Repository navigation
feat(agent-chat): sandbox HTML artifacts before Run - #26216
Merged
Merged
Conversation
Red: bun test test/artifact-html.test.tsx: 5 expected failures (no JSX kind or HTML write output). bun run check blocked by pre-existing design-token findings outside changed files; focused lint passed. Agent-Session: https://cmux.com/deeplink/agent?harness=codex&session=01a1756c-cf95-7a30-a911-a4a2d18a4841&host=gcp-codex-lane-2
HTML/SVG/JSX use the existing side preview, with an offline native artifact endpoint, isolated scripts, and navigation refusal. Completed full HTML writes from normalized ACP tools appear in the transcript and Outputs, with file-based versions. React/Sucrase are bundled locally and loaded after Run. Red 68de299107d: bun test test/artifact-html.test.tsx had 5 expected failures. Green: same command 7 passed; focused artifact/panel/Inspector suite 17 passed; scoped gallery suite 27 passed. Manual Chromium VM check: 10 fixtures and parent/storage/network/file/WebSocket/image/script policy probes passed, with captures. Web bundle build, typecheck, formatting and changed-file lint passed. Localization audit passed with no new keys. Not run: native compilation and AgentPaneArtifactNavigationTests (Linux VM has no swiftc; integration owner runs fleet verification). Full web check remains red on untouched base design-token debt at a30f457. No PR or push; artifact A handoff to nx-chat. Agent-Session: https://cmux.com/deeplink/agent?harness=codex&session=01a1756c-cf95-7a30-a911-a4a2d18a4841&host=gcp-codex-lane-2
…acts-resume-a-1027
Draw passive artifact markup in a script-disabled srcdoc frame, then reserve the native opaque allow-scripts endpoint for explicit Run. Parse inert HTML for consent markers and refuse srcdoc-origin navigation to allowed pane or loopback routes. Deduplicate the standalone opened-write version list by recorded body. Validation: scoped vp fmt passes on seven web files; scoped vp lint passes on new safety/runtime files. App lint reports only existing unlift/follow exhaustive-deps warnings. Swift syntax parse and git diff --check pass. No tests, builds, browser execution, push or hosted dispatch were run locally; parent owns exact-head hosted red/green and review. Agent-Session: https://cmux.com/deeplink/agent?id=aid-196c8c4a1f392915fbea
Bugbot needs on-demand usage enabledBugbot uses usage-based billing for this team and requires on-demand usage to be enabled. A team admin can enable on-demand usage in the Cursor dashboard. |
teamleaderleo
temporarily deployed
to
ci-routing-agent
October 27, 2026 14:16 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
Contributor
|
cmux status (one comment, edited in place; each line is updated by the job that owns it) Review App of this head (app.zip, kept 1 day)
Gallery before/after for
States
Pick other states with a Unclear: CI failed on
Failures:
Matched log linesNot re-run automatically: Written by red: cmux-next checks (god files, concurrency, crash safety, l10n); no finished base run on 7a70781 to compare; do not merge until green; see lane-rules The feat-cmux-next push run https://github.com/manaflow-ai/cmux/actions/runs/41007613823 at 472bb3a failed: cmux-next checks (god files, concurrency, crash safety, l10n). |
Collaborator
Author
|
Owned by an agent session · session |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Collaborator
Author
|
Bead |
|
Found 6 test failures on Blacksmith runners: Failures
|
![Fix with [code]smith](https://pr-comments-assets.blacksmith.sh/codesmith/fix-with-codesmith-light-3x.png)
Carry toolCanonical onto synthesized full-write diffs so canonical creates and raw-input overwrites remain one document in Outputs and the opened artifact version list. Validation: scoped vp fmt and vp lint pass on writtenArtifacts.tsx and artifact-html.test.tsx; git diff --check passes. The focused behavioral regression is committed first at fbfd741; tests and builds are deferred to the coordinator's hosted lane. No push or dispatch. Agent-Session: https://cmux.com/deeplink/agent?id=aid-196c8c4a1f392915fbea
teamleaderleo
temporarily deployed
to
ci-routing-agent
October 27, 2026 14:28 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
teamleaderleo
temporarily deployed
to
ci-routing-agent
