From 67f5494665ccff03cb20b18ef3d49b84cb9842e2 Mon Sep 17 00:00:00 2001
From: "blinkagent[bot]" <237617714+blinkagent[bot]@users.noreply.github.com>
Date: Fri, 13 Mar 2026 14:02:38 -0400
Subject: [PATCH] fix(site): allow microphone access for Web Speech API on
 agents page (#23046)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Problem

The `/agents` page has a voice input feature that uses the Web Speech
API (`webkitSpeechRecognition`), but clicking the mic button always
results in a `"not-allowed"` error — even when the browser has
microphone permission granted.

## Root Cause

The `secureHeaders()` function in `site/site.go` sets a
`Permissions-Policy` header with `microphone=()`, which completely
disables microphone access for the page at the HTTP level. This
overrides any browser-level mic permission grants and causes the Web
Speech API to immediately fire an `onerror` event with `error:
"not-allowed"`.

## Fix

Change `microphone=()` to `microphone=(self)`, which:
- Allows the Coder origin itself to use the microphone (enabling the Web
Speech API voice input)
- Still blocks cross-origin iframes from accessing the microphone

This is the minimal permission change needed — `(self)` is more
restrictive than removing the policy entirely, maintaining the security
intent of the original header.

## Testing

1. Navigate to `/agents`
2. Click the mic button in the chat input
3. Verify voice input works (browser will prompt for mic permission if
not already granted)
4. Verify `Permissions-Policy` response header now shows
`microphone=(self)` instead of `microphone=()`

---------

Co-authored-by: blink-so[bot] <211532188+blink-so[bot]@users.noreply.github.com>
---
 site/site.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/site/site.go b/site/site.go
index 19fc5a6d25..4497f558f9 100644
--- a/site/site.go
+++ b/site/site.go
@@ -612,7 +612,7 @@ func secureHeaders() *secure.Secure {
 		"geolocation=()",
 		"gyroscope=()",
 		"magnetometer=()",
-		"microphone=()",
+		"microphone=(self)",
 		"midi=()",
 		"payment=()",
 		"usb=()",