From 5e7129b192da628b17cc516f94b6019bf41fd106 Mon Sep 17 00:00:00 2001 From: Marceli Pawlinski Date: Fri, 24 Jul 2026 02:59:23 +0100 Subject: [PATCH] fix: add try/catch for SSE JSON parsing and tighten CORS default --- main.ts | 6 +++++- main/backend-sidecar.ts | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/main.ts b/main.ts index 3298a0b1..08d61f6a 100644 --- a/main.ts +++ b/main.ts @@ -416,7 +416,11 @@ async function subscribeBackendEventsForWebContents(webContents: WebContents) { .map((line) => line.slice("data: ".length)) .join("\n"); if (data && !webContents.isDestroyed()) { - webContents.send("backend:event", JSON.parse(data)); + try { + webContents.send("backend:event", JSON.parse(data)); + } catch { + console.warn("Skipping malformed SSE event from backend"); + } } boundary = buffer.indexOf("\n\n"); } diff --git a/main/backend-sidecar.ts b/main/backend-sidecar.ts index 4d081db9..47ec2246 100644 --- a/main/backend-sidecar.ts +++ b/main/backend-sidecar.ts @@ -328,7 +328,7 @@ export function createBackendSidecarController(options: CreateBackendSidecarCont OPENGUI_AUTH_TOKEN: token, OPENGUI_ALLOWED_ROOTS: process.env.OPENGUI_ALLOWED_ROOTS || dependencies.homedir(), OPENGUI_DATA_DIR: dataDir, - OPENGUI_CORS_ORIGIN: process.env.OPENGUI_CORS_ORIGIN || "*", + OPENGUI_CORS_ORIGIN: process.env.OPENGUI_CORS_ORIGIN || "http://localhost:3000", OPENGUI_MODE: "desktop-sidecar", OPENGUI_SERVER_MODE: "desktop-sidecar", },