October 27, 2026 14:28 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
teamleaderleo
temporarily deployed
to
ci-routing-agent
October 27, 2026 14:28 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Regression command for hosted runner: scripts/cmux-next/test-cmux-page-path-cpp.sh. The first two new cases are statically red on the base because PageRequestAllowed accepts the artifact URL as the same page host. Native test execution intentionally deferred by task scope. Agent-Session: https://cmux.com/deeplink/agent?id=aid-ecd03ea7c2f13c412b34
Serve exact cmux-page://cmux.agent/__artifact with an opaque sandbox CSP and the one-shot render protocol. Gate artifact/srcdoc navigation before the main-frame fast return, deny network/file/page subresources throughout descendant frames, and retain normal page navigation. Observed: scoped verify-local checks passed (localization-defaults, package-groups, feature-flags), git diff --check passed, bootstrap node --check passed. Not run: native CEF compilation, browser probe, and C++ tests, per task scope. Hosted regression: scripts/cmux-next/test-cmux-page-path-cpp.sh. Test-first parent b71fd15 contains two statically failing page-authority cases; hosted red/green still required. Agent-Session: https://cmux.com/deeplink/agent?id=aid-ecd03ea7c2f13c412b34
Collaborator
Author
|
Review (codex gpt-6-astra xhigh, next-review): BLOCK at 127e59d
|
…acts-resume-a-1027
Use an artifact-specific native origin capability and frame URL selector so cmux-page://cmux.agent/ opens HTML/SVG previews and explicit Run loads cmux-page://cmux.agent/__artifact. Preserve the scriptless passive frame and allow-scripts consent boundary. Allow only that exact shared artifact endpoint in the agent descriptor frame CSP; other render cards retain their existing capability policy. Validation: scoped vp fmt and vp lint pass on both production web files and focused tests, Swift syntax parse and git diff --check pass. Test-first commit bdfa39f is committed; no tests, builds, browser execution, push or dispatch were run. Agent-Session: https://cmux.com/deeplink/agent?id=aid-196c8c4a1f392915fbea
teamleaderleo
temporarily deployed
to
ci-routing-agent
October 27, 2026 16:24 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
teamleaderleo
temporarily deployed
to
ci-routing-agent
October 28, 2026 06:35 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
This was referenced Oct 29, 2026
…s-resume-a-1027 # Conflicts: # Packages/macOS/CmuxNext/Sources/CmuxNextAgentPane/AgentPaneRenderFrame.swift # Packages/macOS/CmuxNext/Tests/CmuxNextAgentPaneTests/AgentPaneArtifactNavigationTests.swift # release-notes/next/highlights/interactive-chat-artifacts.md # webviews/src/agent-session/acpmux/conversation/ArtifactPanel.tsx # webviews/src/agent-session/acpmux/conversation/artifactSandbox.ts # webviews/test/artifact-html.test.tsx # webviews/test/artifact-panel-sandbox.test.tsx
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-a4efd6c1314eb5a4fc3e
OpenCode sends filePath and Gemini absolute_path; only file_path and path were read, so their no-diff HTML writes produced no preview or Outputs entry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-a4efd6c1314eb5a4fc3e
teamleaderleo
temporarily deployed
to
ci-routing-agent
October 30, 2026 00:38 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
teamleaderleo
temporarily deployed
to
ci-routing-agent
October 30, 2026 00:38 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
teamleaderleo
temporarily deployed
to
ci-routing-agent
October 30, 2026 00:43 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
teamleaderleo
temporarily deployed
to
ci-routing-agent
October 30, 2026 01:50 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
teamleaderleo
temporarily deployed
to
ci-routing-agent
October 30, 2026 01:50 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
teamleaderleo
temporarily deployed
to
sentry-dsyms
October 30, 2026 02:19 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
teamleaderleo
temporarily deployed
to
artifacts
October 30, 2026 02:19 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
teamleaderleo
temporarily deployed
to
artifacts
October 30, 2026 02:26 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
teamleaderleo
temporarily deployed
to
artifacts
