fix: clipboard copy on non-secure origins#155
Merged
vakovalskii merged 1 commit intovakovalskii:mainfrom Apr 10, 2026
Merged
Conversation
akolotov
changed the title
apstenku123
added a commit
to apstenku123/codedash
that referenced
this pull request
Apr 11, 2026
- vakovalskii#155 clipboard copy fallback on non-secure origins (execCommand shim) - vakovalskii#156 star button sync in detail panel (already applied earlier) - vakovalskii#159 bind address vs browser URL separation (execFile, safer) - ca70fd2 dual metrics: user_messages (real) + total_interactions (all) - d3f4326 Node >= 18 version check at startup with clear error Skipped: vakovalskii#100 Warp launch config (non-iTerm2), vakovalskii#157 session name refactor (too many touches), vakovalskii#160 badge display config (non-critical), analytics totalSessionsAll (already have similar in createCostAggregator).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Picked from #37
Problem
Users opening Codedash over a non-secure origin could not copy install or resume commands from the UI. From their point of view, the copy buttons appeared to work, but the clipboard action failed silently or fell back inconsistently, which made common workflows like copying agent install commands or session resume commands frustrating or impossible.
Root cause
The frontend relied directly on
navigator.clipboard.writeText(). That API is restricted by browsers and is not available in insecure contexts, so any copy action triggered from anhttp://origin could fail even though the rest of the app loaded correctly.Fix
I added a shared
copyText()helper that handles copy in three steps:navigator.clipboard.writeText()when the browser allows it.document.execCommand('copy')path.The frontend now routes the main copy actions through that helper, including install commands, export commands, update commands, resume commands, and the GitHub device-code copy flow.
Why this is safe
The change is additive and only affects copy behavior.
navigator.clipboard.writeText()remains the first path.