@@ -785,7 +785,7 @@ export class ClineProvider
785785 webviewView . webview . html =
786786 this . contextProxy . extensionMode === vscode . ExtensionMode . Development
787787 ? await this . getHMRHtmlContent ( webviewView . webview )
788- : this . getHtmlContent ( webviewView . webview )
788+ : await this . getHtmlContent ( webviewView . webview )
789789
790790 // Sets up an event listener to listen for messages passed from the webview view context
791791 // and executes code based on the message that is received.
@@ -1019,6 +1019,12 @@ export class ClineProvider
10191019
10201020 const nonce = getNonce ( )
10211021
1022+ // Get the OpenRouter base URL from configuration
1023+ const { apiConfiguration } = await this . getState ( )
1024+ const openRouterBaseUrl = apiConfiguration . openRouterBaseUrl || "https://openrouter.ai"
1025+ // Extract the domain for CSP
1026+ const openRouterDomain = openRouterBaseUrl . match ( / ^ ( h t t p s ? : \/ \/ [ ^ \/ ] + ) / ) ?. [ 1 ] || "https://openrouter.ai"
1027+
10221028 const stylesUri = getUri ( webview , this . contextProxy . extensionUri , [
10231029 "webview-ui" ,
10241030 "build" ,
@@ -1055,7 +1061,7 @@ export class ClineProvider
10551061 `img-src ${ webview . cspSource } https://storage.googleapis.com https://img.clerk.com data:` ,
10561062 `media-src ${ webview . cspSource } ` ,
10571063 `script-src 'unsafe-eval' ${ webview . cspSource } https://* https://*.posthog.com http://${ localServerUrl } http://0.0.0.0:${ localPort } 'nonce-${ nonce } '` ,
1058- `connect-src ${ webview . cspSource } https://* https://*.posthog.com ws://${ localServerUrl } ws://0.0.0.0:${ localPort } http://${ localServerUrl } http://0.0.0.0:${ localPort } ` ,
1064+ `connect-src ${ webview . cspSource } ${ openRouterDomain } https://* https://*.posthog.com ws://${ localServerUrl } ws://0.0.0.0:${ localPort } http://${ localServerUrl } http://0.0.0.0:${ localPort } ` ,
10591065 ]
10601066
10611067 return /*html*/ `
@@ -1094,7 +1100,7 @@ export class ClineProvider
10941100 * @returns A template string literal containing the HTML that should be
10951101 * rendered within the webview panel
10961102 */
1097- private getHtmlContent ( webview : vscode . Webview ) : string {
1103+ private async getHtmlContent ( webview : vscode . Webview ) : Promise < string > {
10981104 // Get the local path to main script run in the webview,
10991105 // then convert it to a uri we can use in the webview.
11001106
@@ -1129,6 +1135,12 @@ export class ClineProvider
11291135 */
11301136 const nonce = getNonce ( )
11311137
1138+ // Get the OpenRouter base URL from configuration
1139+ const { apiConfiguration } = await this . getState ( )
1140+ const openRouterBaseUrl = apiConfiguration . openRouterBaseUrl || "https://openrouter.ai"
1141+ // Extract the domain for CSP
1142+ const openRouterDomain = openRouterBaseUrl . match ( / ^ ( h t t p s ? : \/ \/ [ ^ \/ ] + ) / ) ?. [ 1 ] || "https://openrouter.ai"
1143+
11321144 // Tip: Install the es6-string-html VS Code extension to enable code highlighting below
11331145 return /*html*/ `
11341146 <!DOCTYPE html>
@@ -1137,7 +1149,7 @@ export class ClineProvider
11371149 <meta charset="utf-8">
11381150 <meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no">
11391151 <meta name="theme-color" content="#000000">
1140- <meta http-equiv="Content-Security-Policy" content="default-src 'none'; font-src ${ webview . cspSource } data:; style-src ${ webview . cspSource } 'unsafe-inline'; img-src ${ webview . cspSource } https://storage.googleapis.com https://img.clerk.com data:; media-src ${ webview . cspSource } ; script-src ${ webview . cspSource } 'wasm-unsafe-eval' 'nonce-${ nonce } ' https://us-assets.i.posthog.com 'strict-dynamic'; connect-src ${ webview . cspSource } https://openrouter.ai https://api.requesty.ai https://us.i.posthog.com https://us-assets.i.posthog.com;">
1152+ <meta http-equiv="Content-Security-Policy" content="default-src 'none'; font-src ${ webview . cspSource } data:; style-src ${ webview . cspSource } 'unsafe-inline'; img-src ${ webview . cspSource } https://storage.googleapis.com https://img.clerk.com data:; media-src ${ webview . cspSource } ; script-src ${ webview . cspSource } 'wasm-unsafe-eval' 'nonce-${ nonce } ' https://us-assets.i.posthog.com 'strict-dynamic'; connect-src ${ webview . cspSource } ${ openRouterDomain } https://api.requesty.ai https://us.i.posthog.com https://us-assets.i.posthog.com;">
11411153 <link rel="stylesheet" type="text/css" href="${ stylesUri } ">
11421154 <link href="${ codiconsUri } " rel="stylesheet" />
11431155 <script nonce="${ nonce } ">
0 commit comments