Repository navigation
feat(artifacts): reuse shared preview host for Artifacts pane - #27605
Merged
Merged
Conversation
Red: bun test test/artifact-html.test.tsx: 5 expected failures (no JSX kind or HTML write output). bun run check blocked by pre-existing design-token findings outside changed files; focused lint passed. Agent-Session: https://cmux.com/deeplink/agent?harness=codex&session=01a1756c-cf95-7a30-a911-a4a2d18a4841&host=gcp-codex-lane-2
HTML/SVG/JSX use the existing side preview, with an offline native artifact endpoint, isolated scripts, and navigation refusal. Completed full HTML writes from normalized ACP tools appear in the transcript and Outputs, with file-based versions. React/Sucrase are bundled locally and loaded after Run. Red 68de299107d: bun test test/artifact-html.test.tsx had 5 expected failures. Green: same command 7 passed; focused artifact/panel/Inspector suite 17 passed; scoped gallery suite 27 passed. Manual Chromium VM check: 10 fixtures and parent/storage/network/file/WebSocket/image/script policy probes passed, with captures. Web bundle build, typecheck, formatting and changed-file lint passed. Localization audit passed with no new keys. Not run: native compilation and AgentPaneArtifactNavigationTests (Linux VM has no swiftc; integration owner runs fleet verification). Full web check remains red on untouched base design-token debt at a30f457. No PR or push; artifact A handoff to nx-chat. Agent-Session: https://cmux.com/deeplink/agent?harness=codex&session=01a1756c-cf95-7a30-a911-a4a2d18a4841&host=gcp-codex-lane-2
…acts-resume-a-1027
Draw passive artifact markup in a script-disabled srcdoc frame, then reserve the native opaque allow-scripts endpoint for explicit Run. Parse inert HTML for consent markers and refuse srcdoc-origin navigation to allowed pane or loopback routes. Deduplicate the standalone opened-write version list by recorded body. Validation: scoped vp fmt passes on seven web files; scoped vp lint passes on new safety/runtime files. App lint reports only existing unlift/follow exhaustive-deps warnings. Swift syntax parse and git diff --check pass. No tests, builds, browser execution, push or hosted dispatch were run locally; parent owns exact-head hosted red/green and review. Agent-Session: https://cmux.com/deeplink/agent?id=aid-196c8c4a1f392915fbea
Carry toolCanonical onto synthesized full-write diffs so canonical creates and raw-input overwrites remain one document in Outputs and the opened artifact version list. Validation: scoped vp fmt and vp lint pass on writtenArtifacts.tsx and artifact-html.test.tsx; git diff --check passes. The focused behavioral regression is committed first at fbfd741; tests and builds are deferred to the coordinator's hosted lane. No push or dispatch. Agent-Session: https://cmux.com/deeplink/agent?id=aid-196c8c4a1f392915fbea
Regression command for hosted runner: scripts/cmux-next/test-cmux-page-path-cpp.sh. The first two new cases are statically red on the base because PageRequestAllowed accepts the artifact URL as the same page host. Native test execution intentionally deferred by task scope. Agent-Session: https://cmux.com/deeplink/agent?id=aid-ecd03ea7c2f13c412b34
Serve exact cmux-page://cmux.agent/__artifact with an opaque sandbox CSP and the one-shot render protocol. Gate artifact/srcdoc navigation before the main-frame fast return, deny network/file/page subresources throughout descendant frames, and retain normal page navigation. Observed: scoped verify-local checks passed (localization-defaults, package-groups, feature-flags), git diff --check passed, bootstrap node --check passed. Not run: native CEF compilation, browser probe, and C++ tests, per task scope. Hosted regression: scripts/cmux-next/test-cmux-page-path-cpp.sh. Test-first parent b71fd15 contains two statically failing page-authority cases; hosted red/green still required. Agent-Session: https://cmux.com/deeplink/agent?id=aid-ecd03ea7c2f13c412b34
…acts-resume-a-1027
Serve the exact cmux-page://cmux.agent/__artifact bootstrap with an opaque sandbox CSP and apply the one-shot direct-child navigation policy in shared WebKit pages. Ordinary page navigation remains unchanged. Agent-Session: https://cmux.com/deeplink/agent?id=aid-wk-artifact-frame
Artifact pages remain fenced by the agent-only source-frame guard and restricted-context policy; ordinary pages may let their navigation hook admit srcdoc. Agent-Session: https://cmux.com/deeplink/agent?id=aid-wk-artifact-frame
|
Found 8 test failures on Blacksmith runners: Failures
|
![Fix with [code]smith](https://pr-comments-assets.blacksmith.sh/codesmith/fix-with-codesmith-light-3x.png)
Contributor
|
cmux status (one comment, edited in place; each line is updated by the job that owns it) Review App of this head (app.zip, kept 1 day)
Gallery before/after for
States
Pick other states with a Passes: CI passes on CI passes on Written by web and size checks: green Shipped in:
|
Collaborator
Author
|
Fleet focused suites at head
The independent review is still running, and the WIP HOLD stays. Agent session: agent session |
Collaborator
Author
|
Owned by an agent session · session |
Conflicts (from #26286 having landed as a squash): artifact_page.h, ArtifactPanel.tsx, RenderCard.tsx, artifactSandbox.ts, artifact-panel-sandbox.test.tsx; the rest taken from base. The shared preview now wraps the side panel's current frame instead of the pre-#31174 copy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-159afad10a5ab45ea16c
teamleaderleo
temporarily deployed
to
ci-routing-agent
November 2, 2026 19:45 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
…cts-shared-host-seam
teamleaderleo
temporarily deployed
to
ci-routing-agent
November 5, 2026 07:44 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
teamleaderleo
temporarily deployed
