From 1402abe74ce8f4fe0c552cd8a85b5d0ba51b5957 Mon Sep 17 00:00:00 2001
From: Elliot Braem <elliot@ejlbraem.com>
Date: Wed, 12 Aug 2026 15:34:43 -0500
Subject: [PATCH] fix(host): add wss: to CSP connect-src for plugin WebSocket
 support

---
 .changeset/wild-ghosts-brake.md | 5 +++++
 host/src/middleware/security.ts | 1 +
 2 files changed, 6 insertions(+)
 create mode 100644 .changeset/wild-ghosts-brake.md

diff --git a/.changeset/wild-ghosts-brake.md b/.changeset/wild-ghosts-brake.md
new file mode 100644
index 00000000..518a206c
--- /dev/null
+++ b/.changeset/wild-ghosts-brake.md
@@ -0,0 +1,5 @@
+---
+"host": patch
+---
+
+Add `wss:` scheme to CSP `connect-src` directive to allow WebSocket connections (e.g. nostr relays, streaming APIs). Plugins declaring `connectSrc` with `wss://` URLs now work through the host without per-request CSP overrides.
diff --git a/host/src/middleware/security.ts b/host/src/middleware/security.ts
index 4a4cc90c..251321e5 100644
--- a/host/src/middleware/security.ts
+++ b/host/src/middleware/security.ts
@@ -159,6 +159,7 @@ export class SecurityMiddleware extends Context.Tag("host/SecurityMiddleware")<
             connectSrc: [
               "'self'",
               "https:",
+              "wss:",
               ...uniqueOrigins,
               ...wsOrigins,
               ...cdnOrigins,