allow localhost connections for update service in CSP

LICENSE

@@ -0,0 +1,47 @@
+Vyla Home Attribution License (VHAL) v1.0
+
+Copyright (c) 2026 Vyla Entertainment
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of the Vyla Home source code and associated documentation (the “Software”), to use, copy, modify, merge, publish, and distribute the Software, subject to the following conditions:
+
+1. Attribution
+
+Any public distribution, publication, derivative work, modified version, or substantial use of the Software must provide clear and visible credit to Vyla Entertainment and Vyla Home.
+
+The attribution must substantially state:
+
+“Based on Vyla Home by Vyla Entertainment”
+
+The attribution must appear in a location reasonably visible to users of the Software, such as an About page, credits section, documentation, repository, application information page, or other comparable location.
+
+2. Preservation of License
+
+Copies or substantial portions of the Software must include a copy of this license and the original copyright notice.
+
+3. Modified Versions
+
+Modified versions may be created and distributed under different terms, provided that the attribution requirements of Section 1 and the preservation requirements of Section 2 remain in effect.
+
+4. No Implication of Endorsement
+
+Use of the Software does not grant permission to imply that Vyla Entertainment endorses, sponsors, or officially supports any modified version or derivative work unless Vyla Entertainment has provided explicit written permission.
+
+5. Trademarks
+
+This license does not grant permission to use the Vyla Entertainment or Vyla Home names, logos, trademarks, service marks, or other branding except as necessary to satisfy the attribution requirement of this license.
+
+6. Commercial Use
+
+Commercial use, sale, and distribution of the Software and derivative works are permitted, provided that all applicable requirements of this license are satisfied.
+
+7. No Warranty
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT.
+
+IN NO EVENT SHALL VYLA ENTERTAINMENT OR THE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+8. Acceptance
+
+By using, copying, modifying, publishing, or distributing the Software, you agree to the terms of this license.
+
+If any provision of this license is found to be unenforceable, the remaining provisions shall remain in effect.

main.js

@@ -103,7 +103,7 @@ cmdApp.get('/__tauri_cmd/:cmd', (req, res) => {
   sendToTauri('tauri-cmd', { cmd: req.params.cmd, url: req.query.url, window: req.query.window });
   res.sendStatus(200);
 });
-cmdApp.listen(4892, () => debugLog("[CMD-SERVER] Dedicated command server listening on port 4892"));
+cmdApp.listen(4892, '127.0.0.1', () => debugLog("[CMD-SERVER] Dedicated command server listening on port 4892"));
 
 process.stdin.resume();
 process.stdin.on('end', () => {
@@ -350,8 +350,8 @@ async function start() {
         tempApp.get('/update/info', (req, res) => {
           res.json({ available: true, current: localVersion, latest: release.version });
         });
-        const handleYes = (req, res) => { userDecision = true; res.sendStatus(200); };
-        const handleNo = (req, res) => { userDecision = false; res.sendStatus(200); };
+        const handleYes = (req, res) => { debugLog("tempApp received YES"); userDecision = true; res.sendStatus(200); };
+        const handleNo = (req, res) => { debugLog("tempApp received NO"); userDecision = false; res.sendStatus(200); };
 
         tempApp.all('/update/yes', handleYes);
         tempApp.all('/update/install', handleYes);
@@ -365,7 +365,7 @@ async function start() {
         });
 
         const tempServer = await new Promise((resolve) => {
-          const s = tempApp.listen(4891, () => resolve(s));
+          const s = tempApp.listen(4891, '127.0.0.1', () => resolve(s));
           s.on('error', (err) => {
             debugLog(`Update server bind error: ${err.message}`);
             resolve(null);
@@ -376,7 +376,8 @@ async function start() {
 
         let waitLoops = 0;
         while (userDecision === null) {
-          if (!tempServer && waitLoops > 400) {
+          if (waitLoops > 24000) {
+            debugLog("Update decision timed out after 10 minutes, defaulting to skip.");
             userDecision = false;
             break;
           }
@@ -480,10 +481,10 @@ async function start() {
     const FRONTEND_PORT = 4890;
     expressApp.use('/build', express.static(path.join(__dirname, 'build')));
 
-    expressServer = expressApp.listen(FRONTEND_PORT, () => {
+    expressServer = expressApp.listen(FRONTEND_PORT, '127.0.0.1', () => {
       sendToTauri('status', { message: 'All backend services running and healthy.' });
       debugLog("Frontend Express running on 4890. Sending READY to Tauri.");
-      sendToTauri('ready', { url: `http://localhost:${FRONTEND_PORT}` });
+      sendToTauri('ready', { url: `http://127.0.0.1:${FRONTEND_PORT}` });
     });
 