to
ci-routing-agent
November 5, 2026 07:44 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
…d artifact bootstrap The base's passive-frame contract (#29837) asserted the Artifacts page never loads the bootstrap; this PR admits it as the second exact parent, so that assertion now expects the load to be allowed, and a srcdoc child still refused. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-0b517f2a10c3ba1c8f62
teamleaderleo
temporarily deployed
to
ci-routing-agent
November 5, 2026 07:53 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
teamleaderleo
temporarily deployed
to
ci-routing-agent
November 5, 2026 07:53 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
teamleaderleo
marked this pull request as ready for review
November 5, 2026 08:02
Collaborator
Author
|
Review (independent subagent, correctness + security): SHIP at 48f3129
Gates: fleet compile-check --app passed (job 8e05f4a5206e8c69f2bc6254); the 4 focused Swift suites passed (step 6eff5d24834aa7cdfe72d8fb); web tests 17/17 and tsc are clean; the C++ page-path test passes with the fix. Follow-up for the consumer: the artifacts Leo, 2026-11-05: "Yes, push them". |
teamleaderleo
temporarily deployed
to
ci-routing-agent
November 5, 2026 08:02 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
…as ignored (web lint) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-0b517f2a10c3ba1c8f62
teamleaderleo
temporarily deployed
to
ci-routing-agent
November 5, 2026 08:22 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
teamleaderleo
temporarily deployed
to
ci-routing-agent
November 5, 2026 08:22 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Collaborator
Author
Collaborator
Author
|
Review (codex, router-review): SHIP at a6051dc Reviewer: codex gpt-6-astra high, fast tier. SHIP at a6051dc Visual verdict: no images; Leo tries the build The focused C++ navigation test passes (219 cases); no correctness, security, or regression findings found in the changed paths. Follow-ups: none |
![cmux-bot[bot]](https://avatars.githubusercontent.com/u/171392238?s=60&v=4){kind=small}
Collaborator
Author
|
Review (claude opus subagent, correctness + security): SHIP at a6051dc The same Claude Opus reviewer read the whole PR at d2869d7 (full diff against base bdd3569), then each later commit: 48f3129 (C++ assertion reconciled with #29837, every base PagePassiveFrameNavigationTests expectation traced) and a6051dc (web lint only). No findings at any of the three heads. Non-blocking: the artifacts PageDescriptor needs |
Collaborator
Author
|
Merging at a6051dc. The one red check,
This PR's own suites pass (PageArtifactFrameTests, PageArtifactsParentTests, ChromiumPageHostBridgeTests, ArtifactsPageProviderTests). |
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Status: brought current with feat-cmux-next (clean merge at d2869d7). One semantic conflict with #29837's passive-frame contract: its C++ test asserted the Artifacts page never loads the bootstrap, which is exactly what this PR admits; 48f3129 updates that assertion (allowed for an empty direct child, still refused for a srcdoc child). Gates at the head: fleet compile-check --app passed (job 8e05f4a5206e8c69f2bc6254), shared-preview and artifact-html web tests 17/17 and tsc clean,
test-cmux-page-path-cpp.shpasses; fleet Swift suites PageArtifactFrameTests, PageArtifactsParentTests, ChromiumPageHostBridgeTests, ArtifactsPageProviderTests all passed (step 6eff5d24834aa7cdfe72d8fb at d2869d7, whose Swift tree is identical to 48f3129); independent review SHIP at 48f3129. Nothing mountsArtifactPreviewon the Artifacts page yet: the consumer PR also needsframe-src cmux-page://cmux.agent/__artifacton the artifacts PageDescriptor.Leo, 2026-11-05, on the remaining Artifacts PRs: "Yes, push them".
#26286 merged; this branch now merges feat-cmux-next directly.
The read-only Artifacts pane needs the same isolated HTML preview as the agent side panel. This extends the existing CEF/WK artifact host to accept the exact cmux.artifacts parent alongside cmux.agent and exports ArtifactPreview for both consumers. The canonical route stays cmux-page://cmux.agent/__artifact. #27264 will consume this after landing; no pane or feature default is enabled here.
Leo: “like the claude.ai artifacts but imagine you didnt need to only have it on claude.ai”. On the MVP: “go ahead”.
Requested seam: “extend the shared PageArtifactFrame/CEF (and WK) host policy to accept the cmux.artifacts origin next to cmux.agent, and reuse the shared Preview/Run component.”
Reuses #26216's Preview/Run flow, #26224's CEF endpoint, and #26286's PageArtifactFrame/WebKit implementation, retaining their authorship in the stack. Austin Wang's project-local Artifacts design in #8610 is related prior work (session-rooted .cmux artifacts/notes and LocalArtifactRepository); this host change copies no storage implementation and leaves that PR untouched.
Security: the response retains its opaque sandbox without allow-same-origin, no network/file/bridge access, and one-shot render protocol. Only the two exact parent origins are admitted; ports, credentials, lookalikes, arbitrary pages, main-frame loads, repeated/nested navigation and resource escapes remain refused. Passive preview has no script capability; Run uses the existing native endpoint. Existing gallery-only fallback remains synthetic, and native origins always select the endpoint. RenderCard behavior is unchanged. The existing message listener is removed on unmount/document replacement; this change adds no timer or observer.
Validation:
The own delta is the shared-host seam and its tests; the larger base diff is #26286's prerequisite stack and will disappear after that PR merges and this branch is rebased. No changes are pushed to the prerequisite branches.
Agent session: agent session