You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
feat(harness): provide managed HTML artifact preview endpoints #5238
Agents currently need ad-hoc localhost servers for local artifact previews. Provide a platform-managed browser-accessible preview endpoint with port, lifecycle, temporary storage, access validation, cleanup, and no file URL policy weakening. Relates to #5213
Observed limitation: the attempted workaround required an agent-managed ; the process was reported running but was not reachable from the later curl check. The target of this issue is a platform-owned preview endpoint with explicit reachability and access evidence. Preserve the existing HTTP-origin security boundary.
Observed limitation: the workaround required an agent-managed Python HTTP server that was reported running but failed a later localhost connection check. This issue targets a platform-owned preview endpoint with explicit reachability and access evidence while preserving the file URL security boundary.
Implementation is now underway on top of current upstream/main (including merged #5261). This PR will own an ephemeral, bounded HTML snapshot service on the Desktop client, bind only to loopback, validate the exact bearer URL and Host header, isolate each preview origin, expire/revoke listeners, and integrate both the Artifact external-open action and a session-bound ArtifactPreview tool. Readiness will mean an actual HTTP probe succeeded, not that a browser loaded the page. Self-contained HTML is supported; workspace directories and remote resources are not served. Save As / Show in Folder remain available. Capability preflight stays in the existing #5254 contribution; verified browser-load reporting stays in #5235. I will publish the PR after regression and browser validation.
Implemented in #5316, based on current upstream/main including #5261. Verified locally: dependency builds, Desktop typecheck, 56 focused tests, and an actual Maka Dev Generated Files → Open in default app → system Chrome Canary page load → Interaction confirmed click. The browser used the managed loopback HTTP URL, not a file URL or an agent-started server. A fresh model-driven generation/tool run was also attempted, but the model failed before any tool call with "Model input limit exceeds the context window"; that path is not recorded as passed. ArtifactPreview publication, session binding, admission and structured output passed protocol-level tests. #5316 covers this managed-endpoint issue only; #5234/#5254 and #5235 remain separate, and #5213 must not be closed by this PR.
Activity
liugddx commentedon Sep 12, 2026
Observed limitation: the attempted workaround required an agent-managed ; the process was reported running but was not reachable from the later curl check. The target of this issue is a platform-owned preview endpoint with explicit reachability and access evidence. Preserve the existing HTTP-origin security boundary.
liugddx commentedon Sep 12, 2026
Observed limitation: the workaround required an agent-managed Python HTTP server that was reported running but failed a later localhost connection check. This issue targets a platform-owned preview endpoint with explicit reachability and access evidence while preserving the file URL security boundary.
liugddx commentedon Sep 14, 2026
Implementation is now underway on top of current upstream/main (including merged #5261). This PR will own an ephemeral, bounded HTML snapshot service on the Desktop client, bind only to loopback, validate the exact bearer URL and Host header, isolate each preview origin, expire/revoke listeners, and integrate both the Artifact external-open action and a session-bound ArtifactPreview tool. Readiness will mean an actual HTTP probe succeeded, not that a browser loaded the page. Self-contained HTML is supported; workspace directories and remote resources are not served. Save As / Show in Folder remain available. Capability preflight stays in the existing #5254 contribution; verified browser-load reporting stays in #5235. I will publish the PR after regression and browser validation.
liugddx commentedon Sep 14, 2026
Implemented in #5316, based on current upstream/main including #5261. Verified locally: dependency builds, Desktop typecheck, 56 focused tests, and an actual Maka Dev Generated Files → Open in default app → system Chrome Canary page load → Interaction confirmed click. The browser used the managed loopback HTTP URL, not a file URL or an agent-started server. A fresh model-driven generation/tool run was also attempted, but the model failed before any tool call with "Model input limit exceeds the context window"; that path is not recorded as passed. ArtifactPreview publication, session binding, admission and structured output passed protocol-level tests. #5316 covers this managed-endpoint issue only; #5234/#5254 and #5235 remain separate, and #5213 must not be closed by this PR.