From a6eacc533cdaa8fc6142c505c1267295b22d90ab Mon Sep 17 00:00:00 2001
From: Hiroshi Ogawa <4232207+hi-ogawa@users.noreply.github.com>
Date: Mon, 7 Sep 2026 22:07:05 +0900
Subject: [PATCH] fix: preserve trace webview origin and allow Google Fonts

Co-authored-by: OpenCode (gpt-6-astra) <noreply@opencode.ai>
---
 packages/extension/src/traceView.ts | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/packages/extension/src/traceView.ts b/packages/extension/src/traceView.ts
index c028532..8c5654b 100644
--- a/packages/extension/src/traceView.ts
+++ b/packages/extension/src/traceView.ts
@@ -130,11 +130,21 @@ export class TraceViewManager {
         /new URL\("\.\/ui\/html\.meta\.json\.gz", window\.location\.href\)/g,
         JSON.stringify(`${metadata.toString()}?v=${Date.now()}`),
       )
+      // Keep the document base on the webview origin so history updates stay
+      // same-origin. Only resource URLs should point at the report directory.
+      html = html.replace(/<(script|link|img|source)\b[^>]*>/gi, tag => tag.replace(
+        /(\s)(src|href)\s*=\s*(['"])(.*?)\3/gi,
+        (attribute, space, name, quote, value) => {
+          if (!value || /^(?:[a-z][a-z\d+.-]*:|\/\/|#)/i.test(value))
+            return attribute
+          const url = new URL(value.replace(/&amp;/g, '&'), base).href
+          return `${space}${name}=${quote}${url.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/'/g, '&#39;')}${quote}`
+        },
+      ))
       html = html.replace(/<script\b/g, `<script nonce="${nonce}"`)
       const hash = JSON.stringify(selection).replace(/</g, '\\u003c')
       html = html.replace(/<head\b[^>]*>/i, `$&
-        <meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src ${source} 'nonce-${nonce}'; style-src ${source} 'unsafe-inline'; img-src ${source} data: blob: https:; font-src ${source} data: https:; connect-src ${source}; frame-src 'self' blob: data:;">
-        <base href="${base.replace(/&/g, '&amp;').replace(/"/g, '&quot;')}">
+        <meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src ${source} 'nonce-${nonce}'; style-src ${source} https://fonts.googleapis.com 'unsafe-inline'; img-src ${source} data: blob: https:; font-src ${source} data: https:; connect-src ${source}; frame-src 'self' blob: data:;">
         <script nonce="${nonce}">
           (() => {
             window.location.hash = ${hash};
-- 
2.51.2