Promote final main to release/stable for v0.5.12

.github/workflows/ci.yml

@@ -108,6 +108,47 @@ jobs:
           test -f apps/desktop/dist-electron/preload.js
           grep -nE "desktopBridge|getWsUrl|PICK_FOLDER_CHANNEL|wsUrl" apps/desktop/dist-electron/preload.js
 
+  html_preview_platform:
+    name: HTML Preview Platform Smoke (${{ matrix.label }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - label: Linux
+            runner: ubuntu-24.04
+          - label: Windows
+            runner: windows-2022
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version-file: package.json
+
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: package.json
+
+      - name: Install Linux listener tools
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          command -v lsof >/dev/null 2>&1 || {
+            sudo apt-get update
+            sudo apt-get install -y lsof
+          }
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Exercise native localhost preview and discovery
+        run: bun run --cwd apps/server test:html-preview-platform
+
   windows_process:
     name: Windows Process Regression
     runs-on: windows-2022

apps/desktop/src/artifactPreviewPolicy.test.ts

@@ -0,0 +1,67 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  artifactPreviewNavigationAllowed,
+  artifactPreviewRequestAllowed,
+} from "./artifactPreviewPolicy";
+
+const ORIGIN = "http://g-123.preview.localhost:5000";
+
+describe("artifactPreviewPolicy", () => {
+  it("allows only same-capability resources and inert embedded data", () => {
+    expect(
+      artifactPreviewRequestAllowed({
+        url: `${ORIGIN}/assets/app.js`,
+        allowedOrigin: ORIGIN,
+        resourceType: "script",
+      }),
+    ).toBe(true);
+    expect(
+      artifactPreviewRequestAllowed({
+        url: "https://example.com/tracker.js",
+        allowedOrigin: ORIGIN,
+        resourceType: "script",
+      }),
+    ).toBe(false);
+    expect(
+      artifactPreviewRequestAllowed({
+        url: `${ORIGIN}/socket`,
+        allowedOrigin: ORIGIN,
+        resourceType: "webSocket",
+      }),
+    ).toBe(false);
+    for (const resourceType of ["worker", "sharedWorker", "serviceWorker"]) {
+      expect(
+        artifactPreviewRequestAllowed({
+          url: `${ORIGIN}/worker.js`,
+          allowedOrigin: ORIGIN,
+          resourceType,
+        }),
+      ).toBe(false);
+    }
+  });
+
+  it("denies subframes and cross-origin top-level navigation", () => {
+    expect(
+      artifactPreviewNavigationAllowed({
+        url: `${ORIGIN}/`,
+        allowedOrigin: ORIGIN,
+        isMainFrame: true,
+      }),
+    ).toBe(true);
+    expect(
+      artifactPreviewNavigationAllowed({
+        url: "https://example.com/",
+        allowedOrigin: ORIGIN,
+        isMainFrame: true,
+      }),
+    ).toBe(false);
+    expect(
+      artifactPreviewNavigationAllowed({
+        url: `${ORIGIN}/frame.html`,
+        allowedOrigin: ORIGIN,
+        isMainFrame: false,
+      }),
+    ).toBe(false);
+  });
+});

apps/desktop/src/artifactPreviewPolicy.ts

@@ -0,0 +1,47 @@
+// FILE: artifactPreviewPolicy.ts
+// Purpose: Pure Electron-level network and navigation policy for untrusted artifact tabs.
+
+const DENIED_RESOURCE_TYPES = new Set([
+  "subFrame",
+  "webSocket",
+  "object",
+  "ping",
+  "worker",
+  "sharedWorker",
+  "serviceWorker",
+]);
+
+export function artifactPreviewRequestAllowed(input: {
+  url: string;
+  allowedOrigin: string;
+  resourceType: string;
+}): boolean {
+  if (DENIED_RESOURCE_TYPES.has(input.resourceType)) {
+    return false;
+  }
+  try {
+    const requestUrl = new URL(input.url);
+    return (
+      requestUrl.protocol === "data:" ||
+      requestUrl.protocol === "blob:" ||
+      requestUrl.origin === input.allowedOrigin
+    );
+  } catch {
+    return false;
+  }
+}
+
+export function artifactPreviewNavigationAllowed(input: {
+  url: string;
+  allowedOrigin: string;
+  isMainFrame: boolean;
+}): boolean {
+  if (!input.isMainFrame) {
+    return false;
+  }
+  try {
+    return new URL(input.url).origin === input.allowedOrigin;
+  } catch {
+    return false;
+  }
+}