mount acp in the goosed server to migrate using acp protocols iteratively (#9097)

ui/desktop/src/utils/__tests__/csp.test.ts

@@ -7,6 +7,7 @@ describe('buildConnectSrc', () => {
     const result = buildConnectSrc(undefined);
     expect(result).toContain("'self'");
     expect(result).toContain('http://127.0.0.1:*');
+    expect(result).toContain('wss://127.0.0.1:*');
   });
 
   it('includes external backend origin when enabled', () => {
@@ -17,6 +18,18 @@ describe('buildConnectSrc', () => {
     };
     const result = buildConnectSrc(config);
     expect(result).toContain('http://dev.company.net:12604');
+    expect(result).toContain('ws://dev.company.net:12604');
+  });
+
+  it('includes external secure WebSocket origin for HTTPS backends', () => {
+    const config: ExternalGoosedConfig = {
+      enabled: true,
+      url: 'https://secure.company.net:12604',
+      secret: 'test',
+    };
+    const result = buildConnectSrc(config);
+    expect(result).toContain('https://secure.company.net:12604');
+    expect(result).toContain('wss://secure.company.net:12604');
   });
 
   it('does not include external origin when disabled', () => {

ui/desktop/src/utils/csp.ts

@@ -4,8 +4,12 @@ const DEFAULT_CONNECT_SOURCES = [
   "'self'",
   'http://127.0.0.1:*',
   'https://127.0.0.1:*',
+  'ws://127.0.0.1:*',
+  'wss://127.0.0.1:*',
   'http://localhost:*',
   'https://localhost:*',
+  'ws://localhost:*',
+  'wss://localhost:*',
   'https://api.github.com',
   'https://github.com',
   'https://objects.githubusercontent.com',
@@ -18,6 +22,8 @@ export function buildConnectSrc(externalGoosed?: ExternalGoosedConfig): string {
     try {
       const externalUrl = new URL(externalGoosed.url);
       sources.push(externalUrl.origin);
+      externalUrl.protocol = externalUrl.protocol === 'https:' ? 'wss:' : 'ws:';
+      sources.push(externalUrl.origin);
     } catch {
       console.warn('Invalid external goosed URL in settings, skipping CSP entry');
     }