fix: resolve resource loading issues in packaged desktop app

- replace inline script WASM loading with external loader to fix CSP
- load esbuild.wasm locally instead of from CDN
- add wasm-unsafe-eval, unsafe-eval, blob: to CSP

Author: esengine

.github/workflows/release-desktop.yml

@@ -47,6 +47,10 @@ jobs:
       - name: Install dependencies
         run: pnpm install
 
+      - name: Copy esbuild.wasm to desktop public
+        shell: bash
+        run: cp node_modules/.pnpm/esbuild-wasm@0.27.2/node_modules/esbuild-wasm/esbuild.wasm desktop/public/esbuild.wasm
+
       - name: Build engine and sync to desktop
         run: node build-tools/cli.js build -t all
 

desktop/public/wasm/wasm-loader.js

@@ -0,0 +1,3 @@
+import createModule from './esengine.js';
+window.__ESEngineModule = createModule;
+window.dispatchEvent(new Event('esengine-loaded'));

desktop/src-tauri/tauri.conf.json

@@ -23,7 +23,7 @@
       }
     ],
     "security": {
-      "csp": "default-src 'self' ipc: http://ipc.localhost; img-src 'self' asset: http://asset.localhost data:; style-src 'self' 'unsafe-inline'",
+      "csp": "default-src 'self' ipc: http://ipc.localhost; script-src 'self' 'wasm-unsafe-eval' 'unsafe-eval' blob:; img-src 'self' asset: http://asset.localhost data:; style-src 'self' 'unsafe-inline'",
       "assetProtocol": {
         "enable": true,
         "scope": ["*/**"]

desktop/src/main.ts

@@ -13,41 +13,28 @@ import type { App, ESEngineModule } from 'esengine';
 let currentLauncher: ProjectLauncher | null = null;
 let wasmModule: ESEngineModule | null = null;
 
-function loadScript(src: string): Promise<void> {
-    return new Promise((resolve) => {
+function loadWasmScript(): Promise<void> {
+    return new Promise((resolve, reject) => {
+        if (window.__ESEngineModule) {
+            resolve();
+            return;
+        }
+
         const script = document.createElement('script');
         script.type = 'module';
-        script.innerHTML = `
-            import createModule from '${src}';
-            window.__ESEngineModule = createModule;
-            window.dispatchEvent(new Event('esengine-loaded'));
-        `;
+        script.src = '/wasm/wasm-loader.js';
+        script.onerror = () => reject(new Error('Failed to load WASM loader script'));
         document.head.appendChild(script);
-        resolve();
+
+        window.addEventListener('esengine-loaded', () => resolve(), { once: true });
     });
 }
 
 async function loadWasmModule(): Promise<ESEngineModule | null> {
     if (wasmModule) return wasmModule;
 
     try {
-        await loadScript('/wasm/esengine.js');
-
-        await new Promise<void>((resolve, reject) => {
-            if (window.__ESEngineModule) {
-                resolve();
-                return;
-            }
-
-            const timeout = setTimeout(() => {
-                reject(new Error('WASM module load timeout'));
-            }, 10000);
-
-            window.addEventListener('esengine-loaded', () => {
-                clearTimeout(timeout);
-                resolve();
-            }, { once: true });
-        });
+        await loadWasmScript();
 
         const createModule = window.__ESEngineModule;
         if (typeof createModule !== 'function') {
@@ -92,6 +79,7 @@ async function init(): Promise<void> {
         fs: nativeFS,
         invoke,
         shell: nativeShell,
+        esbuildWasmURL: '/esbuild.wasm',
     });
 
     const container = document.getElementById('editor-root');

editor/src/builder/PlayableBuilder.ts

@@ -15,7 +15,7 @@ import * as esbuild from 'esbuild-wasm/esm/browser';
 import type { BuildResult, BuildContext } from './BuildService';
 import { BuildProgressReporter } from './BuildProgress';
 import { BuildCache, type BuildCacheData } from './BuildCache';
-import { getEditorContext } from '../context/EditorContext';
+import { getEditorContext, getEsbuildWasmURL } from '../context/EditorContext';
 import { findTsFiles, EDITOR_ONLY_DIRS } from '../scripting/ScriptLoader';
 import { BuildAssetCollector, AssetExportConfigService } from './AssetCollector';
 import { TextureAtlasPacker, type AtlasResult } from './TextureAtlas';
@@ -548,7 +548,7 @@ ${imports}
     private async initializeEsbuild(): Promise<void> {
         try {
             await esbuild.initialize({
-                wasmURL: 'https://cdn.jsdelivr.net/npm/esbuild-wasm@0.27.2/esbuild.wasm',
+                wasmURL: getEsbuildWasmURL(),
             });
         } catch (err) {
             if (!String(err).includes('Cannot call "initialize" more than once')) {

