fix: strip crossorigin from renderer HTML for file:// loads (white screen)

Vite injects crossorigin on script/link tags; under loadFile() + file:// Chromium
treats these as CORS fetches without ACAO, so JS/CSS fail and #root stays empty.

Release 0.2.6.

Made-with: Cursor

Author: agentkernel

electron.vite.config.ts

@@ -1,11 +1,30 @@
 import { defineConfig } from 'electron-vite'
+import type { Plugin } from 'vite'
 import react from '@vitejs/plugin-react'
 import tailwindcss from '@tailwindcss/vite'
 import path from 'path'
 import { fileURLToPath } from 'url'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 
+/**
+ * Vite injects `crossorigin` on injected script/link tags. With `loadFile()` the renderer uses
+ * the `file://` protocol; Chromium treats module scripts/styles with `crossorigin` as CORS fetches,
+ * which fail without ACAO headers — result is an empty #root (white screen). Strip for production HTML.
+ */
+function stripCrossoriginForFileProtocol(): Plugin {
+  return {
+    name: 'strip-crossorigin-file-protocol',
+    enforce: 'post',
+    transformIndexHtml: {
+      order: 'post',
+      handler(html: string) {
+        return html.replace(/\s+crossorigin(?:=["'][^"']*["'])?/gi, '')
+      },
+    },
+  }
+}
+
 export default defineConfig({
   main: {
     build: {
@@ -26,7 +45,7 @@ export default defineConfig({
   },
   renderer: {
     base: './',
-    plugins: [react(), tailwindcss()],
+    plugins: [react(), tailwindcss(), stripCrossoriginForFileProtocol()],
     resolve: {
       alias: {
         '@': path.resolve(__dirname, 'src/renderer'),

package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-desktop",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "Community-maintained Windows desktop app and installer for OpenClaw.",
   "type": "module",
   "main": "out/main/index.js",

resources/bundle-manifest.json

@@ -1,4 +1,4 @@
 {
-  "shellVersion": "0.2.5",
+  "shellVersion": "0.2.6",
   "bundledOpenClawVersion": "2026.3.23-1"
 }