October 30, 2026 02:26 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
teamleaderleo
temporarily deployed
to
artifacts
October 30, 2026 02:33 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Collaborator
Author
|
Review (codex gpt-6.1-sol high, review-router, for drain-transcript): SHIP at f2ce3e8 No findings. Static review only. |
Contributor
|
Shipped in:
|
lawrencecchen
added a commit
that referenced
this pull request
Oct 30, 2026
The slice head 2b2fc8e (= 43037147a0b's tree: slice + trunk sync c09bb74) merges the feat tip, 130 new commits. 58 files conflicted: - 0 reuse the previous round's resolutions: this round's base is the previous feat tip a14725a, so no hunk had all three sides equal to 5f39f9e's inputs. - Regenerated, not hand-merged: the 4 CmuxMessagesLab patches (Fixture, Layout, RowDrawing, WindowView) from the merged vendored sources against the pinned upstream reconstructed from the side whose patch was consistent (feat's for 3, perf's for WindowView; feat 65de604 edited WindowView.swift without rewriting its patch). - 54 resolved by porting feat's change into perf's shape: - Package.swift (CmuxNext: Floating tests get CmuxNextDesign with perf's Wakeups deps; CmuxMobileKit: Model gets feat's Resources with perf's CmuxSafeConcurrency). - Lineage parents #24136: SidebarSessionTreeFeed (recordedParents and per-host links on perf's ServiceObservation), RemoteAcpmuxWire (host/linksAlias notes posted on perf's mainWork; test-only inits take them too), AgentTabRemoteHost, AgentTabs+Wiring, AgentSessionWorkspace (the record is one completion task on main), tests. - Artifact sandbox #26216: perf's page-host PageArtifactFrame already serves the sandboxed endpoint; feat's navigation tests ported to PageNavigation, frame-ancestors expectation added, artifactFrameURL keeps only the page host, webviews tests on perf's URLs. - pane.commandAvailability (#25405) and chief.face (#27914) beside perf's keyToPaint and Wiring init. - State files off main #27749: AgentUnsentDrafts (perf's ObservedMap) and ScrollAnchors (blockingDecode) on AgentPaneStateFile. - AgentPaneTransport.close: perf's close reason plus feat's host-request failure and trust reset. - CloudService: perf's file, plus #27104 signedOutCreation (scope, policy, stop, signOut in +Machines) and #26740 autosize/sizePick; listIsCurrent moved to +AppServer as feat did. - debug.object_menu into perf's DebugDriverControl; Home fixture presence/faces beside perf's field. - Palette overlay window #26951 into perf's paletteBuilt. - Per-window Home #27880 in perf's dockTab helper; active team (1bb1b96) on perf's cloudAuth. - Busy refusal (a930474, 2a9b813) in perf's LineTransport split (+State, +Route, framed write). - Launch snapshot sidebar doc (dc38061): DaemonLaunchSnapshot.sidebarDoc, shown once settled (whenSettled), its connect follow a ServiceObservation; the Rust test moved to launch_snapshot_tests.rs. - Hover card corners (bc66475) with perf's interactive flag; Chief pet state (#25671) on perf's ServiceObservation and AppearanceSignals; Chief picture crop (#27933) on perf's lanes and optional store; Home presence (#25578) as a FrameObservation; sidebar tab look (#27530) via SidebarLookFollower; settleOpenings (#24374) with perf's snap; Omnibar imports. - acpmux: inbox digest senders without slicing; withdraw_queued async with from_agents_only; cmux-tui-core and platform: connection leases beside perf's modules and InlineSocket (bounded_outbound.rs takes back the `platform::transport` import perf had dropped, which feat's claim_watched_connection names). - webviews: App/NewTab/NewTabScreen (retry, slash commands, at), settings keys moved to cardRows.ts. - Feat's tests that call perf-changed inits fixed: TabConcentricCornerTests (input:), HomeChatPresenceFacesTests (deadlines:, frame delivery), RemoteChildSessionsTests (main run loop for posted notes). Generators: cargo metadata in cmux-tui, cmux-tui/fuzz, Native/DiffSidecar and optchat-chief changed no lock; gen-features.py --check, gen-chromium-host-wire.py --check and --check-ops, sync-resource-api.py --check pass. webviews: bun run check passes. schemas/settings/settings-schema.json stays perf's (generated; the autofix regenerates it): until then feat's chiefLook.test.tsx misses the home.bubbleColors rows.
