From 906715d343bbd2ea5f62300232779c41d120dbfc Mon Sep 17 00:00:00 2001
From: achraf <achrafachkari@hotmail.fr>
Date: Mon, 8 Jun 2026 00:11:02 +0200
Subject: [PATCH] Fix production worker isolation headers

---
 nginx.conf                        | 18 ++++++++++++++++++
 src/core/plugins/plugin-runner.ts | 11 ++++++++++-
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/nginx.conf b/nginx.conf
index a50289b..8537017 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -31,17 +31,35 @@ server {
     try_files $uri =404;
     expires 1y;
     add_header Cache-Control "public, immutable";
+    add_header Cross-Origin-Opener-Policy "same-origin" always;
+    add_header Cross-Origin-Embedder-Policy "require-corp" always;
+    add_header Cross-Origin-Resource-Policy "same-origin" always;
+  }
+
+  location /imgly/ {
+    try_files $uri =404;
+    expires 1y;
+    add_header Cache-Control "public, immutable";
+    add_header Cross-Origin-Opener-Policy "same-origin" always;
+    add_header Cross-Origin-Embedder-Policy "require-corp" always;
+    add_header Cross-Origin-Resource-Policy "same-origin" always;
   }
 
   location = /favicon.svg {
     try_files $uri =404;
     expires 30d;
     add_header Cache-Control "public";
+    add_header Cross-Origin-Opener-Policy "same-origin" always;
+    add_header Cross-Origin-Embedder-Policy "require-corp" always;
+    add_header Cross-Origin-Resource-Policy "same-origin" always;
   }
 
   location = /config.js {
     try_files $uri =404;
     add_header Cache-Control "no-store, no-cache, must-revalidate";
+    add_header Cross-Origin-Opener-Policy "same-origin" always;
+    add_header Cross-Origin-Embedder-Policy "require-corp" always;
+    add_header Cross-Origin-Resource-Policy "same-origin" always;
     expires -1;
   }
 
diff --git a/src/core/plugins/plugin-runner.ts b/src/core/plugins/plugin-runner.ts
index af24b80..c4c5b0c 100644
--- a/src/core/plugins/plugin-runner.ts
+++ b/src/core/plugins/plugin-runner.ts
@@ -115,7 +115,16 @@ function runPluginInWorker<TOptions>(
     const onError = (e: ErrorEvent) => {
       cleanup();
       discardPluginWorker(plugin, worker);
-      reject(new Error("Worker error: " + e.message));
+      const location = e.filename
+        ? ` (${e.filename}${e.lineno ? `:${e.lineno}:${e.colno}` : ""})`
+        : "";
+      reject(
+        new Error(
+          `Worker failed to load or execute${location}: ${
+            e.message || "check worker, CORS, and cross-origin isolation headers"
+          }`
+        )
+      );
     };
 
     context.signal.addEventListener("abort", onAbort);