fix(1.0.8): strip cliqz adblocker preload — breaks CSP-strict sites

cliqz/adblocker-electron registers its preload at session level via
session.setPreloads([...preloads, PRELOAD_PATH]) inside
enableBlockingInSession. That preload injects inline <script> elements
via doc.createElement('script') + script.appendChild(textNode) +
parent.appendChild(script). On modern strict-CSP sites this breaks:

- Trusted Types (YouTube, Gmail): "An HTMLScriptElement was directly
  modified and will not be executed" — 52+ console errors.
- Nonce-required CSP (kinogo via Cloudflare): "Refused to execute inline
  script ... script-src 'nonce-...'" — competing with Cloudflare's
  challenge JS, likely the proximate cause of the 403 we see on kinogo
  (CF treats the broken page as bot).

Remove the cliqz preload from each session immediately after
enableBlockingInSession. The network/CSP/blockers attached via
webRequest hooks remain active — only the script-injection layer for
anti-anti-adblock scriptlets is lost, which is a niche feature that
breaks more sites than it fixes.

The 1.0.7 Blink TrustedDOMTypes disable stays (defense in depth, no
cost). The 1.0.6 CSP-header strip stays removed (adblocker overwrites
the webRequest listener anyway).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

main.js

@@ -6,6 +6,16 @@ const cheerio = require('cheerio');
 const { ElectronBlocker, adsAndTrackingLists } = require('@cliqz/adblocker-electron');
 const { autoUpdater } = require('electron-updater');
 
+// Disable Trusted Types CSP enforcement engine-wide.
+// YouTube sends `Content-Security-Policy: require-trusted-types-for 'script'`,
+// which blocks the cliqz adblocker's scriptlet injection (it uses plain
+// `script.text = ...`) → 52+ console errors and broken anti-adblock neutralizers.
+// Stripping the CSP header via webRequest doesn't work — the adblocker's own
+// onHeadersReceived hook overwrites ours (Electron allows only one listener
+// per session). Disabling the Blink feature is the cleanest fix; safe in a
+// kiosk single-user context.
+app.commandLine.appendSwitch('disable-blink-features', 'TrustedDOMTypes');
+
 const CONFIG_PATH = path.join(os.homedir(), '.ESH-Media.json');
 const BLOCKER_CACHE_PATH = path.join(os.homedir(), '.ESH-Media-adblock-v3.bin');
 const DEFAULT_TRUSTED_DOMAINS = [
@@ -101,7 +111,27 @@ function getBlocker() {
 
 function enableBlockingInSession(sess) {
   getBlocker()
-    .then(b => { b.enableBlockingInSession(sess); console.log('[adblock] enabled for session'); })
+    .then(b => {
+      b.enableBlockingInSession(sess);
+      // Remove the cliqz preload script that the blocker just registered on this
+      // session. The preload injects inline <script> elements (via createTextNode +
+      // appendChild) to neutralize anti-adblock scripts, but:
+      //   • Strict-CSP sites (kinogo via Cloudflare, etc.) reject inline scripts
+      //     without a matching nonce → "Refused to execute inline script".
+      //   • Trusted-Types sites (YouTube, Gmail) reject `script.appendChild(text)`
+      //     → "HTMLScriptElement was directly modified" (52 errors).
+      // We keep the adblocker's network blocking and CSP filtering (via the still-
+      // attached webRequest hooks), losing only the niche scriptlet/cosmetic-DOM
+      // injection layer that breaks more sites than it helps.
+      const before = sess.getPreloads();
+      const after = before.filter(p => !/adblocker-electron-preload/i.test(p));
+      if (after.length !== before.length) {
+        sess.setPreloads(after);
+        console.log('[adblock] enabled for session (preload script disabled)');
+      } else {
+        console.log('[adblock] enabled for session');
+      }
+    })
     .catch(e => console.warn('[adblock] failed to enable:', e.message));
 }
 
@@ -334,6 +364,20 @@ ipcMain.handle('check-update-now', async () => {
 
 // --- Window ---
 
+function attachDevToolsShortcut(webContents) {
+  // Ctrl+Shift+I / F12 open DevTools on this webContents.
+  // Always available so a kiosk machine can be debugged without un-kiosking.
+  webContents.on('before-input-event', (_e, input) => {
+    if (input.type !== 'keyDown') return;
+    const isDevToolsCombo =
+      (input.control && input.shift && (input.key === 'I' || input.key === 'i')) ||
+      input.key === 'F12';
+    if (isDevToolsCombo) {
+      try { webContents.openDevTools({ mode: 'detach' }); } catch (_) {}
+    }
+  });
+}
+
 async function createWindow() {
   mainWindow = new BrowserWindow({
     width: 1280,
@@ -347,6 +391,8 @@ async function createWindow() {
     },
   });
 