teamleaderleo
added a commit
that referenced
this pull request
Oct 31, 2026
#26219) (#28732) * fix(agent-chat): preview only complete recorded HTML writes (carry #26219) Carries the part of #26219 that is not on base (#26216 landed the rest): artifactWrites.ts with the partial-hunk guard and the multi-file add provenance, plus test/artifact-writes.test.ts. writtenArtifacts.tsx now re-exports toolArtifacts from it. From #26219: 392a6af, 4ed83ed, 446f9c7, f9ce1d9, bdf7318, ad5452b. Kept base's OpenCode filePath/absolute_path write fields, with test cases for them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-63b9964940c20354b639 * fix(agent-chat): a complete edit or replace of an HTML file keeps its Open The edit-name guard from #26219 dropped every diff of an Edit/replace call unless Codex add provenance proved it, so OpenCode's edit and Gemini's replace, which record the whole old and new file, lost their preview and Open. An edit-named call's unmarked diff now opens when it is shown to be the file: it is not one of the replacement strings its input records (Claude Code's Edit and MultiEdit diffs are exactly those) and the input records some, or with no input its new text is a whole HTML document. Marked fragments and legacy snippets stay closed. Tests: a complete create, edit (Claude-shaped and OpenCode-shaped) and replace open; Edit/MultiEdit replacement snippets, a no-input legacy snippet and a marked fragment stay closed. Gallery: edit-complete, replace-complete, edit-complete-open and edit-snippet artifact-panel states. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-f71664ebfb6cf5206479 --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: cmux-bot[bot] <348531757+cmux-bot[bot]@users.noreply.github.com>
teamleaderleo
added a commit
that referenced
this pull request
Nov 1, 2026
…pted documents stay code - http-equiv and <link> in the document are made inert (meta refresh navigates script-free; dns-prefetch/preconnect reach the network past CSP); x-dns-prefetch-control off. - The frame script refuses link clicks; a second load tears the frame down to the source. - A document with script never previews inline: it stays the code card, and Open takes it to the side panel where Run already is (#26216). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa
teamleaderleo
added a commit
that referenced
this pull request
Nov 1, 2026
…iew (#30673) * Agent chat: draw a reply's closed html/svg fence as a sandboxed inline preview A closed ```html or ```svg fence now draws as its document in an iframe sandboxed with allow-scripts and no same-origin. Its srcdoc starts with the artifact policy (no network); before Run only the frame's nonce'd height reporter runs. Height follows the frame's own report, capped at 480 px. Code shows the source card (Copy kept). An open fence stays plain code. Scripted documents wait for Run, then use the native artifact frame. Meta refresh is made inert, link clicks are refused, and a frame that loads twice falls back to the source. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa * Inline preview: keep frames on their document; no network hints; scripted documents stay code - http-equiv and <link> in the document are made inert (meta refresh navigates script-free; dns-prefetch/preconnect reach the network past CSP); x-dns-prefetch-control off. - The frame script refuses link clicks; a second load tears the frame down to the source. - A document with script never previews inline: it stays the code card, and Open takes it to the side panel where Run already is (#26216). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa * Inline preview: links that leave the document point to # (no speculative DNS of agent-written hosts) Review of design/artifacts (gpt-6.1-sol) BLOCK: CSP does not stop an engine resolving <a href> hosts. Clicks on them are refused anyway, so cross-origin href/xlink:href become # with the original in data-href; fragments and inline data:/blob: images stay. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa * Inline preview: draw in the native artifact frame in the app; fix the link rewrite boundary; fragments scroll in place Review (gpt-6.1-sol) BLOCK at 74ebf5a: - a srcdoc frame takes the pane's CSP, which runs no inline script, so the nonce'd reporter never ran in the app. In the app the preview now uses the native artifact frame (own policy, no network, height report, host navigation delegate) with the inert, script-free document; srcdoc stays for the gallery; other pages show the source. - the href rewrite consumed the boundary quote, so adjacent attributes slipped past; it is a lookbehind now, with that input covered. - in srcdoc a #fragment resolves against the parent page; the frame script scrolls to it in place. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-92fa78a91e29868c5eaa --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Agent-written HTML/SVG/JSX artifacts now work on the default shared
cmux-page://cmux.agent/host as well as the legacy agent host. Passive markup remains a script-disabledsrcdoc; explicit Run uses the exact shared artifact endpointcmux-page://cmux.agent/__artifact(or the legacycmux-agent://render/artifact) and retains the opaquesandbox="allow-scripts"boundary.Leo: "the /side thing i heard somebody really liked in codex... and i think html/html artifacts and that kinda good viewing and good support for it would be cool" / "like the claude.ai artifacts but imagien you didnt need to only have it on claude.ai...".
This supersedes #25190, whose owner explicitly handed the implementation to nx-chat. The CEF route is supplied by #26224, and the live stream/detector pieces are stacked in #26219, #26230. No project artifact storage or Austin's #8610 is touched.
The shared-host delta is test-first
bdfa39f0944→6881532dbc1; it adds exact-origin capability/URL selection, the page descriptor frame source, shared-host passive/Run tests and keeps other RenderCard types unchanged. The CEF prerequisite's static SHIP and native evidence are recorded separately: build9cb98bfe25ba167c7dbc0c6esucceeded on a fleet Mac, and C++ policy run40539592231exercised 149 red→green cases (2 policy failures before, 0 after). A real default-agent browser probe recipe is/tmp/cmux-cef-artifact-probe.py(SHA4270e3e6ec83d4bb6558ec167acdaca403ad7c92419b7841d2435affb56b2a89); it needs the managed tagged app and the shared host'sbrowser.eval/DevTools route.Observed / Not run
No capture: the native change is only page routing and URL policy for artifact pages (AgentPageProvider, AgentPaneNavigation, AgentPaneRenderFrame), with no visible native UI of its own; AgentPaneArtifactNavigationTests passed on a fleet Mac at f2ce3e8, and the webview artifact tests pass in CI at this head.
Agent session: agent session