   } catch (error) {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "vyla-home",
-  "version": "1.1.37",
+  "version": "1.1.40",
   "description": "Vyla Home Desktop App Launcher",
   "main": "main.js",
   "scripts": {

src-tauri/Cargo.lock

@@ -4238,7 +4238,7 @@ dependencies = [
 
 [[package]]
 name = "vyla-home"
-version = "1.1.37"
+version = "1.1.40"
 dependencies = [
  "base64 0.22.1",
  "objc2 0.5.2",

src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "vyla-home"
-version = "1.1.37"
+version = "1.1.40"
 description = "Vyla Home Desktop App Launcher"
 edition = "2021"
 

src-tauri/src/main.rs

@@ -448,7 +448,7 @@ const LINK_HANDLER_SCRIPT: &str =
             logoBtn.onclick = (e) => {
                 e.preventDefault();
                 e.stopPropagation();
-                window.location.href = 'http://localhost:4890';
+                window.location.href = 'http://127.0.0.1:4890';
             };
         }
 

src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
     "$schema": "https://schema.tauri.app/config/2",
     "productName": "Vyla Home",
-    "version": "1.1.37",
+    "version": "1.1.40",
     "identifier": "com.vyla.home",
     "build": {
         "frontendDist": "../ui"
@@ -9,7 +9,7 @@
     "app": {
         "withGlobalTauri": true,
         "security": {
-            "csp": "default-src 'self' http://localhost:4890 http://127.0.0.1:4890; script-src 'self' 'unsafe-inline' 'unsafe-eval' http://localhost:4890 http://127.0.0.1:4890 https://esm.sh; style-src 'self' 'unsafe-inline' http://localhost:4890 http://127.0.0.1:4890; img-src 'self' data: https: http://localhost:4890 http://127.0.0.1:4890; font-src 'self' data: http://localhost:4890 http://127.0.0.1:4890; connect-src 'self' http://localhost: http://127.0.0.1:"
+            "csp": "default-src 'self' http://localhost:4890 http://127.0.0.1:4890; script-src 'self' 'unsafe-inline' 'unsafe-eval' http://localhost:4890 http://127.0.0.1:4890 https://esm.sh; style-src 'self' 'unsafe-inline' http://localhost:4890 http://127.0.0.1:4890; img-src 'self' data: https: http://localhost:4890 http://127.0.0.1:4890; font-src 'self' data: http://localhost:4890 http://127.0.0.1:4890; connect-src 'self' http://localhost:* http://127.0.0.1:*"
         }
     },
     "bundle": {
@@ -45,4 +45,4 @@
             "../node_modules/**/*"
         ]
     }
-}
+}

ui/index.html

@@ -516,6 +516,9 @@ void main() {
         const btnYes = document.getElementById("btn-update-yes");
         const btnNo = document.getElementById("btn-update-no");
 
+        if (actionsEl) actionsEl.style.display = "none";
+        if (progressTrack) progressTrack.style.display = "none";
+
         let currentStatusText = "";
 
         function setStatus(text, color = "rgba(255, 255, 255, 0.85)") {
@@ -567,15 +570,15 @@ void main() {
                 const data = e.payload || e;
                 if (data) {
                     if (progressTrack) progressTrack.style.display = "block";
-                    const percent = data.percent || 0;
-                    if (progressFill) progressFill.style.width = percent + "%";
-                    setStatus(`Downloading update (${percent}%)...`);
+                    if (progressFill) progressFill.style.width = "100%";
+                    if (actionsEl) actionsEl.style.display = "none";
+                    setStatus("Downloading update...");
                 }
             });
 
             eventApi.listen("update-available", (e) => {
                 const data = e.payload || e;
-                if (data) {
+                if (data && data.latest) {
                     if (progressTrack) progressTrack.style.display = "none";
                     setStatus(`Update Available: ${data.latest} (Current: ${data.current})`);
                     if (actionsEl) actionsEl.style.display = "flex";
@@ -602,7 +605,10 @@ void main() {
         btnYes.addEventListener("click", () => {
             if (actionsEl) actionsEl.style.display = "none";
             setStatus("Starting update installation...");
-            fetch("http://127.0.0.1:4891/update/yes", { method: "POST" }).catch(() => { });
+            fetch("http://127.0.0.1:4891/update/yes", { method: "POST" }).catch((err) => {
+                setStatus("Failed to reach update service. Retrying...", "#fca5a5");
+                showDebug(err.message);
+            });
         });
 
         btnNo.addEventListener("click", () => {