without the screenshot.

The agent receives the comment, selector, HTML, and styles, but no image.

Version: 0.0.43-nightly.20260917.1851.

Reproduction

1. Open a page in the desktop app's in-app browser. The affected page was Scout at http://localhost:3001/login.
2. Select an element with the annotation picker and enter a comment.
3. Attach the annotation or send it directly to an agent.
4. Observe the missing image and the main app's DevTools error:

Connecting to 'data:image/png;base64,...' violates the following Content Security Policy directive:
"connect-src 'self' http: https: ws: wss:".
Fetch API cannot load data:image/png;base64,... .
Refused to connect because it violates the document's Content Security Policy.

This reproduces both on the Windows machine hosting the WSL backend and on a Surface connected to that backend through an SSH localhost forward. The tunnel is not required. Ordinary browser snapshots and DOM inspection work.

Cause confirmed in source

• apps/desktop/src/preview/Manager.ts captures the crop with Electron and returns image.toDataURL().
• apps/web/src/lib/previewAnnotation.ts calls fetch(annotation.screenshot.dataUrl) to create the attachment. That request is subject to connect-src.
• apps/desktop/src/electron/ElectronProtocol.ts applies the policy above to both packaged client assets and the development proxy.
• The conversion failure reaches the existing text-only fallback in PreviewView.tsx.

Proposed fix and verification

Reuse the existing dataUrlToFile helper to decode the generated base64 PNG directly, without a fetch. Keep CSP unchanged and preserve annotation text on missing or malformed screenshots, plus Electron's capture timeout and failure handling.

A local patch passed focused regression tests and an integrated Windows desktop check using the installed nightly's Electron shell with the patched development renderer at t3code-dev://app/, connected to an isolated WSL backend. The original desktop CSP remained enforced.

• Attach then send delivered a 7,238-byte PNG of Scout's "Sign in" button. The image in OpenCode's native message event matched the composer file byte-for-byte.
• Ctrl+Enter direct-send delivered an 11,202-byte PNG of "Continue with Google".
• Both native provider messages contained image/png file parts, and the agent described the images correctly.
• Neither flow produced the screenshot-failure toast or a CSP violation.

The patch has not been packaged into a new installer or retested on the Surface through SSH.

[juliusmarminge]

Triage

Confirmed on current main. This is a desktop CSP / data-URL conversion bug, not a failed Electron crop.

What happens

1. apps/desktop/src/preview/Manager.ts crops via webContents.capturePage and returns image.toDataURL().
2. apps/web/src/lib/previewAnnotation.ts turns that into a composer File with fetch(annotation.screenshot.dataUrl).
3. Desktop CSP from apps/desktop/src/electron/ElectronProtocol.ts sets connect-src 'self' http: https: ws: wss: — no data:. fetch of a data: URL is a connect, so Chromium refuses it. (img-src already allows data:; that does not help fetch.)
4. PreviewView treats the conversion failure like a missing crop and toasts “Could not capture the picked element” / “The annotation was kept without the screenshot,” then sends text-only.

That matches the DevTools CSP error and the WSL / SSH-forward repros (tunnel unrelated). Ordinary SnapShot / DOM inspection use different paths (dataUrlToFile already exists in imageCompression.ts and is what SnapShot uses).

Not the same as

Issue	Why different
#10366	Real 5s capturePage timeout on the main process
#9094 / #9700	Inline chat images / OpenCode clipboard paste
#11867	Same toast; may be this CSP path or the timeout path — re-check after the fix

Fix direction

Decode with dataUrlToFile (no fetch), keep CSP unchanged, keep text-only fallback for missing/malformed crops. Electron’s capture timeout stays where it is.

Open fix: #12267 (same reporter). Accepting; next step is review/merge that PR, then confirm #11867.

[Nozzit]

Same thing on Linux, so this isn't Windows-specific: AppImage 0.0.42 on Zorin OS 18 (Ubuntu 24.04 base), GNOME 46, Wayland. Every annotation mode ends with "Could not capture the picked element"; comment, selectors, HTML and styles arrive, the image doesn't.

The desktop trace agrees with the triage above. For a failed pick, PreviewManager.pickElement settles about 80 ms after the annotation message comes in, with exit: Success and no "preview annotation screenshot timed out" warning, so capturePage did its job. The packaged app has connect-src 'self' http: https: ws: wss:, and fetch(dataUrl) in the renderer is what drops the image.

[cestercian]

Taking this — working on a fix.