+  attachDevToolsShortcut(mainWindow.webContents);
+
   if (isDev) {
     mainWindow.loadURL(RENDERER_URL);
   } else {
@@ -506,19 +552,22 @@ async function restoreSession() {
     const sess = cfg.openedSession;
     if (!sess || !Array.isArray(sess.tabs) || !sess.tabs.length) return;
     console.log(`[session] restoring ${sess.tabs.length} tab(s), active=${sess.activeName}`);
-    // Spawn each saved tab by replaying create-view. ipcMain.emit triggers the handler
+    // Spawn each saved tab by replaying create-view, sequentially with a small delay.
-    // synchronously; the view's loadURL is fire-and-forget. We chain via setTimeout to
+    // Concurrent create-view calls in v1.0.3 caused races: multiple setLoader/addChild
-    // avoid stacking N loaders simultaneously.
+    // interleaved → some views ended up unmounted (white screen). Spacing them out
+    // gives each view time to mount before the next steals currentView.
+    const fakeEvent = { sender: mainWindow.webContents };
     for (const tab of sess.tabs) {
       if (!tab?.name || !tab?.url) continue;
-      ipcMain.emit('create-view', { sender: mainWindow.webContents }, tab.name, tab.url, tab.imageUrl || '', 1.0, !!tab.useProxy);
+      ipcMain.emit('create-view', fakeEvent, tab.name, tab.url, tab.imageUrl || '', 1.0, !!tab.useProxy);
+      await new Promise(r => setTimeout(r, 150));
     }
-    // After all spawned, the last one is `currentView`. Switch to the saved active if different.
+    // Switch to saved active if it isn't already the last-spawned (currentView).
     if (sess.activeName === 'home') {
-      ipcMain.emit('hide-view', { sender: mainWindow.webContents });
+      ipcMain.emit('hide-view', fakeEvent);
       sendOpenedApps('home');
     } else if (sess.activeName && sess.activeName !== currentView?.name) {
-      ipcMain.emit('show-view', { sender: mainWindow.webContents }, sess.activeName);
+      ipcMain.emit('show-view', fakeEvent, sess.activeName);
     }
   } catch (e) {
     console.warn('[session] restore failed:', e.message);
@@ -557,6 +606,7 @@ ipcMain.on('create-view', async (_event, name, url, imageUrl, _zoom, useProxy) =
   openedApps.push(appEntry);
   currentView = appEntry;
   view.setBounds(getViewBounds());
+  attachDevToolsShortcut(view.webContents);
 
   view.webContents.on('did-finish-load', () => {
     removeLoader();
@@ -1190,23 +1240,14 @@ app.whenReady().then(async () => {
   app.userAgentFallback = cleanUserAgent;
   session.defaultSession.setUserAgent(cleanUserAgent);
 
-  // Chrome version from the cleaned UA — used for client hints below
+  // Add Referer to image requests so hotlink protection doesn't block them.
-  const chromeVerMatch = cleanUserAgent.match(/Chrome\/(\d+)/);
+  // (Sec-CH-UA spoofing was tried in 1.0.4 and caused white pages — reverted.
-  const chromeMajor = chromeVerMatch ? chromeVerMatch[1] : '128';
+  //  Google embedded-browser detection is now mitigated only via adblock whitelist
-  const secChUa = `"Not_A Brand";v="8", "Chromium";v="${chromeMajor}", "Google Chrome";v="${chromeMajor}"`;
+  //  of gstatic/google-analytics/etc., which previously was being eaten silently.)
-
+  session.defaultSession.webRequest.onBeforeSendHeaders(
-  const installRequestHooks = (sess) => {
-    sess.webRequest.onBeforeSendHeaders(
     { urls: ['https://*/*', 'http://*/*'] },
     (details, callback) => {
       const headers = details.requestHeaders;
-        // Spoof Sec-CH-UA so embedded-browser detectors (Google login, etc.) see
-        // a real-Chrome brand list. Electron normally injects the app name as
-        // the brand which is how Google fingerprints us as "embedded/unsafe".
-        headers['sec-ch-ua'] = secChUa;
-        headers['sec-ch-ua-mobile'] = '?0';
-        headers['sec-ch-ua-platform'] = '"Windows"';
-        // Add Referer to image requests so hotlink protection doesn't block them
       if (details.resourceType === 'image' && !headers['Referer'] && !headers['referer']) {
         try {
           const u = new URL(details.url);
@@ -1216,11 +1257,10 @@ app.whenReady().then(async () => {
       callback({ requestHeaders: headers });
     }
   );
-  };
 
-  installRequestHooks(session.defaultSession);
+  // (Trusted Types now handled engine-wide via --disable-blink-features
-  installRequestHooks(getProxySession());
+  // command-line switch at file top. webRequest.onHeadersReceived strip
-  installRequestHooks(getDirectSession());
+  // was tried in 1.0.6 but the cliqz adblocker overwrites the listener.)
 
   // Apply proxy from config before blocker tries to download filter lists
   loadTrustedDomainsFromDisk();

package.json

@@ -1,6 +1,6 @@
 {
   "name": "ESH-Media",
-  "version": "1.0.4",
+  "version": "1.0.8",
   "private": true,
   "main": "main.js",
   "scripts": {

src/components/Header.tsx

@@ -290,14 +290,22 @@ const Header: React.FC<HeaderProps> = ({ activeApp, setActiveApp, onAppsChange,
         )}
       </div>
 
-      {updateStatus && updateStatus.state !== 'error' && (
+      {updateStatus && (
-        <div className="update-banner">
+        <div className={`update-banner${updateStatus.state === 'error' ? ' error' : ''}`}>
           {updateStatus.state === 'available' && (
             <>
               <span className="update-banner-spinner" />
               <span>Загружается обновление {updateStatus.version}{updateStatus.currentVersion ? ` (текущая ${updateStatus.currentVersion})` : ''}…</span>
             </>
           )}
+          {updateStatus.state === 'error' && (
+            <>
+              <span>Ошибка обновления: {updateStatus.message}</span>
+              <button className="update-banner-btn" onClick={() => window.electron?.checkUpdateNow?.()}>
+                Повторить
+              </button>
+            </>
+          )}
           {updateStatus.state === 'downloading' && (
             <>
               <span>Скачивается {updateStatus.version || 'обновление'}: {updateStatus.percent}%</span>

src/styles/main.css

@@ -1480,6 +1480,11 @@ body {
 }
 .update-banner-close:hover { color: #fff; }
 
+.update-banner.error {
+  border-color: rgba(229,9,20,0.5);
+  background: rgba(40,10,12,0.95);
+}
+
 .update-banner-progress {
   flex: 1;
   height: 4px;