Add --vanilla flag, strip csp on mainFrame only

src/patcher.ts

@@ -42,11 +42,12 @@ require.main!.filename = join(asarPath, discordPkg.main);
 // @ts-ignore Untyped method? Dies from cringe
 app.setAppPath(asarPath);
 
-// Repatch after host updates on Windows
-if (process.platform === "win32")
+if (!process.argv.includes("--vanilla")) {
+    // Repatch after host updates on Windows
+    if (process.platform === "win32")
         require("./patchWin32Updater");
 
-class BrowserWindow extends electron.BrowserWindow {
+    class BrowserWindow extends electron.BrowserWindow {
         constructor(options: BrowserWindowConstructorOptions) {
             if (options?.webPreferences?.preload && options.title) {
                 const original = options.webPreferences.preload;
@@ -59,29 +60,29 @@ class BrowserWindow extends electron.BrowserWindow {
                 initIpc(this);
             } else super(options);
         }
-}
-Object.assign(BrowserWindow, electron.BrowserWindow);
-// esbuild may rename our BrowserWindow, which leads to it being excluded
-// from getFocusedWindow(), so this is necessary
-// https://github.com/discord/electron/blob/13-x-y/lib/browser/api/browser-window.ts#L60-L62
-Object.defineProperty(BrowserWindow, "name", { value: "BrowserWindow", configurable: true });
-
-// Replace electrons exports with our custom BrowserWindow
-const electronPath = require.resolve("electron");
-delete require.cache[electronPath]!.exports;
-require.cache[electronPath]!.exports = {
+    }
+    Object.assign(BrowserWindow, electron.BrowserWindow);
+    // esbuild may rename our BrowserWindow, which leads to it being excluded
+    // from getFocusedWindow(), so this is necessary
+    // https://github.com/discord/electron/blob/13-x-y/lib/browser/api/browser-window.ts#L60-L62
+    Object.defineProperty(BrowserWindow, "name", { value: "BrowserWindow", configurable: true });
+
+    // Replace electrons exports with our custom BrowserWindow
+    const electronPath = require.resolve("electron");
+    delete require.cache[electronPath]!.exports;
+    require.cache[electronPath]!.exports = {
         ...electron,
         BrowserWindow
-};
+    };
 
-// Patch appSettings to force enable devtools
-onceDefined(global, "appSettings", s =>
+    // Patch appSettings to force enable devtools
+    onceDefined(global, "appSettings", s =>
         s.set("DANGEROUS_ENABLE_DEVTOOLS_ONLY_ENABLE_IF_YOU_KNOW_WHAT_YOURE_DOING", true)
-);
+    );
 
-process.env.DATA_DIR = join(app.getPath("userData"), "..", "Vencord");
+    process.env.DATA_DIR = join(app.getPath("userData"), "..", "Vencord");
 
-electron.app.whenReady().then(() => {
+    electron.app.whenReady().then(() => {
         // Source Maps! Maybe there's a better way but since the renderer is executed
         // from a string I don't think any other form of sourcemaps would work
         electron.protocol.registerFileProtocol("vencord", ({ url: unsafeUrl }, cb) => {
@@ -121,19 +122,22 @@ electron.app.whenReady().then(() => {
             }
         }
 
-    electron.session.defaultSession.webRequest.onHeadersReceived(({ responseHeaders, url }, cb) => {
+        electron.session.defaultSession.webRequest.onHeadersReceived(({ responseHeaders, resourceType }, cb) => {
             if (responseHeaders) {
+                if (resourceType === "mainFrame")
                     patchCsp(responseHeaders, "content-security-policy");
-            patchCsp(responseHeaders, "content-security-policy-report-only");
 
-            // Fix hosts that don't properly set the content type, such as
+                // Fix hosts that don't properly set the css content type, such as
                 // raw.githubusercontent.com
-            if (url.endsWith(".css"))
+                if (resourceType === "stylesheet")
                     responseHeaders["content-type"] = ["text/css"];
             }
             cb({ cancel: false, responseHeaders });
         });
-});
+    });
+} else {
+    console.log("[Vencord] Running in vanilla mode. Not loading Vencord");
+}
 
 console.log("[Vencord] Loading original Discord app.asar");
 // Legacy Vencord Injector requires "../app.asar". However, because we