fix(web): disable untruthful agent views

[tusharbhardwaj-bk]

What Changed

• Enforce a runtime-off gate for Agent views that overrides any persisted agentUiSurfacesEnabled=true client preference.
• Leave t3_show_ui calls as ordinary collapsed tool rows and keep expanded state closed.
• Remove the credentialless same-origin lifecycle coordinator and prevent the inner URL renderer from creating an iframe even if called directly.
• Keep PR fix(web): isolate same-origin agent view lifecycles #144's independently safe HTML-shell anti-framing headers and exact server fragment-preservation coverage.
• Document the external embedded-app ownership boundary and the hard-refresh requirement for long-lived SPA tabs.

Why

Deployed verification disproved the premise behind PR #144's iframe isolation. A fresh top-level room load reconstructed the expected live scene after browser storage was cleared, but ordinary and credentialless iframes did not join the room. The ordinary frame could display an older origin-local scene; the credentialless frame displayed empty isolated storage.

The exact deployed source map sets collaboration disabled whenever the app is running in an iframe. Its scene initialization starts room collaboration only when a collaboration API exists, so no generic bkt3 iframe policy can make the URL-selected room load truthfully. A redacted Chrome trace also confirmed that the child received the exact stored URL and its non-empty fragment; URL loss and redirects are ruled out.

The safe bkt3-only response is fail-closed. This does not special-case a domain, rewrite fragments, proxy bearer keys, or weaken sandbox isolation. Restoring truthful inline live-room behavior requires a change in the embedded collaboration app or a different browser integration.

UI Changes

Before: a URL Agent view could show stale origin-local content or an empty canvas while appearing to represent the requested room.

After: Agent views do not mount. Settings shows the switch disabled, and existing calls remain ordinary tool rows. A long-lived tab still running the prior JavaScript must hard-refresh once to load this mitigation.

The live before-state was verified without capturing or exposing room fragments. Post-deploy evidence will be added after the experimental artifact is installed.

Verification

• apps/web: 9 focused surface/runtime DOM tests passed.
• apps/server: 147 focused Agent UI and static-router tests passed.
• apps/desktop: 8 focused protocol/header tests passed.
• apps/web: package typecheck passed.
• Targeted lint and formatting checks passed.
• Fork marker check passed.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• No animation or interaction behavior remains to record

Written by GPT-5.6-Sol in T3 Code (Codex harness).

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	13.6 KiB	—	15.1 KiB	✅
Codex	Thread snapshot wire	—	7.2 KiB	—	7.3 KiB	✅
Codex	Live turn WebSocket wire	—	6.4 KiB	—	7.8 KiB	✅
Codex	Live turn WebSocket decoded	—	55.7 KiB	—	66.4 KiB	✅
Codex	Live turn messages	—	11	—	21	✅
Claude	Total thread wire	—	13.6 KiB	—	15.1 KiB	✅
Claude	Thread snapshot wire	—	7.2 KiB	—	7.3 KiB	✅
Claude	Live turn WebSocket wire	—	6.4 KiB	—	7.8 KiB	✅
Claude	Live turn WebSocket decoded	—	56.5 KiB	—	66.4 KiB	✅
Claude	Live turn messages	—	11	—	21	✅

Baseline: unavailable · PR result: c8df02c · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 110.4 KiB
• Claude decoded thread snapshot: 111.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[tusharbhardwaj-bk]

Deployed verification (secret-free):

• expbkmain artifact ac5bc9f9ed458bda40ad925835f0c4ed31e84ea2 is installed (deployed-sha exact match); t3-expbkt3.service and its deploy timer are active.
• A newly opened experimental client shows Agent views in chat forced unchecked and disabled, including for an existing browser profile, with the fail-closed explanation. This confirms persisted agentUiSurfacesEnabled=true cannot re-enable the surface. A long-lived tab that predates this deploy needs one hard refresh to load the new SPA bundle.
• Both / and an SPA fallback return Content-Security-Policy: frame-ancestors 'none' and X-Frame-Options: DENY.
• The managed browser was closed after verification. The earlier relay trace-stop failure remains a documented non-blocking deviation: direct fresh room reconstruction, the exact deployed Excalidraw source-map iframe guard, and exact iframe-src/hash trace already established the external ownership blocker without exposing room credentials.
• Promotion PR chore: promote expbkmain to bkmain (agent views in chat) #143 was already merged before fix(web): isolate same-origin agent view lifecycles #144/fix(web): disable untruthful agent views #145; it remains closed and untouched. There is currently no open expbkmain → bkmain promotion PR, so these experimental changes have not been promoted.