editor/src/builder/WeChatBuilder.ts

@@ -7,7 +7,7 @@ import * as esbuild from 'esbuild-wasm/esm/browser';
 import type { BuildResult, BuildContext } from './BuildService';
 import { BuildProgressReporter } from './BuildProgress';
 import { BuildCache } from './BuildCache';
-import { getEditorContext } from '../context/EditorContext';
+import { getEditorContext, getEsbuildWasmURL } from '../context/EditorContext';
 import { findTsFiles, EDITOR_ONLY_DIRS } from '../scripting/ScriptLoader';
 import { BuildAssetCollector, AssetExportConfigService } from './AssetCollector';
 import { TextureAtlasPacker, type AtlasResult } from './TextureAtlas';
@@ -518,7 +518,7 @@ function updateMaterials(world, sceneData, materialCache, entityMap) {
 
         try {
             await esbuild.initialize({
-                wasmURL: 'https://cdn.jsdelivr.net/npm/esbuild-wasm@0.27.2/esbuild.wasm',
+                wasmURL: getEsbuildWasmURL(),
             });
         } catch (err) {
             if (!String(err).includes('Cannot call "initialize" more than once')) {

editor/src/context/EditorContext.ts

@@ -16,6 +16,7 @@ export interface EditorContextConfig {
     fs?: NativeFS;
     invoke?: (cmd: string, args?: Record<string, unknown>) => Promise<unknown>;
     shell?: NativeShell;
+    esbuildWasmURL?: string;
 }
 
 let ctx: EditorContextConfig = {};
@@ -36,3 +37,9 @@ export function setEditorInstance(editor: Editor): void {
 export function getEditorInstance(): Editor | null {
     return editorInstance;
 }
+
+const ESBUILD_WASM_CDN = 'https://cdn.jsdelivr.net/npm/esbuild-wasm@0.27.2/esbuild.wasm';
+
+export function getEsbuildWasmURL(): string {
+    return ctx.esbuildWasmURL ?? ESBUILD_WASM_CDN;
+}

editor/src/extension/ExtensionLoader.ts

@@ -7,7 +7,7 @@ import * as esbuild from 'esbuild-wasm/esm/browser';
 import { editorShimPlugin, esengineShimPlugin, virtualFsPlugin } from '../scripting/esbuildPlugins';
 import { findTsFiles } from '../scripting/ScriptLoader';
 import type { NativeFS, CompileError } from '../scripting/types';
-import { getEditorContext } from '../context/EditorContext';
+import { getEditorContext, getEsbuildWasmURL } from '../context/EditorContext';
 import { ExtensionContext } from './ExtensionContext';
 import { setEditorAPI } from './editorAPI';
 import { normalizePath, joinPath, getProjectDir } from '../utils/path';
@@ -53,7 +53,7 @@ export class ExtensionLoader {
 
         try {
             await esbuild.initialize({
-                wasmURL: 'https://cdn.jsdelivr.net/npm/esbuild-wasm@0.27.2/esbuild.wasm',
+                wasmURL: getEsbuildWasmURL(),
             });
         } catch {
             // esbuild is a singleton; already initialized by ScriptLoader is fine

editor/src/scripting/ScriptLoader.ts

@@ -8,7 +8,7 @@ import { defineComponent, defineTag, clearUserComponents } from 'esengine';
 import { virtualFsPlugin } from './esbuildPlugins';
 import type { NativeFS, ScriptLoaderOptions, CompileError } from './types';
 import { clearScriptComponents } from '../schemas/ComponentSchemas';
-import { getEditorContext } from '../context/EditorContext';
+import { getEditorContext, getEsbuildWasmURL } from '../context/EditorContext';
 import { normalizePath, joinPath, getProjectDir } from '../utils/path';
 
 // =============================================================================
@@ -44,7 +44,7 @@ export class ScriptLoader {
 
         try {
             await esbuild.initialize({
-                wasmURL: 'https://cdn.jsdelivr.net/npm/esbuild-wasm@0.27.2/esbuild.wasm',
+                wasmURL: getEsbuildWasmURL(),
             });
         } catch {
             // esbuild is a singleton; already initialized is fine