From 6d3e973848eb810b7368b9e21ab10955dbf137c0 Mon Sep 17 00:00:00 2001
From: Vantz Stockwell <vstockwell@predator-mini.local>
Date: Mon, 30 Mar 2026 12:56:24 -0400
Subject: [PATCH] fix: strip crossorigin from HTML for WKWebView child windows
 + status bar
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Tool windows (still closing instantly with CSP=null):
- Root cause: Vite adds crossorigin attribute to <script> and <link> tags
  in index.html. This forces CORS mode for resource loading. WKWebView's
  Tauri custom protocol handler (tauri://) may not return proper CORS
  headers for child WebviewWindows, causing the module script to fail
  to load and the window to close immediately.
- Fix: Vite plugin strips crossorigin from built HTML via transformIndexHtml
- Also set crossOriginLoading: false for Rollup output chunks

Status bar:
- h-[48px] text-base px-6 — 48px height with 16px text, explicit pixel
  value to avoid Tailwind spacing ambiguity

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 src/components/common/StatusBar.vue |  2 +-
 vite.config.ts                      | 18 ++++++++++++++++--
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/src/components/common/StatusBar.vue b/src/components/common/StatusBar.vue
index 2582ea7..8d6cd9e 100644
--- a/src/components/common/StatusBar.vue
+++ b/src/components/common/StatusBar.vue
@@ -1,5 +1,5 @@
 <template>
-  <div class="h-10 flex items-center justify-between px-4 bg-[var(--wraith-bg-secondary)] border-t border-[var(--wraith-border)] text-sm text-[var(--wraith-text-muted)] shrink-0">
+  <div class="h-[48px] flex items-center justify-between px-6 bg-[var(--wraith-bg-secondary)] border-t border-[var(--wraith-border)] text-base text-[var(--wraith-text-muted)] shrink-0">
     <!-- Left: connection info -->
     <div class="flex items-center gap-3">
       <template v-if="sessionStore.activeSession">
diff --git a/vite.config.ts b/vite.config.ts
index 1b2d5fc..195a147 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -1,10 +1,20 @@
-import { defineConfig } from "vite";
+import { defineConfig, type Plugin } from "vite";
 import vue from "@vitejs/plugin-vue";
 import tailwindcss from "@tailwindcss/vite";
 import { resolve } from "path";
 
+/** Strip crossorigin attribute from HTML — WKWebView + Tauri custom protocol compatibility. */
+function stripCrossOrigin(): Plugin {
+  return {
+    name: "strip-crossorigin",
+    transformIndexHtml(html) {
+      return html.replace(/ crossorigin/g, "");
+    },
+  };
+}
+
 export default defineConfig({
-  plugins: [vue(), tailwindcss()],
+  plugins: [vue(), tailwindcss(), stripCrossOrigin()],
   resolve: {
     alias: {
       "@": resolve(__dirname, "src"),
@@ -23,5 +33,9 @@ export default defineConfig({
     target: ["es2021", "chrome100", "safari13"],
     minify: !process.env.TAURI_DEBUG ? "esbuild" : false,
     sourcemap: !!process.env.TAURI_DEBUG,
+    // Disable crossorigin attribute on script/link tags — WKWebView on
+    // macOS may reject CORS-mode requests for Tauri's custom tauri://
+    // protocol in dynamically created child WebviewWindows.
+    crossOriginLoading: false,
   },
 });