[aterga]

Summary

The wallet's security headers never reach the canister when it is deployed from a release artifact. app.orbit.global (and playground.orbitwallet.io) currently serve no Content-Security-Policy, X-Frame-Options, X-Content-Type-Options or Referrer-Policy, and none of the cache rules from the wallet's asset config apply. orbit.global and docs.orbit.global, whose .ic-assets.json is committed, serve theirs.

Cause

with-ic-assets generates .ic-assets.json in its writeBundle hook and wrote it to apps/wallet/public/. Vite copies public/ into the output before that hook runs, so the file only reached the output of a later build on the same machine. A clean build, such as the deterministic Docker build behind every release, never contains it. The 0.8.1 release tarball has no .ic-assets.json, so scripts/deploy-app uploads the assets without headers.

Changes

• with-ic-assets.plugin.ts: write .ic-assets.json into the build output (dir), next to the assets it configures. The publicDir option is dropped; nothing passed it.
• with-versioned-entrypoint.plugin.ts: don't copy a leftover public/.ic-assets.json (from builds before this change) into dist/v<version>/. A nested config there would override the root one for the versioned UI.
• with-ic-assets.plugin.spec.ts: new tests. The file is written into the output, sets X-Frame-Options: DENY, nosniff, a CSP with default-src 'none' and frame-ancestors 'none', and allows inline scripts of index.html by hash.

The released index.html and v0.8.1/index.html contain no inline scripts, so the root CSP applies to the versioned UIs unchanged.

Testing

• New unit tests (run in CI; dependencies could not be installed in the environment this was written in).
• The deterministic build artifact from this PR's CI should contain .ic-assets.json at its root.
• After the next wallet release: deploy to playground first and check that the app still works under the CSP (it has not been enforced on deployed builds for a while), and that the headers are present, before production.

---

Generated by Claude Code

[Copilot]

🟡 Changes recommended

The enforced connect-src policy blocks both WASM chunk store subdomains, causing registry-based disaster recovery to fail before WASM and Candid can be loaded.

1 open issue

• CSP blocks registry-based disaster recovery from WASM chunk stores · New

What changed in this PR

This PR ensures clean wallet builds include the asset configuration needed to apply security headers and cache rules when deploying release artifacts.

Changes:

• Write .ic-assets.json directly into the build output and remove the unused publicDir option.
• Exclude stale asset configuration files when copying public assets into versioned directories.
• Add unit tests for output placement, security headers, and inline-script hashes.

File	Description
apps/​wallet/​build/​plugins/​with-versioned-entrypoint.plugin.ts	Prevent stale nested asset configurations from overriding the root configuration.
apps/​wallet/​build/​plugins/​with-ic-assets.plugin.ts	Generate the asset configuration directly in the build output.
apps/​wallet/​build/​plugins/​with-ic-assets.plugin.spec.ts	Test configuration generation and security policy contents.

_{Review effort: Balanced}

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 13b4396.

Security Overview

• 🔎 Scanned files: 3 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/5243341a-e7d7-47de-848a-f52264761c93?scanId=918bbf4a-b6e9-4c8b-bc27-5c6ac8eca34a&codeScanTypes=PrScan&tab=issues&detectionTypes=traditional,businessLogic,customRule,IAC,SECRETS,CICD,EOL,uncategorized

Detected Code Changes

Change Type	Relevant files
Enhancement	► apps/wallet/build/plugins/with-ic-assets.plugin.ts     Implement Vercel OAuth Flow
Enhancement	► apps/wallet/build/plugins/with-versioned-entrypoint.plugin.ts     Adjust copy behavior to exclude .ic-assets.json5?

[Copilot]

🔵 Needs a closer look

Activating the previously unenforced wallet CSP requires release-artifact and deployed-header checks plus playground browser validation of login, versioned navigation, and disaster-recovery downloads, since unit tests alone cannot establish runtime compatibility.

No open issues 🎉

1 resolved since last review

• CSP blocks registry-based disaster recovery from WASM chunk stores

_{Review effort: Balanced}